From 763f24c2a65cc0408b59e4b27b6f438f466eb66b Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Wed, 24 Dec 2025 09:31:18 +0100
Subject: [PATCH 1/3] Boot Services

---
 doc/index.html                                | 871 +++++++++++++++++-
 generate/generate.go                          |   8 +
 generate/go_servicepermissions.tpl            |  30 +
 go.mod                                        |  13 +-
 go.sum                                        |  12 +
 go/client/client.go                           |  11 +
 go/metalstack/admin/v2/filesystem.pb.go       |   2 +-
 go/metalstack/admin/v2/image.pb.go            |   2 +-
 go/metalstack/admin/v2/ip.pb.go               |   2 +-
 go/metalstack/admin/v2/machine.pb.go          |   2 +-
 go/metalstack/admin/v2/network.pb.go          |   2 +-
 go/metalstack/admin/v2/partition.pb.go        |   2 +-
 go/metalstack/admin/v2/project.pb.go          |   2 +-
 go/metalstack/admin/v2/size.pb.go             |   2 +-
 go/metalstack/admin/v2/switch.pb.go           |   2 +-
 go/metalstack/admin/v2/tenant.pb.go           |   2 +-
 go/metalstack/admin/v2/token.pb.go            |   2 +-
 go/metalstack/api/v2/common.pb.go             | 177 ++--
 go/metalstack/api/v2/filesystem.pb.go         |   2 +-
 go/metalstack/api/v2/health.pb.go             |   2 +-
 go/metalstack/api/v2/image.pb.go              |   2 +-
 go/metalstack/api/v2/ip.pb.go                 |   2 +-
 go/metalstack/api/v2/machine.pb.go            | 490 +++++++---
 go/metalstack/api/v2/method.pb.go             |  69 +-
 go/metalstack/api/v2/network.pb.go            |   2 +-
 go/metalstack/api/v2/partition.pb.go          |  23 +-
 go/metalstack/api/v2/predefined_rules.pb.go   |   2 +-
 go/metalstack/api/v2/project.pb.go            |   2 +-
 go/metalstack/api/v2/size.pb.go               |   2 +-
 go/metalstack/api/v2/switch.pb.go             |   2 +-
 go/metalstack/api/v2/tenant.pb.go             |   2 +-
 go/metalstack/api/v2/token.pb.go              | 209 +++--
 go/metalstack/api/v2/user.pb.go               |   2 +-
 go/metalstack/api/v2/version.pb.go            |   2 +-
 go/metalstack/infra/v2/bmc.pb.go              |   2 +-
 go/metalstack/infra/v2/boot.pb.go             | 842 +++++++++++++++++
 go/metalstack/infra/v2/event.pb.go            |   2 +-
 .../infra/v2/infrav2connect/boot.connect.go   | 281 ++++++
 go/metalstack/infra/v2/switch.pb.go           |   2 +-
 go/permissions/permissions.go                 |   3 +
 go/permissions/servicepermissions.go          |  48 +
 go/tests/api_scopes_test.go                   |  36 +-
 go/tests/mock_clients.go                      |   9 +
 go/tests/mocks/client/Infrav2.go              |  46 +
 .../v2/infrav2connect/BootServiceClient.go    | 448 +++++++++
 .../v2/infrav2connect/BootServiceHandler.go   | 443 +++++++++
 proto/buf.gen.yaml                            |   2 +-
 proto/buf.lock                                |   4 +-
 proto/metalstack/api/v2/common.proto          |  12 +
 proto/metalstack/api/v2/machine.proto         |  46 +-
 proto/metalstack/api/v2/method.proto          |   2 +
 proto/metalstack/api/v2/partition.proto       |  15 +-
 proto/metalstack/api/v2/token.proto           |  25 +-
 proto/metalstack/infra/v2/boot.proto          | 156 ++++
 python/metalstack/api/v2/common_pb2.py        |  16 +-
 python/metalstack/api/v2/common_pb2.pyi       |  11 +
 python/metalstack/api/v2/machine_pb2.py       | 116 ++-
 python/metalstack/api/v2/machine_pb2.pyi      |  40 +
 python/metalstack/api/v2/method_pb2.py        |  20 +-
 python/metalstack/api/v2/method_pb2.pyi       |  13 +-
 python/metalstack/api/v2/partition_pb2.py     |  46 +-
 python/metalstack/api/v2/token_pb2.py         | 104 ++-
 python/metalstack/api/v2/token_pb2.pyi        |  39 +-
 python/metalstack/client/client.py            |   4 +
 python/metalstack/infra/v2/boot_connect.py    | 444 +++++++++
 python/metalstack/infra/v2/boot_pb2.py        | 113 +++
 python/metalstack/infra/v2/boot_pb2.pyi       | 111 +++
 67 files changed, 4984 insertions(+), 476 deletions(-)
 create mode 100644 go/metalstack/infra/v2/boot.pb.go
 create mode 100644 go/metalstack/infra/v2/infrav2connect/boot.connect.go
 create mode 100644 go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceClient.go
 create mode 100644 go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceHandler.go
 create mode 100644 proto/metalstack/infra/v2/boot.proto
 create mode 100644 python/metalstack/infra/v2/boot_connect.py
 create mode 100644 python/metalstack/infra/v2/boot_pb2.py
 create mode 100644 python/metalstack/infra/v2/boot_pb2.pyi

diff --git a/doc/index.html b/doc/index.html
index d5b61b91..647e777f 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -215,6 +215,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.InfraRole"><span class="badge">E</span>InfraRole</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.MachineRole"><span class="badge">E</span>MachineRole</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.OptimisticLockingStrategy"><span class="badge">E</span>OptimisticLockingStrategy</a>
                 </li>
@@ -260,6 +264,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
               
             </ul>
           </li>
@@ -895,6 +903,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.MachineDiskQuery"><span class="badge">M</span>MachineDiskQuery</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.MachineFRU"><span class="badge">M</span>MachineFRU</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.MachineFRUQuery"><span class="badge">M</span>MachineFRUQuery</a>
                 </li>
@@ -907,6 +919,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.MachineHardwareQuery"><span class="badge">M</span>MachineHardwareQuery</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.MachineIPMI"><span class="badge">M</span>MachineIPMI</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.MachineIPMIQuery"><span class="badge">M</span>MachineIPMIQuery</a>
                 </li>
@@ -1656,6 +1672,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.Token"><span class="badge">M</span>Token</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.Token.MachineRolesEntry"><span class="badge">M</span>Token.MachineRolesEntry</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.Token.ProjectRolesEntry"><span class="badge">M</span>Token.ProjectRolesEntry</a>
                 </li>
@@ -1668,6 +1688,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.TokenServiceCreateRequest"><span class="badge">M</span>TokenServiceCreateRequest</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry"><span class="badge">M</span>TokenServiceCreateRequest.MachineRolesEntry</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry"><span class="badge">M</span>TokenServiceCreateRequest.ProjectRolesEntry</a>
                 </li>
@@ -1716,6 +1740,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.TokenServiceUpdateRequest"><span class="badge">M</span>TokenServiceUpdateRequest</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry"><span class="badge">M</span>TokenServiceUpdateRequest.MachineRolesEntry</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry"><span class="badge">M</span>TokenServiceUpdateRequest.ProjectRolesEntry</a>
                 </li>
@@ -1849,6 +1877,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse"><span class="badge">M</span>MethodServiceTokenScopedListResponse</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntry"><span class="badge">M</span>MethodServiceTokenScopedListResponse.MachineRolesEntry</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry"><span class="badge">M</span>MethodServiceTokenScopedListResponse.ProjectRolesEntry</a>
                 </li>
@@ -1945,6 +1977,69 @@ <h2>Table of Contents</h2>
           </li>
         
           
+          <li>
+            <a href="#metalstack%2finfra%2fv2%2fboot.proto">metalstack/infra/v2/boot.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceBootRequest"><span class="badge">M</span>BootServiceBootRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceBootResponse"><span class="badge">M</span>BootServiceBootResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceDhcpRequest"><span class="badge">M</span>BootServiceDhcpRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceDhcpResponse"><span class="badge">M</span>BootServiceDhcpResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceRegisterRequest"><span class="badge">M</span>BootServiceRegisterRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceRegisterResponse"><span class="badge">M</span>BootServiceRegisterResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceReportRequest"><span class="badge">M</span>BootServiceReportRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceReportResponse"><span class="badge">M</span>BootServiceReportResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceSuperUserPasswordRequest"><span class="badge">M</span>BootServiceSuperUserPasswordRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceSuperUserPasswordResponse"><span class="badge">M</span>BootServiceSuperUserPasswordResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceWaitRequest"><span class="badge">M</span>BootServiceWaitRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootServiceWaitResponse"><span class="badge">M</span>BootServiceWaitResponse</a>
+                </li>
+              
+              
+              
+              
+                <li>
+                  <a href="#metalstack.infra.v2.BootService"><span class="badge">S</span>BootService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
           <li>
             <a href="#metalstack%2finfra%2fv2%2fevent.proto">metalstack/infra/v2/event.proto</a>
             <ul>
@@ -2327,6 +2422,35 @@ <h3 id="metalstack.api.v2.InfraRole">InfraRole</h3>
           </tbody>
         </table>
       
+        <h3 id="metalstack.api.v2.MachineRole">MachineRole</h3>
+        <p>MachineRole specifies what role a microservice needs to call this machine service</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>MACHINE_ROLE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>MACHINE_ROLE_UNSPECIFIED is not specified</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_ROLE_EDITOR</td>
+                <td>1</td>
+                <td><p>MACHINE_ROLE_EDITOR a microservice needs at least editor role to call this method</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_ROLE_VIEWER</td>
+                <td>2</td>
+                <td><p>MACHINE_ROLE_VIEWER a microservice needs at least viewer role to call this method</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
         <h3 id="metalstack.api.v2.OptimisticLockingStrategy">OptimisticLockingStrategy</h3>
         <p>OptimisticLockingStrategy defines how optimistic locking should be handled.</p><p>It defaults to client side, which requires the UpdatedAt timestamp to be provided</p>
         <table class="enum-table">
@@ -2505,6 +2629,14 @@ <h3 id="metalstack/api/v2/common.proto-extensions">File-level Extensions</h3>
                 <td><p>InfraRoles are used to define which infra role a microservice must provide to call this method</p></td>
               </tr>
             
+              <tr>
+                <td>machine_roles</td>
+                <td><a href="#metalstack.api.v2.MachineRole">MachineRole</a></td>
+                <td><a href="#google.protobuf.MethodOptions">.google.protobuf.MethodOptions</a></td>
+                <td>51006</td>
+                <td><p>MachineRole are used to define which infra role a microservice must provide to call this method</p></td>
+              </tr>
+            
               <tr>
                 <td>project_roles</td>
                 <td><a href="#metalstack.api.v2.ProjectRole">ProjectRole</a></td>
@@ -7466,6 +7598,79 @@ <h3 id="metalstack.api.v2.MachineDiskQuery">MachineDiskQuery</h3>
 
         
       
+        <h3 id="metalstack.api.v2.MachineFRU">MachineFRU</h3>
+        <p>MachineFRU describes details to the machine which are required in case of a necessary replacement</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>chassis_part_number</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ChassisPartNumber is the part number of the machine chassis </p></td>
+                </tr>
+              
+                <tr>
+                  <td>chassis_part_serial</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ChassisPartSerial is the serial number of the machine chassis </p></td>
+                </tr>
+              
+                <tr>
+                  <td>board_mfg</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>BoardMFG is the short description of the mainboard </p></td>
+                </tr>
+              
+                <tr>
+                  <td>board_mfg_serial</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>BoardSerial is the serial number of the mainboard </p></td>
+                </tr>
+              
+                <tr>
+                  <td>board_part_number</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>BoardPartNumber is the part number of the mainboard </p></td>
+                </tr>
+              
+                <tr>
+                  <td>product_manufacturer</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ProductManufacturer is the manufacturer of the machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>product_part_number</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ProductPartNumber is the part number of the machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>product_serial</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>ProductSerial is the serial number of the machine </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.MachineFRUQuery">MachineFRUQuery</h3>
         <p>MachineFRUQuery machine fru specific machine queries</p>
 
@@ -7622,6 +7827,79 @@ <h3 id="metalstack.api.v2.MachineHardwareQuery">MachineHardwareQuery</h3>
 
         
       
+        <h3 id="metalstack.api.v2.MachineIPMI">MachineIPMI</h3>
+        <p>MachineIPMI describe details of the ipmi or out of band device</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>address</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Address of this ipmi device from outside </p></td>
+                </tr>
+              
+                <tr>
+                  <td>mac</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Mac address of the network interface of this ipmi device </p></td>
+                </tr>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>User of this ipmi device </p></td>
+                </tr>
+              
+                <tr>
+                  <td>password</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Password of this ipmi device </p></td>
+                </tr>
+              
+                <tr>
+                  <td>interface</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Interface of this ipmi device </p></td>
+                </tr>
+              
+                <tr>
+                  <td>fru</td>
+                  <td><a href="#metalstack.api.v2.MachineFRU">MachineFRU</a></td>
+                  <td></td>
+                  <td><p>FRU field replaceable unit details for this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>bmc_version</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>BMCVersion of this ipmi device </p></td>
+                </tr>
+              
+                <tr>
+                  <td>power_state</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>PowerState of this machine </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.MachineIPMIQuery">MachineIPMIQuery</h3>
         <p>MachineIPMIQuery machine ipmi specific machine queries</p>
 
@@ -13761,6 +14039,45 @@ <h3 id="metalstack.api.v2.Token">Token</h3>
                   <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
                 </tr>
               
+                <tr>
+                  <td>machine_roles</td>
+                  <td><a href="#metalstack.api.v2.Token.MachineRolesEntry">Token.MachineRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>MachineRoles associates a machine uuid with the corresponding role of the token owner
+TODO: decide if we need this map from machine.uuid-&gt;role, we could instead use the subject in the token instead </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.Token.MachineRolesEntry">Token.MachineRolesEntry</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.MachineRole">MachineRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
@@ -13890,9 +14207,16 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</
                 </tr>
               
                 <tr>
-                  <td>labels</td>
-                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
-                  <td></td>
+                  <td>machine_roles</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry">TokenServiceCreateRequest.MachineRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>MachineRoles associates a machine uuid with the corresponding role of the token owner </p></td>
+                </tr>
+              
+                <tr>
+                  <td>labels</td>
+                  <td><a href="#metalstack.api.v2.Labels">Labels</a></td>
+                  <td></td>
                   <td><p>Labels on this token </p></td>
                 </tr>
               
@@ -13903,6 +14227,37 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</
 
         
       
+        <h3 id="metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry">TokenServiceCreateRequest.MachineRolesEntry</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.MachineRole">MachineRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry">TokenServiceCreateRequest.ProjectRolesEntry</h3>
         <p></p>
 
@@ -14211,6 +14566,13 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</
                   <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
                 </tr>
               
+                <tr>
+                  <td>machine_roles</td>
+                  <td><a href="#metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry">TokenServiceUpdateRequest.MachineRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>MachineRoles associates a machine uuid with the corresponding role of the token owner </p></td>
+                </tr>
+              
                 <tr>
                   <td>labels</td>
                   <td><a href="#metalstack.api.v2.UpdateLabels">UpdateLabels</a></td>
@@ -14225,6 +14587,37 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</
 
         
       
+        <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry">TokenServiceUpdateRequest.MachineRolesEntry</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.MachineRole">MachineRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry">TokenServiceUpdateRequest.ProjectRolesEntry</h3>
         <p></p>
 
@@ -14970,6 +15363,44 @@ <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse">MethodServiceTok
                   <td><p>InfraRole defines the infrastructure role of the token owner </p></td>
                 </tr>
               
+                <tr>
+                  <td>machine_roles</td>
+                  <td><a href="#metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntry">MethodServiceTokenScopedListResponse.MachineRolesEntry</a></td>
+                  <td>repeated</td>
+                  <td><p>MachineRoles defines the machine roles of the token owner </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntry">MethodServiceTokenScopedListResponse.MachineRolesEntry</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#metalstack.api.v2.MachineRole">MachineRole</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
@@ -15359,6 +15790,440 @@ <h3 id="metalstack.infra.v2.BMCService">BMCService</h3>
         
     
       
+      <div class="file-heading">
+        <h2 id="metalstack/infra/v2/boot.proto">metalstack/infra/v2/boot.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.infra.v2.BootServiceBootRequest">BootServiceBootRequest</h3>
+        <p>BootServiceBootRequest is called to get specified parameters to boot a machine with the given mac</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>mac</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Mac address of the machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Partition where this machine is located </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceBootResponse">BootServiceBootResponse</h3>
+        <p>BootServiceBootResponse contains additional infos which are required to boot a machine</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>kernel</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Kernel is the url to the linux kernel to boot </p></td>
+                </tr>
+              
+                <tr>
+                  <td>init_ram_disks</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Initial ram disk is the url to the initial ram disk to boot </p></td>
+                </tr>
+              
+                <tr>
+                  <td>cmdline</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>CMDLine contains kernel command line parameters to boot </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceDhcpRequest">BootServiceDhcpRequest</h3>
+        <p>BootServiceDhcpRequest is called once a machine issues a dhcp request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of the machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Partition where this machine is located </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceDhcpResponse">BootServiceDhcpResponse</h3>
+        <p>BootServiceDhcpResponse contains the response to a dhcp request</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceRegisterRequest">BootServiceRegisterRequest</h3>
+        <p>BootServiceRegisterRequest is called from metal-hammer to register a machine with as much hardware details as possible</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>hardware</td>
+                  <td><a href="#metalstack.api.v2.MachineHardware">metalstack.api.v2.MachineHardware</a></td>
+                  <td></td>
+                  <td><p>Hardware details of this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>bios</td>
+                  <td><a href="#metalstack.api.v2.MachineBios">metalstack.api.v2.MachineBios</a></td>
+                  <td></td>
+                  <td><p>Bios details of this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>ipmi</td>
+                  <td><a href="#metalstack.api.v2.MachineIPMI">metalstack.api.v2.MachineIPMI</a></td>
+                  <td></td>
+                  <td><p>IPMI details of this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tags</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Tags of this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metal_hammer_version</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>MetalHammer version this machine was bootet into </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Partition where this machine is located </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceRegisterResponse">BootServiceRegisterResponse</h3>
+        <p>BootServiceRegisterResponse response to a BootServiceRegisterResponse request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of this machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>size</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Size is the calculated size from given hardware details </p></td>
+                </tr>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Partition of this machine </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceReportRequest">BootServiceReportRequest</h3>
+        <p>BootServiceReportRequest is sent from metal-hammer to the api to report the outcome of the register</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of the machine to boot </p></td>
+                </tr>
+              
+                <tr>
+                  <td>console_password</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Console_Password </p></td>
+                </tr>
+              
+                <tr>
+                  <td>success</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td></td>
+                  <td><p>Success is set to true of the allocation succeeded </p></td>
+                </tr>
+              
+                <tr>
+                  <td>message</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Message contains additional information if installation failed </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceReportResponse">BootServiceReportResponse</h3>
+        <p>BootServiceReportRequest is the response to a BootServiceReportRequest</p>
+
+        
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceSuperUserPasswordRequest">BootServiceSuperUserPasswordRequest</h3>
+        <p>BootServiceSuperUserPasswordRequest this call returns the password for the machine superuser</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of this machine </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceSuperUserPasswordResponse">BootServiceSuperUserPasswordResponse</h3>
+        <p>BootServiceSuperUserPasswordResponse the super user password is returned</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>feature_disabled</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td></td>
+                  <td><p>FeatureDisable FIXME </p></td>
+                </tr>
+              
+                <tr>
+                  <td>super_user_password</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>SuperUserPassword is the password of the superuser on the ipmi device </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceWaitRequest">BootServiceWaitRequest</h3>
+        <p>BootServiceWaitRequest is called when a machine was registered and is waiting for allocation</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of this machine </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.BootServiceWaitResponse">BootServiceWaitResponse</h3>
+        <p>BootServiceWaitResponse response to a wait request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>allocation</td>
+                  <td><a href="#metalstack.api.v2.MachineAllocation">metalstack.api.v2.MachineAllocation</a></td>
+                  <td></td>
+                  <td><p>Allocation contains the machine.allocation to actually install the machine </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+
+      
+
+      
+        <h3 id="metalstack.infra.v2.BootService">BootService</h3>
+        <p>BootService is used for all boot related requests, either pixiecore or metal-hammer</p><p>Pixiecore</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>Dhcp</td>
+                <td><a href="#metalstack.infra.v2.BootServiceDhcpRequest">BootServiceDhcpRequest</a></td>
+                <td><a href="#metalstack.infra.v2.BootServiceDhcpResponse">BootServiceDhcpResponse</a></td>
+                <td><p>Dhcp is the first dhcp request (option 97). A ProvisioningEventPXEBooting is fired</p></td>
+              </tr>
+            
+              <tr>
+                <td>Boot</td>
+                <td><a href="#metalstack.infra.v2.BootServiceBootRequest">BootServiceBootRequest</a></td>
+                <td><a href="#metalstack.infra.v2.BootServiceBootResponse">BootServiceBootResponse</a></td>
+                <td><p>Boot is called from pixie once the machine got the first dhcp response and ipxie asks for subsequent kernel and initrd</p></td>
+              </tr>
+            
+              <tr>
+                <td>SuperUserPassword</td>
+                <td><a href="#metalstack.infra.v2.BootServiceSuperUserPasswordRequest">BootServiceSuperUserPasswordRequest</a></td>
+                <td><a href="#metalstack.infra.v2.BootServiceSuperUserPasswordResponse">BootServiceSuperUserPasswordResponse</a></td>
+                <td><p>SuperUserPassword metal-hammer takes the configured root password for the bmc from metal-api and configure the bmc accordingly</p></td>
+              </tr>
+            
+              <tr>
+                <td>Register</td>
+                <td><a href="#metalstack.infra.v2.BootServiceRegisterRequest">BootServiceRegisterRequest</a></td>
+                <td><a href="#metalstack.infra.v2.BootServiceRegisterResponse">BootServiceRegisterResponse</a></td>
+                <td><p>Register is called from metal-hammer after hardware inventory is finished, tells metal-api all glory details about that machine</p></td>
+              </tr>
+            
+              <tr>
+                <td>Wait</td>
+                <td><a href="#metalstack.infra.v2.BootServiceWaitRequest">BootServiceWaitRequest</a></td>
+                <td><a href="#metalstack.infra.v2.BootServiceWaitResponse">BootServiceWaitResponse</a> stream</td>
+                <td><p>Wait is a hanging call that waits until the machine gets allocated by a user</p></td>
+              </tr>
+            
+              <tr>
+                <td>Report</td>
+                <td><a href="#metalstack.infra.v2.BootServiceReportRequest">BootServiceReportRequest</a></td>
+                <td><a href="#metalstack.infra.v2.BootServiceReportResponse">BootServiceReportResponse</a></td>
+                <td><p>Report tells metal-api installation was either successful or failed</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
       <div class="file-heading">
         <h2 id="metalstack/infra/v2/event.proto">metalstack/infra/v2/event.proto</h2><a href="#title">Top</a>
       </div>
diff --git a/generate/generate.go b/generate/generate.go
index 6910ff42..84538131 100644
--- a/generate/generate.go
+++ b/generate/generate.go
@@ -97,6 +97,7 @@ func servicePermissions(root string) (*permissions.ServicePermissions, error) {
 		roles = permissions.Roles{
 			Admin:   permissions.Admin{},
 			Infra:   permissions.Infra{},
+			Machine: permissions.Machine{},
 			Tenant:  permissions.Tenant{},
 			Project: permissions.Project{},
 		}
@@ -114,6 +115,7 @@ func servicePermissions(root string) (*permissions.ServicePermissions, error) {
 			Self:    map[string]bool{},
 			Admin:   map[string]bool{},
 			Infra:   map[string]bool{},
+			Machine: map[string]bool{},
 			Tenant:  map[string]bool{},
 			Project: map[string]bool{},
 		}
@@ -167,6 +169,12 @@ func servicePermissions(root string) (*permissions.ServicePermissions, error) {
 							visibility.Infra[methodName] = true
 						case v1.InfraRole_INFRA_ROLE_UNSPECIFIED.String():
 							// noop
+						// Machine
+						case v1.MachineRole_MACHINE_ROLE_EDITOR.String(), v1.MachineRole_MACHINE_ROLE_VIEWER.String():
+							roles.Machine[role] = append(roles.Machine[role], methodName)
+							visibility.Machine[methodName] = true
+						case v1.MachineRole_MACHINE_ROLE_UNSPECIFIED.String():
+							// noop
 						// Visibility
 						case v1.Visibility_VISIBILITY_PUBLIC.String():
 							visibility.Public[methodName] = true
diff --git a/generate/go_servicepermissions.tpl b/generate/go_servicepermissions.tpl
index 9245cb2b..74fe5109 100644
--- a/generate/go_servicepermissions.tpl
+++ b/generate/go_servicepermissions.tpl
@@ -34,6 +34,15 @@ func GetServicePermissions() *ServicePermissions {
 					},
 				{{- end }}
 			},
+			Machine:   Machine{
+				{{- range $role, $methods := .Roles.Machine }}
+					"{{ $role }}": []string{
+						{{- range $method := $methods }}
+							"{{ $method }}",
+						{{- end }}
+					},
+				{{- end }}
+			},
 			Tenant:  Tenant{
 				{{- range $role, $methods := .Roles.Tenant }}
 					"{{ $role }}": []string{
@@ -77,6 +86,11 @@ func GetServicePermissions() *ServicePermissions {
 			Infra:    map[string]bool{
 {{- range $key, $value := .Visibility.Infra }}
 	"{{ $key }}": {{ $value }} ,
+{{- end }}
+			},
+			Machine:    map[string]bool{
+{{- range $key, $value := .Visibility.Machine }}
+	"{{ $key }}": {{ $value }} ,
 {{- end }}
 			},
 			Tenant:    map[string]bool{
@@ -118,6 +132,11 @@ func IsInfraScope(req connect.AnyRequest) bool {
 	return ok
 }
 
+func IsMachineScope(req connect.AnyRequest) bool {
+	_, ok := GetServicePermissions().Visibility.Machine[req.Spec().Procedure]
+	return ok
+}
+
 func IsTenantScope(req connect.AnyRequest) bool {
 	_, ok := GetServicePermissions().Visibility.Tenant[req.Spec().Procedure]
 	return ok
@@ -153,4 +172,15 @@ func GetProjectFromRequest(req connect.AnyRequest) (string, bool) {
 		return rq.GetProject(), true
 	}
 	return "", false
+}
+
+func GetMachineIdFromRequest(req connect.AnyRequest) (string, bool) {
+	if !IsMachineScope(req) {
+		return "", false
+	}
+	switch rq := req.Any().(type) {
+	case interface{ GetUuid() string }:
+		return rq.GetUuid(), true
+	}
+	return "", false
 }
\ No newline at end of file
diff --git a/go.mod b/go.mod
index b0f7bdb8..913f314a 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/metal-stack/api
 go 1.25
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20251209175733-2a1774d88802.1
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20251209175733-2a1774d88802.1
 	buf.build/go/protovalidate v1.1.0
 	connectrpc.com/connect v1.19.1
 	github.com/bufbuild/protocompile v0.14.1
@@ -12,7 +12,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/klauspost/connect-compress/v2 v2.1.0
 	github.com/stretchr/testify v1.11.1
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -22,14 +22,17 @@ require (
 	github.com/google/cel-go v0.26.1 // indirect
 	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/minio/minlz v1.0.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/stoewer/go-strcase v1.3.1 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
-	golang.org/x/exp v0.0.0-20251209150349-8475f28825e9 // indirect
+	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
+	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 17f2eb64..b75b4b4a 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20251209175733-2a1774d88802.1 h1:ZnX3qpF/pDiYrf+Q3p+/zCzZ5ELSpszy5hdVarDMSV4=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20251209175733-2a1774d88802.1/go.mod h1:fUl8CEN/6ZAMk6bP8ahBJPUJw7rbp+j4x+wCcYi2IG4=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20251209175733-2a1774d88802.1 h1:j9yeqTWEFrtimt8Nng2MIeRrpoCvQzM9/g25XTvqUGg=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20251209175733-2a1774d88802.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM=
 buf.build/go/protovalidate v1.1.0 h1:pQqEQRpOo4SqS60qkvmhLTTQU9JwzEvdyiqAtXa5SeY=
 buf.build/go/protovalidate v1.1.0/go.mod h1:bGZcPiAQDC3ErCHK3t74jSoJDFOs2JH3d7LWuTEIdss=
 cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
@@ -58,14 +60,24 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 golang.org/x/exp v0.0.0-20251209150349-8475f28825e9 h1:MDfG8Cvcqlt9XXrmEiD4epKn7VJHZO84hejP9Jmp0MM=
 golang.org/x/exp v0.0.0-20251209150349-8475f28825e9/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
 golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
+google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b h1:uA40e2M6fYRBf0+8uN5mLlqUtV192iiksiICIBkYJ1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:Xa7le7qx2vmqB/SzWUBa7KdMjpdpAHlh5QCSnjessQk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
 google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/go/client/client.go b/go/client/client.go
index a28cb156..53d6c850 100755
--- a/go/client/client.go
+++ b/go/client/client.go
@@ -90,12 +90,14 @@ type (
 
 	Infrav2 interface {
 		BMC() infrav2connect.BMCServiceClient
+		Boot() infrav2connect.BootServiceClient
 		Event() infrav2connect.EventServiceClient
 		Switch() infrav2connect.SwitchServiceClient
 	}
 
 	infrav2 struct {
 		bmcservice    infrav2connect.BMCServiceClient
+		bootservice   infrav2connect.BootServiceClient
 		eventservice  infrav2connect.EventServiceClient
 		switchservice infrav2connect.SwitchServiceClient
 	}
@@ -391,6 +393,12 @@ func (c *client) Infrav2() Infrav2 {
 			connect.WithInterceptors(c.interceptors...),
 			compress.WithAll(compress.LevelBalanced),
 		),
+		bootservice: infrav2connect.NewBootServiceClient(
+			c.config.HttpClient(),
+			c.config.BaseURL,
+			connect.WithInterceptors(c.interceptors...),
+			compress.WithAll(compress.LevelBalanced),
+		),
 		eventservice: infrav2connect.NewEventServiceClient(
 			c.config.HttpClient(),
 			c.config.BaseURL,
@@ -410,6 +418,9 @@ func (c *client) Infrav2() Infrav2 {
 func (c *infrav2) BMC() infrav2connect.BMCServiceClient {
 	return c.bmcservice
 }
+func (c *infrav2) Boot() infrav2connect.BootServiceClient {
+	return c.bootservice
+}
 func (c *infrav2) Event() infrav2connect.EventServiceClient {
 	return c.eventservice
 }
diff --git a/go/metalstack/admin/v2/filesystem.pb.go b/go/metalstack/admin/v2/filesystem.pb.go
index c395d53f..750ae226 100644
--- a/go/metalstack/admin/v2/filesystem.pb.go
+++ b/go/metalstack/admin/v2/filesystem.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/filesystem.proto
 
diff --git a/go/metalstack/admin/v2/image.pb.go b/go/metalstack/admin/v2/image.pb.go
index caf74e15..58202dbf 100644
--- a/go/metalstack/admin/v2/image.pb.go
+++ b/go/metalstack/admin/v2/image.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/image.proto
 
diff --git a/go/metalstack/admin/v2/ip.pb.go b/go/metalstack/admin/v2/ip.pb.go
index fcbb7cc3..ab24e077 100644
--- a/go/metalstack/admin/v2/ip.pb.go
+++ b/go/metalstack/admin/v2/ip.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/ip.proto
 
diff --git a/go/metalstack/admin/v2/machine.pb.go b/go/metalstack/admin/v2/machine.pb.go
index 76419332..df02b8b1 100644
--- a/go/metalstack/admin/v2/machine.pb.go
+++ b/go/metalstack/admin/v2/machine.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/machine.proto
 
diff --git a/go/metalstack/admin/v2/network.pb.go b/go/metalstack/admin/v2/network.pb.go
index 6b1cffe2..96395c5f 100644
--- a/go/metalstack/admin/v2/network.pb.go
+++ b/go/metalstack/admin/v2/network.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/network.proto
 
diff --git a/go/metalstack/admin/v2/partition.pb.go b/go/metalstack/admin/v2/partition.pb.go
index d30482da..7d9266da 100644
--- a/go/metalstack/admin/v2/partition.pb.go
+++ b/go/metalstack/admin/v2/partition.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/partition.proto
 
diff --git a/go/metalstack/admin/v2/project.pb.go b/go/metalstack/admin/v2/project.pb.go
index a9a57b6b..76465046 100644
--- a/go/metalstack/admin/v2/project.pb.go
+++ b/go/metalstack/admin/v2/project.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/project.proto
 
diff --git a/go/metalstack/admin/v2/size.pb.go b/go/metalstack/admin/v2/size.pb.go
index 71d1f39f..b17594a7 100644
--- a/go/metalstack/admin/v2/size.pb.go
+++ b/go/metalstack/admin/v2/size.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/size.proto
 
diff --git a/go/metalstack/admin/v2/switch.pb.go b/go/metalstack/admin/v2/switch.pb.go
index 80daaaf2..cf56cf61 100644
--- a/go/metalstack/admin/v2/switch.pb.go
+++ b/go/metalstack/admin/v2/switch.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/switch.proto
 
diff --git a/go/metalstack/admin/v2/tenant.pb.go b/go/metalstack/admin/v2/tenant.pb.go
index 0973d1b5..1015efcd 100644
--- a/go/metalstack/admin/v2/tenant.pb.go
+++ b/go/metalstack/admin/v2/tenant.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/tenant.proto
 
diff --git a/go/metalstack/admin/v2/token.pb.go b/go/metalstack/admin/v2/token.pb.go
index b48f9b07..feb7991b 100644
--- a/go/metalstack/admin/v2/token.pb.go
+++ b/go/metalstack/admin/v2/token.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/admin/v2/token.proto
 
diff --git a/go/metalstack/api/v2/common.pb.go b/go/metalstack/api/v2/common.pb.go
index 0b77a426..04201d1e 100644
--- a/go/metalstack/api/v2/common.pb.go
+++ b/go/metalstack/api/v2/common.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/common.proto
 
@@ -250,6 +250,59 @@ func (InfraRole) EnumDescriptor() ([]byte, []int) {
 	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{3}
 }
 
+// MachineRole specifies what role a microservice needs to call this machine service
+type MachineRole int32
+
+const (
+	// MACHINE_ROLE_UNSPECIFIED is not specified
+	MachineRole_MACHINE_ROLE_UNSPECIFIED MachineRole = 0
+	// MACHINE_ROLE_EDITOR a microservice needs at least editor role to call this method
+	MachineRole_MACHINE_ROLE_EDITOR MachineRole = 1
+	// MACHINE_ROLE_VIEWER a microservice needs at least viewer role to call this method
+	MachineRole_MACHINE_ROLE_VIEWER MachineRole = 2
+)
+
+// Enum value maps for MachineRole.
+var (
+	MachineRole_name = map[int32]string{
+		0: "MACHINE_ROLE_UNSPECIFIED",
+		1: "MACHINE_ROLE_EDITOR",
+		2: "MACHINE_ROLE_VIEWER",
+	}
+	MachineRole_value = map[string]int32{
+		"MACHINE_ROLE_UNSPECIFIED": 0,
+		"MACHINE_ROLE_EDITOR":      1,
+		"MACHINE_ROLE_VIEWER":      2,
+	}
+)
+
+func (x MachineRole) Enum() *MachineRole {
+	p := new(MachineRole)
+	*p = x
+	return p
+}
+
+func (x MachineRole) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MachineRole) Descriptor() protoreflect.EnumDescriptor {
+	return file_metalstack_api_v2_common_proto_enumTypes[4].Descriptor()
+}
+
+func (MachineRole) Type() protoreflect.EnumType {
+	return &file_metalstack_api_v2_common_proto_enumTypes[4]
+}
+
+func (x MachineRole) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MachineRole.Descriptor instead.
+func (MachineRole) EnumDescriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{4}
+}
+
 // Visibility of a method
 type Visibility int32
 
@@ -287,11 +340,11 @@ func (x Visibility) String() string {
 }
 
 func (Visibility) Descriptor() protoreflect.EnumDescriptor {
-	return file_metalstack_api_v2_common_proto_enumTypes[4].Descriptor()
+	return file_metalstack_api_v2_common_proto_enumTypes[5].Descriptor()
 }
 
 func (Visibility) Type() protoreflect.EnumType {
-	return &file_metalstack_api_v2_common_proto_enumTypes[4]
+	return &file_metalstack_api_v2_common_proto_enumTypes[5]
 }
 
 func (x Visibility) Number() protoreflect.EnumNumber {
@@ -300,7 +353,7 @@ func (x Visibility) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Visibility.Descriptor instead.
 func (Visibility) EnumDescriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{4}
+	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{5}
 }
 
 // Auditing option specified per service method
@@ -342,11 +395,11 @@ func (x Auditing) String() string {
 }
 
 func (Auditing) Descriptor() protoreflect.EnumDescriptor {
-	return file_metalstack_api_v2_common_proto_enumTypes[5].Descriptor()
+	return file_metalstack_api_v2_common_proto_enumTypes[6].Descriptor()
 }
 
 func (Auditing) Type() protoreflect.EnumType {
-	return &file_metalstack_api_v2_common_proto_enumTypes[5]
+	return &file_metalstack_api_v2_common_proto_enumTypes[6]
 }
 
 func (x Auditing) Number() protoreflect.EnumNumber {
@@ -355,7 +408,7 @@ func (x Auditing) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Auditing.Descriptor instead.
 func (Auditing) EnumDescriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{5}
+	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{6}
 }
 
 // OptimisticLockingStrategy defines how optimistic locking should be handled.
@@ -397,11 +450,11 @@ func (x OptimisticLockingStrategy) String() string {
 }
 
 func (OptimisticLockingStrategy) Descriptor() protoreflect.EnumDescriptor {
-	return file_metalstack_api_v2_common_proto_enumTypes[6].Descriptor()
+	return file_metalstack_api_v2_common_proto_enumTypes[7].Descriptor()
 }
 
 func (OptimisticLockingStrategy) Type() protoreflect.EnumType {
-	return &file_metalstack_api_v2_common_proto_enumTypes[6]
+	return &file_metalstack_api_v2_common_proto_enumTypes[7]
 }
 
 func (x OptimisticLockingStrategy) Number() protoreflect.EnumNumber {
@@ -410,7 +463,7 @@ func (x OptimisticLockingStrategy) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use OptimisticLockingStrategy.Descriptor instead.
 func (OptimisticLockingStrategy) EnumDescriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{6}
+	return file_metalstack_api_v2_common_proto_rawDescGZIP(), []int{7}
 }
 
 // Paging defines paging for methods with a lot of results
@@ -749,6 +802,14 @@ var file_metalstack_api_v2_common_proto_extTypes = []protoimpl.ExtensionInfo{
 		Tag:           "varint,51005,rep,packed,name=infra_roles,enum=metalstack.api.v2.InfraRole",
 		Filename:      "metalstack/api/v2/common.proto",
 	},
+	{
+		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
+		ExtensionType: ([]MachineRole)(nil),
+		Field:         51006,
+		Name:          "metalstack.api.v2.machine_roles",
+		Tag:           "varint,51006,rep,packed,name=machine_roles,enum=metalstack.api.v2.MachineRole",
+		Filename:      "metalstack/api/v2/common.proto",
+	},
 	{
 		ExtendedType:  (*descriptorpb.EnumValueOptions)(nil),
 		ExtensionType: (*string)(nil),
@@ -785,6 +846,10 @@ var (
 	//
 	// repeated metalstack.api.v2.InfraRole infra_roles = 51005;
 	E_InfraRoles = &file_metalstack_api_v2_common_proto_extTypes[5]
+	// MachineRole are used to define which infra role a microservice must provide to call this method
+	//
+	// repeated metalstack.api.v2.MachineRole machine_roles = 51006;
+	E_MachineRoles = &file_metalstack_api_v2_common_proto_extTypes[6]
 )
 
 // Extension fields to descriptorpb.EnumValueOptions.
@@ -792,7 +857,7 @@ var (
 	// StringValue which can be set to a enum
 	//
 	// optional string enum_string_value = 52000;
-	E_EnumStringValue = &file_metalstack_api_v2_common_proto_extTypes[6]
+	E_EnumStringValue = &file_metalstack_api_v2_common_proto_extTypes[7]
 )
 
 var File_metalstack_api_v2_common_proto protoreflect.FileDescriptor
@@ -847,7 +912,11 @@ const file_metalstack_api_v2_common_proto_rawDesc = "" +
 	"\tInfraRole\x12\x1a\n" +
 	"\x16INFRA_ROLE_UNSPECIFIED\x10\x00\x12\x15\n" +
 	"\x11INFRA_ROLE_EDITOR\x10\x01\x12\x15\n" +
-	"\x11INFRA_ROLE_VIEWER\x10\x02*T\n" +
+	"\x11INFRA_ROLE_VIEWER\x10\x02*]\n" +
+	"\vMachineRole\x12\x1c\n" +
+	"\x18MACHINE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n" +
+	"\x13MACHINE_ROLE_EDITOR\x10\x01\x12\x17\n" +
+	"\x13MACHINE_ROLE_VIEWER\x10\x02*T\n" +
 	"\n" +
 	"Visibility\x12\x1a\n" +
 	"\x16VISIBILITY_UNSPECIFIED\x10\x00\x12\x15\n" +
@@ -870,7 +939,8 @@ const file_metalstack_api_v2_common_proto_rawDesc = "" +
 	"visibility:Y\n" +
 	"\bauditing\x12\x1e.google.protobuf.MethodOptions\x18\xbc\x8e\x03 \x01(\x0e2\x1b.metalstack.api.v2.AuditingR\bauditing:_\n" +
 	"\vinfra_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbd\x8e\x03 \x03(\x0e2\x1c.metalstack.api.v2.InfraRoleR\n" +
-	"infraRoles:O\n" +
+	"infraRoles:e\n" +
+	"\rmachine_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbe\x8e\x03 \x03(\x0e2\x1e.metalstack.api.v2.MachineRoleR\fmachineRoles:O\n" +
 	"\x11enum_string_value\x12!.google.protobuf.EnumValueOptions\x18\xa0\x96\x03 \x01(\tR\x0fenumStringValueB\xc1\x01\n" +
 	"\x15com.metalstack.api.v2B\vCommonProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3"
 
@@ -886,51 +956,54 @@ func file_metalstack_api_v2_common_proto_rawDescGZIP() []byte {
 	return file_metalstack_api_v2_common_proto_rawDescData
 }
 
-var file_metalstack_api_v2_common_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
+var file_metalstack_api_v2_common_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
 var file_metalstack_api_v2_common_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_metalstack_api_v2_common_proto_goTypes = []any{
 	(TenantRole)(0),                       // 0: metalstack.api.v2.TenantRole
 	(ProjectRole)(0),                      // 1: metalstack.api.v2.ProjectRole
 	(AdminRole)(0),                        // 2: metalstack.api.v2.AdminRole
 	(InfraRole)(0),                        // 3: metalstack.api.v2.InfraRole
-	(Visibility)(0),                       // 4: metalstack.api.v2.Visibility
-	(Auditing)(0),                         // 5: metalstack.api.v2.Auditing
-	(OptimisticLockingStrategy)(0),        // 6: metalstack.api.v2.OptimisticLockingStrategy
-	(*Paging)(nil),                        // 7: metalstack.api.v2.Paging
-	(*Labels)(nil),                        // 8: metalstack.api.v2.Labels
-	(*Meta)(nil),                          // 9: metalstack.api.v2.Meta
-	(*UpdateLabels)(nil),                  // 10: metalstack.api.v2.UpdateLabels
-	(*UpdateMeta)(nil),                    // 11: metalstack.api.v2.UpdateMeta
-	nil,                                   // 12: metalstack.api.v2.Labels.LabelsEntry
-	(*timestamppb.Timestamp)(nil),         // 13: google.protobuf.Timestamp
-	(*descriptorpb.MethodOptions)(nil),    // 14: google.protobuf.MethodOptions
-	(*descriptorpb.EnumValueOptions)(nil), // 15: google.protobuf.EnumValueOptions
+	(MachineRole)(0),                      // 4: metalstack.api.v2.MachineRole
+	(Visibility)(0),                       // 5: metalstack.api.v2.Visibility
+	(Auditing)(0),                         // 6: metalstack.api.v2.Auditing
+	(OptimisticLockingStrategy)(0),        // 7: metalstack.api.v2.OptimisticLockingStrategy
+	(*Paging)(nil),                        // 8: metalstack.api.v2.Paging
+	(*Labels)(nil),                        // 9: metalstack.api.v2.Labels
+	(*Meta)(nil),                          // 10: metalstack.api.v2.Meta
+	(*UpdateLabels)(nil),                  // 11: metalstack.api.v2.UpdateLabels
+	(*UpdateMeta)(nil),                    // 12: metalstack.api.v2.UpdateMeta
+	nil,                                   // 13: metalstack.api.v2.Labels.LabelsEntry
+	(*timestamppb.Timestamp)(nil),         // 14: google.protobuf.Timestamp
+	(*descriptorpb.MethodOptions)(nil),    // 15: google.protobuf.MethodOptions
+	(*descriptorpb.EnumValueOptions)(nil), // 16: google.protobuf.EnumValueOptions
 }
 var file_metalstack_api_v2_common_proto_depIdxs = []int32{
-	12, // 0: metalstack.api.v2.Labels.labels:type_name -> metalstack.api.v2.Labels.LabelsEntry
-	8,  // 1: metalstack.api.v2.Meta.labels:type_name -> metalstack.api.v2.Labels
-	13, // 2: metalstack.api.v2.Meta.created_at:type_name -> google.protobuf.Timestamp
-	13, // 3: metalstack.api.v2.Meta.updated_at:type_name -> google.protobuf.Timestamp
-	8,  // 4: metalstack.api.v2.UpdateLabels.update:type_name -> metalstack.api.v2.Labels
-	13, // 5: metalstack.api.v2.UpdateMeta.updated_at:type_name -> google.protobuf.Timestamp
-	6,  // 6: metalstack.api.v2.UpdateMeta.locking_strategy:type_name -> metalstack.api.v2.OptimisticLockingStrategy
-	14, // 7: metalstack.api.v2.tenant_roles:extendee -> google.protobuf.MethodOptions
-	14, // 8: metalstack.api.v2.project_roles:extendee -> google.protobuf.MethodOptions
-	14, // 9: metalstack.api.v2.admin_roles:extendee -> google.protobuf.MethodOptions
-	14, // 10: metalstack.api.v2.visibility:extendee -> google.protobuf.MethodOptions
-	14, // 11: metalstack.api.v2.auditing:extendee -> google.protobuf.MethodOptions
-	14, // 12: metalstack.api.v2.infra_roles:extendee -> google.protobuf.MethodOptions
-	15, // 13: metalstack.api.v2.enum_string_value:extendee -> google.protobuf.EnumValueOptions
-	0,  // 14: metalstack.api.v2.tenant_roles:type_name -> metalstack.api.v2.TenantRole
-	1,  // 15: metalstack.api.v2.project_roles:type_name -> metalstack.api.v2.ProjectRole
-	2,  // 16: metalstack.api.v2.admin_roles:type_name -> metalstack.api.v2.AdminRole
-	4,  // 17: metalstack.api.v2.visibility:type_name -> metalstack.api.v2.Visibility
-	5,  // 18: metalstack.api.v2.auditing:type_name -> metalstack.api.v2.Auditing
-	3,  // 19: metalstack.api.v2.infra_roles:type_name -> metalstack.api.v2.InfraRole
-	20, // [20:20] is the sub-list for method output_type
-	20, // [20:20] is the sub-list for method input_type
-	14, // [14:20] is the sub-list for extension type_name
-	7,  // [7:14] is the sub-list for extension extendee
+	13, // 0: metalstack.api.v2.Labels.labels:type_name -> metalstack.api.v2.Labels.LabelsEntry
+	9,  // 1: metalstack.api.v2.Meta.labels:type_name -> metalstack.api.v2.Labels
+	14, // 2: metalstack.api.v2.Meta.created_at:type_name -> google.protobuf.Timestamp
+	14, // 3: metalstack.api.v2.Meta.updated_at:type_name -> google.protobuf.Timestamp
+	9,  // 4: metalstack.api.v2.UpdateLabels.update:type_name -> metalstack.api.v2.Labels
+	14, // 5: metalstack.api.v2.UpdateMeta.updated_at:type_name -> google.protobuf.Timestamp
+	7,  // 6: metalstack.api.v2.UpdateMeta.locking_strategy:type_name -> metalstack.api.v2.OptimisticLockingStrategy
+	15, // 7: metalstack.api.v2.tenant_roles:extendee -> google.protobuf.MethodOptions
+	15, // 8: metalstack.api.v2.project_roles:extendee -> google.protobuf.MethodOptions
+	15, // 9: metalstack.api.v2.admin_roles:extendee -> google.protobuf.MethodOptions
+	15, // 10: metalstack.api.v2.visibility:extendee -> google.protobuf.MethodOptions
+	15, // 11: metalstack.api.v2.auditing:extendee -> google.protobuf.MethodOptions
+	15, // 12: metalstack.api.v2.infra_roles:extendee -> google.protobuf.MethodOptions
+	15, // 13: metalstack.api.v2.machine_roles:extendee -> google.protobuf.MethodOptions
+	16, // 14: metalstack.api.v2.enum_string_value:extendee -> google.protobuf.EnumValueOptions
+	0,  // 15: metalstack.api.v2.tenant_roles:type_name -> metalstack.api.v2.TenantRole
+	1,  // 16: metalstack.api.v2.project_roles:type_name -> metalstack.api.v2.ProjectRole
+	2,  // 17: metalstack.api.v2.admin_roles:type_name -> metalstack.api.v2.AdminRole
+	5,  // 18: metalstack.api.v2.visibility:type_name -> metalstack.api.v2.Visibility
+	6,  // 19: metalstack.api.v2.auditing:type_name -> metalstack.api.v2.Auditing
+	3,  // 20: metalstack.api.v2.infra_roles:type_name -> metalstack.api.v2.InfraRole
+	4,  // 21: metalstack.api.v2.machine_roles:type_name -> metalstack.api.v2.MachineRole
+	22, // [22:22] is the sub-list for method output_type
+	22, // [22:22] is the sub-list for method input_type
+	15, // [15:22] is the sub-list for extension type_name
+	7,  // [7:15] is the sub-list for extension extendee
 	0,  // [0:7] is the sub-list for field type_name
 }
 
@@ -946,9 +1019,9 @@ func file_metalstack_api_v2_common_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_common_proto_rawDesc), len(file_metalstack_api_v2_common_proto_rawDesc)),
-			NumEnums:      7,
+			NumEnums:      8,
 			NumMessages:   6,
-			NumExtensions: 7,
+			NumExtensions: 8,
 			NumServices:   0,
 		},
 		GoTypes:           file_metalstack_api_v2_common_proto_goTypes,
diff --git a/go/metalstack/api/v2/filesystem.pb.go b/go/metalstack/api/v2/filesystem.pb.go
index b613337e..ffeb547c 100644
--- a/go/metalstack/api/v2/filesystem.pb.go
+++ b/go/metalstack/api/v2/filesystem.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/filesystem.proto
 
diff --git a/go/metalstack/api/v2/health.pb.go b/go/metalstack/api/v2/health.pb.go
index ee526adc..b05a6c59 100644
--- a/go/metalstack/api/v2/health.pb.go
+++ b/go/metalstack/api/v2/health.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/health.proto
 
diff --git a/go/metalstack/api/v2/image.pb.go b/go/metalstack/api/v2/image.pb.go
index d9c152d6..baf8fdea 100644
--- a/go/metalstack/api/v2/image.pb.go
+++ b/go/metalstack/api/v2/image.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/image.proto
 
diff --git a/go/metalstack/api/v2/ip.pb.go b/go/metalstack/api/v2/ip.pb.go
index 0a5315e4..cf4645b1 100644
--- a/go/metalstack/api/v2/ip.pb.go
+++ b/go/metalstack/api/v2/ip.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/ip.proto
 
diff --git a/go/metalstack/api/v2/machine.pb.go b/go/metalstack/api/v2/machine.pb.go
index 511c227b..3c7d43ac 100644
--- a/go/metalstack/api/v2/machine.pb.go
+++ b/go/metalstack/api/v2/machine.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/machine.proto
 
@@ -2453,6 +2453,224 @@ func (x *MachineBios) GetDate() string {
 	return ""
 }
 
+// MachineIPMI describe details of the ipmi or out of band device
+type MachineIPMI struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Address of this ipmi device from outside
+	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+	// Mac address of the network interface of this ipmi device
+	Mac string `protobuf:"bytes,2,opt,name=mac,proto3" json:"mac,omitempty"`
+	// User of this ipmi device
+	User string `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty"`
+	// Password of this ipmi device
+	Password string `protobuf:"bytes,4,opt,name=password,proto3" json:"password,omitempty"`
+	// Interface of this ipmi device
+	Interface string `protobuf:"bytes,5,opt,name=interface,proto3" json:"interface,omitempty"`
+	// FRU field replaceable unit details for this machine
+	Fru *MachineFRU `protobuf:"bytes,6,opt,name=fru,proto3" json:"fru,omitempty"`
+	// BMCVersion of this ipmi device
+	BmcVersion string `protobuf:"bytes,7,opt,name=bmc_version,json=bmcVersion,proto3" json:"bmc_version,omitempty"`
+	// PowerState of this machine
+	PowerState    string `protobuf:"bytes,8,opt,name=power_state,json=powerState,proto3" json:"power_state,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MachineIPMI) Reset() {
+	*x = MachineIPMI{}
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MachineIPMI) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineIPMI) ProtoMessage() {}
+
+func (x *MachineIPMI) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[27]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineIPMI.ProtoReflect.Descriptor instead.
+func (*MachineIPMI) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *MachineIPMI) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *MachineIPMI) GetMac() string {
+	if x != nil {
+		return x.Mac
+	}
+	return ""
+}
+
+func (x *MachineIPMI) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+func (x *MachineIPMI) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+func (x *MachineIPMI) GetInterface() string {
+	if x != nil {
+		return x.Interface
+	}
+	return ""
+}
+
+func (x *MachineIPMI) GetFru() *MachineFRU {
+	if x != nil {
+		return x.Fru
+	}
+	return nil
+}
+
+func (x *MachineIPMI) GetBmcVersion() string {
+	if x != nil {
+		return x.BmcVersion
+	}
+	return ""
+}
+
+func (x *MachineIPMI) GetPowerState() string {
+	if x != nil {
+		return x.PowerState
+	}
+	return ""
+}
+
+// MachineFRU describes details to the machine which are required in case of a necessary replacement
+type MachineFRU struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ChassisPartNumber is the part number of the machine chassis
+	ChassisPartNumber *string `protobuf:"bytes,1,opt,name=chassis_part_number,json=chassisPartNumber,proto3,oneof" json:"chassis_part_number,omitempty"`
+	// ChassisPartSerial is the serial number of the machine chassis
+	ChassisPartSerial *string `protobuf:"bytes,2,opt,name=chassis_part_serial,json=chassisPartSerial,proto3,oneof" json:"chassis_part_serial,omitempty"`
+	// BoardMFG is the short description of the mainboard
+	BoardMfg *string `protobuf:"bytes,3,opt,name=board_mfg,json=boardMfg,proto3,oneof" json:"board_mfg,omitempty"`
+	// BoardSerial is the serial number of the mainboard
+	BoardMfgSerial *string `protobuf:"bytes,4,opt,name=board_mfg_serial,json=boardMfgSerial,proto3,oneof" json:"board_mfg_serial,omitempty"`
+	// BoardPartNumber is the part number of the mainboard
+	BoardPartNumber *string `protobuf:"bytes,5,opt,name=board_part_number,json=boardPartNumber,proto3,oneof" json:"board_part_number,omitempty"`
+	// ProductManufacturer is the manufacturer of the machine
+	ProductManufacturer *string `protobuf:"bytes,6,opt,name=product_manufacturer,json=productManufacturer,proto3,oneof" json:"product_manufacturer,omitempty"`
+	// ProductPartNumber is the part number of the machine
+	ProductPartNumber *string `protobuf:"bytes,7,opt,name=product_part_number,json=productPartNumber,proto3,oneof" json:"product_part_number,omitempty"`
+	// ProductSerial is the serial number of the machine
+	ProductSerial *string `protobuf:"bytes,8,opt,name=product_serial,json=productSerial,proto3,oneof" json:"product_serial,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MachineFRU) Reset() {
+	*x = MachineFRU{}
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MachineFRU) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineFRU) ProtoMessage() {}
+
+func (x *MachineFRU) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[28]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineFRU.ProtoReflect.Descriptor instead.
+func (*MachineFRU) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *MachineFRU) GetChassisPartNumber() string {
+	if x != nil && x.ChassisPartNumber != nil {
+		return *x.ChassisPartNumber
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetChassisPartSerial() string {
+	if x != nil && x.ChassisPartSerial != nil {
+		return *x.ChassisPartSerial
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetBoardMfg() string {
+	if x != nil && x.BoardMfg != nil {
+		return *x.BoardMfg
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetBoardMfgSerial() string {
+	if x != nil && x.BoardMfgSerial != nil {
+		return *x.BoardMfgSerial
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetBoardPartNumber() string {
+	if x != nil && x.BoardPartNumber != nil {
+		return *x.BoardPartNumber
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetProductManufacturer() string {
+	if x != nil && x.ProductManufacturer != nil {
+		return *x.ProductManufacturer
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetProductPartNumber() string {
+	if x != nil && x.ProductPartNumber != nil {
+		return *x.ProductPartNumber
+	}
+	return ""
+}
+
+func (x *MachineFRU) GetProductSerial() string {
+	if x != nil && x.ProductSerial != nil {
+		return *x.ProductSerial
+	}
+	return ""
+}
+
 // MachineRecentProvisioningEvents the recent provisioning events for this machine
 type MachineRecentProvisioningEvents struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2470,7 +2688,7 @@ type MachineRecentProvisioningEvents struct {
 
 func (x *MachineRecentProvisioningEvents) Reset() {
 	*x = MachineRecentProvisioningEvents{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[27]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2482,7 +2700,7 @@ func (x *MachineRecentProvisioningEvents) String() string {
 func (*MachineRecentProvisioningEvents) ProtoMessage() {}
 
 func (x *MachineRecentProvisioningEvents) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[27]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2495,7 +2713,7 @@ func (x *MachineRecentProvisioningEvents) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineRecentProvisioningEvents.ProtoReflect.Descriptor instead.
 func (*MachineRecentProvisioningEvents) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{27}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *MachineRecentProvisioningEvents) GetEvents() []*MachineProvisioningEvent {
@@ -2541,7 +2759,7 @@ type MachineProvisioningEvent struct {
 
 func (x *MachineProvisioningEvent) Reset() {
 	*x = MachineProvisioningEvent{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[28]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2553,7 +2771,7 @@ func (x *MachineProvisioningEvent) String() string {
 func (*MachineProvisioningEvent) ProtoMessage() {}
 
 func (x *MachineProvisioningEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[28]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2566,7 +2784,7 @@ func (x *MachineProvisioningEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineProvisioningEvent.ProtoReflect.Descriptor instead.
 func (*MachineProvisioningEvent) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{28}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *MachineProvisioningEvent) GetTime() *timestamppb.Timestamp {
@@ -2605,7 +2823,7 @@ type MachineVPN struct {
 
 func (x *MachineVPN) Reset() {
 	*x = MachineVPN{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[29]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2617,7 +2835,7 @@ func (x *MachineVPN) String() string {
 func (*MachineVPN) ProtoMessage() {}
 
 func (x *MachineVPN) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[29]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2630,7 +2848,7 @@ func (x *MachineVPN) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineVPN.ProtoReflect.Descriptor instead.
 func (*MachineVPN) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{29}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *MachineVPN) GetControlPlaneAddress() string {
@@ -2691,7 +2909,7 @@ type MachineQuery struct {
 
 func (x *MachineQuery) Reset() {
 	*x = MachineQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[30]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2703,7 +2921,7 @@ func (x *MachineQuery) String() string {
 func (*MachineQuery) ProtoMessage() {}
 
 func (x *MachineQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[30]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2716,7 +2934,7 @@ func (x *MachineQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineQuery.ProtoReflect.Descriptor instead.
 func (*MachineQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{30}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *MachineQuery) GetUuid() string {
@@ -2842,7 +3060,7 @@ type MachineAllocationQuery struct {
 
 func (x *MachineAllocationQuery) Reset() {
 	*x = MachineAllocationQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[31]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2854,7 +3072,7 @@ func (x *MachineAllocationQuery) String() string {
 func (*MachineAllocationQuery) ProtoMessage() {}
 
 func (x *MachineAllocationQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[31]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2867,7 +3085,7 @@ func (x *MachineAllocationQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineAllocationQuery.ProtoReflect.Descriptor instead.
 func (*MachineAllocationQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{31}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *MachineAllocationQuery) GetUuid() string {
@@ -2947,7 +3165,7 @@ type MachineNetworkQuery struct {
 
 func (x *MachineNetworkQuery) Reset() {
 	*x = MachineNetworkQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[32]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2959,7 +3177,7 @@ func (x *MachineNetworkQuery) String() string {
 func (*MachineNetworkQuery) ProtoMessage() {}
 
 func (x *MachineNetworkQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[32]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2972,7 +3190,7 @@ func (x *MachineNetworkQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineNetworkQuery.ProtoReflect.Descriptor instead.
 func (*MachineNetworkQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{32}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *MachineNetworkQuery) GetNetworks() []string {
@@ -3034,7 +3252,7 @@ type MachineNicQuery struct {
 
 func (x *MachineNicQuery) Reset() {
 	*x = MachineNicQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[33]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3046,7 +3264,7 @@ func (x *MachineNicQuery) String() string {
 func (*MachineNicQuery) ProtoMessage() {}
 
 func (x *MachineNicQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[33]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3059,7 +3277,7 @@ func (x *MachineNicQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineNicQuery.ProtoReflect.Descriptor instead.
 func (*MachineNicQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{33}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *MachineNicQuery) GetMacs() []string {
@@ -3103,7 +3321,7 @@ type MachineDiskQuery struct {
 
 func (x *MachineDiskQuery) Reset() {
 	*x = MachineDiskQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[34]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3115,7 +3333,7 @@ func (x *MachineDiskQuery) String() string {
 func (*MachineDiskQuery) ProtoMessage() {}
 
 func (x *MachineDiskQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[34]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3128,7 +3346,7 @@ func (x *MachineDiskQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineDiskQuery.ProtoReflect.Descriptor instead.
 func (*MachineDiskQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{34}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *MachineDiskQuery) GetNames() []string {
@@ -3162,7 +3380,7 @@ type MachineIPMIQuery struct {
 
 func (x *MachineIPMIQuery) Reset() {
 	*x = MachineIPMIQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[35]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3174,7 +3392,7 @@ func (x *MachineIPMIQuery) String() string {
 func (*MachineIPMIQuery) ProtoMessage() {}
 
 func (x *MachineIPMIQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[35]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3187,7 +3405,7 @@ func (x *MachineIPMIQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineIPMIQuery.ProtoReflect.Descriptor instead.
 func (*MachineIPMIQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{35}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *MachineIPMIQuery) GetAddress() string {
@@ -3243,7 +3461,7 @@ type MachineFRUQuery struct {
 
 func (x *MachineFRUQuery) Reset() {
 	*x = MachineFRUQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[36]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3255,7 +3473,7 @@ func (x *MachineFRUQuery) String() string {
 func (*MachineFRUQuery) ProtoMessage() {}
 
 func (x *MachineFRUQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[36]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3268,7 +3486,7 @@ func (x *MachineFRUQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineFRUQuery.ProtoReflect.Descriptor instead.
 func (*MachineFRUQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{36}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *MachineFRUQuery) GetChassisPartNumber() string {
@@ -3340,7 +3558,7 @@ type MachineHardwareQuery struct {
 
 func (x *MachineHardwareQuery) Reset() {
 	*x = MachineHardwareQuery{}
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[37]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3352,7 +3570,7 @@ func (x *MachineHardwareQuery) String() string {
 func (*MachineHardwareQuery) ProtoMessage() {}
 
 func (x *MachineHardwareQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_machine_proto_msgTypes[37]
+	mi := &file_metalstack_api_v2_machine_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3365,7 +3583,7 @@ func (x *MachineHardwareQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineHardwareQuery.ProtoReflect.Descriptor instead.
 func (*MachineHardwareQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{37}
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *MachineHardwareQuery) GetMemory() uint64 {
@@ -3553,11 +3771,41 @@ const file_metalstack_api_v2_machine_proto_rawDesc = "" +
 	"\x04size\x18\x02 \x01(\x04R\x04size\"o\n" +
 	"\x1eMachineChassisIdentifyLEDState\x12\x1e\n" +
 	"\x05value\x18\x01 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x01R\x05value\x12-\n" +
-	"\vdescription\x18\x02 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\"q\n" +
-	"\vMachineBios\x12\"\n" +
-	"\aversion\x18\x01 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\aversion\x12 \n" +
-	"\x06vendor\x18\x02 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1c\n" +
-	"\x04date\x18\x03 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\x04date\"\xd3\x02\n" +
+	"\vdescription\x18\x02 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\"z\n" +
+	"\vMachineBios\x12%\n" +
+	"\aversion\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\aversion\x12#\n" +
+	"\x06vendor\x18\x02 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\x06vendor\x12\x1f\n" +
+	"\x04date\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\x04date\"\xd1\x02\n" +
+	"\vMachineIPMI\x12!\n" +
+	"\aaddress\x18\x01 \x01(\tB\a\xbaH\x04r\x02p\x01R\aaddress\x12\x1d\n" +
+	"\x03mac\x18\x02 \x01(\tB\v\xbaH\br\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n" +
+	"\x04user\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\x04user\x12'\n" +
+	"\bpassword\x18\x04 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\bpassword\x12)\n" +
+	"\tinterface\x18\x05 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\tinterface\x12/\n" +
+	"\x03fru\x18\x06 \x01(\v2\x1d.metalstack.api.v2.MachineFRUR\x03fru\x12,\n" +
+	"\vbmc_version\x18\a \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\n" +
+	"bmcVersion\x12,\n" +
+	"\vpower_state\x18\b \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\n" +
+	"powerState\"\xa6\x05\n" +
+	"\n" +
+	"MachineFRU\x12@\n" +
+	"\x13chassis_part_number\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\x11chassisPartNumber\x88\x01\x01\x12@\n" +
+	"\x13chassis_part_serial\x18\x02 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x01R\x11chassisPartSerial\x88\x01\x01\x12-\n" +
+	"\tboard_mfg\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x02R\bboardMfg\x88\x01\x01\x12:\n" +
+	"\x10board_mfg_serial\x18\x04 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x03R\x0eboardMfgSerial\x88\x01\x01\x12<\n" +
+	"\x11board_part_number\x18\x05 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x04R\x0fboardPartNumber\x88\x01\x01\x12C\n" +
+	"\x14product_manufacturer\x18\x06 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x05R\x13productManufacturer\x88\x01\x01\x12@\n" +
+	"\x13product_part_number\x18\a \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x06R\x11productPartNumber\x88\x01\x01\x127\n" +
+	"\x0eproduct_serial\x18\b \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\aR\rproductSerial\x88\x01\x01B\x16\n" +
+	"\x14_chassis_part_numberB\x16\n" +
+	"\x14_chassis_part_serialB\f\n" +
+	"\n" +
+	"_board_mfgB\x13\n" +
+	"\x11_board_mfg_serialB\x14\n" +
+	"\x12_board_part_numberB\x17\n" +
+	"\x15_product_manufacturerB\x16\n" +
+	"\x14_product_part_numberB\x11\n" +
+	"\x0f_product_serial\"\xd3\x02\n" +
 	"\x1fMachineRecentProvisioningEvents\x12C\n" +
 	"\x06events\x18\x01 \x03(\v2+.metalstack.api.v2.MachineProvisioningEventR\x06events\x12B\n" +
 	"\x0flast_event_time\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\rlastEventTime\x12U\n" +
@@ -3741,7 +3989,7 @@ func file_metalstack_api_v2_machine_proto_rawDescGZIP() []byte {
 }
 
 var file_metalstack_api_v2_machine_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
-var file_metalstack_api_v2_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 38)
+var file_metalstack_api_v2_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 40)
 var file_metalstack_api_v2_machine_proto_goTypes = []any{
 	(IPProtocol)(0),                         // 0: metalstack.api.v2.IPProtocol
 	(MachineState)(0),                       // 1: metalstack.api.v2.MachineState
@@ -3776,111 +4024,114 @@ var file_metalstack_api_v2_machine_proto_goTypes = []any{
 	(*MachineBlockDevice)(nil),              // 30: metalstack.api.v2.MachineBlockDevice
 	(*MachineChassisIdentifyLEDState)(nil),  // 31: metalstack.api.v2.MachineChassisIdentifyLEDState
 	(*MachineBios)(nil),                     // 32: metalstack.api.v2.MachineBios
-	(*MachineRecentProvisioningEvents)(nil), // 33: metalstack.api.v2.MachineRecentProvisioningEvents
-	(*MachineProvisioningEvent)(nil),        // 34: metalstack.api.v2.MachineProvisioningEvent
-	(*MachineVPN)(nil),                      // 35: metalstack.api.v2.MachineVPN
-	(*MachineQuery)(nil),                    // 36: metalstack.api.v2.MachineQuery
-	(*MachineAllocationQuery)(nil),          // 37: metalstack.api.v2.MachineAllocationQuery
-	(*MachineNetworkQuery)(nil),             // 38: metalstack.api.v2.MachineNetworkQuery
-	(*MachineNicQuery)(nil),                 // 39: metalstack.api.v2.MachineNicQuery
-	(*MachineDiskQuery)(nil),                // 40: metalstack.api.v2.MachineDiskQuery
-	(*MachineIPMIQuery)(nil),                // 41: metalstack.api.v2.MachineIPMIQuery
-	(*MachineFRUQuery)(nil),                 // 42: metalstack.api.v2.MachineFRUQuery
-	(*MachineHardwareQuery)(nil),            // 43: metalstack.api.v2.MachineHardwareQuery
-	(*Labels)(nil),                          // 44: metalstack.api.v2.Labels
-	(*DNSServer)(nil),                       // 45: metalstack.api.v2.DNSServer
-	(*NTPServer)(nil),                       // 46: metalstack.api.v2.NTPServer
-	(*UpdateMeta)(nil),                      // 47: metalstack.api.v2.UpdateMeta
-	(*UpdateLabels)(nil),                    // 48: metalstack.api.v2.UpdateLabels
-	(*Meta)(nil),                            // 49: metalstack.api.v2.Meta
-	(*Partition)(nil),                       // 50: metalstack.api.v2.Partition
-	(*Size)(nil),                            // 51: metalstack.api.v2.Size
-	(*Image)(nil),                           // 52: metalstack.api.v2.Image
-	(*FilesystemLayout)(nil),                // 53: metalstack.api.v2.FilesystemLayout
-	(NetworkType)(0),                        // 54: metalstack.api.v2.NetworkType
-	(NATType)(0),                            // 55: metalstack.api.v2.NATType
-	(*timestamppb.Timestamp)(nil),           // 56: google.protobuf.Timestamp
+	(*MachineIPMI)(nil),                     // 33: metalstack.api.v2.MachineIPMI
+	(*MachineFRU)(nil),                      // 34: metalstack.api.v2.MachineFRU
+	(*MachineRecentProvisioningEvents)(nil), // 35: metalstack.api.v2.MachineRecentProvisioningEvents
+	(*MachineProvisioningEvent)(nil),        // 36: metalstack.api.v2.MachineProvisioningEvent
+	(*MachineVPN)(nil),                      // 37: metalstack.api.v2.MachineVPN
+	(*MachineQuery)(nil),                    // 38: metalstack.api.v2.MachineQuery
+	(*MachineAllocationQuery)(nil),          // 39: metalstack.api.v2.MachineAllocationQuery
+	(*MachineNetworkQuery)(nil),             // 40: metalstack.api.v2.MachineNetworkQuery
+	(*MachineNicQuery)(nil),                 // 41: metalstack.api.v2.MachineNicQuery
+	(*MachineDiskQuery)(nil),                // 42: metalstack.api.v2.MachineDiskQuery
+	(*MachineIPMIQuery)(nil),                // 43: metalstack.api.v2.MachineIPMIQuery
+	(*MachineFRUQuery)(nil),                 // 44: metalstack.api.v2.MachineFRUQuery
+	(*MachineHardwareQuery)(nil),            // 45: metalstack.api.v2.MachineHardwareQuery
+	(*Labels)(nil),                          // 46: metalstack.api.v2.Labels
+	(*DNSServer)(nil),                       // 47: metalstack.api.v2.DNSServer
+	(*NTPServer)(nil),                       // 48: metalstack.api.v2.NTPServer
+	(*UpdateMeta)(nil),                      // 49: metalstack.api.v2.UpdateMeta
+	(*UpdateLabels)(nil),                    // 50: metalstack.api.v2.UpdateLabels
+	(*Meta)(nil),                            // 51: metalstack.api.v2.Meta
+	(*Partition)(nil),                       // 52: metalstack.api.v2.Partition
+	(*Size)(nil),                            // 53: metalstack.api.v2.Size
+	(*Image)(nil),                           // 54: metalstack.api.v2.Image
+	(*FilesystemLayout)(nil),                // 55: metalstack.api.v2.FilesystemLayout
+	(NetworkType)(0),                        // 56: metalstack.api.v2.NetworkType
+	(NATType)(0),                            // 57: metalstack.api.v2.NATType
+	(*timestamppb.Timestamp)(nil),           // 58: google.protobuf.Timestamp
 }
 var file_metalstack_api_v2_machine_proto_depIdxs = []int32{
 	17, // 0: metalstack.api.v2.MachineServiceGetResponse.machine:type_name -> metalstack.api.v2.Machine
-	44, // 1: metalstack.api.v2.MachineServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	46, // 1: metalstack.api.v2.MachineServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
 	21, // 2: metalstack.api.v2.MachineServiceCreateRequest.networks:type_name -> metalstack.api.v2.MachineAllocationNetwork
-	45, // 3: metalstack.api.v2.MachineServiceCreateRequest.dns_server:type_name -> metalstack.api.v2.DNSServer
-	46, // 4: metalstack.api.v2.MachineServiceCreateRequest.ntp_server:type_name -> metalstack.api.v2.NTPServer
+	47, // 3: metalstack.api.v2.MachineServiceCreateRequest.dns_server:type_name -> metalstack.api.v2.DNSServer
+	48, // 4: metalstack.api.v2.MachineServiceCreateRequest.ntp_server:type_name -> metalstack.api.v2.NTPServer
 	5,  // 5: metalstack.api.v2.MachineServiceCreateRequest.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
 	9,  // 6: metalstack.api.v2.MachineServiceCreateRequest.firewall_spec:type_name -> metalstack.api.v2.FirewallSpec
 	22, // 7: metalstack.api.v2.FirewallSpec.firewall_rules:type_name -> metalstack.api.v2.FirewallRules
 	17, // 8: metalstack.api.v2.MachineServiceCreateResponse.machine:type_name -> metalstack.api.v2.Machine
-	47, // 9: metalstack.api.v2.MachineServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
-	48, // 10: metalstack.api.v2.MachineServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
+	49, // 9: metalstack.api.v2.MachineServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
+	50, // 10: metalstack.api.v2.MachineServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
 	17, // 11: metalstack.api.v2.MachineServiceUpdateResponse.machine:type_name -> metalstack.api.v2.Machine
-	36, // 12: metalstack.api.v2.MachineServiceListRequest.query:type_name -> metalstack.api.v2.MachineQuery
+	38, // 12: metalstack.api.v2.MachineServiceListRequest.query:type_name -> metalstack.api.v2.MachineQuery
 	17, // 13: metalstack.api.v2.MachineServiceListResponse.machines:type_name -> metalstack.api.v2.Machine
 	17, // 14: metalstack.api.v2.MachineServiceDeleteResponse.machine:type_name -> metalstack.api.v2.Machine
-	49, // 15: metalstack.api.v2.Machine.meta:type_name -> metalstack.api.v2.Meta
-	50, // 16: metalstack.api.v2.Machine.partition:type_name -> metalstack.api.v2.Partition
-	51, // 17: metalstack.api.v2.Machine.size:type_name -> metalstack.api.v2.Size
+	51, // 15: metalstack.api.v2.Machine.meta:type_name -> metalstack.api.v2.Meta
+	52, // 16: metalstack.api.v2.Machine.partition:type_name -> metalstack.api.v2.Partition
+	53, // 17: metalstack.api.v2.Machine.size:type_name -> metalstack.api.v2.Size
 	26, // 18: metalstack.api.v2.Machine.hardware:type_name -> metalstack.api.v2.MachineHardware
 	32, // 19: metalstack.api.v2.Machine.bios:type_name -> metalstack.api.v2.MachineBios
 	20, // 20: metalstack.api.v2.Machine.allocation:type_name -> metalstack.api.v2.MachineAllocation
 	18, // 21: metalstack.api.v2.Machine.status:type_name -> metalstack.api.v2.MachineStatus
-	33, // 22: metalstack.api.v2.Machine.recent_provisioning_events:type_name -> metalstack.api.v2.MachineRecentProvisioningEvents
+	35, // 22: metalstack.api.v2.Machine.recent_provisioning_events:type_name -> metalstack.api.v2.MachineRecentProvisioningEvents
 	19, // 23: metalstack.api.v2.MachineStatus.condition:type_name -> metalstack.api.v2.MachineCondition
 	31, // 24: metalstack.api.v2.MachineStatus.led_state:type_name -> metalstack.api.v2.MachineChassisIdentifyLEDState
 	4,  // 25: metalstack.api.v2.MachineStatus.liveliness:type_name -> metalstack.api.v2.MachineLiveliness
 	1,  // 26: metalstack.api.v2.MachineCondition.state:type_name -> metalstack.api.v2.MachineState
-	49, // 27: metalstack.api.v2.MachineAllocation.meta:type_name -> metalstack.api.v2.Meta
-	52, // 28: metalstack.api.v2.MachineAllocation.image:type_name -> metalstack.api.v2.Image
-	53, // 29: metalstack.api.v2.MachineAllocation.filesystem_layout:type_name -> metalstack.api.v2.FilesystemLayout
+	51, // 27: metalstack.api.v2.MachineAllocation.meta:type_name -> metalstack.api.v2.Meta
+	54, // 28: metalstack.api.v2.MachineAllocation.image:type_name -> metalstack.api.v2.Image
+	55, // 29: metalstack.api.v2.MachineAllocation.filesystem_layout:type_name -> metalstack.api.v2.FilesystemLayout
 	25, // 30: metalstack.api.v2.MachineAllocation.networks:type_name -> metalstack.api.v2.MachineNetwork
 	5,  // 31: metalstack.api.v2.MachineAllocation.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
 	22, // 32: metalstack.api.v2.MachineAllocation.firewall_rules:type_name -> metalstack.api.v2.FirewallRules
-	45, // 33: metalstack.api.v2.MachineAllocation.dns_server:type_name -> metalstack.api.v2.DNSServer
-	46, // 34: metalstack.api.v2.MachineAllocation.ntp_server:type_name -> metalstack.api.v2.NTPServer
-	35, // 35: metalstack.api.v2.MachineAllocation.vpn:type_name -> metalstack.api.v2.MachineVPN
+	47, // 33: metalstack.api.v2.MachineAllocation.dns_server:type_name -> metalstack.api.v2.DNSServer
+	48, // 34: metalstack.api.v2.MachineAllocation.ntp_server:type_name -> metalstack.api.v2.NTPServer
+	37, // 35: metalstack.api.v2.MachineAllocation.vpn:type_name -> metalstack.api.v2.MachineVPN
 	23, // 36: metalstack.api.v2.FirewallRules.egress:type_name -> metalstack.api.v2.FirewallEgressRule
 	24, // 37: metalstack.api.v2.FirewallRules.ingress:type_name -> metalstack.api.v2.FirewallIngressRule
 	0,  // 38: metalstack.api.v2.FirewallEgressRule.protocol:type_name -> metalstack.api.v2.IPProtocol
 	0,  // 39: metalstack.api.v2.FirewallIngressRule.protocol:type_name -> metalstack.api.v2.IPProtocol
-	54, // 40: metalstack.api.v2.MachineNetwork.network_type:type_name -> metalstack.api.v2.NetworkType
-	55, // 41: metalstack.api.v2.MachineNetwork.nat_type:type_name -> metalstack.api.v2.NATType
+	56, // 40: metalstack.api.v2.MachineNetwork.network_type:type_name -> metalstack.api.v2.NetworkType
+	57, // 41: metalstack.api.v2.MachineNetwork.nat_type:type_name -> metalstack.api.v2.NATType
 	30, // 42: metalstack.api.v2.MachineHardware.disks:type_name -> metalstack.api.v2.MachineBlockDevice
 	27, // 43: metalstack.api.v2.MachineHardware.cpus:type_name -> metalstack.api.v2.MetalCPU
 	28, // 44: metalstack.api.v2.MachineHardware.gpus:type_name -> metalstack.api.v2.MetalGPU
 	29, // 45: metalstack.api.v2.MachineHardware.nics:type_name -> metalstack.api.v2.MachineNic
 	29, // 46: metalstack.api.v2.MachineNic.neighbors:type_name -> metalstack.api.v2.MachineNic
-	34, // 47: metalstack.api.v2.MachineRecentProvisioningEvents.events:type_name -> metalstack.api.v2.MachineProvisioningEvent
-	56, // 48: metalstack.api.v2.MachineRecentProvisioningEvents.last_event_time:type_name -> google.protobuf.Timestamp
-	34, // 49: metalstack.api.v2.MachineRecentProvisioningEvents.last_error_event:type_name -> metalstack.api.v2.MachineProvisioningEvent
-	2,  // 50: metalstack.api.v2.MachineRecentProvisioningEvents.state:type_name -> metalstack.api.v2.MachineProvisioningEventState
-	56, // 51: metalstack.api.v2.MachineProvisioningEvent.time:type_name -> google.protobuf.Timestamp
-	3,  // 52: metalstack.api.v2.MachineProvisioningEvent.event:type_name -> metalstack.api.v2.MachineProvisioningEventType
-	44, // 53: metalstack.api.v2.MachineQuery.labels:type_name -> metalstack.api.v2.Labels
-	37, // 54: metalstack.api.v2.MachineQuery.allocation:type_name -> metalstack.api.v2.MachineAllocationQuery
-	38, // 55: metalstack.api.v2.MachineQuery.network:type_name -> metalstack.api.v2.MachineNetworkQuery
-	39, // 56: metalstack.api.v2.MachineQuery.nic:type_name -> metalstack.api.v2.MachineNicQuery
-	40, // 57: metalstack.api.v2.MachineQuery.disk:type_name -> metalstack.api.v2.MachineDiskQuery
-	41, // 58: metalstack.api.v2.MachineQuery.ipmi:type_name -> metalstack.api.v2.MachineIPMIQuery
-	42, // 59: metalstack.api.v2.MachineQuery.fru:type_name -> metalstack.api.v2.MachineFRUQuery
-	43, // 60: metalstack.api.v2.MachineQuery.hardware:type_name -> metalstack.api.v2.MachineHardwareQuery
-	1,  // 61: metalstack.api.v2.MachineQuery.state:type_name -> metalstack.api.v2.MachineState
-	5,  // 62: metalstack.api.v2.MachineAllocationQuery.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
-	44, // 63: metalstack.api.v2.MachineAllocationQuery.labels:type_name -> metalstack.api.v2.Labels
-	6,  // 64: metalstack.api.v2.MachineService.Get:input_type -> metalstack.api.v2.MachineServiceGetRequest
-	8,  // 65: metalstack.api.v2.MachineService.Create:input_type -> metalstack.api.v2.MachineServiceCreateRequest
-	11, // 66: metalstack.api.v2.MachineService.Update:input_type -> metalstack.api.v2.MachineServiceUpdateRequest
-	13, // 67: metalstack.api.v2.MachineService.List:input_type -> metalstack.api.v2.MachineServiceListRequest
-	15, // 68: metalstack.api.v2.MachineService.Delete:input_type -> metalstack.api.v2.MachineServiceDeleteRequest
-	7,  // 69: metalstack.api.v2.MachineService.Get:output_type -> metalstack.api.v2.MachineServiceGetResponse
-	10, // 70: metalstack.api.v2.MachineService.Create:output_type -> metalstack.api.v2.MachineServiceCreateResponse
-	12, // 71: metalstack.api.v2.MachineService.Update:output_type -> metalstack.api.v2.MachineServiceUpdateResponse
-	14, // 72: metalstack.api.v2.MachineService.List:output_type -> metalstack.api.v2.MachineServiceListResponse
-	16, // 73: metalstack.api.v2.MachineService.Delete:output_type -> metalstack.api.v2.MachineServiceDeleteResponse
-	69, // [69:74] is the sub-list for method output_type
-	64, // [64:69] is the sub-list for method input_type
-	64, // [64:64] is the sub-list for extension type_name
-	64, // [64:64] is the sub-list for extension extendee
-	0,  // [0:64] is the sub-list for field type_name
+	34, // 47: metalstack.api.v2.MachineIPMI.fru:type_name -> metalstack.api.v2.MachineFRU
+	36, // 48: metalstack.api.v2.MachineRecentProvisioningEvents.events:type_name -> metalstack.api.v2.MachineProvisioningEvent
+	58, // 49: metalstack.api.v2.MachineRecentProvisioningEvents.last_event_time:type_name -> google.protobuf.Timestamp
+	36, // 50: metalstack.api.v2.MachineRecentProvisioningEvents.last_error_event:type_name -> metalstack.api.v2.MachineProvisioningEvent
+	2,  // 51: metalstack.api.v2.MachineRecentProvisioningEvents.state:type_name -> metalstack.api.v2.MachineProvisioningEventState
+	58, // 52: metalstack.api.v2.MachineProvisioningEvent.time:type_name -> google.protobuf.Timestamp
+	3,  // 53: metalstack.api.v2.MachineProvisioningEvent.event:type_name -> metalstack.api.v2.MachineProvisioningEventType
+	46, // 54: metalstack.api.v2.MachineQuery.labels:type_name -> metalstack.api.v2.Labels
+	39, // 55: metalstack.api.v2.MachineQuery.allocation:type_name -> metalstack.api.v2.MachineAllocationQuery
+	40, // 56: metalstack.api.v2.MachineQuery.network:type_name -> metalstack.api.v2.MachineNetworkQuery
+	41, // 57: metalstack.api.v2.MachineQuery.nic:type_name -> metalstack.api.v2.MachineNicQuery
+	42, // 58: metalstack.api.v2.MachineQuery.disk:type_name -> metalstack.api.v2.MachineDiskQuery
+	43, // 59: metalstack.api.v2.MachineQuery.ipmi:type_name -> metalstack.api.v2.MachineIPMIQuery
+	44, // 60: metalstack.api.v2.MachineQuery.fru:type_name -> metalstack.api.v2.MachineFRUQuery
+	45, // 61: metalstack.api.v2.MachineQuery.hardware:type_name -> metalstack.api.v2.MachineHardwareQuery
+	1,  // 62: metalstack.api.v2.MachineQuery.state:type_name -> metalstack.api.v2.MachineState
+	5,  // 63: metalstack.api.v2.MachineAllocationQuery.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
+	46, // 64: metalstack.api.v2.MachineAllocationQuery.labels:type_name -> metalstack.api.v2.Labels
+	6,  // 65: metalstack.api.v2.MachineService.Get:input_type -> metalstack.api.v2.MachineServiceGetRequest
+	8,  // 66: metalstack.api.v2.MachineService.Create:input_type -> metalstack.api.v2.MachineServiceCreateRequest
+	11, // 67: metalstack.api.v2.MachineService.Update:input_type -> metalstack.api.v2.MachineServiceUpdateRequest
+	13, // 68: metalstack.api.v2.MachineService.List:input_type -> metalstack.api.v2.MachineServiceListRequest
+	15, // 69: metalstack.api.v2.MachineService.Delete:input_type -> metalstack.api.v2.MachineServiceDeleteRequest
+	7,  // 70: metalstack.api.v2.MachineService.Get:output_type -> metalstack.api.v2.MachineServiceGetResponse
+	10, // 71: metalstack.api.v2.MachineService.Create:output_type -> metalstack.api.v2.MachineServiceCreateResponse
+	12, // 72: metalstack.api.v2.MachineService.Update:output_type -> metalstack.api.v2.MachineServiceUpdateResponse
+	14, // 73: metalstack.api.v2.MachineService.List:output_type -> metalstack.api.v2.MachineServiceListResponse
+	16, // 74: metalstack.api.v2.MachineService.Delete:output_type -> metalstack.api.v2.MachineServiceDeleteResponse
+	70, // [70:75] is the sub-list for method output_type
+	65, // [65:70] is the sub-list for method input_type
+	65, // [65:65] is the sub-list for extension type_name
+	65, // [65:65] is the sub-list for extension extendee
+	0,  // [0:65] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_api_v2_machine_proto_init() }
@@ -3898,18 +4149,19 @@ func file_metalstack_api_v2_machine_proto_init() {
 	file_metalstack_api_v2_machine_proto_msgTypes[2].OneofWrappers = []any{}
 	file_metalstack_api_v2_machine_proto_msgTypes[5].OneofWrappers = []any{}
 	file_metalstack_api_v2_machine_proto_msgTypes[15].OneofWrappers = []any{}
-	file_metalstack_api_v2_machine_proto_msgTypes[30].OneofWrappers = []any{}
-	file_metalstack_api_v2_machine_proto_msgTypes[31].OneofWrappers = []any{}
-	file_metalstack_api_v2_machine_proto_msgTypes[35].OneofWrappers = []any{}
-	file_metalstack_api_v2_machine_proto_msgTypes[36].OneofWrappers = []any{}
+	file_metalstack_api_v2_machine_proto_msgTypes[28].OneofWrappers = []any{}
+	file_metalstack_api_v2_machine_proto_msgTypes[32].OneofWrappers = []any{}
+	file_metalstack_api_v2_machine_proto_msgTypes[33].OneofWrappers = []any{}
 	file_metalstack_api_v2_machine_proto_msgTypes[37].OneofWrappers = []any{}
+	file_metalstack_api_v2_machine_proto_msgTypes[38].OneofWrappers = []any{}
+	file_metalstack_api_v2_machine_proto_msgTypes[39].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_machine_proto_rawDesc), len(file_metalstack_api_v2_machine_proto_rawDesc)),
 			NumEnums:      6,
-			NumMessages:   38,
+			NumMessages:   40,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/metalstack/api/v2/method.pb.go b/go/metalstack/api/v2/method.pb.go
index 952f4f7f..939a9795 100644
--- a/go/metalstack/api/v2/method.pb.go
+++ b/go/metalstack/api/v2/method.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/method.proto
 
@@ -154,7 +154,9 @@ type MethodServiceTokenScopedListResponse struct {
 	// AdminRole defines the admin role of the token owner
 	AdminRole *AdminRole `protobuf:"varint,5,opt,name=admin_role,json=adminRole,proto3,enum=metalstack.api.v2.AdminRole,oneof" json:"admin_role,omitempty"`
 	// InfraRole defines the infrastructure role of the token owner
-	InfraRole     *InfraRole `protobuf:"varint,6,opt,name=infra_role,json=infraRole,proto3,enum=metalstack.api.v2.InfraRole,oneof" json:"infra_role,omitempty"`
+	InfraRole *InfraRole `protobuf:"varint,6,opt,name=infra_role,json=infraRole,proto3,enum=metalstack.api.v2.InfraRole,oneof" json:"infra_role,omitempty"`
+	// MachineRoles defines the machine roles of the token owner
+	MachineRoles  map[string]MachineRole `protobuf:"bytes,7,rep,name=machine_roles,json=machineRoles,proto3" json:"machine_roles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value,enum=metalstack.api.v2.MachineRole"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -224,6 +226,13 @@ func (x *MethodServiceTokenScopedListResponse) GetInfraRole() InfraRole {
 	return InfraRole_INFRA_ROLE_UNSPECIFIED
 }
 
+func (x *MethodServiceTokenScopedListResponse) GetMachineRoles() map[string]MachineRole {
+	if x != nil {
+		return x.MachineRoles
+	}
+	return nil
+}
+
 var File_metalstack_api_v2_method_proto protoreflect.FileDescriptor
 
 const file_metalstack_api_v2_method_proto_rawDesc = "" +
@@ -232,7 +241,7 @@ const file_metalstack_api_v2_method_proto_rawDesc = "" +
 	"\x18MethodServiceListRequest\"5\n" +
 	"\x19MethodServiceListResponse\x12\x18\n" +
 	"\amethods\x18\x01 \x03(\tR\amethods\"%\n" +
-	"#MethodServiceTokenScopedListRequest\"\xc0\x05\n" +
+	"#MethodServiceTokenScopedListRequest\"\x91\a\n" +
 	"$MethodServiceTokenScopedListResponse\x12E\n" +
 	"\vpermissions\x18\x01 \x03(\v2#.metalstack.api.v2.MethodPermissionR\vpermissions\x12n\n" +
 	"\rproject_roles\x18\x03 \x03(\v2I.metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntryR\fprojectRoles\x12k\n" +
@@ -240,13 +249,17 @@ const file_metalstack_api_v2_method_proto_rawDesc = "" +
 	"\n" +
 	"admin_role\x18\x05 \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
-	"infra_role\x18\x06 \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x1a_\n" +
+	"infra_role\x18\x06 \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12n\n" +
+	"\rmachine_roles\x18\a \x03(\v2I.metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntryR\fmachineRoles\x1a_\n" +
 	"\x11ProjectRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x028\x01\x1a]\n" +
 	"\x10TenantRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x123\n" +
-	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01B\r\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01\x1a_\n" +
+	"\x11MachineRolesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01B\r\n" +
 	"\v_admin_roleB\r\n" +
 	"\v_infra_role2\x83\x02\n" +
 	"\rMethodService\x12g\n" +
@@ -266,7 +279,7 @@ func file_metalstack_api_v2_method_proto_rawDescGZIP() []byte {
 	return file_metalstack_api_v2_method_proto_rawDescData
 }
 
-var file_metalstack_api_v2_method_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_metalstack_api_v2_method_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
 var file_metalstack_api_v2_method_proto_goTypes = []any{
 	(*MethodServiceListRequest)(nil),             // 0: metalstack.api.v2.MethodServiceListRequest
 	(*MethodServiceListResponse)(nil),            // 1: metalstack.api.v2.MethodServiceListResponse
@@ -274,29 +287,33 @@ var file_metalstack_api_v2_method_proto_goTypes = []any{
 	(*MethodServiceTokenScopedListResponse)(nil), // 3: metalstack.api.v2.MethodServiceTokenScopedListResponse
 	nil,                      // 4: metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry
 	nil,                      // 5: metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry
-	(*MethodPermission)(nil), // 6: metalstack.api.v2.MethodPermission
-	(AdminRole)(0),           // 7: metalstack.api.v2.AdminRole
-	(InfraRole)(0),           // 8: metalstack.api.v2.InfraRole
-	(ProjectRole)(0),         // 9: metalstack.api.v2.ProjectRole
-	(TenantRole)(0),          // 10: metalstack.api.v2.TenantRole
+	nil,                      // 6: metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntry
+	(*MethodPermission)(nil), // 7: metalstack.api.v2.MethodPermission
+	(AdminRole)(0),           // 8: metalstack.api.v2.AdminRole
+	(InfraRole)(0),           // 9: metalstack.api.v2.InfraRole
+	(ProjectRole)(0),         // 10: metalstack.api.v2.ProjectRole
+	(TenantRole)(0),          // 11: metalstack.api.v2.TenantRole
+	(MachineRole)(0),         // 12: metalstack.api.v2.MachineRole
 }
 var file_metalstack_api_v2_method_proto_depIdxs = []int32{
-	6,  // 0: metalstack.api.v2.MethodServiceTokenScopedListResponse.permissions:type_name -> metalstack.api.v2.MethodPermission
+	7,  // 0: metalstack.api.v2.MethodServiceTokenScopedListResponse.permissions:type_name -> metalstack.api.v2.MethodPermission
 	4,  // 1: metalstack.api.v2.MethodServiceTokenScopedListResponse.project_roles:type_name -> metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry
 	5,  // 2: metalstack.api.v2.MethodServiceTokenScopedListResponse.tenant_roles:type_name -> metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry
-	7,  // 3: metalstack.api.v2.MethodServiceTokenScopedListResponse.admin_role:type_name -> metalstack.api.v2.AdminRole
-	8,  // 4: metalstack.api.v2.MethodServiceTokenScopedListResponse.infra_role:type_name -> metalstack.api.v2.InfraRole
-	9,  // 5: metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	10, // 6: metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	0,  // 7: metalstack.api.v2.MethodService.List:input_type -> metalstack.api.v2.MethodServiceListRequest
-	2,  // 8: metalstack.api.v2.MethodService.TokenScopedList:input_type -> metalstack.api.v2.MethodServiceTokenScopedListRequest
-	1,  // 9: metalstack.api.v2.MethodService.List:output_type -> metalstack.api.v2.MethodServiceListResponse
-	3,  // 10: metalstack.api.v2.MethodService.TokenScopedList:output_type -> metalstack.api.v2.MethodServiceTokenScopedListResponse
-	9,  // [9:11] is the sub-list for method output_type
-	7,  // [7:9] is the sub-list for method input_type
-	7,  // [7:7] is the sub-list for extension type_name
-	7,  // [7:7] is the sub-list for extension extendee
-	0,  // [0:7] is the sub-list for field type_name
+	8,  // 3: metalstack.api.v2.MethodServiceTokenScopedListResponse.admin_role:type_name -> metalstack.api.v2.AdminRole
+	9,  // 4: metalstack.api.v2.MethodServiceTokenScopedListResponse.infra_role:type_name -> metalstack.api.v2.InfraRole
+	6,  // 5: metalstack.api.v2.MethodServiceTokenScopedListResponse.machine_roles:type_name -> metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntry
+	10, // 6: metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	11, // 7: metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	12, // 8: metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	0,  // 9: metalstack.api.v2.MethodService.List:input_type -> metalstack.api.v2.MethodServiceListRequest
+	2,  // 10: metalstack.api.v2.MethodService.TokenScopedList:input_type -> metalstack.api.v2.MethodServiceTokenScopedListRequest
+	1,  // 11: metalstack.api.v2.MethodService.List:output_type -> metalstack.api.v2.MethodServiceListResponse
+	3,  // 12: metalstack.api.v2.MethodService.TokenScopedList:output_type -> metalstack.api.v2.MethodServiceTokenScopedListResponse
+	11, // [11:13] is the sub-list for method output_type
+	9,  // [9:11] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_api_v2_method_proto_init() }
@@ -313,7 +330,7 @@ func file_metalstack_api_v2_method_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_method_proto_rawDesc), len(file_metalstack_api_v2_method_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   7,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/metalstack/api/v2/network.pb.go b/go/metalstack/api/v2/network.pb.go
index 959fd091..132b1685 100644
--- a/go/metalstack/api/v2/network.pb.go
+++ b/go/metalstack/api/v2/network.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/network.proto
 
diff --git a/go/metalstack/api/v2/partition.pb.go b/go/metalstack/api/v2/partition.pb.go
index fc64c003..cc4f8191 100644
--- a/go/metalstack/api/v2/partition.pb.go
+++ b/go/metalstack/api/v2/partition.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/partition.proto
 
@@ -522,10 +522,9 @@ var File_metalstack_api_v2_partition_proto protoreflect.FileDescriptor
 
 const file_metalstack_api_v2_partition_proto_rawDesc = "" +
 	"\n" +
-	"!metalstack/api/v2/partition.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xa5\x03\n" +
-	"\tPartition\x12\x1a\n" +
-	"\x02id\x18\x01 \x01(\tB\n" +
-	"\xbaH\ar\x05\x10\x02\x18\x80\x01R\x02id\x12+\n" +
+	"!metalstack/api/v2/partition.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xa6\x03\n" +
+	"\tPartition\x12\x1b\n" +
+	"\x02id\x18\x01 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\x02id\x12+\n" +
 	"\x04meta\x18\x02 \x01(\v2\x17.metalstack.api.v2.MetaR\x04meta\x12-\n" +
 	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12\\\n" +
 	"\x12boot_configuration\x18\x04 \x01(\v2-.metalstack.api.v2.PartitionBootConfigurationR\x11bootConfiguration\x12E\n" +
@@ -534,10 +533,9 @@ const file_metalstack_api_v2_partition_proto_rawDesc = "" +
 	"\n" +
 	"ntp_server\x18\x06 \x03(\v2\x1c.metalstack.api.v2.NTPServerB\b\xbaH\x05\x92\x01\x02\x10\n" +
 	"R\tntpServer\x124\n" +
-	"\x16mgmt_service_addresses\x18\a \x03(\tR\x14mgmtServiceAddresses\"{\n" +
-	"\x0ePartitionQuery\x12\x1f\n" +
-	"\x02id\x18\x01 \x01(\tB\n" +
-	"\xbaH\ar\x05\x10\x02\x18\x80\x01H\x00R\x02id\x88\x01\x01\x126\n" +
+	"\x16mgmt_service_addresses\x18\a \x03(\tR\x14mgmtServiceAddresses\"|\n" +
+	"\x0ePartitionQuery\x12 \n" +
+	"\x02id\x18\x01 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01H\x00R\x02id\x88\x01\x01\x126\n" +
 	"\x06labels\x18\x02 \x01(\v2\x19.metalstack.api.v2.LabelsH\x01R\x06labels\x88\x01\x01B\x05\n" +
 	"\x03_idB\t\n" +
 	"\a_labels\"\x94\x01\n" +
@@ -549,10 +547,9 @@ const file_metalstack_api_v2_partition_proto_rawDesc = "" +
 	"\tDNSServer\x12\x17\n" +
 	"\x02ip\x18\x01 \x01(\tB\a\xbaH\x04r\x02p\x01R\x02ip\"/\n" +
 	"\tNTPServer\x12\"\n" +
-	"\aaddress\x18\x01 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\aaddress\"8\n" +
-	"\x1aPartitionServiceGetRequest\x12\x1a\n" +
-	"\x02id\x18\x01 \x01(\tB\n" +
-	"\xbaH\ar\x05\x10\x02\x18\x80\x01R\x02id\"V\n" +
+	"\aaddress\x18\x01 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\aaddress\"9\n" +
+	"\x1aPartitionServiceGetRequest\x12\x1b\n" +
+	"\x02id\x18\x01 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\x02id\"V\n" +
 	"\x1bPartitionServiceListRequest\x127\n" +
 	"\x05query\x18\x01 \x01(\v2!.metalstack.api.v2.PartitionQueryR\x05query\"Y\n" +
 	"\x1bPartitionServiceGetResponse\x12:\n" +
diff --git a/go/metalstack/api/v2/predefined_rules.pb.go b/go/metalstack/api/v2/predefined_rules.pb.go
index 7b755cc3..decc252e 100644
--- a/go/metalstack/api/v2/predefined_rules.pb.go
+++ b/go/metalstack/api/v2/predefined_rules.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/predefined_rules.proto
 
diff --git a/go/metalstack/api/v2/project.pb.go b/go/metalstack/api/v2/project.pb.go
index 50d7a4d4..6a185273 100644
--- a/go/metalstack/api/v2/project.pb.go
+++ b/go/metalstack/api/v2/project.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/project.proto
 
diff --git a/go/metalstack/api/v2/size.pb.go b/go/metalstack/api/v2/size.pb.go
index e2303302..2f6c9070 100644
--- a/go/metalstack/api/v2/size.pb.go
+++ b/go/metalstack/api/v2/size.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/size.proto
 
diff --git a/go/metalstack/api/v2/switch.pb.go b/go/metalstack/api/v2/switch.pb.go
index fab16a35..b5c92c55 100644
--- a/go/metalstack/api/v2/switch.pb.go
+++ b/go/metalstack/api/v2/switch.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/switch.proto
 
diff --git a/go/metalstack/api/v2/tenant.pb.go b/go/metalstack/api/v2/tenant.pb.go
index 087f13b0..7cd317ec 100644
--- a/go/metalstack/api/v2/tenant.pb.go
+++ b/go/metalstack/api/v2/tenant.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/tenant.proto
 
diff --git a/go/metalstack/api/v2/token.pb.go b/go/metalstack/api/v2/token.pb.go
index 7d2cc683..162a5fbb 100644
--- a/go/metalstack/api/v2/token.pb.go
+++ b/go/metalstack/api/v2/token.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/token.proto
 
@@ -114,7 +114,10 @@ type Token struct {
 	// AdminRole defines the admin role of the token owner
 	AdminRole *AdminRole `protobuf:"varint,11,opt,name=admin_role,json=adminRole,proto3,enum=metalstack.api.v2.AdminRole,oneof" json:"admin_role,omitempty"`
 	// InfraRole defines the infrastructure role of the token owner
-	InfraRole     *InfraRole `protobuf:"varint,12,opt,name=infra_role,json=infraRole,proto3,enum=metalstack.api.v2.InfraRole,oneof" json:"infra_role,omitempty"`
+	InfraRole *InfraRole `protobuf:"varint,12,opt,name=infra_role,json=infraRole,proto3,enum=metalstack.api.v2.InfraRole,oneof" json:"infra_role,omitempty"`
+	// MachineRoles associates a machine uuid with the corresponding role of the token owner
+	// TODO: decide if we need this map from machine.uuid->role, we could instead use the subject in the token instead
+	MachineRoles  map[string]MachineRole `protobuf:"bytes,13,rep,name=machine_roles,json=machineRoles,proto3" json:"machine_roles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value,enum=metalstack.api.v2.MachineRole"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -233,6 +236,13 @@ func (x *Token) GetInfraRole() InfraRole {
 	return InfraRole_INFRA_ROLE_UNSPECIFIED
 }
 
+func (x *Token) GetMachineRoles() map[string]MachineRole {
+	if x != nil {
+		return x.MachineRoles
+	}
+	return nil
+}
+
 // TokenServiceCreateRequest is the request payload to create a token
 type TokenServiceCreateRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -250,8 +260,10 @@ type TokenServiceCreateRequest struct {
 	AdminRole *AdminRole `protobuf:"varint,7,opt,name=admin_role,json=adminRole,proto3,enum=metalstack.api.v2.AdminRole,oneof" json:"admin_role,omitempty"`
 	// InfraRole defines the infrastructure role of the token owner
 	InfraRole *InfraRole `protobuf:"varint,8,opt,name=infra_role,json=infraRole,proto3,enum=metalstack.api.v2.InfraRole,oneof" json:"infra_role,omitempty"`
+	// MachineRoles associates a machine uuid with the corresponding role of the token owner
+	MachineRoles map[string]MachineRole `protobuf:"bytes,9,rep,name=machine_roles,json=machineRoles,proto3" json:"machine_roles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value,enum=metalstack.api.v2.MachineRole"`
 	// Labels on this token
-	Labels        *Labels `protobuf:"bytes,9,opt,name=labels,proto3" json:"labels,omitempty"`
+	Labels        *Labels `protobuf:"bytes,10,opt,name=labels,proto3" json:"labels,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -335,6 +347,13 @@ func (x *TokenServiceCreateRequest) GetInfraRole() InfraRole {
 	return InfraRole_INFRA_ROLE_UNSPECIFIED
 }
 
+func (x *TokenServiceCreateRequest) GetMachineRoles() map[string]MachineRole {
+	if x != nil {
+		return x.MachineRoles
+	}
+	return nil
+}
+
 func (x *TokenServiceCreateRequest) GetLabels() *Labels {
 	if x != nil {
 		return x.Labels
@@ -643,8 +662,10 @@ type TokenServiceUpdateRequest struct {
 	AdminRole *AdminRole `protobuf:"varint,7,opt,name=admin_role,json=adminRole,proto3,enum=metalstack.api.v2.AdminRole,oneof" json:"admin_role,omitempty"`
 	// InfraRole defines the infrastructure role of the token owner
 	InfraRole *InfraRole `protobuf:"varint,8,opt,name=infra_role,json=infraRole,proto3,enum=metalstack.api.v2.InfraRole,oneof" json:"infra_role,omitempty"`
+	// MachineRoles associates a machine uuid with the corresponding role of the token owner
+	MachineRoles map[string]MachineRole `protobuf:"bytes,9,rep,name=machine_roles,json=machineRoles,proto3" json:"machine_roles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value,enum=metalstack.api.v2.MachineRole"`
 	// Labels on this token
-	Labels        *UpdateLabels `protobuf:"bytes,9,opt,name=labels,proto3" json:"labels,omitempty"`
+	Labels        *UpdateLabels `protobuf:"bytes,10,opt,name=labels,proto3" json:"labels,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -735,6 +756,13 @@ func (x *TokenServiceUpdateRequest) GetInfraRole() InfraRole {
 	return InfraRole_INFRA_ROLE_UNSPECIFIED
 }
 
+func (x *TokenServiceUpdateRequest) GetMachineRoles() map[string]MachineRole {
+	if x != nil {
+		return x.MachineRoles
+	}
+	return nil
+}
+
 func (x *TokenServiceUpdateRequest) GetLabels() *UpdateLabels {
 	if x != nil {
 		return x.Labels
@@ -978,7 +1006,8 @@ var File_metalstack_api_v2_token_proto protoreflect.FileDescriptor
 
 const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
-	"\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xe0\b\n" +
+	"\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n" +
+	"\n" +
 	"\x05Token\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n" +
 	"\x04user\x18\x02 \x01(\tB\n" +
@@ -996,16 +1025,20 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
 	"admin_role\x18\v \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
-	"infra_role\x18\f \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x1a_\n" +
+	"infra_role\x18\f \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n" +
+	"\rmachine_roles\x18\r \x03(\v2*.metalstack.api.v2.Token.MachineRolesEntryR\fmachineRoles\x1a_\n" +
 	"\x11ProjectRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x028\x01\x1a]\n" +
 	"\x10TenantRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x123\n" +
-	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01\x1a_\n" +
+	"\x11MachineRolesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n" +
 	"\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n" +
 	"\v_admin_roleB\r\n" +
-	"\v_infra_role\"\x82\a\n" +
+	"\v_infra_role\"\xde\b\n" +
 	"\x19TokenServiceCreateRequest\x12-\n" +
 	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12O\n" +
 	"\vpermissions\x18\x02 \x03(\v2#.metalstack.api.v2.MethodPermissionB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
@@ -1015,14 +1048,19 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
 	"admin_role\x18\a \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
-	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x121\n" +
-	"\x06labels\x18\t \x01(\v2\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n" +
+	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12y\n" +
+	"\rmachine_roles\x18\t \x03(\v2>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fmachineRoles\x121\n" +
+	"\x06labels\x18\n" +
+	" \x01(\v2\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n" +
 	"\x11ProjectRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x028\x01\x1a]\n" +
 	"\x10TenantRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x123\n" +
-	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01B\r\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01\x1a_\n" +
+	"\x11MachineRolesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01B\r\n" +
 	"\v_admin_roleB\r\n" +
 	"\v_infra_role\"[\n" +
 	"\x10MethodPermission\x12\"\n" +
@@ -1036,7 +1074,7 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"9\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n" +
-	"\x1aTokenServiceRevokeResponse\"\xb0\a\n" +
+	"\x1aTokenServiceRevokeResponse\"\x8c\t\n" +
 	"\x19TokenServiceUpdateRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12F\n" +
 	"\vupdate_meta\x18\x02 \x01(\v2\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\n" +
@@ -1048,14 +1086,19 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
 	"admin_role\x18\a \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
-	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x127\n" +
-	"\x06labels\x18\t \x01(\v2\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n" +
+	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12y\n" +
+	"\rmachine_roles\x18\t \x03(\v2>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fmachineRoles\x127\n" +
+	"\x06labels\x18\n" +
+	" \x01(\v2\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n" +
 	"\x11ProjectRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x028\x01\x1a]\n" +
 	"\x10TenantRolesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x123\n" +
-	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01B\x0e\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleR\x05value:\x028\x01\x1a_\n" +
+	"\x11MachineRolesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
+	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01B\x0e\n" +
 	"\f_descriptionB\r\n" +
 	"\v_admin_roleB\r\n" +
 	"\v_infra_role\"L\n" +
@@ -1096,7 +1139,7 @@ func file_metalstack_api_v2_token_proto_rawDescGZIP() []byte {
 }
 
 var file_metalstack_api_v2_token_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_metalstack_api_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
+var file_metalstack_api_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
 var file_metalstack_api_v2_token_proto_goTypes = []any{
 	(TokenType)(0),                      // 0: metalstack.api.v2.TokenType
 	(*Token)(nil),                       // 1: metalstack.api.v2.Token
@@ -1115,73 +1158,83 @@ var file_metalstack_api_v2_token_proto_goTypes = []any{
 	(*TokenServiceRefreshResponse)(nil), // 14: metalstack.api.v2.TokenServiceRefreshResponse
 	nil,                                 // 15: metalstack.api.v2.Token.ProjectRolesEntry
 	nil,                                 // 16: metalstack.api.v2.Token.TenantRolesEntry
-	nil,                                 // 17: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
-	nil,                                 // 18: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
-	nil,                                 // 19: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
-	nil,                                 // 20: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
-	(*Meta)(nil),                        // 21: metalstack.api.v2.Meta
-	(*timestamppb.Timestamp)(nil),       // 22: google.protobuf.Timestamp
-	(AdminRole)(0),                      // 23: metalstack.api.v2.AdminRole
-	(InfraRole)(0),                      // 24: metalstack.api.v2.InfraRole
-	(*durationpb.Duration)(nil),         // 25: google.protobuf.Duration
-	(*Labels)(nil),                      // 26: metalstack.api.v2.Labels
-	(*UpdateMeta)(nil),                  // 27: metalstack.api.v2.UpdateMeta
-	(*UpdateLabels)(nil),                // 28: metalstack.api.v2.UpdateLabels
-	(ProjectRole)(0),                    // 29: metalstack.api.v2.ProjectRole
-	(TenantRole)(0),                     // 30: metalstack.api.v2.TenantRole
+	nil,                                 // 17: metalstack.api.v2.Token.MachineRolesEntry
+	nil,                                 // 18: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
+	nil,                                 // 19: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
+	nil,                                 // 20: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
+	nil,                                 // 21: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
+	nil,                                 // 22: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
+	nil,                                 // 23: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
+	(*Meta)(nil),                        // 24: metalstack.api.v2.Meta
+	(*timestamppb.Timestamp)(nil),       // 25: google.protobuf.Timestamp
+	(AdminRole)(0),                      // 26: metalstack.api.v2.AdminRole
+	(InfraRole)(0),                      // 27: metalstack.api.v2.InfraRole
+	(*durationpb.Duration)(nil),         // 28: google.protobuf.Duration
+	(*Labels)(nil),                      // 29: metalstack.api.v2.Labels
+	(*UpdateMeta)(nil),                  // 30: metalstack.api.v2.UpdateMeta
+	(*UpdateLabels)(nil),                // 31: metalstack.api.v2.UpdateLabels
+	(ProjectRole)(0),                    // 32: metalstack.api.v2.ProjectRole
+	(TenantRole)(0),                     // 33: metalstack.api.v2.TenantRole
+	(MachineRole)(0),                    // 34: metalstack.api.v2.MachineRole
 }
 var file_metalstack_api_v2_token_proto_depIdxs = []int32{
-	21, // 0: metalstack.api.v2.Token.meta:type_name -> metalstack.api.v2.Meta
+	24, // 0: metalstack.api.v2.Token.meta:type_name -> metalstack.api.v2.Meta
 	3,  // 1: metalstack.api.v2.Token.permissions:type_name -> metalstack.api.v2.MethodPermission
-	22, // 2: metalstack.api.v2.Token.expires:type_name -> google.protobuf.Timestamp
-	22, // 3: metalstack.api.v2.Token.issued_at:type_name -> google.protobuf.Timestamp
+	25, // 2: metalstack.api.v2.Token.expires:type_name -> google.protobuf.Timestamp
+	25, // 3: metalstack.api.v2.Token.issued_at:type_name -> google.protobuf.Timestamp
 	0,  // 4: metalstack.api.v2.Token.token_type:type_name -> metalstack.api.v2.TokenType
 	15, // 5: metalstack.api.v2.Token.project_roles:type_name -> metalstack.api.v2.Token.ProjectRolesEntry
 	16, // 6: metalstack.api.v2.Token.tenant_roles:type_name -> metalstack.api.v2.Token.TenantRolesEntry
-	23, // 7: metalstack.api.v2.Token.admin_role:type_name -> metalstack.api.v2.AdminRole
-	24, // 8: metalstack.api.v2.Token.infra_role:type_name -> metalstack.api.v2.InfraRole
-	3,  // 9: metalstack.api.v2.TokenServiceCreateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
-	25, // 10: metalstack.api.v2.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
-	17, // 11: metalstack.api.v2.TokenServiceCreateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
-	18, // 12: metalstack.api.v2.TokenServiceCreateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
-	23, // 13: metalstack.api.v2.TokenServiceCreateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
-	24, // 14: metalstack.api.v2.TokenServiceCreateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
-	26, // 15: metalstack.api.v2.TokenServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
-	1,  // 16: metalstack.api.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 17: metalstack.api.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
-	27, // 18: metalstack.api.v2.TokenServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
-	3,  // 19: metalstack.api.v2.TokenServiceUpdateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
-	19, // 20: metalstack.api.v2.TokenServiceUpdateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
-	20, // 21: metalstack.api.v2.TokenServiceUpdateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
-	23, // 22: metalstack.api.v2.TokenServiceUpdateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
-	24, // 23: metalstack.api.v2.TokenServiceUpdateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
-	28, // 24: metalstack.api.v2.TokenServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
-	1,  // 25: metalstack.api.v2.TokenServiceUpdateResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 26: metalstack.api.v2.TokenServiceGetResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 27: metalstack.api.v2.TokenServiceRefreshResponse.token:type_name -> metalstack.api.v2.Token
-	29, // 28: metalstack.api.v2.Token.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	30, // 29: metalstack.api.v2.Token.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	29, // 30: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	30, // 31: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	29, // 32: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	30, // 33: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	11, // 34: metalstack.api.v2.TokenService.Get:input_type -> metalstack.api.v2.TokenServiceGetRequest
-	2,  // 35: metalstack.api.v2.TokenService.Create:input_type -> metalstack.api.v2.TokenServiceCreateRequest
-	9,  // 36: metalstack.api.v2.TokenService.Update:input_type -> metalstack.api.v2.TokenServiceUpdateRequest
-	5,  // 37: metalstack.api.v2.TokenService.List:input_type -> metalstack.api.v2.TokenServiceListRequest
-	7,  // 38: metalstack.api.v2.TokenService.Revoke:input_type -> metalstack.api.v2.TokenServiceRevokeRequest
-	13, // 39: metalstack.api.v2.TokenService.Refresh:input_type -> metalstack.api.v2.TokenServiceRefreshRequest
-	12, // 40: metalstack.api.v2.TokenService.Get:output_type -> metalstack.api.v2.TokenServiceGetResponse
-	4,  // 41: metalstack.api.v2.TokenService.Create:output_type -> metalstack.api.v2.TokenServiceCreateResponse
-	10, // 42: metalstack.api.v2.TokenService.Update:output_type -> metalstack.api.v2.TokenServiceUpdateResponse
-	6,  // 43: metalstack.api.v2.TokenService.List:output_type -> metalstack.api.v2.TokenServiceListResponse
-	8,  // 44: metalstack.api.v2.TokenService.Revoke:output_type -> metalstack.api.v2.TokenServiceRevokeResponse
-	14, // 45: metalstack.api.v2.TokenService.Refresh:output_type -> metalstack.api.v2.TokenServiceRefreshResponse
-	40, // [40:46] is the sub-list for method output_type
-	34, // [34:40] is the sub-list for method input_type
-	34, // [34:34] is the sub-list for extension type_name
-	34, // [34:34] is the sub-list for extension extendee
-	0,  // [0:34] is the sub-list for field type_name
+	26, // 7: metalstack.api.v2.Token.admin_role:type_name -> metalstack.api.v2.AdminRole
+	27, // 8: metalstack.api.v2.Token.infra_role:type_name -> metalstack.api.v2.InfraRole
+	17, // 9: metalstack.api.v2.Token.machine_roles:type_name -> metalstack.api.v2.Token.MachineRolesEntry
+	3,  // 10: metalstack.api.v2.TokenServiceCreateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
+	28, // 11: metalstack.api.v2.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
+	18, // 12: metalstack.api.v2.TokenServiceCreateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
+	19, // 13: metalstack.api.v2.TokenServiceCreateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
+	26, // 14: metalstack.api.v2.TokenServiceCreateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
+	27, // 15: metalstack.api.v2.TokenServiceCreateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
+	20, // 16: metalstack.api.v2.TokenServiceCreateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
+	29, // 17: metalstack.api.v2.TokenServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	1,  // 18: metalstack.api.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 19: metalstack.api.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
+	30, // 20: metalstack.api.v2.TokenServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
+	3,  // 21: metalstack.api.v2.TokenServiceUpdateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
+	21, // 22: metalstack.api.v2.TokenServiceUpdateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
+	22, // 23: metalstack.api.v2.TokenServiceUpdateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
+	26, // 24: metalstack.api.v2.TokenServiceUpdateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
+	27, // 25: metalstack.api.v2.TokenServiceUpdateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
+	23, // 26: metalstack.api.v2.TokenServiceUpdateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
+	31, // 27: metalstack.api.v2.TokenServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
+	1,  // 28: metalstack.api.v2.TokenServiceUpdateResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 29: metalstack.api.v2.TokenServiceGetResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 30: metalstack.api.v2.TokenServiceRefreshResponse.token:type_name -> metalstack.api.v2.Token
+	32, // 31: metalstack.api.v2.Token.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	33, // 32: metalstack.api.v2.Token.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	34, // 33: metalstack.api.v2.Token.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	32, // 34: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	33, // 35: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	34, // 36: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	32, // 37: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	33, // 38: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	34, // 39: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	11, // 40: metalstack.api.v2.TokenService.Get:input_type -> metalstack.api.v2.TokenServiceGetRequest
+	2,  // 41: metalstack.api.v2.TokenService.Create:input_type -> metalstack.api.v2.TokenServiceCreateRequest
+	9,  // 42: metalstack.api.v2.TokenService.Update:input_type -> metalstack.api.v2.TokenServiceUpdateRequest
+	5,  // 43: metalstack.api.v2.TokenService.List:input_type -> metalstack.api.v2.TokenServiceListRequest
+	7,  // 44: metalstack.api.v2.TokenService.Revoke:input_type -> metalstack.api.v2.TokenServiceRevokeRequest
+	13, // 45: metalstack.api.v2.TokenService.Refresh:input_type -> metalstack.api.v2.TokenServiceRefreshRequest
+	12, // 46: metalstack.api.v2.TokenService.Get:output_type -> metalstack.api.v2.TokenServiceGetResponse
+	4,  // 47: metalstack.api.v2.TokenService.Create:output_type -> metalstack.api.v2.TokenServiceCreateResponse
+	10, // 48: metalstack.api.v2.TokenService.Update:output_type -> metalstack.api.v2.TokenServiceUpdateResponse
+	6,  // 49: metalstack.api.v2.TokenService.List:output_type -> metalstack.api.v2.TokenServiceListResponse
+	8,  // 50: metalstack.api.v2.TokenService.Revoke:output_type -> metalstack.api.v2.TokenServiceRevokeResponse
+	14, // 51: metalstack.api.v2.TokenService.Refresh:output_type -> metalstack.api.v2.TokenServiceRefreshResponse
+	46, // [46:52] is the sub-list for method output_type
+	40, // [40:46] is the sub-list for method input_type
+	40, // [40:40] is the sub-list for extension type_name
+	40, // [40:40] is the sub-list for extension extendee
+	0,  // [0:40] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_api_v2_token_proto_init() }
@@ -1200,7 +1253,7 @@ func file_metalstack_api_v2_token_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_token_proto_rawDesc), len(file_metalstack_api_v2_token_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   20,
+			NumMessages:   23,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/metalstack/api/v2/user.pb.go b/go/metalstack/api/v2/user.pb.go
index fe5ee97b..05db8018 100644
--- a/go/metalstack/api/v2/user.pb.go
+++ b/go/metalstack/api/v2/user.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/user.proto
 
diff --git a/go/metalstack/api/v2/version.pb.go b/go/metalstack/api/v2/version.pb.go
index d963a4d4..846b3fe9 100644
--- a/go/metalstack/api/v2/version.pb.go
+++ b/go/metalstack/api/v2/version.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/api/v2/version.proto
 
diff --git a/go/metalstack/infra/v2/bmc.pb.go b/go/metalstack/infra/v2/bmc.pb.go
index a9842bb5..f5457b09 100644
--- a/go/metalstack/infra/v2/bmc.pb.go
+++ b/go/metalstack/infra/v2/bmc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/infra/v2/bmc.proto
 
diff --git a/go/metalstack/infra/v2/boot.pb.go b/go/metalstack/infra/v2/boot.pb.go
new file mode 100644
index 00000000..1c0a2a75
--- /dev/null
+++ b/go/metalstack/infra/v2/boot.pb.go
@@ -0,0 +1,842 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: metalstack/infra/v2/boot.proto
+
+package infrav2
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// BootServiceDhcpRequest is called once a machine issues a dhcp request
+type BootServiceDhcpRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of the machine
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Partition where this machine is located
+	Partition     string `protobuf:"bytes,2,opt,name=partition,proto3" json:"partition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceDhcpRequest) Reset() {
+	*x = BootServiceDhcpRequest{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceDhcpRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceDhcpRequest) ProtoMessage() {}
+
+func (x *BootServiceDhcpRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceDhcpRequest.ProtoReflect.Descriptor instead.
+func (*BootServiceDhcpRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *BootServiceDhcpRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *BootServiceDhcpRequest) GetPartition() string {
+	if x != nil {
+		return x.Partition
+	}
+	return ""
+}
+
+// BootServiceDhcpResponse contains the response to a dhcp request
+type BootServiceDhcpResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceDhcpResponse) Reset() {
+	*x = BootServiceDhcpResponse{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceDhcpResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceDhcpResponse) ProtoMessage() {}
+
+func (x *BootServiceDhcpResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceDhcpResponse.ProtoReflect.Descriptor instead.
+func (*BootServiceDhcpResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{1}
+}
+
+// BootServiceBootRequest is called to get specified parameters to boot a machine with the given mac
+type BootServiceBootRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Mac address of the machine
+	Mac string `protobuf:"bytes,1,opt,name=mac,proto3" json:"mac,omitempty"`
+	// Partition where this machine is located
+	Partition     string `protobuf:"bytes,2,opt,name=partition,proto3" json:"partition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceBootRequest) Reset() {
+	*x = BootServiceBootRequest{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceBootRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceBootRequest) ProtoMessage() {}
+
+func (x *BootServiceBootRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceBootRequest.ProtoReflect.Descriptor instead.
+func (*BootServiceBootRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *BootServiceBootRequest) GetMac() string {
+	if x != nil {
+		return x.Mac
+	}
+	return ""
+}
+
+func (x *BootServiceBootRequest) GetPartition() string {
+	if x != nil {
+		return x.Partition
+	}
+	return ""
+}
+
+// BootServiceBootResponse contains additional infos which are required to boot a machine
+type BootServiceBootResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Kernel is the url to the linux kernel to boot
+	Kernel string `protobuf:"bytes,1,opt,name=kernel,proto3" json:"kernel,omitempty"`
+	// Initial ram disk is the url to the initial ram disk to boot
+	InitRamDisks []string `protobuf:"bytes,2,rep,name=init_ram_disks,json=initRamDisks,proto3" json:"init_ram_disks,omitempty"`
+	// CMDLine contains kernel command line parameters to boot
+	Cmdline       *string `protobuf:"bytes,3,opt,name=cmdline,proto3,oneof" json:"cmdline,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceBootResponse) Reset() {
+	*x = BootServiceBootResponse{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceBootResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceBootResponse) ProtoMessage() {}
+
+func (x *BootServiceBootResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceBootResponse.ProtoReflect.Descriptor instead.
+func (*BootServiceBootResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *BootServiceBootResponse) GetKernel() string {
+	if x != nil {
+		return x.Kernel
+	}
+	return ""
+}
+
+func (x *BootServiceBootResponse) GetInitRamDisks() []string {
+	if x != nil {
+		return x.InitRamDisks
+	}
+	return nil
+}
+
+func (x *BootServiceBootResponse) GetCmdline() string {
+	if x != nil && x.Cmdline != nil {
+		return *x.Cmdline
+	}
+	return ""
+}
+
+// BootServiceRegisterRequest is called from metal-hammer to register a machine with as much hardware details as possible
+type BootServiceRegisterRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of this machine
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Hardware details of this machine
+	Hardware *v2.MachineHardware `protobuf:"bytes,2,opt,name=hardware,proto3" json:"hardware,omitempty"`
+	// Bios details of this machine
+	Bios *v2.MachineBios `protobuf:"bytes,3,opt,name=bios,proto3" json:"bios,omitempty"`
+	// IPMI details of this machine
+	Ipmi *v2.MachineIPMI `protobuf:"bytes,4,opt,name=ipmi,proto3" json:"ipmi,omitempty"`
+	// Tags of this machine
+	Tags []string `protobuf:"bytes,5,rep,name=tags,proto3" json:"tags,omitempty"`
+	// MetalHammer version this machine was bootet into
+	MetalHammerVersion string `protobuf:"bytes,6,opt,name=metal_hammer_version,json=metalHammerVersion,proto3" json:"metal_hammer_version,omitempty"`
+	// Partition where this machine is located
+	Partition     string `protobuf:"bytes,7,opt,name=partition,proto3" json:"partition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceRegisterRequest) Reset() {
+	*x = BootServiceRegisterRequest{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceRegisterRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceRegisterRequest) ProtoMessage() {}
+
+func (x *BootServiceRegisterRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceRegisterRequest.ProtoReflect.Descriptor instead.
+func (*BootServiceRegisterRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *BootServiceRegisterRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *BootServiceRegisterRequest) GetHardware() *v2.MachineHardware {
+	if x != nil {
+		return x.Hardware
+	}
+	return nil
+}
+
+func (x *BootServiceRegisterRequest) GetBios() *v2.MachineBios {
+	if x != nil {
+		return x.Bios
+	}
+	return nil
+}
+
+func (x *BootServiceRegisterRequest) GetIpmi() *v2.MachineIPMI {
+	if x != nil {
+		return x.Ipmi
+	}
+	return nil
+}
+
+func (x *BootServiceRegisterRequest) GetTags() []string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *BootServiceRegisterRequest) GetMetalHammerVersion() string {
+	if x != nil {
+		return x.MetalHammerVersion
+	}
+	return ""
+}
+
+func (x *BootServiceRegisterRequest) GetPartition() string {
+	if x != nil {
+		return x.Partition
+	}
+	return ""
+}
+
+// BootServiceRegisterResponse response to a BootServiceRegisterResponse request
+type BootServiceRegisterResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of this machine
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Size is the calculated size from given hardware details
+	Size string `protobuf:"bytes,2,opt,name=size,proto3" json:"size,omitempty"`
+	// Partition of this machine
+	Partition     string `protobuf:"bytes,3,opt,name=partition,proto3" json:"partition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceRegisterResponse) Reset() {
+	*x = BootServiceRegisterResponse{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceRegisterResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceRegisterResponse) ProtoMessage() {}
+
+func (x *BootServiceRegisterResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceRegisterResponse.ProtoReflect.Descriptor instead.
+func (*BootServiceRegisterResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *BootServiceRegisterResponse) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *BootServiceRegisterResponse) GetSize() string {
+	if x != nil {
+		return x.Size
+	}
+	return ""
+}
+
+func (x *BootServiceRegisterResponse) GetPartition() string {
+	if x != nil {
+		return x.Partition
+	}
+	return ""
+}
+
+// BootServiceWaitRequest is called when a machine was registered and is waiting for allocation
+type BootServiceWaitRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of this machine
+	Uuid          string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceWaitRequest) Reset() {
+	*x = BootServiceWaitRequest{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceWaitRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceWaitRequest) ProtoMessage() {}
+
+func (x *BootServiceWaitRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceWaitRequest.ProtoReflect.Descriptor instead.
+func (*BootServiceWaitRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *BootServiceWaitRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+// BootServiceWaitResponse response to a wait request
+type BootServiceWaitResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Allocation contains the machine.allocation to actually install the machine
+	Allocation    *v2.MachineAllocation `protobuf:"bytes,1,opt,name=allocation,proto3" json:"allocation,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceWaitResponse) Reset() {
+	*x = BootServiceWaitResponse{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceWaitResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceWaitResponse) ProtoMessage() {}
+
+func (x *BootServiceWaitResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceWaitResponse.ProtoReflect.Descriptor instead.
+func (*BootServiceWaitResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *BootServiceWaitResponse) GetAllocation() *v2.MachineAllocation {
+	if x != nil {
+		return x.Allocation
+	}
+	return nil
+}
+
+// BootServiceReportRequest is sent from metal-hammer to the api to report the outcome of the register
+type BootServiceReportRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of the machine to boot
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Console_Password
+	ConsolePassword string `protobuf:"bytes,2,opt,name=console_password,json=consolePassword,proto3" json:"console_password,omitempty"`
+	// Success is set to true of the allocation succeeded
+	Success bool `protobuf:"varint,4,opt,name=success,proto3" json:"success,omitempty"`
+	// Message contains additional information if installation failed
+	Message       string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceReportRequest) Reset() {
+	*x = BootServiceReportRequest{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceReportRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceReportRequest) ProtoMessage() {}
+
+func (x *BootServiceReportRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceReportRequest.ProtoReflect.Descriptor instead.
+func (*BootServiceReportRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *BootServiceReportRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *BootServiceReportRequest) GetConsolePassword() string {
+	if x != nil {
+		return x.ConsolePassword
+	}
+	return ""
+}
+
+func (x *BootServiceReportRequest) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
+func (x *BootServiceReportRequest) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+// BootServiceReportRequest is the response to a BootServiceReportRequest
+type BootServiceReportResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceReportResponse) Reset() {
+	*x = BootServiceReportResponse{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceReportResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceReportResponse) ProtoMessage() {}
+
+func (x *BootServiceReportResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceReportResponse.ProtoReflect.Descriptor instead.
+func (*BootServiceReportResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{9}
+}
+
+// BootServiceSuperUserPasswordRequest this call returns the password for the machine superuser
+type BootServiceSuperUserPasswordRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of this machine
+	Uuid          string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BootServiceSuperUserPasswordRequest) Reset() {
+	*x = BootServiceSuperUserPasswordRequest{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceSuperUserPasswordRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceSuperUserPasswordRequest) ProtoMessage() {}
+
+func (x *BootServiceSuperUserPasswordRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceSuperUserPasswordRequest.ProtoReflect.Descriptor instead.
+func (*BootServiceSuperUserPasswordRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *BootServiceSuperUserPasswordRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+// BootServiceSuperUserPasswordResponse the super user password is returned
+type BootServiceSuperUserPasswordResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// FeatureDisable FIXME
+	FeatureDisabled bool `protobuf:"varint,1,opt,name=feature_disabled,json=featureDisabled,proto3" json:"feature_disabled,omitempty"`
+	// SuperUserPassword is the password of the superuser on the ipmi device
+	SuperUserPassword string `protobuf:"bytes,2,opt,name=super_user_password,json=superUserPassword,proto3" json:"super_user_password,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *BootServiceSuperUserPasswordResponse) Reset() {
+	*x = BootServiceSuperUserPasswordResponse{}
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BootServiceSuperUserPasswordResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootServiceSuperUserPasswordResponse) ProtoMessage() {}
+
+func (x *BootServiceSuperUserPasswordResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_boot_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootServiceSuperUserPasswordResponse.ProtoReflect.Descriptor instead.
+func (*BootServiceSuperUserPasswordResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_boot_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *BootServiceSuperUserPasswordResponse) GetFeatureDisabled() bool {
+	if x != nil {
+		return x.FeatureDisabled
+	}
+	return false
+}
+
+func (x *BootServiceSuperUserPasswordResponse) GetSuperUserPassword() string {
+	if x != nil {
+		return x.SuperUserPassword
+	}
+	return ""
+}
+
+var File_metalstack_infra_v2_boot_proto protoreflect.FileDescriptor
+
+const file_metalstack_infra_v2_boot_proto_rawDesc = "" +
+	"\n" +
+	"\x1emetalstack/infra/v2/boot.proto\x12\x13metalstack.infra.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\x1a(metalstack/api/v2/predefined_rules.proto\"a\n" +
+	"\x16BootServiceDhcpRequest\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12)\n" +
+	"\tpartition\x18\x02 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\tpartition\"\x19\n" +
+	"\x17BootServiceDhcpResponse\"b\n" +
+	"\x16BootServiceBootRequest\x12\x1d\n" +
+	"\x03mac\x18\x01 \x01(\tB\v\xbaH\br\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12)\n" +
+	"\tpartition\x18\x02 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\tpartition\"\x9c\x01\n" +
+	"\x17BootServiceBootResponse\x12#\n" +
+	"\x06kernel\x18\x01 \x01(\tB\v\xbaH\br\x06೮\xb1\x02\x01R\x06kernel\x12$\n" +
+	"\x0einit_ram_disks\x18\x02 \x03(\tR\finitRamDisks\x12*\n" +
+	"\acmdline\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\acmdline\x88\x01\x01B\n" +
+	"\n" +
+	"\b_cmdline\"\xe0\x02\n" +
+	"\x1aBootServiceRegisterRequest\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12>\n" +
+	"\bhardware\x18\x02 \x01(\v2\".metalstack.api.v2.MachineHardwareR\bhardware\x122\n" +
+	"\x04bios\x18\x03 \x01(\v2\x1e.metalstack.api.v2.MachineBiosR\x04bios\x122\n" +
+	"\x04ipmi\x18\x04 \x01(\v2\x1e.metalstack.api.v2.MachineIPMIR\x04ipmi\x12\x12\n" +
+	"\x04tags\x18\x05 \x03(\tR\x04tags\x12=\n" +
+	"\x14metal_hammer_version\x18\x06 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\x12metalHammerVersion\x12)\n" +
+	"\tpartition\x18\a \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\tpartition\"\x87\x01\n" +
+	"\x1bBootServiceRegisterResponse\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n" +
+	"\x04size\x18\x02 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\x04size\x12)\n" +
+	"\tpartition\x18\x03 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\tpartition\"6\n" +
+	"\x16BootServiceWaitRequest\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"_\n" +
+	"\x17BootServiceWaitResponse\x12D\n" +
+	"\n" +
+	"allocation\x18\x01 \x01(\v2$.metalstack.api.v2.MachineAllocationR\n" +
+	"allocation\"\xaf\x01\n" +
+	"\x18BootServiceReportRequest\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x125\n" +
+	"\x10console_password\x18\x02 \x01(\tB\n" +
+	"\xbaH\ar\x05\x10\x02\x18\x80\x01R\x0fconsolePassword\x12\x18\n" +
+	"\asuccess\x18\x04 \x01(\bR\asuccess\x12$\n" +
+	"\amessage\x18\x05 \x01(\tB\n" +
+	"\xbaH\ar\x05\x10\x02\x18\x80\x04R\amessage\"\x1b\n" +
+	"\x19BootServiceReportResponse\"C\n" +
+	"#BootServiceSuperUserPasswordRequest\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x8d\x01\n" +
+	"$BootServiceSuperUserPasswordResponse\x12)\n" +
+	"\x10feature_disabled\x18\x01 \x01(\bR\x0ffeatureDisabled\x12:\n" +
+	"\x13super_user_password\x18\x02 \x01(\tB\n" +
+	"\xbaH\ar\x05\x10\x02\x18\x80\x01R\x11superUserPassword2\xde\x05\n" +
+	"\vBootService\x12l\n" +
+	"\x04Dhcp\x12+.metalstack.infra.v2.BootServiceDhcpRequest\x1a,.metalstack.infra.v2.BootServiceDhcpResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x12m\n" +
+	"\x04Boot\x12+.metalstack.infra.v2.BootServiceBootRequest\x1a,.metalstack.infra.v2.BootServiceBootResponse\"\n" +
+	"\xe0\xf3\x18\x02\xea\xf3\x18\x02\x01\x02\x12\x93\x01\n" +
+	"\x11SuperUserPassword\x128.metalstack.infra.v2.BootServiceSuperUserPasswordRequest\x1a9.metalstack.infra.v2.BootServiceSuperUserPasswordResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01\x12x\n" +
+	"\bRegister\x12/.metalstack.infra.v2.BootServiceRegisterRequest\x1a0.metalstack.infra.v2.BootServiceRegisterResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01\x12n\n" +
+	"\x04Wait\x12+.metalstack.infra.v2.BootServiceWaitRequest\x1a,.metalstack.infra.v2.BootServiceWaitResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x010\x01\x12r\n" +
+	"\x06Report\x12-.metalstack.infra.v2.BootServiceReportRequest\x1a..metalstack.infra.v2.BootServiceReportResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01B\xcd\x01\n" +
+	"\x17com.metalstack.infra.v2B\tBootProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3"
+
+var (
+	file_metalstack_infra_v2_boot_proto_rawDescOnce sync.Once
+	file_metalstack_infra_v2_boot_proto_rawDescData []byte
+)
+
+func file_metalstack_infra_v2_boot_proto_rawDescGZIP() []byte {
+	file_metalstack_infra_v2_boot_proto_rawDescOnce.Do(func() {
+		file_metalstack_infra_v2_boot_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metalstack_infra_v2_boot_proto_rawDesc), len(file_metalstack_infra_v2_boot_proto_rawDesc)))
+	})
+	return file_metalstack_infra_v2_boot_proto_rawDescData
+}
+
+var file_metalstack_infra_v2_boot_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_metalstack_infra_v2_boot_proto_goTypes = []any{
+	(*BootServiceDhcpRequest)(nil),               // 0: metalstack.infra.v2.BootServiceDhcpRequest
+	(*BootServiceDhcpResponse)(nil),              // 1: metalstack.infra.v2.BootServiceDhcpResponse
+	(*BootServiceBootRequest)(nil),               // 2: metalstack.infra.v2.BootServiceBootRequest
+	(*BootServiceBootResponse)(nil),              // 3: metalstack.infra.v2.BootServiceBootResponse
+	(*BootServiceRegisterRequest)(nil),           // 4: metalstack.infra.v2.BootServiceRegisterRequest
+	(*BootServiceRegisterResponse)(nil),          // 5: metalstack.infra.v2.BootServiceRegisterResponse
+	(*BootServiceWaitRequest)(nil),               // 6: metalstack.infra.v2.BootServiceWaitRequest
+	(*BootServiceWaitResponse)(nil),              // 7: metalstack.infra.v2.BootServiceWaitResponse
+	(*BootServiceReportRequest)(nil),             // 8: metalstack.infra.v2.BootServiceReportRequest
+	(*BootServiceReportResponse)(nil),            // 9: metalstack.infra.v2.BootServiceReportResponse
+	(*BootServiceSuperUserPasswordRequest)(nil),  // 10: metalstack.infra.v2.BootServiceSuperUserPasswordRequest
+	(*BootServiceSuperUserPasswordResponse)(nil), // 11: metalstack.infra.v2.BootServiceSuperUserPasswordResponse
+	(*v2.MachineHardware)(nil),                   // 12: metalstack.api.v2.MachineHardware
+	(*v2.MachineBios)(nil),                       // 13: metalstack.api.v2.MachineBios
+	(*v2.MachineIPMI)(nil),                       // 14: metalstack.api.v2.MachineIPMI
+	(*v2.MachineAllocation)(nil),                 // 15: metalstack.api.v2.MachineAllocation
+}
+var file_metalstack_infra_v2_boot_proto_depIdxs = []int32{
+	12, // 0: metalstack.infra.v2.BootServiceRegisterRequest.hardware:type_name -> metalstack.api.v2.MachineHardware
+	13, // 1: metalstack.infra.v2.BootServiceRegisterRequest.bios:type_name -> metalstack.api.v2.MachineBios
+	14, // 2: metalstack.infra.v2.BootServiceRegisterRequest.ipmi:type_name -> metalstack.api.v2.MachineIPMI
+	15, // 3: metalstack.infra.v2.BootServiceWaitResponse.allocation:type_name -> metalstack.api.v2.MachineAllocation
+	0,  // 4: metalstack.infra.v2.BootService.Dhcp:input_type -> metalstack.infra.v2.BootServiceDhcpRequest
+	2,  // 5: metalstack.infra.v2.BootService.Boot:input_type -> metalstack.infra.v2.BootServiceBootRequest
+	10, // 6: metalstack.infra.v2.BootService.SuperUserPassword:input_type -> metalstack.infra.v2.BootServiceSuperUserPasswordRequest
+	4,  // 7: metalstack.infra.v2.BootService.Register:input_type -> metalstack.infra.v2.BootServiceRegisterRequest
+	6,  // 8: metalstack.infra.v2.BootService.Wait:input_type -> metalstack.infra.v2.BootServiceWaitRequest
+	8,  // 9: metalstack.infra.v2.BootService.Report:input_type -> metalstack.infra.v2.BootServiceReportRequest
+	1,  // 10: metalstack.infra.v2.BootService.Dhcp:output_type -> metalstack.infra.v2.BootServiceDhcpResponse
+	3,  // 11: metalstack.infra.v2.BootService.Boot:output_type -> metalstack.infra.v2.BootServiceBootResponse
+	11, // 12: metalstack.infra.v2.BootService.SuperUserPassword:output_type -> metalstack.infra.v2.BootServiceSuperUserPasswordResponse
+	5,  // 13: metalstack.infra.v2.BootService.Register:output_type -> metalstack.infra.v2.BootServiceRegisterResponse
+	7,  // 14: metalstack.infra.v2.BootService.Wait:output_type -> metalstack.infra.v2.BootServiceWaitResponse
+	9,  // 15: metalstack.infra.v2.BootService.Report:output_type -> metalstack.infra.v2.BootServiceReportResponse
+	10, // [10:16] is the sub-list for method output_type
+	4,  // [4:10] is the sub-list for method input_type
+	4,  // [4:4] is the sub-list for extension type_name
+	4,  // [4:4] is the sub-list for extension extendee
+	0,  // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_metalstack_infra_v2_boot_proto_init() }
+func file_metalstack_infra_v2_boot_proto_init() {
+	if File_metalstack_infra_v2_boot_proto != nil {
+		return
+	}
+	file_metalstack_infra_v2_boot_proto_msgTypes[3].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_infra_v2_boot_proto_rawDesc), len(file_metalstack_infra_v2_boot_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   12,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_metalstack_infra_v2_boot_proto_goTypes,
+		DependencyIndexes: file_metalstack_infra_v2_boot_proto_depIdxs,
+		MessageInfos:      file_metalstack_infra_v2_boot_proto_msgTypes,
+	}.Build()
+	File_metalstack_infra_v2_boot_proto = out.File
+	file_metalstack_infra_v2_boot_proto_goTypes = nil
+	file_metalstack_infra_v2_boot_proto_depIdxs = nil
+}
diff --git a/go/metalstack/infra/v2/event.pb.go b/go/metalstack/infra/v2/event.pb.go
index 90118aeb..353e7029 100644
--- a/go/metalstack/infra/v2/event.pb.go
+++ b/go/metalstack/infra/v2/event.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/infra/v2/event.proto
 
diff --git a/go/metalstack/infra/v2/infrav2connect/boot.connect.go b/go/metalstack/infra/v2/infrav2connect/boot.connect.go
new file mode 100644
index 00000000..c89fa64d
--- /dev/null
+++ b/go/metalstack/infra/v2/infrav2connect/boot.connect.go
@@ -0,0 +1,281 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: metalstack/infra/v2/boot.proto
+
+package infrav2connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v2 "github.com/metal-stack/api/go/metalstack/infra/v2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// BootServiceName is the fully-qualified name of the BootService service.
+	BootServiceName = "metalstack.infra.v2.BootService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// BootServiceDhcpProcedure is the fully-qualified name of the BootService's Dhcp RPC.
+	BootServiceDhcpProcedure = "/metalstack.infra.v2.BootService/Dhcp"
+	// BootServiceBootProcedure is the fully-qualified name of the BootService's Boot RPC.
+	BootServiceBootProcedure = "/metalstack.infra.v2.BootService/Boot"
+	// BootServiceSuperUserPasswordProcedure is the fully-qualified name of the BootService's
+	// SuperUserPassword RPC.
+	BootServiceSuperUserPasswordProcedure = "/metalstack.infra.v2.BootService/SuperUserPassword"
+	// BootServiceRegisterProcedure is the fully-qualified name of the BootService's Register RPC.
+	BootServiceRegisterProcedure = "/metalstack.infra.v2.BootService/Register"
+	// BootServiceWaitProcedure is the fully-qualified name of the BootService's Wait RPC.
+	BootServiceWaitProcedure = "/metalstack.infra.v2.BootService/Wait"
+	// BootServiceReportProcedure is the fully-qualified name of the BootService's Report RPC.
+	BootServiceReportProcedure = "/metalstack.infra.v2.BootService/Report"
+)
+
+// BootServiceClient is a client for the metalstack.infra.v2.BootService service.
+type BootServiceClient interface {
+	// Dhcp is the first dhcp request (option 97). A ProvisioningEventPXEBooting is fired
+	Dhcp(context.Context, *v2.BootServiceDhcpRequest) (*v2.BootServiceDhcpResponse, error)
+	// Boot is called from pixie once the machine got the first dhcp response and ipxie asks for subsequent kernel and initrd
+	Boot(context.Context, *v2.BootServiceBootRequest) (*v2.BootServiceBootResponse, error)
+	// SuperUserPassword metal-hammer takes the configured root password for the bmc from metal-api and configure the bmc accordingly
+	SuperUserPassword(context.Context, *v2.BootServiceSuperUserPasswordRequest) (*v2.BootServiceSuperUserPasswordResponse, error)
+	// Register is called from metal-hammer after hardware inventory is finished, tells metal-api all glory details about that machine
+	Register(context.Context, *v2.BootServiceRegisterRequest) (*v2.BootServiceRegisterResponse, error)
+	// Wait is a hanging call that waits until the machine gets allocated by a user
+	Wait(context.Context, *v2.BootServiceWaitRequest) (*connect.ServerStreamForClient[v2.BootServiceWaitResponse], error)
+	// Report tells metal-api installation was either successful or failed
+	Report(context.Context, *v2.BootServiceReportRequest) (*v2.BootServiceReportResponse, error)
+}
+
+// NewBootServiceClient constructs a client for the metalstack.infra.v2.BootService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewBootServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) BootServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	bootServiceMethods := v2.File_metalstack_infra_v2_boot_proto.Services().ByName("BootService").Methods()
+	return &bootServiceClient{
+		dhcp: connect.NewClient[v2.BootServiceDhcpRequest, v2.BootServiceDhcpResponse](
+			httpClient,
+			baseURL+BootServiceDhcpProcedure,
+			connect.WithSchema(bootServiceMethods.ByName("Dhcp")),
+			connect.WithClientOptions(opts...),
+		),
+		boot: connect.NewClient[v2.BootServiceBootRequest, v2.BootServiceBootResponse](
+			httpClient,
+			baseURL+BootServiceBootProcedure,
+			connect.WithSchema(bootServiceMethods.ByName("Boot")),
+			connect.WithClientOptions(opts...),
+		),
+		superUserPassword: connect.NewClient[v2.BootServiceSuperUserPasswordRequest, v2.BootServiceSuperUserPasswordResponse](
+			httpClient,
+			baseURL+BootServiceSuperUserPasswordProcedure,
+			connect.WithSchema(bootServiceMethods.ByName("SuperUserPassword")),
+			connect.WithClientOptions(opts...),
+		),
+		register: connect.NewClient[v2.BootServiceRegisterRequest, v2.BootServiceRegisterResponse](
+			httpClient,
+			baseURL+BootServiceRegisterProcedure,
+			connect.WithSchema(bootServiceMethods.ByName("Register")),
+			connect.WithClientOptions(opts...),
+		),
+		wait: connect.NewClient[v2.BootServiceWaitRequest, v2.BootServiceWaitResponse](
+			httpClient,
+			baseURL+BootServiceWaitProcedure,
+			connect.WithSchema(bootServiceMethods.ByName("Wait")),
+			connect.WithClientOptions(opts...),
+		),
+		report: connect.NewClient[v2.BootServiceReportRequest, v2.BootServiceReportResponse](
+			httpClient,
+			baseURL+BootServiceReportProcedure,
+			connect.WithSchema(bootServiceMethods.ByName("Report")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// bootServiceClient implements BootServiceClient.
+type bootServiceClient struct {
+	dhcp              *connect.Client[v2.BootServiceDhcpRequest, v2.BootServiceDhcpResponse]
+	boot              *connect.Client[v2.BootServiceBootRequest, v2.BootServiceBootResponse]
+	superUserPassword *connect.Client[v2.BootServiceSuperUserPasswordRequest, v2.BootServiceSuperUserPasswordResponse]
+	register          *connect.Client[v2.BootServiceRegisterRequest, v2.BootServiceRegisterResponse]
+	wait              *connect.Client[v2.BootServiceWaitRequest, v2.BootServiceWaitResponse]
+	report            *connect.Client[v2.BootServiceReportRequest, v2.BootServiceReportResponse]
+}
+
+// Dhcp calls metalstack.infra.v2.BootService.Dhcp.
+func (c *bootServiceClient) Dhcp(ctx context.Context, req *v2.BootServiceDhcpRequest) (*v2.BootServiceDhcpResponse, error) {
+	response, err := c.dhcp.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// Boot calls metalstack.infra.v2.BootService.Boot.
+func (c *bootServiceClient) Boot(ctx context.Context, req *v2.BootServiceBootRequest) (*v2.BootServiceBootResponse, error) {
+	response, err := c.boot.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// SuperUserPassword calls metalstack.infra.v2.BootService.SuperUserPassword.
+func (c *bootServiceClient) SuperUserPassword(ctx context.Context, req *v2.BootServiceSuperUserPasswordRequest) (*v2.BootServiceSuperUserPasswordResponse, error) {
+	response, err := c.superUserPassword.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// Register calls metalstack.infra.v2.BootService.Register.
+func (c *bootServiceClient) Register(ctx context.Context, req *v2.BootServiceRegisterRequest) (*v2.BootServiceRegisterResponse, error) {
+	response, err := c.register.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// Wait calls metalstack.infra.v2.BootService.Wait.
+func (c *bootServiceClient) Wait(ctx context.Context, req *v2.BootServiceWaitRequest) (*connect.ServerStreamForClient[v2.BootServiceWaitResponse], error) {
+	return c.wait.CallServerStream(ctx, connect.NewRequest(req))
+}
+
+// Report calls metalstack.infra.v2.BootService.Report.
+func (c *bootServiceClient) Report(ctx context.Context, req *v2.BootServiceReportRequest) (*v2.BootServiceReportResponse, error) {
+	response, err := c.report.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// BootServiceHandler is an implementation of the metalstack.infra.v2.BootService service.
+type BootServiceHandler interface {
+	// Dhcp is the first dhcp request (option 97). A ProvisioningEventPXEBooting is fired
+	Dhcp(context.Context, *v2.BootServiceDhcpRequest) (*v2.BootServiceDhcpResponse, error)
+	// Boot is called from pixie once the machine got the first dhcp response and ipxie asks for subsequent kernel and initrd
+	Boot(context.Context, *v2.BootServiceBootRequest) (*v2.BootServiceBootResponse, error)
+	// SuperUserPassword metal-hammer takes the configured root password for the bmc from metal-api and configure the bmc accordingly
+	SuperUserPassword(context.Context, *v2.BootServiceSuperUserPasswordRequest) (*v2.BootServiceSuperUserPasswordResponse, error)
+	// Register is called from metal-hammer after hardware inventory is finished, tells metal-api all glory details about that machine
+	Register(context.Context, *v2.BootServiceRegisterRequest) (*v2.BootServiceRegisterResponse, error)
+	// Wait is a hanging call that waits until the machine gets allocated by a user
+	Wait(context.Context, *v2.BootServiceWaitRequest, *connect.ServerStream[v2.BootServiceWaitResponse]) error
+	// Report tells metal-api installation was either successful or failed
+	Report(context.Context, *v2.BootServiceReportRequest) (*v2.BootServiceReportResponse, error)
+}
+
+// NewBootServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewBootServiceHandler(svc BootServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	bootServiceMethods := v2.File_metalstack_infra_v2_boot_proto.Services().ByName("BootService").Methods()
+	bootServiceDhcpHandler := connect.NewUnaryHandlerSimple(
+		BootServiceDhcpProcedure,
+		svc.Dhcp,
+		connect.WithSchema(bootServiceMethods.ByName("Dhcp")),
+		connect.WithHandlerOptions(opts...),
+	)
+	bootServiceBootHandler := connect.NewUnaryHandlerSimple(
+		BootServiceBootProcedure,
+		svc.Boot,
+		connect.WithSchema(bootServiceMethods.ByName("Boot")),
+		connect.WithHandlerOptions(opts...),
+	)
+	bootServiceSuperUserPasswordHandler := connect.NewUnaryHandlerSimple(
+		BootServiceSuperUserPasswordProcedure,
+		svc.SuperUserPassword,
+		connect.WithSchema(bootServiceMethods.ByName("SuperUserPassword")),
+		connect.WithHandlerOptions(opts...),
+	)
+	bootServiceRegisterHandler := connect.NewUnaryHandlerSimple(
+		BootServiceRegisterProcedure,
+		svc.Register,
+		connect.WithSchema(bootServiceMethods.ByName("Register")),
+		connect.WithHandlerOptions(opts...),
+	)
+	bootServiceWaitHandler := connect.NewServerStreamHandlerSimple(
+		BootServiceWaitProcedure,
+		svc.Wait,
+		connect.WithSchema(bootServiceMethods.ByName("Wait")),
+		connect.WithHandlerOptions(opts...),
+	)
+	bootServiceReportHandler := connect.NewUnaryHandlerSimple(
+		BootServiceReportProcedure,
+		svc.Report,
+		connect.WithSchema(bootServiceMethods.ByName("Report")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/metalstack.infra.v2.BootService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case BootServiceDhcpProcedure:
+			bootServiceDhcpHandler.ServeHTTP(w, r)
+		case BootServiceBootProcedure:
+			bootServiceBootHandler.ServeHTTP(w, r)
+		case BootServiceSuperUserPasswordProcedure:
+			bootServiceSuperUserPasswordHandler.ServeHTTP(w, r)
+		case BootServiceRegisterProcedure:
+			bootServiceRegisterHandler.ServeHTTP(w, r)
+		case BootServiceWaitProcedure:
+			bootServiceWaitHandler.ServeHTTP(w, r)
+		case BootServiceReportProcedure:
+			bootServiceReportHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedBootServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedBootServiceHandler struct{}
+
+func (UnimplementedBootServiceHandler) Dhcp(context.Context, *v2.BootServiceDhcpRequest) (*v2.BootServiceDhcpResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BootService.Dhcp is not implemented"))
+}
+
+func (UnimplementedBootServiceHandler) Boot(context.Context, *v2.BootServiceBootRequest) (*v2.BootServiceBootResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BootService.Boot is not implemented"))
+}
+
+func (UnimplementedBootServiceHandler) SuperUserPassword(context.Context, *v2.BootServiceSuperUserPasswordRequest) (*v2.BootServiceSuperUserPasswordResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BootService.SuperUserPassword is not implemented"))
+}
+
+func (UnimplementedBootServiceHandler) Register(context.Context, *v2.BootServiceRegisterRequest) (*v2.BootServiceRegisterResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BootService.Register is not implemented"))
+}
+
+func (UnimplementedBootServiceHandler) Wait(context.Context, *v2.BootServiceWaitRequest, *connect.ServerStream[v2.BootServiceWaitResponse]) error {
+	return connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BootService.Wait is not implemented"))
+}
+
+func (UnimplementedBootServiceHandler) Report(context.Context, *v2.BootServiceReportRequest) (*v2.BootServiceReportResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BootService.Report is not implemented"))
+}
diff --git a/go/metalstack/infra/v2/switch.pb.go b/go/metalstack/infra/v2/switch.pb.go
index 1fd9342a..a0d95820 100644
--- a/go/metalstack/infra/v2/switch.pb.go
+++ b/go/metalstack/infra/v2/switch.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: metalstack/infra/v2/switch.proto
 
diff --git a/go/permissions/permissions.go b/go/permissions/permissions.go
index 40bb83e8..adcde813 100644
--- a/go/permissions/permissions.go
+++ b/go/permissions/permissions.go
@@ -20,6 +20,7 @@ type (
 
 	Admin   map[string][]string
 	Infra   map[string][]string
+	Machine map[string][]string
 	Tenant  map[string][]string
 	Project map[string][]string
 
@@ -27,6 +28,7 @@ type (
 	Roles struct {
 		Admin   Admin   `json:"admin,omitempty"`
 		Infra   Infra   `json:"infra,omitempty"`
+		Machine Machine `json:"machine,omitempty"`
 		Tenant  Tenant  `json:"tenant,omitempty"`
 		Project Project `json:"project,omitempty"`
 	}
@@ -36,6 +38,7 @@ type (
 		Self    map[string]bool `json:"self,omitempty"`
 		Admin   map[string]bool `json:"admin,omitempty"`
 		Infra   map[string]bool `json:"infra,omitempty"`
+		Machine map[string]bool `json:"machine,omitempty"`
 		Tenant  map[string]bool `json:"tenant,omitempty"`
 		Project map[string]bool `json:"project,omitempty"`
 	}
diff --git a/go/permissions/servicepermissions.go b/go/permissions/servicepermissions.go
index df3708e1..20bd54c4 100755
--- a/go/permissions/servicepermissions.go
+++ b/go/permissions/servicepermissions.go
@@ -33,6 +33,7 @@ func GetServices() []string {
 		"metalstack.api.v2.UserService",
 		"metalstack.api.v2.VersionService",
 		"metalstack.infra.v2.BMCService",
+		"metalstack.infra.v2.BootService",
 		"metalstack.infra.v2.EventService",
 		"metalstack.infra.v2.SwitchService",
 	}
@@ -96,15 +97,26 @@ func GetServicePermissions() *ServicePermissions {
 			Infra: Infra{
 				"INFRA_ROLE_EDITOR": []string{
 					"/metalstack.infra.v2.BMCService/UpdateBMCInfo",
+					"/metalstack.infra.v2.BootService/Dhcp",
+					"/metalstack.infra.v2.BootService/Boot",
 					"/metalstack.infra.v2.EventService/Send",
 					"/metalstack.infra.v2.SwitchService/Get",
 					"/metalstack.infra.v2.SwitchService/Register",
 					"/metalstack.infra.v2.SwitchService/Heartbeat",
 				},
 				"INFRA_ROLE_VIEWER": []string{
+					"/metalstack.infra.v2.BootService/Boot",
 					"/metalstack.infra.v2.SwitchService/Get",
 				},
 			},
+			Machine: Machine{
+				"MACHINE_ROLE_EDITOR": []string{
+					"/metalstack.infra.v2.BootService/SuperUserPassword",
+					"/metalstack.infra.v2.BootService/Register",
+					"/metalstack.infra.v2.BootService/Wait",
+					"/metalstack.infra.v2.BootService/Report",
+				},
+			},
 			Tenant: Tenant{
 				"TENANT_ROLE_EDITOR": []string{
 					"/metalstack.api.v2.ProjectService/Create",
@@ -292,6 +304,12 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.api.v2.UserService/Get":                             true,
 			"/metalstack.api.v2.VersionService/Get":                          true,
 			"/metalstack.infra.v2.BMCService/UpdateBMCInfo":                  true,
+			"/metalstack.infra.v2.BootService/Boot":                          true,
+			"/metalstack.infra.v2.BootService/Dhcp":                          true,
+			"/metalstack.infra.v2.BootService/Register":                      true,
+			"/metalstack.infra.v2.BootService/Report":                        true,
+			"/metalstack.infra.v2.BootService/SuperUserPassword":             true,
+			"/metalstack.infra.v2.BootService/Wait":                          true,
 			"/metalstack.infra.v2.EventService/Send":                         true,
 			"/metalstack.infra.v2.SwitchService/Get":                         true,
 			"/metalstack.infra.v2.SwitchService/Heartbeat":                   true,
@@ -370,11 +388,19 @@ func GetServicePermissions() *ServicePermissions {
 			},
 			Infra: map[string]bool{
 				"/metalstack.infra.v2.BMCService/UpdateBMCInfo": true,
+				"/metalstack.infra.v2.BootService/Boot":         true,
+				"/metalstack.infra.v2.BootService/Dhcp":         true,
 				"/metalstack.infra.v2.EventService/Send":        true,
 				"/metalstack.infra.v2.SwitchService/Get":        true,
 				"/metalstack.infra.v2.SwitchService/Heartbeat":  true,
 				"/metalstack.infra.v2.SwitchService/Register":   true,
 			},
+			Machine: map[string]bool{
+				"/metalstack.infra.v2.BootService/Register":          true,
+				"/metalstack.infra.v2.BootService/Report":            true,
+				"/metalstack.infra.v2.BootService/SuperUserPassword": true,
+				"/metalstack.infra.v2.BootService/Wait":              true,
+			},
 			Tenant: map[string]bool{
 				"/metalstack.api.v2.ProjectService/Create":      true,
 				"/metalstack.api.v2.TenantService/Delete":       true,
@@ -514,6 +540,12 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.api.v2.UserService/Get":                 true,
 			"/metalstack.api.v2.VersionService/Get":              false,
 			"/metalstack.infra.v2.BMCService/UpdateBMCInfo":      false,
+			"/metalstack.infra.v2.BootService/Boot":              false,
+			"/metalstack.infra.v2.BootService/Dhcp":              false,
+			"/metalstack.infra.v2.BootService/Register":          false,
+			"/metalstack.infra.v2.BootService/Report":            false,
+			"/metalstack.infra.v2.BootService/SuperUserPassword": false,
+			"/metalstack.infra.v2.BootService/Wait":              false,
 			"/metalstack.infra.v2.EventService/Send":             false,
 			"/metalstack.infra.v2.SwitchService/Get":             false,
 			"/metalstack.infra.v2.SwitchService/Heartbeat":       false,
@@ -542,6 +574,11 @@ func IsInfraScope(req connect.AnyRequest) bool {
 	return ok
 }
 
+func IsMachineScope(req connect.AnyRequest) bool {
+	_, ok := GetServicePermissions().Visibility.Machine[req.Spec().Procedure]
+	return ok
+}
+
 func IsTenantScope(req connect.AnyRequest) bool {
 	_, ok := GetServicePermissions().Visibility.Tenant[req.Spec().Procedure]
 	return ok
@@ -578,3 +615,14 @@ func GetProjectFromRequest(req connect.AnyRequest) (string, bool) {
 	}
 	return "", false
 }
+
+func GetMachineIdFromRequest(req connect.AnyRequest) (string, bool) {
+	if !IsMachineScope(req) {
+		return "", false
+	}
+	switch rq := req.Any().(type) {
+	case interface{ GetUuid() string }:
+		return rq.GetUuid(), true
+	}
+	return "", false
+}
diff --git a/go/tests/api_scopes_test.go b/go/tests/api_scopes_test.go
index bc0b59fc..df7d89a5 100644
--- a/go/tests/api_scopes_test.go
+++ b/go/tests/api_scopes_test.go
@@ -20,6 +20,7 @@ type (
 	project    struct{}
 	admin      struct{}
 	infra      struct{}
+	machine    struct{}
 	visibility struct{}
 )
 
@@ -57,6 +58,14 @@ func (infra) Get(methodOpts []*descriptorpb.UninterpretedOption) (scopes []strin
 	return
 }
 
+func (machine) Get(methodOpts []*descriptorpb.UninterpretedOption) (scopes []string) {
+	scopes = getScopes(methodOpts, []string{
+		v2.MachineRole_MACHINE_ROLE_EDITOR.String(),
+		v2.MachineRole_MACHINE_ROLE_VIEWER.String(),
+	})
+	return
+}
+
 func (visibility) Get(methodOpts []*descriptorpb.UninterpretedOption) (scopes []string) {
 	scopes = getScopes(methodOpts, []string{
 		v2.Visibility_VISIBILITY_PUBLIC.String(),
@@ -111,11 +120,11 @@ func Test_APIScopes(t *testing.T) {
 	errs := errors.Join(
 		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Add\" has apiv2.TenantRole but request payload \"WrongProjectServiceAddRequest\" does not have a login field"),
 		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Get\" has apiv2.ProjectRole but request payload \"WrongProjectServiceGetRequest\" does not have a project field"),
-		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/List\" has no scope defined. one scope needs to be defined though. use one of the following scopes: [apiv2.AdminRole apiv2.InfraRole apiv2.ProjectRole apiv2.TenantRole apiv2.Visibility]"),
+		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/List\" has no scope defined. one scope needs to be defined though. use one of the following scopes: [apiv2.AdminRole apiv2.InfraRole apiv2.MachineRole apiv2.ProjectRole apiv2.TenantRole apiv2.Visibility]"),
 		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Update\" does not have a update_meta field in WrongProjectServiceUpdateRequest"),
 		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Update\" can not have apiv2.AdminRole ([ADMIN_ROLE_VIEWER]) and apiv2.ProjectRole ([PROJECT_ROLE_OWNER]) at the same time. only one scope is allowed."),
 		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Delete\" can not have apiv2.AdminRole ([ADMIN_ROLE_VIEWER]) and apiv2.Visibility ([VISIBILITY_PUBLIC]) at the same time. only one scope is allowed."),
-		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Charge\" has no scope defined. one scope needs to be defined though. use one of the following scopes: [apiv2.AdminRole apiv2.InfraRole apiv2.ProjectRole apiv2.TenantRole apiv2.Visibility]"),
+		errors.New("api service method: \"/metalstack.api.v2.WrongProjectService/Charge\" has no scope defined. one scope needs to be defined though. use one of the following scopes: [apiv2.AdminRole apiv2.InfraRole apiv2.MachineRole apiv2.ProjectRole apiv2.TenantRole apiv2.Visibility]"),
 	)
 
 	require.Equal(t, err, errs)
@@ -127,17 +136,19 @@ func validateProto(root string) error {
 		pr v2.ProjectRole
 		ar v2.AdminRole
 		ir v2.InfraRole
+		mr v2.MachineRole
 		vr v2.Visibility
 
 		trs = fmt.Sprintf("%T", tr)
 		prs = fmt.Sprintf("%T", pr)
 		ars = fmt.Sprintf("%T", ar)
 		irs = fmt.Sprintf("%T", ir)
+		mrs = fmt.Sprintf("%T", mr)
 		vrs = fmt.Sprintf("%T", vr)
 
 		// add all *rs from above here
 		scopeKeys = []string{
-			trs, prs, ars, irs, vrs,
+			trs, prs, ars, irs, mrs, vrs,
 		}
 	)
 	slices.Sort(scopeKeys)
@@ -163,6 +174,7 @@ func validateProto(root string) error {
 						prs: project{}.Get(methodOpts),
 						ars: admin{}.Get(methodOpts),
 						irs: infra{}.Get(methodOpts),
+						mrs: machine{}.Get(methodOpts),
 						vrs: visibility{}.Get(methodOpts),
 					}
 					allScopeNames = func() (names []string) {
@@ -245,6 +257,24 @@ func validateProto(root string) error {
 							errs = append(errs, fmt.Errorf("api service method: %q has %s but request payload %q does not have a login field", methodName, trs, tenantRequest))
 						}
 					}
+					if name == mrs {
+						machineIdFound := false
+						machineRequest := ""
+						for _, mt := range fd.GetMessageType() {
+							if mt.GetName() != method.GetInputType() {
+								continue
+							}
+							for _, field := range mt.GetField() {
+								if field.GetName() == "uuid" {
+									machineIdFound = true
+								}
+							}
+							machineRequest = mt.GetName()
+						}
+						if !machineIdFound {
+							errs = append(errs, fmt.Errorf("api service method: %q has %s but request payload %q does not have a uuid field", methodName, mrs, machineRequest))
+						}
+					}
 				}
 
 				if methodScope == "" {
diff --git a/go/tests/mock_clients.go b/go/tests/mock_clients.go
index df85cdfd..ce655768 100755
--- a/go/tests/mock_clients.go
+++ b/go/tests/mock_clients.go
@@ -93,12 +93,14 @@ type (
 	}
 	infrav2 struct {
 		bmcservice    *infrav2mocks.BMCServiceClient
+		bootservice   *infrav2mocks.BootServiceClient
 		eventservice  *infrav2mocks.EventServiceClient
 		switchservice *infrav2mocks.SwitchServiceClient
 	}
 
 	Infrav2MockFns struct {
 		BMC    func(m *mock.Mock)
+		Boot   func(m *mock.Mock)
 		Event  func(m *mock.Mock)
 		Switch func(m *mock.Mock)
 	}
@@ -340,6 +342,7 @@ func (w wrapper) Infrav2(fns *Infrav2MockFns) *infrav2 {
 func newinfrav2(t *testing.T, fns *Infrav2MockFns) *infrav2 {
 	a := &infrav2{
 		bmcservice:    infrav2mocks.NewBMCServiceClient(t),
+		bootservice:   infrav2mocks.NewBootServiceClient(t),
 		eventservice:  infrav2mocks.NewEventServiceClient(t),
 		switchservice: infrav2mocks.NewSwitchServiceClient(t),
 	}
@@ -348,6 +351,9 @@ func newinfrav2(t *testing.T, fns *Infrav2MockFns) *infrav2 {
 		if fns.BMC != nil {
 			fns.BMC(&a.bmcservice.Mock)
 		}
+		if fns.Boot != nil {
+			fns.Boot(&a.bootservice.Mock)
+		}
 		if fns.Event != nil {
 			fns.Event(&a.eventservice.Mock)
 		}
@@ -363,6 +369,9 @@ func newinfrav2(t *testing.T, fns *Infrav2MockFns) *infrav2 {
 func (c *infrav2) BMC() infrav2connect.BMCServiceClient {
 	return c.bmcservice
 }
+func (c *infrav2) Boot() infrav2connect.BootServiceClient {
+	return c.bootservice
+}
 func (c *infrav2) Event() infrav2connect.EventServiceClient {
 	return c.eventservice
 }
diff --git a/go/tests/mocks/client/Infrav2.go b/go/tests/mocks/client/Infrav2.go
index 5c1e2341..07d18623 100644
--- a/go/tests/mocks/client/Infrav2.go
+++ b/go/tests/mocks/client/Infrav2.go
@@ -82,6 +82,52 @@ func (_c *Infrav2_BMC_Call) RunAndReturn(run func() infrav2connect.BMCServiceCli
 	return _c
 }
 
+// Boot provides a mock function for the type Infrav2
+func (_mock *Infrav2) Boot() infrav2connect.BootServiceClient {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Boot")
+	}
+
+	var r0 infrav2connect.BootServiceClient
+	if returnFunc, ok := ret.Get(0).(func() infrav2connect.BootServiceClient); ok {
+		r0 = returnFunc()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(infrav2connect.BootServiceClient)
+		}
+	}
+	return r0
+}
+
+// Infrav2_Boot_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Boot'
+type Infrav2_Boot_Call struct {
+	*mock.Call
+}
+
+// Boot is a helper method to define mock.On call
+func (_e *Infrav2_Expecter) Boot() *Infrav2_Boot_Call {
+	return &Infrav2_Boot_Call{Call: _e.mock.On("Boot")}
+}
+
+func (_c *Infrav2_Boot_Call) Run(run func()) *Infrav2_Boot_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Infrav2_Boot_Call) Return(bootServiceClient infrav2connect.BootServiceClient) *Infrav2_Boot_Call {
+	_c.Call.Return(bootServiceClient)
+	return _c
+}
+
+func (_c *Infrav2_Boot_Call) RunAndReturn(run func() infrav2connect.BootServiceClient) *Infrav2_Boot_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Event provides a mock function for the type Infrav2
 func (_mock *Infrav2) Event() infrav2connect.EventServiceClient {
 	ret := _mock.Called()
diff --git a/go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceClient.go b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceClient.go
new file mode 100644
index 00000000..43baae23
--- /dev/null
+++ b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceClient.go
@@ -0,0 +1,448 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package infrav2connect
+
+import (
+	"context"
+
+	"connectrpc.com/connect"
+	"github.com/metal-stack/api/go/metalstack/infra/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewBootServiceClient creates a new instance of BootServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewBootServiceClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *BootServiceClient {
+	mock := &BootServiceClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// BootServiceClient is an autogenerated mock type for the BootServiceClient type
+type BootServiceClient struct {
+	mock.Mock
+}
+
+type BootServiceClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *BootServiceClient) EXPECT() *BootServiceClient_Expecter {
+	return &BootServiceClient_Expecter{mock: &_m.Mock}
+}
+
+// Boot provides a mock function for the type BootServiceClient
+func (_mock *BootServiceClient) Boot(context1 context.Context, bootServiceBootRequest *infrav2.BootServiceBootRequest) (*infrav2.BootServiceBootResponse, error) {
+	ret := _mock.Called(context1, bootServiceBootRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Boot")
+	}
+
+	var r0 *infrav2.BootServiceBootResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceBootRequest) (*infrav2.BootServiceBootResponse, error)); ok {
+		return returnFunc(context1, bootServiceBootRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceBootRequest) *infrav2.BootServiceBootResponse); ok {
+		r0 = returnFunc(context1, bootServiceBootRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceBootResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceBootRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceBootRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceClient_Boot_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Boot'
+type BootServiceClient_Boot_Call struct {
+	*mock.Call
+}
+
+// Boot is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceBootRequest *infrav2.BootServiceBootRequest
+func (_e *BootServiceClient_Expecter) Boot(context1 interface{}, bootServiceBootRequest interface{}) *BootServiceClient_Boot_Call {
+	return &BootServiceClient_Boot_Call{Call: _e.mock.On("Boot", context1, bootServiceBootRequest)}
+}
+
+func (_c *BootServiceClient_Boot_Call) Run(run func(context1 context.Context, bootServiceBootRequest *infrav2.BootServiceBootRequest)) *BootServiceClient_Boot_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceBootRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceBootRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceClient_Boot_Call) Return(bootServiceBootResponse *infrav2.BootServiceBootResponse, err error) *BootServiceClient_Boot_Call {
+	_c.Call.Return(bootServiceBootResponse, err)
+	return _c
+}
+
+func (_c *BootServiceClient_Boot_Call) RunAndReturn(run func(context1 context.Context, bootServiceBootRequest *infrav2.BootServiceBootRequest) (*infrav2.BootServiceBootResponse, error)) *BootServiceClient_Boot_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Dhcp provides a mock function for the type BootServiceClient
+func (_mock *BootServiceClient) Dhcp(context1 context.Context, bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest) (*infrav2.BootServiceDhcpResponse, error) {
+	ret := _mock.Called(context1, bootServiceDhcpRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Dhcp")
+	}
+
+	var r0 *infrav2.BootServiceDhcpResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceDhcpRequest) (*infrav2.BootServiceDhcpResponse, error)); ok {
+		return returnFunc(context1, bootServiceDhcpRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceDhcpRequest) *infrav2.BootServiceDhcpResponse); ok {
+		r0 = returnFunc(context1, bootServiceDhcpRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceDhcpResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceDhcpRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceDhcpRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceClient_Dhcp_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Dhcp'
+type BootServiceClient_Dhcp_Call struct {
+	*mock.Call
+}
+
+// Dhcp is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest
+func (_e *BootServiceClient_Expecter) Dhcp(context1 interface{}, bootServiceDhcpRequest interface{}) *BootServiceClient_Dhcp_Call {
+	return &BootServiceClient_Dhcp_Call{Call: _e.mock.On("Dhcp", context1, bootServiceDhcpRequest)}
+}
+
+func (_c *BootServiceClient_Dhcp_Call) Run(run func(context1 context.Context, bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest)) *BootServiceClient_Dhcp_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceDhcpRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceDhcpRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceClient_Dhcp_Call) Return(bootServiceDhcpResponse *infrav2.BootServiceDhcpResponse, err error) *BootServiceClient_Dhcp_Call {
+	_c.Call.Return(bootServiceDhcpResponse, err)
+	return _c
+}
+
+func (_c *BootServiceClient_Dhcp_Call) RunAndReturn(run func(context1 context.Context, bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest) (*infrav2.BootServiceDhcpResponse, error)) *BootServiceClient_Dhcp_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Register provides a mock function for the type BootServiceClient
+func (_mock *BootServiceClient) Register(context1 context.Context, bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest) (*infrav2.BootServiceRegisterResponse, error) {
+	ret := _mock.Called(context1, bootServiceRegisterRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Register")
+	}
+
+	var r0 *infrav2.BootServiceRegisterResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceRegisterRequest) (*infrav2.BootServiceRegisterResponse, error)); ok {
+		return returnFunc(context1, bootServiceRegisterRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceRegisterRequest) *infrav2.BootServiceRegisterResponse); ok {
+		r0 = returnFunc(context1, bootServiceRegisterRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceRegisterResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceRegisterRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceRegisterRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceClient_Register_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Register'
+type BootServiceClient_Register_Call struct {
+	*mock.Call
+}
+
+// Register is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest
+func (_e *BootServiceClient_Expecter) Register(context1 interface{}, bootServiceRegisterRequest interface{}) *BootServiceClient_Register_Call {
+	return &BootServiceClient_Register_Call{Call: _e.mock.On("Register", context1, bootServiceRegisterRequest)}
+}
+
+func (_c *BootServiceClient_Register_Call) Run(run func(context1 context.Context, bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest)) *BootServiceClient_Register_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceRegisterRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceRegisterRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceClient_Register_Call) Return(bootServiceRegisterResponse *infrav2.BootServiceRegisterResponse, err error) *BootServiceClient_Register_Call {
+	_c.Call.Return(bootServiceRegisterResponse, err)
+	return _c
+}
+
+func (_c *BootServiceClient_Register_Call) RunAndReturn(run func(context1 context.Context, bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest) (*infrav2.BootServiceRegisterResponse, error)) *BootServiceClient_Register_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Report provides a mock function for the type BootServiceClient
+func (_mock *BootServiceClient) Report(context1 context.Context, bootServiceReportRequest *infrav2.BootServiceReportRequest) (*infrav2.BootServiceReportResponse, error) {
+	ret := _mock.Called(context1, bootServiceReportRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Report")
+	}
+
+	var r0 *infrav2.BootServiceReportResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceReportRequest) (*infrav2.BootServiceReportResponse, error)); ok {
+		return returnFunc(context1, bootServiceReportRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceReportRequest) *infrav2.BootServiceReportResponse); ok {
+		r0 = returnFunc(context1, bootServiceReportRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceReportResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceReportRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceReportRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceClient_Report_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Report'
+type BootServiceClient_Report_Call struct {
+	*mock.Call
+}
+
+// Report is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceReportRequest *infrav2.BootServiceReportRequest
+func (_e *BootServiceClient_Expecter) Report(context1 interface{}, bootServiceReportRequest interface{}) *BootServiceClient_Report_Call {
+	return &BootServiceClient_Report_Call{Call: _e.mock.On("Report", context1, bootServiceReportRequest)}
+}
+
+func (_c *BootServiceClient_Report_Call) Run(run func(context1 context.Context, bootServiceReportRequest *infrav2.BootServiceReportRequest)) *BootServiceClient_Report_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceReportRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceReportRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceClient_Report_Call) Return(bootServiceReportResponse *infrav2.BootServiceReportResponse, err error) *BootServiceClient_Report_Call {
+	_c.Call.Return(bootServiceReportResponse, err)
+	return _c
+}
+
+func (_c *BootServiceClient_Report_Call) RunAndReturn(run func(context1 context.Context, bootServiceReportRequest *infrav2.BootServiceReportRequest) (*infrav2.BootServiceReportResponse, error)) *BootServiceClient_Report_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SuperUserPassword provides a mock function for the type BootServiceClient
+func (_mock *BootServiceClient) SuperUserPassword(context1 context.Context, bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest) (*infrav2.BootServiceSuperUserPasswordResponse, error) {
+	ret := _mock.Called(context1, bootServiceSuperUserPasswordRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SuperUserPassword")
+	}
+
+	var r0 *infrav2.BootServiceSuperUserPasswordResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceSuperUserPasswordRequest) (*infrav2.BootServiceSuperUserPasswordResponse, error)); ok {
+		return returnFunc(context1, bootServiceSuperUserPasswordRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceSuperUserPasswordRequest) *infrav2.BootServiceSuperUserPasswordResponse); ok {
+		r0 = returnFunc(context1, bootServiceSuperUserPasswordRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceSuperUserPasswordResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceSuperUserPasswordRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceSuperUserPasswordRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceClient_SuperUserPassword_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SuperUserPassword'
+type BootServiceClient_SuperUserPassword_Call struct {
+	*mock.Call
+}
+
+// SuperUserPassword is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest
+func (_e *BootServiceClient_Expecter) SuperUserPassword(context1 interface{}, bootServiceSuperUserPasswordRequest interface{}) *BootServiceClient_SuperUserPassword_Call {
+	return &BootServiceClient_SuperUserPassword_Call{Call: _e.mock.On("SuperUserPassword", context1, bootServiceSuperUserPasswordRequest)}
+}
+
+func (_c *BootServiceClient_SuperUserPassword_Call) Run(run func(context1 context.Context, bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest)) *BootServiceClient_SuperUserPassword_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceSuperUserPasswordRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceSuperUserPasswordRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceClient_SuperUserPassword_Call) Return(bootServiceSuperUserPasswordResponse *infrav2.BootServiceSuperUserPasswordResponse, err error) *BootServiceClient_SuperUserPassword_Call {
+	_c.Call.Return(bootServiceSuperUserPasswordResponse, err)
+	return _c
+}
+
+func (_c *BootServiceClient_SuperUserPassword_Call) RunAndReturn(run func(context1 context.Context, bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest) (*infrav2.BootServiceSuperUserPasswordResponse, error)) *BootServiceClient_SuperUserPassword_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Wait provides a mock function for the type BootServiceClient
+func (_mock *BootServiceClient) Wait(context1 context.Context, bootServiceWaitRequest *infrav2.BootServiceWaitRequest) (*connect.ServerStreamForClient[infrav2.BootServiceWaitResponse], error) {
+	ret := _mock.Called(context1, bootServiceWaitRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Wait")
+	}
+
+	var r0 *connect.ServerStreamForClient[infrav2.BootServiceWaitResponse]
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceWaitRequest) (*connect.ServerStreamForClient[infrav2.BootServiceWaitResponse], error)); ok {
+		return returnFunc(context1, bootServiceWaitRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceWaitRequest) *connect.ServerStreamForClient[infrav2.BootServiceWaitResponse]); ok {
+		r0 = returnFunc(context1, bootServiceWaitRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.ServerStreamForClient[infrav2.BootServiceWaitResponse])
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceWaitRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceWaitRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceClient_Wait_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Wait'
+type BootServiceClient_Wait_Call struct {
+	*mock.Call
+}
+
+// Wait is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceWaitRequest *infrav2.BootServiceWaitRequest
+func (_e *BootServiceClient_Expecter) Wait(context1 interface{}, bootServiceWaitRequest interface{}) *BootServiceClient_Wait_Call {
+	return &BootServiceClient_Wait_Call{Call: _e.mock.On("Wait", context1, bootServiceWaitRequest)}
+}
+
+func (_c *BootServiceClient_Wait_Call) Run(run func(context1 context.Context, bootServiceWaitRequest *infrav2.BootServiceWaitRequest)) *BootServiceClient_Wait_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceWaitRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceWaitRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceClient_Wait_Call) Return(serverStreamForClient *connect.ServerStreamForClient[infrav2.BootServiceWaitResponse], err error) *BootServiceClient_Wait_Call {
+	_c.Call.Return(serverStreamForClient, err)
+	return _c
+}
+
+func (_c *BootServiceClient_Wait_Call) RunAndReturn(run func(context1 context.Context, bootServiceWaitRequest *infrav2.BootServiceWaitRequest) (*connect.ServerStreamForClient[infrav2.BootServiceWaitResponse], error)) *BootServiceClient_Wait_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceHandler.go b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceHandler.go
new file mode 100644
index 00000000..03d3847e
--- /dev/null
+++ b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BootServiceHandler.go
@@ -0,0 +1,443 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package infrav2connect
+
+import (
+	"context"
+
+	"connectrpc.com/connect"
+	"github.com/metal-stack/api/go/metalstack/infra/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewBootServiceHandler creates a new instance of BootServiceHandler. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewBootServiceHandler(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *BootServiceHandler {
+	mock := &BootServiceHandler{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// BootServiceHandler is an autogenerated mock type for the BootServiceHandler type
+type BootServiceHandler struct {
+	mock.Mock
+}
+
+type BootServiceHandler_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *BootServiceHandler) EXPECT() *BootServiceHandler_Expecter {
+	return &BootServiceHandler_Expecter{mock: &_m.Mock}
+}
+
+// Boot provides a mock function for the type BootServiceHandler
+func (_mock *BootServiceHandler) Boot(context1 context.Context, bootServiceBootRequest *infrav2.BootServiceBootRequest) (*infrav2.BootServiceBootResponse, error) {
+	ret := _mock.Called(context1, bootServiceBootRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Boot")
+	}
+
+	var r0 *infrav2.BootServiceBootResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceBootRequest) (*infrav2.BootServiceBootResponse, error)); ok {
+		return returnFunc(context1, bootServiceBootRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceBootRequest) *infrav2.BootServiceBootResponse); ok {
+		r0 = returnFunc(context1, bootServiceBootRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceBootResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceBootRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceBootRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceHandler_Boot_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Boot'
+type BootServiceHandler_Boot_Call struct {
+	*mock.Call
+}
+
+// Boot is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceBootRequest *infrav2.BootServiceBootRequest
+func (_e *BootServiceHandler_Expecter) Boot(context1 interface{}, bootServiceBootRequest interface{}) *BootServiceHandler_Boot_Call {
+	return &BootServiceHandler_Boot_Call{Call: _e.mock.On("Boot", context1, bootServiceBootRequest)}
+}
+
+func (_c *BootServiceHandler_Boot_Call) Run(run func(context1 context.Context, bootServiceBootRequest *infrav2.BootServiceBootRequest)) *BootServiceHandler_Boot_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceBootRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceBootRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceHandler_Boot_Call) Return(bootServiceBootResponse *infrav2.BootServiceBootResponse, err error) *BootServiceHandler_Boot_Call {
+	_c.Call.Return(bootServiceBootResponse, err)
+	return _c
+}
+
+func (_c *BootServiceHandler_Boot_Call) RunAndReturn(run func(context1 context.Context, bootServiceBootRequest *infrav2.BootServiceBootRequest) (*infrav2.BootServiceBootResponse, error)) *BootServiceHandler_Boot_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Dhcp provides a mock function for the type BootServiceHandler
+func (_mock *BootServiceHandler) Dhcp(context1 context.Context, bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest) (*infrav2.BootServiceDhcpResponse, error) {
+	ret := _mock.Called(context1, bootServiceDhcpRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Dhcp")
+	}
+
+	var r0 *infrav2.BootServiceDhcpResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceDhcpRequest) (*infrav2.BootServiceDhcpResponse, error)); ok {
+		return returnFunc(context1, bootServiceDhcpRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceDhcpRequest) *infrav2.BootServiceDhcpResponse); ok {
+		r0 = returnFunc(context1, bootServiceDhcpRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceDhcpResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceDhcpRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceDhcpRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceHandler_Dhcp_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Dhcp'
+type BootServiceHandler_Dhcp_Call struct {
+	*mock.Call
+}
+
+// Dhcp is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest
+func (_e *BootServiceHandler_Expecter) Dhcp(context1 interface{}, bootServiceDhcpRequest interface{}) *BootServiceHandler_Dhcp_Call {
+	return &BootServiceHandler_Dhcp_Call{Call: _e.mock.On("Dhcp", context1, bootServiceDhcpRequest)}
+}
+
+func (_c *BootServiceHandler_Dhcp_Call) Run(run func(context1 context.Context, bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest)) *BootServiceHandler_Dhcp_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceDhcpRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceDhcpRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceHandler_Dhcp_Call) Return(bootServiceDhcpResponse *infrav2.BootServiceDhcpResponse, err error) *BootServiceHandler_Dhcp_Call {
+	_c.Call.Return(bootServiceDhcpResponse, err)
+	return _c
+}
+
+func (_c *BootServiceHandler_Dhcp_Call) RunAndReturn(run func(context1 context.Context, bootServiceDhcpRequest *infrav2.BootServiceDhcpRequest) (*infrav2.BootServiceDhcpResponse, error)) *BootServiceHandler_Dhcp_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Register provides a mock function for the type BootServiceHandler
+func (_mock *BootServiceHandler) Register(context1 context.Context, bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest) (*infrav2.BootServiceRegisterResponse, error) {
+	ret := _mock.Called(context1, bootServiceRegisterRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Register")
+	}
+
+	var r0 *infrav2.BootServiceRegisterResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceRegisterRequest) (*infrav2.BootServiceRegisterResponse, error)); ok {
+		return returnFunc(context1, bootServiceRegisterRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceRegisterRequest) *infrav2.BootServiceRegisterResponse); ok {
+		r0 = returnFunc(context1, bootServiceRegisterRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceRegisterResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceRegisterRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceRegisterRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceHandler_Register_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Register'
+type BootServiceHandler_Register_Call struct {
+	*mock.Call
+}
+
+// Register is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest
+func (_e *BootServiceHandler_Expecter) Register(context1 interface{}, bootServiceRegisterRequest interface{}) *BootServiceHandler_Register_Call {
+	return &BootServiceHandler_Register_Call{Call: _e.mock.On("Register", context1, bootServiceRegisterRequest)}
+}
+
+func (_c *BootServiceHandler_Register_Call) Run(run func(context1 context.Context, bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest)) *BootServiceHandler_Register_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceRegisterRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceRegisterRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceHandler_Register_Call) Return(bootServiceRegisterResponse *infrav2.BootServiceRegisterResponse, err error) *BootServiceHandler_Register_Call {
+	_c.Call.Return(bootServiceRegisterResponse, err)
+	return _c
+}
+
+func (_c *BootServiceHandler_Register_Call) RunAndReturn(run func(context1 context.Context, bootServiceRegisterRequest *infrav2.BootServiceRegisterRequest) (*infrav2.BootServiceRegisterResponse, error)) *BootServiceHandler_Register_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Report provides a mock function for the type BootServiceHandler
+func (_mock *BootServiceHandler) Report(context1 context.Context, bootServiceReportRequest *infrav2.BootServiceReportRequest) (*infrav2.BootServiceReportResponse, error) {
+	ret := _mock.Called(context1, bootServiceReportRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Report")
+	}
+
+	var r0 *infrav2.BootServiceReportResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceReportRequest) (*infrav2.BootServiceReportResponse, error)); ok {
+		return returnFunc(context1, bootServiceReportRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceReportRequest) *infrav2.BootServiceReportResponse); ok {
+		r0 = returnFunc(context1, bootServiceReportRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceReportResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceReportRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceReportRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceHandler_Report_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Report'
+type BootServiceHandler_Report_Call struct {
+	*mock.Call
+}
+
+// Report is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceReportRequest *infrav2.BootServiceReportRequest
+func (_e *BootServiceHandler_Expecter) Report(context1 interface{}, bootServiceReportRequest interface{}) *BootServiceHandler_Report_Call {
+	return &BootServiceHandler_Report_Call{Call: _e.mock.On("Report", context1, bootServiceReportRequest)}
+}
+
+func (_c *BootServiceHandler_Report_Call) Run(run func(context1 context.Context, bootServiceReportRequest *infrav2.BootServiceReportRequest)) *BootServiceHandler_Report_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceReportRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceReportRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceHandler_Report_Call) Return(bootServiceReportResponse *infrav2.BootServiceReportResponse, err error) *BootServiceHandler_Report_Call {
+	_c.Call.Return(bootServiceReportResponse, err)
+	return _c
+}
+
+func (_c *BootServiceHandler_Report_Call) RunAndReturn(run func(context1 context.Context, bootServiceReportRequest *infrav2.BootServiceReportRequest) (*infrav2.BootServiceReportResponse, error)) *BootServiceHandler_Report_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SuperUserPassword provides a mock function for the type BootServiceHandler
+func (_mock *BootServiceHandler) SuperUserPassword(context1 context.Context, bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest) (*infrav2.BootServiceSuperUserPasswordResponse, error) {
+	ret := _mock.Called(context1, bootServiceSuperUserPasswordRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SuperUserPassword")
+	}
+
+	var r0 *infrav2.BootServiceSuperUserPasswordResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceSuperUserPasswordRequest) (*infrav2.BootServiceSuperUserPasswordResponse, error)); ok {
+		return returnFunc(context1, bootServiceSuperUserPasswordRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceSuperUserPasswordRequest) *infrav2.BootServiceSuperUserPasswordResponse); ok {
+		r0 = returnFunc(context1, bootServiceSuperUserPasswordRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*infrav2.BootServiceSuperUserPasswordResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *infrav2.BootServiceSuperUserPasswordRequest) error); ok {
+		r1 = returnFunc(context1, bootServiceSuperUserPasswordRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BootServiceHandler_SuperUserPassword_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SuperUserPassword'
+type BootServiceHandler_SuperUserPassword_Call struct {
+	*mock.Call
+}
+
+// SuperUserPassword is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest
+func (_e *BootServiceHandler_Expecter) SuperUserPassword(context1 interface{}, bootServiceSuperUserPasswordRequest interface{}) *BootServiceHandler_SuperUserPassword_Call {
+	return &BootServiceHandler_SuperUserPassword_Call{Call: _e.mock.On("SuperUserPassword", context1, bootServiceSuperUserPasswordRequest)}
+}
+
+func (_c *BootServiceHandler_SuperUserPassword_Call) Run(run func(context1 context.Context, bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest)) *BootServiceHandler_SuperUserPassword_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceSuperUserPasswordRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceSuperUserPasswordRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceHandler_SuperUserPassword_Call) Return(bootServiceSuperUserPasswordResponse *infrav2.BootServiceSuperUserPasswordResponse, err error) *BootServiceHandler_SuperUserPassword_Call {
+	_c.Call.Return(bootServiceSuperUserPasswordResponse, err)
+	return _c
+}
+
+func (_c *BootServiceHandler_SuperUserPassword_Call) RunAndReturn(run func(context1 context.Context, bootServiceSuperUserPasswordRequest *infrav2.BootServiceSuperUserPasswordRequest) (*infrav2.BootServiceSuperUserPasswordResponse, error)) *BootServiceHandler_SuperUserPassword_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Wait provides a mock function for the type BootServiceHandler
+func (_mock *BootServiceHandler) Wait(context1 context.Context, bootServiceWaitRequest *infrav2.BootServiceWaitRequest, serverStream *connect.ServerStream[infrav2.BootServiceWaitResponse]) error {
+	ret := _mock.Called(context1, bootServiceWaitRequest, serverStream)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Wait")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *infrav2.BootServiceWaitRequest, *connect.ServerStream[infrav2.BootServiceWaitResponse]) error); ok {
+		r0 = returnFunc(context1, bootServiceWaitRequest, serverStream)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// BootServiceHandler_Wait_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Wait'
+type BootServiceHandler_Wait_Call struct {
+	*mock.Call
+}
+
+// Wait is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bootServiceWaitRequest *infrav2.BootServiceWaitRequest
+//   - serverStream *connect.ServerStream[infrav2.BootServiceWaitResponse]
+func (_e *BootServiceHandler_Expecter) Wait(context1 interface{}, bootServiceWaitRequest interface{}, serverStream interface{}) *BootServiceHandler_Wait_Call {
+	return &BootServiceHandler_Wait_Call{Call: _e.mock.On("Wait", context1, bootServiceWaitRequest, serverStream)}
+}
+
+func (_c *BootServiceHandler_Wait_Call) Run(run func(context1 context.Context, bootServiceWaitRequest *infrav2.BootServiceWaitRequest, serverStream *connect.ServerStream[infrav2.BootServiceWaitResponse])) *BootServiceHandler_Wait_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *infrav2.BootServiceWaitRequest
+		if args[1] != nil {
+			arg1 = args[1].(*infrav2.BootServiceWaitRequest)
+		}
+		var arg2 *connect.ServerStream[infrav2.BootServiceWaitResponse]
+		if args[2] != nil {
+			arg2 = args[2].(*connect.ServerStream[infrav2.BootServiceWaitResponse])
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *BootServiceHandler_Wait_Call) Return(err error) *BootServiceHandler_Wait_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *BootServiceHandler_Wait_Call) RunAndReturn(run func(context1 context.Context, bootServiceWaitRequest *infrav2.BootServiceWaitRequest, serverStream *connect.ServerStream[infrav2.BootServiceWaitResponse]) error) *BootServiceHandler_Wait_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/proto/buf.gen.yaml b/proto/buf.gen.yaml
index 2b8a18e8..8b1c86e4 100644
--- a/proto/buf.gen.yaml
+++ b/proto/buf.gen.yaml
@@ -13,7 +13,7 @@ managed:
       value: github.com/metal-stack/api/go
 plugins:
   # go
-  - remote: buf.build/protocolbuffers/go:v1.36.10
+  - remote: buf.build/protocolbuffers/go:v1.36.11
     out: ../go
     opt: paths=source_relative
   - remote: buf.build/connectrpc/go:v1.19.1
diff --git a/proto/buf.lock b/proto/buf.lock
index bb66131a..069cd88d 100644
--- a/proto/buf.lock
+++ b/proto/buf.lock
@@ -2,5 +2,5 @@
 version: v2
 deps:
   - name: buf.build/bufbuild/protovalidate
-    commit: 52f32327d4b045a79293a6ad4e7e1236
-    digest: b5:cbabc98d4b7b7b0447c9b15f68eeb8a7a44ef8516cb386ac5f66e7fd4062cd6723ed3f452ad8c384b851f79e33d26e7f8a94e2b807282b3def1cd966c7eace97
+    commit: 2a1774d888024a9b93ce7eb4b59f6a83
+    digest: b5:6b7f9bc919b65e5b79d7b726ffc03d6f815a412d6b792970fa6f065cae162107bd0a9d47272c8ab1a2c9514e87b13d3fbf71df614374d62d2183afb64be2d30a
diff --git a/proto/metalstack/api/v2/common.proto b/proto/metalstack/api/v2/common.proto
index b64e6042..6e560ffd 100644
--- a/proto/metalstack/api/v2/common.proto
+++ b/proto/metalstack/api/v2/common.proto
@@ -54,6 +54,16 @@ enum InfraRole {
   INFRA_ROLE_VIEWER = 2;
 }
 
+// MachineRole specifies what role a microservice needs to call this machine service
+enum MachineRole {
+  // MACHINE_ROLE_UNSPECIFIED is not specified
+  MACHINE_ROLE_UNSPECIFIED = 0;
+  // MACHINE_ROLE_EDITOR a microservice needs at least editor role to call this method
+  MACHINE_ROLE_EDITOR = 1;
+  // MACHINE_ROLE_VIEWER a microservice needs at least viewer role to call this method
+  MACHINE_ROLE_VIEWER = 2;
+}
+
 // Visibility of a method
 enum Visibility {
   // VISIBILITY_UNSPECIFIED is not defined
@@ -90,6 +100,8 @@ extend google.protobuf.MethodOptions {
   Auditing auditing = 51004;
   // InfraRoles are used to define which infra role a microservice must provide to call this method
   repeated InfraRole infra_roles = 51005;
+  // MachineRole are used to define which infra role a microservice must provide to call this method
+  repeated MachineRole machine_roles = 51006;
 }
 
 // EnumValueOptions, can be accessed with go/enum/GetFormatStringValue
diff --git a/proto/metalstack/api/v2/machine.proto b/proto/metalstack/api/v2/machine.proto
index 57a7c3d6..8c60d270 100644
--- a/proto/metalstack/api/v2/machine.proto
+++ b/proto/metalstack/api/v2/machine.proto
@@ -480,11 +480,51 @@ message MachineChassisIdentifyLEDState {
 // MachineBios contains BIOS details of this machine
 message MachineBios {
   // Version the bios version
-  string version = 1 [(buf.validate.field).string = {max_len: 256}];
+  string version = 1 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
   // Vendor the bios vendor
-  string vendor = 2 [(buf.validate.field).string = {max_len: 256}];
+  string vendor = 2 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
   // Date the bios date as string because every vendor has different ideas howto describe the date
-  string date = 3 [(buf.validate.field).string = {max_len: 256}];
+  string date = 3 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+}
+
+// MachineIPMI describe details of the ipmi or out of band device
+message MachineIPMI {
+  // Address of this ipmi device from outside
+  string address = 1 [(buf.validate.field).string.ip = true];
+  // Mac address of the network interface of this ipmi device
+  string mac = 2 [(buf.validate.field).string.(macaddress) = true];
+  // User of this ipmi device
+  string user = 3 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // Password of this ipmi device
+  string password = 4 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // Interface of this ipmi device
+  string interface = 5 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // FRU field replaceable unit details for this machine
+  MachineFRU fru = 6;
+  // BMCVersion of this ipmi device
+  string bmc_version = 7 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // PowerState of this machine
+  string power_state = 8 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+}
+
+// MachineFRU describes details to the machine which are required in case of a necessary replacement
+message MachineFRU {
+  // ChassisPartNumber is the part number of the machine chassis
+  optional string chassis_part_number = 1 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // ChassisPartSerial is the serial number of the machine chassis
+  optional string chassis_part_serial = 2 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // BoardMFG is the short description of the mainboard
+  optional string board_mfg = 3 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // BoardSerial is the serial number of the mainboard
+  optional string board_mfg_serial = 4 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // BoardPartNumber is the part number of the mainboard
+  optional string board_part_number = 5 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // ProductManufacturer is the manufacturer of the machine
+  optional string product_manufacturer = 6 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // ProductPartNumber is the part number of the machine
+  optional string product_part_number = 7 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // ProductSerial is the serial number of the machine
+  optional string product_serial = 8 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
 }
 
 // MachineRecentProvisioningEvents the recent provisioning events for this machine
diff --git a/proto/metalstack/api/v2/method.proto b/proto/metalstack/api/v2/method.proto
index 9bdfee55..1f352261 100644
--- a/proto/metalstack/api/v2/method.proto
+++ b/proto/metalstack/api/v2/method.proto
@@ -43,4 +43,6 @@ message MethodServiceTokenScopedListResponse {
   optional AdminRole admin_role = 5 [(buf.validate.field).enum.defined_only = true];
   // InfraRole defines the infrastructure role of the token owner
   optional InfraRole infra_role = 6 [(buf.validate.field).enum.defined_only = true];
+  // MachineRoles defines the machine roles of the token owner
+  map<string, MachineRole> machine_roles = 7;
 }
diff --git a/proto/metalstack/api/v2/partition.proto b/proto/metalstack/api/v2/partition.proto
index 8fcb6dbf..0bbb9f23 100644
--- a/proto/metalstack/api/v2/partition.proto
+++ b/proto/metalstack/api/v2/partition.proto
@@ -23,10 +23,7 @@ service PartitionService {
 // Partition is a failure domain with machines and switches
 message Partition {
   // ID of this partition
-  string id = 1 [(buf.validate.field).string = {
-    min_len: 2
-    max_len: 128
-  }];
+  string id = 1 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
   // Meta for this ip
   Meta meta = 2;
   // Description of this partition
@@ -45,10 +42,7 @@ message Partition {
 // PartitionQuery is used to search partitions
 message PartitionQuery {
   // ID of the partition to get
-  optional string id = 1 [(buf.validate.field).string = {
-    min_len: 2
-    max_len: 128
-  }];
+  optional string id = 1 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
   // Labels lists only partitions containing the given labels
   optional Labels labels = 2;
 }
@@ -78,10 +72,7 @@ message NTPServer {
 // PartitionServiceGetRequest is the request payload for a partition get request
 message PartitionServiceGetRequest {
   // ID of the partition to get
-  string id = 1 [(buf.validate.field).string = {
-    min_len: 2
-    max_len: 128
-  }];
+  string id = 1 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
 }
 
 // PartitionServiceListRequest is the request payload for a partition list request
diff --git a/proto/metalstack/api/v2/token.proto b/proto/metalstack/api/v2/token.proto
index 539e9ef6..1ac5efcc 100644
--- a/proto/metalstack/api/v2/token.proto
+++ b/proto/metalstack/api/v2/token.proto
@@ -82,6 +82,9 @@ message Token {
   optional AdminRole admin_role = 11 [(buf.validate.field).enum.defined_only = true];
   // InfraRole defines the infrastructure role of the token owner
   optional InfraRole infra_role = 12 [(buf.validate.field).enum.defined_only = true];
+  // MachineRoles associates a machine uuid with the corresponding role of the token owner
+  // TODO: decide if we need this map from machine.uuid->role, we could instead use the subject in the token instead
+  map<string, MachineRole> machine_roles = 13;
 }
 
 // TokenType specifies different use cases of tokens
@@ -130,8 +133,17 @@ message TokenServiceCreateRequest {
   optional AdminRole admin_role = 7 [(buf.validate.field).enum.defined_only = true];
   // InfraRole defines the infrastructure role of the token owner
   optional InfraRole infra_role = 8 [(buf.validate.field).enum.defined_only = true];
+  // MachineRoles associates a machine uuid with the corresponding role of the token owner
+  map<string, MachineRole> machine_roles = 9 [(buf.validate.field).map = {
+    keys: {
+      string: {uuid: true}
+    }
+    values: {
+      enum: {defined_only: true}
+    }
+  }];
   // Labels on this token
-  Labels labels = 9;
+  Labels labels = 10;
 }
 
 // MethodPermission is a mapping from a subject/project to a service method
@@ -209,8 +221,17 @@ message TokenServiceUpdateRequest {
   optional AdminRole admin_role = 7 [(buf.validate.field).enum.defined_only = true];
   // InfraRole defines the infrastructure role of the token owner
   optional InfraRole infra_role = 8 [(buf.validate.field).enum.defined_only = true];
+  // MachineRoles associates a machine uuid with the corresponding role of the token owner
+  map<string, MachineRole> machine_roles = 9 [(buf.validate.field).map = {
+    keys: {
+      string: {uuid: true}
+    }
+    values: {
+      enum: {defined_only: true}
+    }
+  }];
   // Labels on this token
-  UpdateLabels labels = 9;
+  UpdateLabels labels = 10;
 }
 
 // TokenServiceUpdateResponse is the response payload of a token update request
diff --git a/proto/metalstack/infra/v2/boot.proto b/proto/metalstack/infra/v2/boot.proto
new file mode 100644
index 00000000..238878f0
--- /dev/null
+++ b/proto/metalstack/infra/v2/boot.proto
@@ -0,0 +1,156 @@
+syntax = "proto3";
+
+package metalstack.infra.v2;
+
+import "buf/validate/validate.proto";
+import "metalstack/api/v2/common.proto";
+import "metalstack/api/v2/machine.proto";
+import "metalstack/api/v2/predefined_rules.proto";
+
+// BootService is used for all boot related requests, either pixiecore or metal-hammer
+service BootService {
+  // Pixiecore
+
+  // Dhcp is the first dhcp request (option 97). A ProvisioningEventPXEBooting is fired
+  rpc Dhcp(BootServiceDhcpRequest) returns (BootServiceDhcpResponse) {
+    option (metalstack.api.v2.infra_roles) = INFRA_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+  // Boot is called from pixie once the machine got the first dhcp response and ipxie asks for subsequent kernel and initrd
+  rpc Boot(BootServiceBootRequest) returns (BootServiceBootResponse) {
+    option (metalstack.api.v2.infra_roles) = INFRA_ROLE_EDITOR;
+    option (metalstack.api.v2.infra_roles) = INFRA_ROLE_VIEWER;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+
+  // Metal Hammer
+
+  // SuperUserPassword metal-hammer takes the configured root password for the bmc from metal-api and configure the bmc accordingly
+  rpc SuperUserPassword(BootServiceSuperUserPasswordRequest) returns (BootServiceSuperUserPasswordResponse) {
+    option (metalstack.api.v2.machine_roles) = MACHINE_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+  // Register is called from metal-hammer after hardware inventory is finished, tells metal-api all glory details about that machine
+  rpc Register(BootServiceRegisterRequest) returns (BootServiceRegisterResponse) {
+    option (metalstack.api.v2.machine_roles) = MACHINE_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+  // Wait is a hanging call that waits until the machine gets allocated by a user
+  rpc Wait(BootServiceWaitRequest) returns (stream BootServiceWaitResponse) {
+    option (metalstack.api.v2.machine_roles) = MACHINE_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+
+  // Report tells metal-api installation was either successful or failed
+  rpc Report(BootServiceReportRequest) returns (BootServiceReportResponse) {
+    option (metalstack.api.v2.machine_roles) = MACHINE_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
+}
+
+// BootServiceDhcpRequest is called once a machine issues a dhcp request
+message BootServiceDhcpRequest {
+  // UUID of the machine
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Partition where this machine is located
+  string partition = 2 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
+}
+
+// BootServiceDhcpResponse contains the response to a dhcp request
+message BootServiceDhcpResponse {}
+
+// BootServiceBootRequest is called to get specified parameters to boot a machine with the given mac
+message BootServiceBootRequest {
+  // Mac address of the machine
+  string mac = 1 [(buf.validate.field).string.(metalstack.api.v2.macaddress) = true];
+  // Partition where this machine is located
+  string partition = 2 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
+}
+
+// BootServiceBootResponse contains additional infos which are required to boot a machine
+message BootServiceBootResponse {
+  // Kernel is the url to the linux kernel to boot
+  string kernel = 1 [(buf.validate.field).string.(metalstack.api.v2.is_uri) = true];
+  // Initial ram disk is the url to the initial ram disk to boot
+  repeated string init_ram_disks = 2;
+  // CMDLine contains kernel command line parameters to boot
+  optional string cmdline = 3 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+}
+
+// BootServiceRegisterRequest is called from metal-hammer to register a machine with as much hardware details as possible
+message BootServiceRegisterRequest {
+  // UUID of this machine
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Hardware details of this machine
+  metalstack.api.v2.MachineHardware hardware = 2;
+  // Bios details of this machine
+  metalstack.api.v2.MachineBios bios = 3;
+  // IPMI details of this machine
+  metalstack.api.v2.MachineIPMI ipmi = 4;
+  // Tags of this machine
+  repeated string tags = 5;
+  // MetalHammer version this machine was bootet into
+  string metal_hammer_version = 6 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // Partition where this machine is located
+  string partition = 7 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
+}
+
+// BootServiceRegisterResponse response to a BootServiceRegisterResponse request
+message BootServiceRegisterResponse {
+  // UUID of this machine
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Size is the calculated size from given hardware details
+  string size = 2 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
+  // Partition of this machine
+  string partition = 3 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
+}
+
+// BootServiceWaitRequest is called when a machine was registered and is waiting for allocation
+message BootServiceWaitRequest {
+  // UUID of this machine
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+}
+
+// BootServiceWaitResponse response to a wait request
+message BootServiceWaitResponse {
+  // Allocation contains the machine.allocation to actually install the machine
+  metalstack.api.v2.MachineAllocation allocation = 1;
+}
+
+// BootServiceReportRequest is sent from metal-hammer to the api to report the outcome of the register
+message BootServiceReportRequest {
+  // UUID of the machine to boot
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Console_Password
+  string console_password = 2 [(buf.validate.field).string = {
+    min_len: 2
+    max_len: 128
+  }];
+  // Success is set to true of the allocation succeeded
+  bool success = 4;
+  // Message contains additional information if installation failed
+  string message = 5 [(buf.validate.field).string = {
+    min_len: 2
+    max_len: 512
+  }];
+}
+
+// BootServiceReportRequest is the response to a BootServiceReportRequest
+message BootServiceReportResponse {}
+
+// BootServiceSuperUserPasswordRequest this call returns the password for the machine superuser
+message BootServiceSuperUserPasswordRequest {
+  // UUID of this machine
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+}
+
+// BootServiceSuperUserPasswordResponse the super user password is returned
+message BootServiceSuperUserPasswordResponse {
+  // FeatureDisable FIXME
+  bool feature_disabled = 1;
+  // SuperUserPassword is the password of the superuser on the ipmi device
+  string super_user_password = 2 [(buf.validate.field).string = {
+    min_len: 2
+    max_len: 128
+  }];
+}
diff --git a/python/metalstack/api/v2/common_pb2.py b/python/metalstack/api/v2/common_pb2.py
index bc8ff12e..eb5bebb1 100644
--- a/python/metalstack/api/v2/common_pb2.py
+++ b/python/metalstack/api/v2/common_pb2.py
@@ -27,7 +27,7 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/common.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"O\n\x06Paging\x12\x17\n\x04page\x18\x01 \x01(\x04H\x00R\x04page\x88\x01\x01\x12\x19\n\x05\x63ount\x18\x02 \x01(\x04H\x01R\x05\x63ount\x88\x01\x01\x42\x07\n\x05_pageB\x08\n\x06_count\"\x9c\x01\n\x06Labels\x12W\n\x06labels\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.Labels.LabelsEntryB\x18\xbaH\x15\x9a\x01\x12\"\x07r\x05\x10\x01\x18\x80\x02*\x07r\x05\x10\x00\x18\x80\x02R\x06labels\x1a\x39\n\x0bLabelsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\"\xdf\x01\n\x04Meta\x12\x36\n\x06labels\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x00R\x06labels\x88\x01\x01\x12\x39\n\ncreated_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tcreatedAt\x12\x39\n\nupdated_at\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x1e\n\ngeneration\x18\x04 \x01(\x04R\ngenerationB\t\n\x07_labels\"Y\n\x0cUpdateLabels\x12\x31\n\x06update\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06update\x12\x16\n\x06remove\x18\x02 \x03(\tR\x06remove\"\xaa\x01\n\nUpdateMeta\x12\x39\n\nupdated_at\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x61\n\x10locking_strategy\x18\x02 \x01(\x0e\x32,.metalstack.api.v2.OptimisticLockingStrategyB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0flockingStrategy*\x87\x01\n\nTenantRole\x12\x1b\n\x17TENANT_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11TENANT_ROLE_OWNER\x10\x01\x12\x16\n\x12TENANT_ROLE_EDITOR\x10\x02\x12\x16\n\x12TENANT_ROLE_VIEWER\x10\x03\x12\x15\n\x11TENANT_ROLE_GUEST\x10\x04*u\n\x0bProjectRole\x12\x1c\n\x18PROJECT_ROLE_UNSPECIFIED\x10\x00\x12\x16\n\x12PROJECT_ROLE_OWNER\x10\x01\x12\x17\n\x13PROJECT_ROLE_EDITOR\x10\x02\x12\x17\n\x13PROJECT_ROLE_VIEWER\x10\x03*U\n\tAdminRole\x12\x1a\n\x16\x41\x44MIN_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41\x44MIN_ROLE_EDITOR\x10\x01\x12\x15\n\x11\x41\x44MIN_ROLE_VIEWER\x10\x02*U\n\tInfraRole\x12\x1a\n\x16INFRA_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11INFRA_ROLE_EDITOR\x10\x01\x12\x15\n\x11INFRA_ROLE_VIEWER\x10\x02*T\n\nVisibility\x12\x1a\n\x16VISIBILITY_UNSPECIFIED\x10\x00\x12\x15\n\x11VISIBILITY_PUBLIC\x10\x01\x12\x13\n\x0fVISIBILITY_SELF\x10\x03*R\n\x08\x41uditing\x12\x18\n\x14\x41UDITING_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41UDITING_INCLUDED\x10\x01\x12\x15\n\x11\x41UDITING_EXCLUDED\x10\x02*\x98\x01\n\x19OptimisticLockingStrategy\x12+\n\'OPTIMISTIC_LOCKING_STRATEGY_UNSPECIFIED\x10\x00\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_CLIENT\x10\x01\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_SERVER\x10\x02:b\n\x0ctenant_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb8\x8e\x03 \x03(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x0btenantRoles:e\n\rproject_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb9\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x0cprojectRoles:_\n\x0b\x61\x64min_roles\x12\x1e.google.protobuf.MethodOptions\x18\xba\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.AdminRoleR\nadminRoles:_\n\nvisibility\x12\x1e.google.protobuf.MethodOptions\x18\xbb\x8e\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.VisibilityR\nvisibility:Y\n\x08\x61uditing\x12\x1e.google.protobuf.MethodOptions\x18\xbc\x8e\x03 \x01(\x0e\x32\x1b.metalstack.api.v2.AuditingR\x08\x61uditing:_\n\x0binfra_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbd\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.InfraRoleR\ninfraRoles:O\n\x11\x65num_string_value\x12!.google.protobuf.EnumValueOptions\x18\xa0\x96\x03 \x01(\tR\x0f\x65numStringValueB\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0b\x43ommonProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/common.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"O\n\x06Paging\x12\x17\n\x04page\x18\x01 \x01(\x04H\x00R\x04page\x88\x01\x01\x12\x19\n\x05\x63ount\x18\x02 \x01(\x04H\x01R\x05\x63ount\x88\x01\x01\x42\x07\n\x05_pageB\x08\n\x06_count\"\x9c\x01\n\x06Labels\x12W\n\x06labels\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.Labels.LabelsEntryB\x18\xbaH\x15\x9a\x01\x12\"\x07r\x05\x10\x01\x18\x80\x02*\x07r\x05\x10\x00\x18\x80\x02R\x06labels\x1a\x39\n\x0bLabelsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\"\xdf\x01\n\x04Meta\x12\x36\n\x06labels\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x00R\x06labels\x88\x01\x01\x12\x39\n\ncreated_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tcreatedAt\x12\x39\n\nupdated_at\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x1e\n\ngeneration\x18\x04 \x01(\x04R\ngenerationB\t\n\x07_labels\"Y\n\x0cUpdateLabels\x12\x31\n\x06update\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06update\x12\x16\n\x06remove\x18\x02 \x03(\tR\x06remove\"\xaa\x01\n\nUpdateMeta\x12\x39\n\nupdated_at\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x61\n\x10locking_strategy\x18\x02 \x01(\x0e\x32,.metalstack.api.v2.OptimisticLockingStrategyB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0flockingStrategy*\x87\x01\n\nTenantRole\x12\x1b\n\x17TENANT_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11TENANT_ROLE_OWNER\x10\x01\x12\x16\n\x12TENANT_ROLE_EDITOR\x10\x02\x12\x16\n\x12TENANT_ROLE_VIEWER\x10\x03\x12\x15\n\x11TENANT_ROLE_GUEST\x10\x04*u\n\x0bProjectRole\x12\x1c\n\x18PROJECT_ROLE_UNSPECIFIED\x10\x00\x12\x16\n\x12PROJECT_ROLE_OWNER\x10\x01\x12\x17\n\x13PROJECT_ROLE_EDITOR\x10\x02\x12\x17\n\x13PROJECT_ROLE_VIEWER\x10\x03*U\n\tAdminRole\x12\x1a\n\x16\x41\x44MIN_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41\x44MIN_ROLE_EDITOR\x10\x01\x12\x15\n\x11\x41\x44MIN_ROLE_VIEWER\x10\x02*U\n\tInfraRole\x12\x1a\n\x16INFRA_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11INFRA_ROLE_EDITOR\x10\x01\x12\x15\n\x11INFRA_ROLE_VIEWER\x10\x02*]\n\x0bMachineRole\x12\x1c\n\x18MACHINE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n\x13MACHINE_ROLE_EDITOR\x10\x01\x12\x17\n\x13MACHINE_ROLE_VIEWER\x10\x02*T\n\nVisibility\x12\x1a\n\x16VISIBILITY_UNSPECIFIED\x10\x00\x12\x15\n\x11VISIBILITY_PUBLIC\x10\x01\x12\x13\n\x0fVISIBILITY_SELF\x10\x03*R\n\x08\x41uditing\x12\x18\n\x14\x41UDITING_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41UDITING_INCLUDED\x10\x01\x12\x15\n\x11\x41UDITING_EXCLUDED\x10\x02*\x98\x01\n\x19OptimisticLockingStrategy\x12+\n\'OPTIMISTIC_LOCKING_STRATEGY_UNSPECIFIED\x10\x00\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_CLIENT\x10\x01\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_SERVER\x10\x02:b\n\x0ctenant_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb8\x8e\x03 \x03(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x0btenantRoles:e\n\rproject_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb9\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x0cprojectRoles:_\n\x0b\x61\x64min_roles\x12\x1e.google.protobuf.MethodOptions\x18\xba\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.AdminRoleR\nadminRoles:_\n\nvisibility\x12\x1e.google.protobuf.MethodOptions\x18\xbb\x8e\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.VisibilityR\nvisibility:Y\n\x08\x61uditing\x12\x1e.google.protobuf.MethodOptions\x18\xbc\x8e\x03 \x01(\x0e\x32\x1b.metalstack.api.v2.AuditingR\x08\x61uditing:_\n\x0binfra_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbd\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.InfraRoleR\ninfraRoles:e\n\rmachine_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbe\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x0cmachineRoles:O\n\x11\x65num_string_value\x12!.google.protobuf.EnumValueOptions\x18\xa0\x96\x03 \x01(\tR\x0f\x65numStringValueB\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0b\x43ommonProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -49,12 +49,14 @@
   _globals['_ADMINROLE']._serialized_end=1221
   _globals['_INFRAROLE']._serialized_start=1223
   _globals['_INFRAROLE']._serialized_end=1308
-  _globals['_VISIBILITY']._serialized_start=1310
-  _globals['_VISIBILITY']._serialized_end=1394
-  _globals['_AUDITING']._serialized_start=1396
-  _globals['_AUDITING']._serialized_end=1478
-  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_start=1481
-  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_end=1633
+  _globals['_MACHINEROLE']._serialized_start=1310
+  _globals['_MACHINEROLE']._serialized_end=1403
+  _globals['_VISIBILITY']._serialized_start=1405
+  _globals['_VISIBILITY']._serialized_end=1489
+  _globals['_AUDITING']._serialized_start=1491
+  _globals['_AUDITING']._serialized_end=1573
+  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_start=1576
+  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_end=1728
   _globals['_PAGING']._serialized_start=149
   _globals['_PAGING']._serialized_end=228
   _globals['_LABELS']._serialized_start=231
diff --git a/python/metalstack/api/v2/common_pb2.pyi b/python/metalstack/api/v2/common_pb2.pyi
index f4bb2283..4e014f5a 100644
--- a/python/metalstack/api/v2/common_pb2.pyi
+++ b/python/metalstack/api/v2/common_pb2.pyi
@@ -39,6 +39,12 @@ class InfraRole(int, metaclass=_enum_type_wrapper.EnumTypeWrapper):
     INFRA_ROLE_EDITOR: _ClassVar[InfraRole]
     INFRA_ROLE_VIEWER: _ClassVar[InfraRole]
 
+class MachineRole(int, metaclass=_enum_type_wrapper.EnumTypeWrapper):
+    __slots__ = ()
+    MACHINE_ROLE_UNSPECIFIED: _ClassVar[MachineRole]
+    MACHINE_ROLE_EDITOR: _ClassVar[MachineRole]
+    MACHINE_ROLE_VIEWER: _ClassVar[MachineRole]
+
 class Visibility(int, metaclass=_enum_type_wrapper.EnumTypeWrapper):
     __slots__ = ()
     VISIBILITY_UNSPECIFIED: _ClassVar[Visibility]
@@ -71,6 +77,9 @@ ADMIN_ROLE_VIEWER: AdminRole
 INFRA_ROLE_UNSPECIFIED: InfraRole
 INFRA_ROLE_EDITOR: InfraRole
 INFRA_ROLE_VIEWER: InfraRole
+MACHINE_ROLE_UNSPECIFIED: MachineRole
+MACHINE_ROLE_EDITOR: MachineRole
+MACHINE_ROLE_VIEWER: MachineRole
 VISIBILITY_UNSPECIFIED: Visibility
 VISIBILITY_PUBLIC: Visibility
 VISIBILITY_SELF: Visibility
@@ -92,6 +101,8 @@ AUDITING_FIELD_NUMBER: _ClassVar[int]
 auditing: _descriptor.FieldDescriptor
 INFRA_ROLES_FIELD_NUMBER: _ClassVar[int]
 infra_roles: _descriptor.FieldDescriptor
+MACHINE_ROLES_FIELD_NUMBER: _ClassVar[int]
+machine_roles: _descriptor.FieldDescriptor
 ENUM_STRING_VALUE_FIELD_NUMBER: _ClassVar[int]
 enum_string_value: _descriptor.FieldDescriptor
 
diff --git a/python/metalstack/api/v2/machine_pb2.py b/python/metalstack/api/v2/machine_pb2.py
index ad3237a2..9bdc7c5d 100644
--- a/python/metalstack/api/v2/machine_pb2.py
+++ b/python/metalstack/api/v2/machine_pb2.py
@@ -33,7 +33,7 @@
 from metalstack.api.v2 import size_pb2 as metalstack_dot_api_dot_v2_dot_size__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/api/v2/machine.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\"metalstack/api/v2/filesystem.proto\x1a\x1dmetalstack/api/v2/image.proto\x1a\x1fmetalstack/api/v2/network.proto\x1a!metalstack/api/v2/partition.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1cmetalstack/api/v2/size.proto\"\\\n\x18MachineServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"Q\n\x19MachineServiceGetResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xa2\x08\n\x1bMachineServiceCreateRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12!\n\x04uuid\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12(\n\x08hostname\x18\x05 \x01(\tB\x07\xbaH\x04r\x02h\x01H\x02R\x08hostname\x88\x01\x01\x12)\n\tpartition\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\x12\x1c\n\x04size\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04size\x12\x1e\n\x05image\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05image\x12\x30\n\x11\x66ilesystem_layout\x18\t \x01(\tH\x03R\x10\x66ilesystemLayout\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\n \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12*\n\x08userdata\x18\x0b \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02H\x04R\x08userdata\x88\x01\x01\x12\x31\n\x06labels\x18\x0c \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x12G\n\x08networks\x18\r \x03(\x0b\x32+.metalstack.api.v2.MachineAllocationNetworkR\x08networks\x12\x1e\n\x03ips\x18\x0e \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12%\n\x0eplacement_tags\x18\x0f \x03(\tR\rplacementTags\x12\x45\n\ndns_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x11 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12[\n\x0f\x61llocation_type\x18\x12 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12\x44\n\rfirewall_spec\x18\x13 \x01(\x0b\x32\x1f.metalstack.api.v2.FirewallSpecR\x0c\x66irewallSpecB\x07\n\x05_uuidB\x0e\n\x0c_descriptionB\x0b\n\t_hostnameB\x14\n\x12_filesystem_layoutB\x0b\n\t_userdata\"W\n\x0c\x46irewallSpec\x12G\n\x0e\x66irewall_rules\x18\x13 \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\"T\n\x1cMachineServiceCreateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xef\x02\n\x1bMachineServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12\"\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x05 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x01R\x06labels\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\x06 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeysB\x0e\n\x0c_descriptionB\t\n\x07_labels\"T\n\x1cMachineServiceUpdateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"v\n\x19MachineServiceListRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.MachineQueryR\x05query\"T\n\x1aMachineServiceListResponse\x12\x36\n\x08machines\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.MachineR\x08machines\"_\n\x1bMachineServiceDeleteRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"T\n\x1cMachineServiceDeleteResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xc1\x04\n\x07Machine\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12:\n\tpartition\x18\x03 \x01(\x0b\x32\x1c.metalstack.api.v2.PartitionR\tpartition\x12\x1c\n\x04rack\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04rack\x12+\n\x04size\x18\x05 \x01(\x0b\x32\x17.metalstack.api.v2.SizeR\x04size\x12>\n\x08hardware\x18\x06 \x01(\x0b\x32\".metalstack.api.v2.MachineHardwareR\x08hardware\x12\x32\n\x04\x62ios\x18\x07 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineBiosR\x04\x62ios\x12\x44\n\nallocation\x18\x08 \x01(\x0b\x32$.metalstack.api.v2.MachineAllocationR\nallocation\x12\x38\n\x06status\x18\t \x01(\x0b\x32 .metalstack.api.v2.MachineStatusR\x06status\x12p\n\x1arecent_provisioning_events\x18\n \x01(\x0b\x32\x32.metalstack.api.v2.MachineRecentProvisioningEventsR\x18recentProvisioningEvents\"\xa4\x02\n\rMachineStatus\x12\x41\n\tcondition\x18\x01 \x01(\x0b\x32#.metalstack.api.v2.MachineConditionR\tcondition\x12N\n\tled_state\x18\x02 \x01(\x0b\x32\x31.metalstack.api.v2.MachineChassisIdentifyLEDStateR\x08ledState\x12N\n\nliveliness\x18\x03 \x01(\x0e\x32$.metalstack.api.v2.MachineLivelinessB\x08\xbaH\x05\x82\x01\x02\x10\x01R\nliveliness\x12\x30\n\x14metal_hammer_version\x18\x04 \x01(\tR\x12metalHammerVersion\"\xa4\x01\n\x10MachineCondition\x12?\n\x05state\x18\x01 \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12 \n\x06issuer\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06issuer\"\xa8\x07\n\x11MachineAllocation\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12\'\n\ncreated_by\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\tcreatedBy\x12\"\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12.\n\x05image\x18\x07 \x01(\x0b\x32\x18.metalstack.api.v2.ImageR\x05image\x12P\n\x11\x66ilesystem_layout\x18\x08 \x01(\x0b\x32#.metalstack.api.v2.FilesystemLayoutR\x10\x66ilesystemLayout\x12=\n\x08networks\x18\t \x03(\x0b\x32!.metalstack.api.v2.MachineNetworkR\x08networks\x12#\n\x08hostname\x18\n \x01(\tB\x07\xbaH\x04r\x02h\x01R\x08hostname\x12\x39\n\x0fssh_public_keys\x18\x0b \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12%\n\x08userdata\x18\x0c \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02R\x08userdata\x12[\n\x0f\x61llocation_type\x18\r \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12G\n\x0e\x66irewall_rules\x18\x0e \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\x12\x45\n\ndns_server\x18\x0f \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12/\n\x03vpn\x18\x11 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineVPNR\x03vpn\"}\n\x18MachineAllocationNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12\x30\n\x12no_auto_acquire_ip\x18\x02 \x01(\x08H\x00R\x0fnoAutoAcquireIp\x88\x01\x01\x42\x15\n\x13_no_auto_acquire_ip\"\x90\x01\n\rFirewallRules\x12=\n\x06\x65gress\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.FirewallEgressRuleR\x06\x65gress\x12@\n\x07ingress\x18\x02 \x03(\x0b\x32&.metalstack.api.v2.FirewallIngressRuleR\x07ingress\"\xd0\x01\n\x12\x46irewallEgressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x02to\x12\x31\n\x07\x63omment\x18\x04 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xf3\x01\n\x13\x46irewallIngressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x02to\x12 \n\x04\x66rom\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x04\x66rom\x12\x31\n\x07\x63omment\x18\x05 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xe7\x02\n\x0eMachineNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12K\n\x0cnetwork_type\x18\x05 \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0bnetworkType\x12?\n\x08nat_type\x18\x06 \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x07natType\x12\x10\n\x03vrf\x18\x07 \x01(\x04R\x03vrf\x12\x10\n\x03\x61sn\x18\x08 \x01(\rR\x03\x61sn\"\xfb\x01\n\x0fMachineHardware\x12\x16\n\x06memory\x18\x01 \x01(\x04R\x06memory\x12;\n\x05\x64isks\x18\x03 \x03(\x0b\x32%.metalstack.api.v2.MachineBlockDeviceR\x05\x64isks\x12/\n\x04\x63pus\x18\x04 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalCPUR\x04\x63pus\x12/\n\x04gpus\x18\x05 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalGPUR\x04gpus\x12\x31\n\x04nics\x18\x06 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\x04nics\"|\n\x08MetalCPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\x12\x14\n\x05\x63ores\x18\x03 \x01(\rR\x05\x63ores\x12\x18\n\x07threads\x18\x04 \x01(\rR\x07threads\"L\n\x08MetalGPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\"\xa7\x02\n\nMachineNic\x12\x1d\n\x03mac\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12(\n\nidentifier\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\nidentifier\x12 \n\x06vendor\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x06vendor\x12\x1e\n\x05model\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05model\x12\x14\n\x05speed\x18\x06 \x01(\x04R\x05speed\x12;\n\tneighbors\x18\x07 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\tneighbors\x12\x1a\n\x08hostname\x18\x08 \x01(\tR\x08hostname\"I\n\x12MachineBlockDevice\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x12\n\x04size\x18\x02 \x01(\x04R\x04size\"o\n\x1eMachineChassisIdentifyLEDState\x12\x1e\n\x05value\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05value\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\"q\n\x0bMachineBios\x12\"\n\x07version\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07version\x12 \n\x06vendor\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1c\n\x04\x64\x61te\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x04\x64\x61te\"\xd3\x02\n\x1fMachineRecentProvisioningEvents\x12\x43\n\x06\x65vents\x18\x01 \x03(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x06\x65vents\x12\x42\n\x0flast_event_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\rlastEventTime\x12U\n\x10last_error_event\x18\x03 \x01(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x0elastErrorEvent\x12P\n\x05state\x18\x04 \x01(\x0e\x32\x30.metalstack.api.v2.MachineProvisioningEventStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\"\xab\x01\n\x18MachineProvisioningEvent\x12.\n\x04time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x04time\x12\x45\n\x05\x65vent\x18\x02 \x01(\x0e\x32/.metalstack.api.v2.MachineProvisioningEventTypeR\x05\x65vent\x12\x18\n\x07message\x18\x03 \x01(\tR\x07message\"y\n\nMachineVPN\x12\x32\n\x15\x63ontrol_plane_address\x18\x01 \x01(\tR\x13\x63ontrolPlaneAddress\x12\x19\n\x08\x61uth_key\x18\x02 \x01(\tR\x07\x61uthKey\x12\x1c\n\tconnected\x18\x03 \x01(\x08R\tconnected\"\xa8\x07\n\x0cMachineQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12-\n\tpartition\x18\x03 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x02R\tpartition\x88\x01\x01\x12#\n\x04size\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x04size\x88\x01\x01\x12#\n\x04rack\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x04rack\x88\x01\x01\x12\x36\n\x06labels\x18\x06 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12N\n\nallocation\x18\x07 \x01(\x0b\x32).metalstack.api.v2.MachineAllocationQueryH\x06R\nallocation\x88\x01\x01\x12\x45\n\x07network\x18\x08 \x01(\x0b\x32&.metalstack.api.v2.MachineNetworkQueryH\x07R\x07network\x88\x01\x01\x12\x39\n\x03nic\x18\t \x01(\x0b\x32\".metalstack.api.v2.MachineNicQueryH\x08R\x03nic\x88\x01\x01\x12<\n\x04\x64isk\x18\n \x01(\x0b\x32#.metalstack.api.v2.MachineDiskQueryH\tR\x04\x64isk\x88\x01\x01\x12<\n\x04ipmi\x18\x0b \x01(\x0b\x32#.metalstack.api.v2.MachineIPMIQueryH\nR\x04ipmi\x88\x01\x01\x12\x39\n\x03\x66ru\x18\x0c \x01(\x0b\x32\".metalstack.api.v2.MachineFRUQueryH\x0bR\x03\x66ru\x88\x01\x01\x12H\n\x08hardware\x18\r \x01(\x0b\x32\'.metalstack.api.v2.MachineHardwareQueryH\x0cR\x08hardware\x88\x01\x01\x12:\n\x05state\x18\x0e \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateH\rR\x05state\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\x0c\n\n_partitionB\x07\n\x05_sizeB\x07\n\x05_rackB\t\n\x07_labelsB\r\n\x0b_allocationB\n\n\x08_networkB\x06\n\x04_nicB\x07\n\x05_diskB\x07\n\x05_ipmiB\x06\n\x04_fruB\x0b\n\t_hardwareB\x08\n\x06_state\"\xa0\x04\n\x16MachineAllocationQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\'\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x02R\x07project\x88\x01\x01\x12%\n\x05image\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x05image\x88\x01\x01\x12<\n\x11\x66ilesystem_layout\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x10\x66ilesystemLayout\x88\x01\x01\x12+\n\x08hostname\x18\x06 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x05R\x08hostname\x88\x01\x01\x12`\n\x0f\x61llocation_type\x18\x07 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x0e\x61llocationType\x88\x01\x01\x12\x36\n\x06labels\x18\x08 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x07R\x06labels\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\n\n\x08_projectB\x08\n\x06_imageB\x14\n\x12_filesystem_layoutB\x0b\n\t_hostnameB\x12\n\x10_allocation_typeB\t\n\x07_labels\"\xe4\x01\n\x13MachineNetworkQuery\x12\x1a\n\x08networks\x18\x01 \x03(\tR\x08networks\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12\x12\n\x04vrfs\x18\x05 \x03(\x04R\x04vrfs\x12\x12\n\x04\x61sns\x18\x06 \x03(\rR\x04\x61sns\"\xd9\x01\n\x0fMachineNicQuery\x12(\n\x04macs\x18\x01 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x04macs\x12\'\n\x05names\x18\x02 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\x05names\x12\x39\n\rneighbor_macs\x18\x03 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x0cneighborMacs\x12\x38\n\x0eneighbor_names\x18\x04 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\rneighborNames\"Y\n\x10MachineDiskQuery\x12%\n\x05names\x18\x01 \x03(\tB\x0f\xbaH\x0c\x92\x01\t\x10\x64\"\x05r\x03\x18\x80\x01R\x05names\x12\x1e\n\x05sizes\x18\x02 \x03(\x04\x42\x08\xbaH\x05\x92\x01\x02\x10\x64R\x05sizes\"\xd9\x01\n\x10MachineIPMIQuery\x12&\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01H\x00R\x07\x61\x64\x64ress\x88\x01\x01\x12\"\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01H\x01R\x03mac\x88\x01\x01\x12!\n\x04user\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x04user\x88\x01\x01\x12+\n\tinterface\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\tinterface\x88\x01\x01\x42\n\n\x08_addressB\x06\n\x04_macB\x07\n\x05_userB\x0c\n\n_interface\"\x88\x05\n\x0fMachineFRUQuery\x12=\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12=\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12*\n\tboard_mfg\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12\x30\n\x0c\x62oard_serial\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\x0b\x62oardSerial\x88\x01\x01\x12\x39\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12@\n\x14product_manufacturer\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x05R\x13productManufacturer\x88\x01\x01\x12=\n\x13product_part_number\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x34\n\x0eproduct_serial\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x0f\n\r_board_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"n\n\x14MachineHardwareQuery\x12\x1b\n\x06memory\x18\x01 \x01(\x04H\x00R\x06memory\x88\x01\x01\x12 \n\tcpu_cores\x18\x02 \x01(\rH\x01R\x08\x63puCores\x88\x01\x01\x42\t\n\x07_memoryB\x0c\n\n_cpu_cores*e\n\nIPProtocol\x12\x1b\n\x17IP_PROTOCOL_UNSPECIFIED\x10\x00\x12\x1c\n\x0fIP_PROTOCOL_TCP\x10\x01\x1a\x07\x82\xb2\x19\x03tcp\x12\x1c\n\x0fIP_PROTOCOL_UDP\x10\x02\x1a\x07\x82\xb2\x19\x03udp*\xaf\x01\n\x0cMachineState\x12#\n\x19MACHINE_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12(\n\x16MACHINE_STATE_RESERVED\x10\x01\x1a\x0c\x82\xb2\x19\x08reserved\x12$\n\x14MACHINE_STATE_LOCKED\x10\x02\x1a\n\x82\xb2\x19\x06locked\x12*\n\x17MACHINE_STATE_AVAILABLE\x10\x03\x1a\r\x82\xb2\x19\tavailable*\xdf\x01\n\x1dMachineProvisioningEventState\x12\x36\n,MACHINE_PROVISIONING_EVENT_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12=\n*MACHINE_PROVISIONING_EVENT_STATE_CRASHLOOP\x10\x01\x1a\r\x82\xb2\x19\tcrashloop\x12G\n/MACHINE_PROVISIONING_EVENT_STATE_FAILED_RECLAIM\x10\x02\x1a\x12\x82\xb2\x19\x0e\x66\x61iled-reclaim*\x9f\x06\n\x1cMachineProvisioningEventType\x12/\n+MACHINE_PROVISIONING_EVENT_TYPE_UNSPECIFIED\x10\x00\x12\x34\n%MACHINE_PROVISIONING_EVENT_TYPE_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x41live\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_CRASHED\x10\x02\x1a\x0b\x82\xb2\x19\x07\x43rashed\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PXE_BOOTING\x10\x03\x1a\x0f\x82\xb2\x19\x0bPXE Booting\x12\x46\n.MACHINE_PROVISIONING_EVENT_TYPE_PLANNED_REBOOT\x10\x04\x1a\x12\x82\xb2\x19\x0ePlanned Reboot\x12<\n)MACHINE_PROVISIONING_EVENT_TYPE_PREPARING\x10\x05\x1a\r\x82\xb2\x19\tPreparing\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_REGISTERING\x10\x06\x1a\x0f\x82\xb2\x19\x0bRegistering\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_WAITING\x10\x07\x1a\x0b\x82\xb2\x19\x07Waiting\x12>\n*MACHINE_PROVISIONING_EVENT_TYPE_INSTALLING\x10\x08\x1a\x0e\x82\xb2\x19\nInstalling\x12N\n2MACHINE_PROVISIONING_EVENT_TYPE_BOOTING_NEW_KERNEL\x10\t\x1a\x16\x82\xb2\x19\x12\x42ooting New Kernel\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PHONED_HOME\x10\n\x1a\x0f\x82\xb2\x19\x0bPhoned Home\x12H\n/MACHINE_PROVISIONING_EVENT_TYPE_MACHINE_RECLAIM\x10\x0b\x1a\x13\x82\xb2\x19\x0fMachine Reclaim*\xba\x01\n\x11MachineLiveliness\x12(\n\x1eMACHINE_LIVELINESS_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\'\n\x18MACHINE_LIVELINESS_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x61live\x12%\n\x17MACHINE_LIVELINESS_DEAD\x10\x02\x1a\x08\x82\xb2\x19\x04\x64\x65\x61\x64\x12+\n\x1aMACHINE_LIVELINESS_UNKNOWN\x10\x03\x1a\x0b\x82\xb2\x19\x07unknown*\xac\x01\n\x15MachineAllocationType\x12-\n#MACHINE_ALLOCATION_TYPE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\x30\n\x1fMACHINE_ALLOCATION_TYPE_MACHINE\x10\x01\x1a\x0b\x82\xb2\x19\x07machine\x12\x32\n MACHINE_ALLOCATION_TYPE_FIREWALL\x10\x02\x1a\x0c\x82\xb2\x19\x08\x66irewall2\xca\x04\n\x0eMachineService\x12m\n\x03Get\x12+.metalstack.api.v2.MachineServiceGetRequest\x1a,.metalstack.api.v2.MachineServiceGetResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x43reate\x12..metalstack.api.v2.MachineServiceCreateRequest\x1a/.metalstack.api.v2.MachineServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n\x06Update\x12..metalstack.api.v2.MachineServiceUpdateRequest\x1a/.metalstack.api.v2.MachineServiceUpdateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12p\n\x04List\x12,.metalstack.api.v2.MachineServiceListRequest\x1a-.metalstack.api.v2.MachineServiceListResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x44\x65lete\x12..metalstack.api.v2.MachineServiceDeleteRequest\x1a/.metalstack.api.v2.MachineServiceDeleteResponse\"\x06\xca\xf3\x18\x02\x01\x02\x42\xc2\x01\n\x15\x63om.metalstack.api.v2B\x0cMachineProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/api/v2/machine.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\"metalstack/api/v2/filesystem.proto\x1a\x1dmetalstack/api/v2/image.proto\x1a\x1fmetalstack/api/v2/network.proto\x1a!metalstack/api/v2/partition.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1cmetalstack/api/v2/size.proto\"\\\n\x18MachineServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"Q\n\x19MachineServiceGetResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xa2\x08\n\x1bMachineServiceCreateRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12!\n\x04uuid\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12(\n\x08hostname\x18\x05 \x01(\tB\x07\xbaH\x04r\x02h\x01H\x02R\x08hostname\x88\x01\x01\x12)\n\tpartition\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\x12\x1c\n\x04size\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04size\x12\x1e\n\x05image\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05image\x12\x30\n\x11\x66ilesystem_layout\x18\t \x01(\tH\x03R\x10\x66ilesystemLayout\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\n \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12*\n\x08userdata\x18\x0b \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02H\x04R\x08userdata\x88\x01\x01\x12\x31\n\x06labels\x18\x0c \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x12G\n\x08networks\x18\r \x03(\x0b\x32+.metalstack.api.v2.MachineAllocationNetworkR\x08networks\x12\x1e\n\x03ips\x18\x0e \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12%\n\x0eplacement_tags\x18\x0f \x03(\tR\rplacementTags\x12\x45\n\ndns_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x11 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12[\n\x0f\x61llocation_type\x18\x12 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12\x44\n\rfirewall_spec\x18\x13 \x01(\x0b\x32\x1f.metalstack.api.v2.FirewallSpecR\x0c\x66irewallSpecB\x07\n\x05_uuidB\x0e\n\x0c_descriptionB\x0b\n\t_hostnameB\x14\n\x12_filesystem_layoutB\x0b\n\t_userdata\"W\n\x0c\x46irewallSpec\x12G\n\x0e\x66irewall_rules\x18\x13 \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\"T\n\x1cMachineServiceCreateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xef\x02\n\x1bMachineServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12\"\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x05 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x01R\x06labels\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\x06 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeysB\x0e\n\x0c_descriptionB\t\n\x07_labels\"T\n\x1cMachineServiceUpdateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"v\n\x19MachineServiceListRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.MachineQueryR\x05query\"T\n\x1aMachineServiceListResponse\x12\x36\n\x08machines\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.MachineR\x08machines\"_\n\x1bMachineServiceDeleteRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"T\n\x1cMachineServiceDeleteResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xc1\x04\n\x07Machine\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12:\n\tpartition\x18\x03 \x01(\x0b\x32\x1c.metalstack.api.v2.PartitionR\tpartition\x12\x1c\n\x04rack\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04rack\x12+\n\x04size\x18\x05 \x01(\x0b\x32\x17.metalstack.api.v2.SizeR\x04size\x12>\n\x08hardware\x18\x06 \x01(\x0b\x32\".metalstack.api.v2.MachineHardwareR\x08hardware\x12\x32\n\x04\x62ios\x18\x07 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineBiosR\x04\x62ios\x12\x44\n\nallocation\x18\x08 \x01(\x0b\x32$.metalstack.api.v2.MachineAllocationR\nallocation\x12\x38\n\x06status\x18\t \x01(\x0b\x32 .metalstack.api.v2.MachineStatusR\x06status\x12p\n\x1arecent_provisioning_events\x18\n \x01(\x0b\x32\x32.metalstack.api.v2.MachineRecentProvisioningEventsR\x18recentProvisioningEvents\"\xa4\x02\n\rMachineStatus\x12\x41\n\tcondition\x18\x01 \x01(\x0b\x32#.metalstack.api.v2.MachineConditionR\tcondition\x12N\n\tled_state\x18\x02 \x01(\x0b\x32\x31.metalstack.api.v2.MachineChassisIdentifyLEDStateR\x08ledState\x12N\n\nliveliness\x18\x03 \x01(\x0e\x32$.metalstack.api.v2.MachineLivelinessB\x08\xbaH\x05\x82\x01\x02\x10\x01R\nliveliness\x12\x30\n\x14metal_hammer_version\x18\x04 \x01(\tR\x12metalHammerVersion\"\xa4\x01\n\x10MachineCondition\x12?\n\x05state\x18\x01 \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12 \n\x06issuer\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06issuer\"\xa8\x07\n\x11MachineAllocation\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12\'\n\ncreated_by\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\tcreatedBy\x12\"\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12.\n\x05image\x18\x07 \x01(\x0b\x32\x18.metalstack.api.v2.ImageR\x05image\x12P\n\x11\x66ilesystem_layout\x18\x08 \x01(\x0b\x32#.metalstack.api.v2.FilesystemLayoutR\x10\x66ilesystemLayout\x12=\n\x08networks\x18\t \x03(\x0b\x32!.metalstack.api.v2.MachineNetworkR\x08networks\x12#\n\x08hostname\x18\n \x01(\tB\x07\xbaH\x04r\x02h\x01R\x08hostname\x12\x39\n\x0fssh_public_keys\x18\x0b \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12%\n\x08userdata\x18\x0c \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02R\x08userdata\x12[\n\x0f\x61llocation_type\x18\r \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12G\n\x0e\x66irewall_rules\x18\x0e \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\x12\x45\n\ndns_server\x18\x0f \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12/\n\x03vpn\x18\x11 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineVPNR\x03vpn\"}\n\x18MachineAllocationNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12\x30\n\x12no_auto_acquire_ip\x18\x02 \x01(\x08H\x00R\x0fnoAutoAcquireIp\x88\x01\x01\x42\x15\n\x13_no_auto_acquire_ip\"\x90\x01\n\rFirewallRules\x12=\n\x06\x65gress\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.FirewallEgressRuleR\x06\x65gress\x12@\n\x07ingress\x18\x02 \x03(\x0b\x32&.metalstack.api.v2.FirewallIngressRuleR\x07ingress\"\xd0\x01\n\x12\x46irewallEgressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x02to\x12\x31\n\x07\x63omment\x18\x04 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xf3\x01\n\x13\x46irewallIngressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x02to\x12 \n\x04\x66rom\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x04\x66rom\x12\x31\n\x07\x63omment\x18\x05 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xe7\x02\n\x0eMachineNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12K\n\x0cnetwork_type\x18\x05 \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0bnetworkType\x12?\n\x08nat_type\x18\x06 \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x07natType\x12\x10\n\x03vrf\x18\x07 \x01(\x04R\x03vrf\x12\x10\n\x03\x61sn\x18\x08 \x01(\rR\x03\x61sn\"\xfb\x01\n\x0fMachineHardware\x12\x16\n\x06memory\x18\x01 \x01(\x04R\x06memory\x12;\n\x05\x64isks\x18\x03 \x03(\x0b\x32%.metalstack.api.v2.MachineBlockDeviceR\x05\x64isks\x12/\n\x04\x63pus\x18\x04 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalCPUR\x04\x63pus\x12/\n\x04gpus\x18\x05 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalGPUR\x04gpus\x12\x31\n\x04nics\x18\x06 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\x04nics\"|\n\x08MetalCPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\x12\x14\n\x05\x63ores\x18\x03 \x01(\rR\x05\x63ores\x12\x18\n\x07threads\x18\x04 \x01(\rR\x07threads\"L\n\x08MetalGPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\"\xa7\x02\n\nMachineNic\x12\x1d\n\x03mac\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12(\n\nidentifier\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\nidentifier\x12 \n\x06vendor\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x06vendor\x12\x1e\n\x05model\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05model\x12\x14\n\x05speed\x18\x06 \x01(\x04R\x05speed\x12;\n\tneighbors\x18\x07 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\tneighbors\x12\x1a\n\x08hostname\x18\x08 \x01(\tR\x08hostname\"I\n\x12MachineBlockDevice\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x12\n\x04size\x18\x02 \x01(\x04R\x04size\"o\n\x1eMachineChassisIdentifyLEDState\x12\x1e\n\x05value\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05value\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\"z\n\x0bMachineBios\x12%\n\x07version\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x07version\x12#\n\x06vendor\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x06vendor\x12\x1f\n\x04\x64\x61te\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04\x64\x61te\"\xd1\x02\n\x0bMachineIPMI\x12!\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x07\x61\x64\x64ress\x12\x1d\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04user\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04user\x12\'\n\x08password\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x08password\x12)\n\tinterface\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\tinterface\x12/\n\x03\x66ru\x18\x06 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineFRUR\x03\x66ru\x12,\n\x0b\x62mc_version\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\nbmcVersion\x12,\n\x0bpower_state\x18\x08 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\npowerState\"\xa6\x05\n\nMachineFRU\x12@\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12@\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12-\n\tboard_mfg\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12:\n\x10\x62oard_mfg_serial\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x03R\x0e\x62oardMfgSerial\x88\x01\x01\x12<\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12\x43\n\x14product_manufacturer\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x05R\x13productManufacturer\x88\x01\x01\x12@\n\x13product_part_number\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x37\n\x0eproduct_serial\x18\x08 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x13\n\x11_board_mfg_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"\xd3\x02\n\x1fMachineRecentProvisioningEvents\x12\x43\n\x06\x65vents\x18\x01 \x03(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x06\x65vents\x12\x42\n\x0flast_event_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\rlastEventTime\x12U\n\x10last_error_event\x18\x03 \x01(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x0elastErrorEvent\x12P\n\x05state\x18\x04 \x01(\x0e\x32\x30.metalstack.api.v2.MachineProvisioningEventStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\"\xab\x01\n\x18MachineProvisioningEvent\x12.\n\x04time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x04time\x12\x45\n\x05\x65vent\x18\x02 \x01(\x0e\x32/.metalstack.api.v2.MachineProvisioningEventTypeR\x05\x65vent\x12\x18\n\x07message\x18\x03 \x01(\tR\x07message\"y\n\nMachineVPN\x12\x32\n\x15\x63ontrol_plane_address\x18\x01 \x01(\tR\x13\x63ontrolPlaneAddress\x12\x19\n\x08\x61uth_key\x18\x02 \x01(\tR\x07\x61uthKey\x12\x1c\n\tconnected\x18\x03 \x01(\x08R\tconnected\"\xa8\x07\n\x0cMachineQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12-\n\tpartition\x18\x03 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x02R\tpartition\x88\x01\x01\x12#\n\x04size\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x04size\x88\x01\x01\x12#\n\x04rack\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x04rack\x88\x01\x01\x12\x36\n\x06labels\x18\x06 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12N\n\nallocation\x18\x07 \x01(\x0b\x32).metalstack.api.v2.MachineAllocationQueryH\x06R\nallocation\x88\x01\x01\x12\x45\n\x07network\x18\x08 \x01(\x0b\x32&.metalstack.api.v2.MachineNetworkQueryH\x07R\x07network\x88\x01\x01\x12\x39\n\x03nic\x18\t \x01(\x0b\x32\".metalstack.api.v2.MachineNicQueryH\x08R\x03nic\x88\x01\x01\x12<\n\x04\x64isk\x18\n \x01(\x0b\x32#.metalstack.api.v2.MachineDiskQueryH\tR\x04\x64isk\x88\x01\x01\x12<\n\x04ipmi\x18\x0b \x01(\x0b\x32#.metalstack.api.v2.MachineIPMIQueryH\nR\x04ipmi\x88\x01\x01\x12\x39\n\x03\x66ru\x18\x0c \x01(\x0b\x32\".metalstack.api.v2.MachineFRUQueryH\x0bR\x03\x66ru\x88\x01\x01\x12H\n\x08hardware\x18\r \x01(\x0b\x32\'.metalstack.api.v2.MachineHardwareQueryH\x0cR\x08hardware\x88\x01\x01\x12:\n\x05state\x18\x0e \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateH\rR\x05state\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\x0c\n\n_partitionB\x07\n\x05_sizeB\x07\n\x05_rackB\t\n\x07_labelsB\r\n\x0b_allocationB\n\n\x08_networkB\x06\n\x04_nicB\x07\n\x05_diskB\x07\n\x05_ipmiB\x06\n\x04_fruB\x0b\n\t_hardwareB\x08\n\x06_state\"\xa0\x04\n\x16MachineAllocationQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\'\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x02R\x07project\x88\x01\x01\x12%\n\x05image\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x05image\x88\x01\x01\x12<\n\x11\x66ilesystem_layout\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x10\x66ilesystemLayout\x88\x01\x01\x12+\n\x08hostname\x18\x06 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x05R\x08hostname\x88\x01\x01\x12`\n\x0f\x61llocation_type\x18\x07 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x0e\x61llocationType\x88\x01\x01\x12\x36\n\x06labels\x18\x08 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x07R\x06labels\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\n\n\x08_projectB\x08\n\x06_imageB\x14\n\x12_filesystem_layoutB\x0b\n\t_hostnameB\x12\n\x10_allocation_typeB\t\n\x07_labels\"\xe4\x01\n\x13MachineNetworkQuery\x12\x1a\n\x08networks\x18\x01 \x03(\tR\x08networks\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12\x12\n\x04vrfs\x18\x05 \x03(\x04R\x04vrfs\x12\x12\n\x04\x61sns\x18\x06 \x03(\rR\x04\x61sns\"\xd9\x01\n\x0fMachineNicQuery\x12(\n\x04macs\x18\x01 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x04macs\x12\'\n\x05names\x18\x02 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\x05names\x12\x39\n\rneighbor_macs\x18\x03 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x0cneighborMacs\x12\x38\n\x0eneighbor_names\x18\x04 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\rneighborNames\"Y\n\x10MachineDiskQuery\x12%\n\x05names\x18\x01 \x03(\tB\x0f\xbaH\x0c\x92\x01\t\x10\x64\"\x05r\x03\x18\x80\x01R\x05names\x12\x1e\n\x05sizes\x18\x02 \x03(\x04\x42\x08\xbaH\x05\x92\x01\x02\x10\x64R\x05sizes\"\xd9\x01\n\x10MachineIPMIQuery\x12&\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01H\x00R\x07\x61\x64\x64ress\x88\x01\x01\x12\"\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01H\x01R\x03mac\x88\x01\x01\x12!\n\x04user\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x04user\x88\x01\x01\x12+\n\tinterface\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\tinterface\x88\x01\x01\x42\n\n\x08_addressB\x06\n\x04_macB\x07\n\x05_userB\x0c\n\n_interface\"\x88\x05\n\x0fMachineFRUQuery\x12=\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12=\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12*\n\tboard_mfg\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12\x30\n\x0c\x62oard_serial\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\x0b\x62oardSerial\x88\x01\x01\x12\x39\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12@\n\x14product_manufacturer\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x05R\x13productManufacturer\x88\x01\x01\x12=\n\x13product_part_number\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x34\n\x0eproduct_serial\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x0f\n\r_board_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"n\n\x14MachineHardwareQuery\x12\x1b\n\x06memory\x18\x01 \x01(\x04H\x00R\x06memory\x88\x01\x01\x12 \n\tcpu_cores\x18\x02 \x01(\rH\x01R\x08\x63puCores\x88\x01\x01\x42\t\n\x07_memoryB\x0c\n\n_cpu_cores*e\n\nIPProtocol\x12\x1b\n\x17IP_PROTOCOL_UNSPECIFIED\x10\x00\x12\x1c\n\x0fIP_PROTOCOL_TCP\x10\x01\x1a\x07\x82\xb2\x19\x03tcp\x12\x1c\n\x0fIP_PROTOCOL_UDP\x10\x02\x1a\x07\x82\xb2\x19\x03udp*\xaf\x01\n\x0cMachineState\x12#\n\x19MACHINE_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12(\n\x16MACHINE_STATE_RESERVED\x10\x01\x1a\x0c\x82\xb2\x19\x08reserved\x12$\n\x14MACHINE_STATE_LOCKED\x10\x02\x1a\n\x82\xb2\x19\x06locked\x12*\n\x17MACHINE_STATE_AVAILABLE\x10\x03\x1a\r\x82\xb2\x19\tavailable*\xdf\x01\n\x1dMachineProvisioningEventState\x12\x36\n,MACHINE_PROVISIONING_EVENT_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12=\n*MACHINE_PROVISIONING_EVENT_STATE_CRASHLOOP\x10\x01\x1a\r\x82\xb2\x19\tcrashloop\x12G\n/MACHINE_PROVISIONING_EVENT_STATE_FAILED_RECLAIM\x10\x02\x1a\x12\x82\xb2\x19\x0e\x66\x61iled-reclaim*\x9f\x06\n\x1cMachineProvisioningEventType\x12/\n+MACHINE_PROVISIONING_EVENT_TYPE_UNSPECIFIED\x10\x00\x12\x34\n%MACHINE_PROVISIONING_EVENT_TYPE_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x41live\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_CRASHED\x10\x02\x1a\x0b\x82\xb2\x19\x07\x43rashed\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PXE_BOOTING\x10\x03\x1a\x0f\x82\xb2\x19\x0bPXE Booting\x12\x46\n.MACHINE_PROVISIONING_EVENT_TYPE_PLANNED_REBOOT\x10\x04\x1a\x12\x82\xb2\x19\x0ePlanned Reboot\x12<\n)MACHINE_PROVISIONING_EVENT_TYPE_PREPARING\x10\x05\x1a\r\x82\xb2\x19\tPreparing\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_REGISTERING\x10\x06\x1a\x0f\x82\xb2\x19\x0bRegistering\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_WAITING\x10\x07\x1a\x0b\x82\xb2\x19\x07Waiting\x12>\n*MACHINE_PROVISIONING_EVENT_TYPE_INSTALLING\x10\x08\x1a\x0e\x82\xb2\x19\nInstalling\x12N\n2MACHINE_PROVISIONING_EVENT_TYPE_BOOTING_NEW_KERNEL\x10\t\x1a\x16\x82\xb2\x19\x12\x42ooting New Kernel\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PHONED_HOME\x10\n\x1a\x0f\x82\xb2\x19\x0bPhoned Home\x12H\n/MACHINE_PROVISIONING_EVENT_TYPE_MACHINE_RECLAIM\x10\x0b\x1a\x13\x82\xb2\x19\x0fMachine Reclaim*\xba\x01\n\x11MachineLiveliness\x12(\n\x1eMACHINE_LIVELINESS_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\'\n\x18MACHINE_LIVELINESS_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x61live\x12%\n\x17MACHINE_LIVELINESS_DEAD\x10\x02\x1a\x08\x82\xb2\x19\x04\x64\x65\x61\x64\x12+\n\x1aMACHINE_LIVELINESS_UNKNOWN\x10\x03\x1a\x0b\x82\xb2\x19\x07unknown*\xac\x01\n\x15MachineAllocationType\x12-\n#MACHINE_ALLOCATION_TYPE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\x30\n\x1fMACHINE_ALLOCATION_TYPE_MACHINE\x10\x01\x1a\x0b\x82\xb2\x19\x07machine\x12\x32\n MACHINE_ALLOCATION_TYPE_FIREWALL\x10\x02\x1a\x0c\x82\xb2\x19\x08\x66irewall2\xca\x04\n\x0eMachineService\x12m\n\x03Get\x12+.metalstack.api.v2.MachineServiceGetRequest\x1a,.metalstack.api.v2.MachineServiceGetResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x43reate\x12..metalstack.api.v2.MachineServiceCreateRequest\x1a/.metalstack.api.v2.MachineServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n\x06Update\x12..metalstack.api.v2.MachineServiceUpdateRequest\x1a/.metalstack.api.v2.MachineServiceUpdateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12p\n\x04List\x12,.metalstack.api.v2.MachineServiceListRequest\x1a-.metalstack.api.v2.MachineServiceListResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x44\x65lete\x12..metalstack.api.v2.MachineServiceDeleteRequest\x1a/.metalstack.api.v2.MachineServiceDeleteResponse\"\x06\xca\xf3\x18\x02\x01\x02\x42\xc2\x01\n\x15\x63om.metalstack.api.v2B\x0cMachineProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -230,11 +230,41 @@
   _globals['_MACHINECHASSISIDENTIFYLEDSTATE'].fields_by_name['description']._loaded_options = None
   _globals['_MACHINECHASSISIDENTIFYLEDSTATE'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_MACHINEBIOS'].fields_by_name['version']._loaded_options = None
-  _globals['_MACHINEBIOS'].fields_by_name['version']._serialized_options = b'\272H\005r\003\030\200\002'
+  _globals['_MACHINEBIOS'].fields_by_name['version']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_MACHINEBIOS'].fields_by_name['vendor']._loaded_options = None
-  _globals['_MACHINEBIOS'].fields_by_name['vendor']._serialized_options = b'\272H\005r\003\030\200\002'
+  _globals['_MACHINEBIOS'].fields_by_name['vendor']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_MACHINEBIOS'].fields_by_name['date']._loaded_options = None
-  _globals['_MACHINEBIOS'].fields_by_name['date']._serialized_options = b'\272H\005r\003\030\200\002'
+  _globals['_MACHINEBIOS'].fields_by_name['date']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEIPMI'].fields_by_name['address']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['address']._serialized_options = b'\272H\004r\002p\001'
+  _globals['_MACHINEIPMI'].fields_by_name['mac']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['mac']._serialized_options = b'\272H\010r\006\270\263\256\261\002\001'
+  _globals['_MACHINEIPMI'].fields_by_name['user']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['user']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEIPMI'].fields_by_name['password']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['password']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEIPMI'].fields_by_name['interface']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['interface']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEIPMI'].fields_by_name['bmc_version']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['bmc_version']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEIPMI'].fields_by_name['power_state']._loaded_options = None
+  _globals['_MACHINEIPMI'].fields_by_name['power_state']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['chassis_part_number']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['chassis_part_number']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['chassis_part_serial']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['chassis_part_serial']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['board_mfg']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['board_mfg']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['board_mfg_serial']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['board_mfg_serial']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['board_part_number']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['board_part_number']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['product_manufacturer']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['product_manufacturer']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['product_part_number']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['product_part_number']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_MACHINEFRU'].fields_by_name['product_serial']._loaded_options = None
+  _globals['_MACHINEFRU'].fields_by_name['product_serial']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_MACHINERECENTPROVISIONINGEVENTS'].fields_by_name['state']._loaded_options = None
   _globals['_MACHINERECENTPROVISIONINGEVENTS'].fields_by_name['state']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_MACHINEQUERY'].fields_by_name['uuid']._loaded_options = None
@@ -313,18 +343,18 @@
   _globals['_MACHINESERVICE'].methods_by_name['List']._serialized_options = b'\312\363\030\003\001\002\003\340\363\030\002'
   _globals['_MACHINESERVICE'].methods_by_name['Delete']._loaded_options = None
   _globals['_MACHINESERVICE'].methods_by_name['Delete']._serialized_options = b'\312\363\030\002\001\002'
-  _globals['_IPPROTOCOL']._serialized_start=10396
-  _globals['_IPPROTOCOL']._serialized_end=10497
-  _globals['_MACHINESTATE']._serialized_start=10500
-  _globals['_MACHINESTATE']._serialized_end=10675
-  _globals['_MACHINEPROVISIONINGEVENTSTATE']._serialized_start=10678
-  _globals['_MACHINEPROVISIONINGEVENTSTATE']._serialized_end=10901
-  _globals['_MACHINEPROVISIONINGEVENTTYPE']._serialized_start=10904
-  _globals['_MACHINEPROVISIONINGEVENTTYPE']._serialized_end=11703
-  _globals['_MACHINELIVELINESS']._serialized_start=11706
-  _globals['_MACHINELIVELINESS']._serialized_end=11892
-  _globals['_MACHINEALLOCATIONTYPE']._serialized_start=11895
-  _globals['_MACHINEALLOCATIONTYPE']._serialized_end=12067
+  _globals['_IPPROTOCOL']._serialized_start=11426
+  _globals['_IPPROTOCOL']._serialized_end=11527
+  _globals['_MACHINESTATE']._serialized_start=11530
+  _globals['_MACHINESTATE']._serialized_end=11705
+  _globals['_MACHINEPROVISIONINGEVENTSTATE']._serialized_start=11708
+  _globals['_MACHINEPROVISIONINGEVENTSTATE']._serialized_end=11931
+  _globals['_MACHINEPROVISIONINGEVENTTYPE']._serialized_start=11934
+  _globals['_MACHINEPROVISIONINGEVENTTYPE']._serialized_end=12733
+  _globals['_MACHINELIVELINESS']._serialized_start=12736
+  _globals['_MACHINELIVELINESS']._serialized_end=12922
+  _globals['_MACHINEALLOCATIONTYPE']._serialized_start=12925
+  _globals['_MACHINEALLOCATIONTYPE']._serialized_end=13097
   _globals['_MACHINESERVICEGETREQUEST']._serialized_start=355
   _globals['_MACHINESERVICEGETREQUEST']._serialized_end=447
   _globals['_MACHINESERVICEGETRESPONSE']._serialized_start=449
@@ -378,29 +408,33 @@
   _globals['_MACHINECHASSISIDENTIFYLEDSTATE']._serialized_start=6518
   _globals['_MACHINECHASSISIDENTIFYLEDSTATE']._serialized_end=6629
   _globals['_MACHINEBIOS']._serialized_start=6631
-  _globals['_MACHINEBIOS']._serialized_end=6744
-  _globals['_MACHINERECENTPROVISIONINGEVENTS']._serialized_start=6747
-  _globals['_MACHINERECENTPROVISIONINGEVENTS']._serialized_end=7086
-  _globals['_MACHINEPROVISIONINGEVENT']._serialized_start=7089
-  _globals['_MACHINEPROVISIONINGEVENT']._serialized_end=7260
-  _globals['_MACHINEVPN']._serialized_start=7262
-  _globals['_MACHINEVPN']._serialized_end=7383
-  _globals['_MACHINEQUERY']._serialized_start=7386
-  _globals['_MACHINEQUERY']._serialized_end=8322
-  _globals['_MACHINEALLOCATIONQUERY']._serialized_start=8325
-  _globals['_MACHINEALLOCATIONQUERY']._serialized_end=8869
-  _globals['_MACHINENETWORKQUERY']._serialized_start=8872
-  _globals['_MACHINENETWORKQUERY']._serialized_end=9100
-  _globals['_MACHINENICQUERY']._serialized_start=9103
-  _globals['_MACHINENICQUERY']._serialized_end=9320
-  _globals['_MACHINEDISKQUERY']._serialized_start=9322
-  _globals['_MACHINEDISKQUERY']._serialized_end=9411
-  _globals['_MACHINEIPMIQUERY']._serialized_start=9414
-  _globals['_MACHINEIPMIQUERY']._serialized_end=9631
-  _globals['_MACHINEFRUQUERY']._serialized_start=9634
-  _globals['_MACHINEFRUQUERY']._serialized_end=10282
-  _globals['_MACHINEHARDWAREQUERY']._serialized_start=10284
-  _globals['_MACHINEHARDWAREQUERY']._serialized_end=10394
-  _globals['_MACHINESERVICE']._serialized_start=12070
-  _globals['_MACHINESERVICE']._serialized_end=12656
+  _globals['_MACHINEBIOS']._serialized_end=6753
+  _globals['_MACHINEIPMI']._serialized_start=6756
+  _globals['_MACHINEIPMI']._serialized_end=7093
+  _globals['_MACHINEFRU']._serialized_start=7096
+  _globals['_MACHINEFRU']._serialized_end=7774
+  _globals['_MACHINERECENTPROVISIONINGEVENTS']._serialized_start=7777
+  _globals['_MACHINERECENTPROVISIONINGEVENTS']._serialized_end=8116
+  _globals['_MACHINEPROVISIONINGEVENT']._serialized_start=8119
+  _globals['_MACHINEPROVISIONINGEVENT']._serialized_end=8290
+  _globals['_MACHINEVPN']._serialized_start=8292
+  _globals['_MACHINEVPN']._serialized_end=8413
+  _globals['_MACHINEQUERY']._serialized_start=8416
+  _globals['_MACHINEQUERY']._serialized_end=9352
+  _globals['_MACHINEALLOCATIONQUERY']._serialized_start=9355
+  _globals['_MACHINEALLOCATIONQUERY']._serialized_end=9899
+  _globals['_MACHINENETWORKQUERY']._serialized_start=9902
+  _globals['_MACHINENETWORKQUERY']._serialized_end=10130
+  _globals['_MACHINENICQUERY']._serialized_start=10133
+  _globals['_MACHINENICQUERY']._serialized_end=10350
+  _globals['_MACHINEDISKQUERY']._serialized_start=10352
+  _globals['_MACHINEDISKQUERY']._serialized_end=10441
+  _globals['_MACHINEIPMIQUERY']._serialized_start=10444
+  _globals['_MACHINEIPMIQUERY']._serialized_end=10661
+  _globals['_MACHINEFRUQUERY']._serialized_start=10664
+  _globals['_MACHINEFRUQUERY']._serialized_end=11312
+  _globals['_MACHINEHARDWAREQUERY']._serialized_start=11314
+  _globals['_MACHINEHARDWAREQUERY']._serialized_end=11424
+  _globals['_MACHINESERVICE']._serialized_start=13100
+  _globals['_MACHINESERVICE']._serialized_end=13686
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/machine_pb2.pyi b/python/metalstack/api/v2/machine_pb2.pyi
index d459a136..03435633 100644
--- a/python/metalstack/api/v2/machine_pb2.pyi
+++ b/python/metalstack/api/v2/machine_pb2.pyi
@@ -437,6 +437,46 @@ class MachineBios(_message.Message):
     date: str
     def __init__(self, version: _Optional[str] = ..., vendor: _Optional[str] = ..., date: _Optional[str] = ...) -> None: ...
 
+class MachineIPMI(_message.Message):
+    __slots__ = ("address", "mac", "user", "password", "interface", "fru", "bmc_version", "power_state")
+    ADDRESS_FIELD_NUMBER: _ClassVar[int]
+    MAC_FIELD_NUMBER: _ClassVar[int]
+    USER_FIELD_NUMBER: _ClassVar[int]
+    PASSWORD_FIELD_NUMBER: _ClassVar[int]
+    INTERFACE_FIELD_NUMBER: _ClassVar[int]
+    FRU_FIELD_NUMBER: _ClassVar[int]
+    BMC_VERSION_FIELD_NUMBER: _ClassVar[int]
+    POWER_STATE_FIELD_NUMBER: _ClassVar[int]
+    address: str
+    mac: str
+    user: str
+    password: str
+    interface: str
+    fru: MachineFRU
+    bmc_version: str
+    power_state: str
+    def __init__(self, address: _Optional[str] = ..., mac: _Optional[str] = ..., user: _Optional[str] = ..., password: _Optional[str] = ..., interface: _Optional[str] = ..., fru: _Optional[_Union[MachineFRU, _Mapping]] = ..., bmc_version: _Optional[str] = ..., power_state: _Optional[str] = ...) -> None: ...
+
+class MachineFRU(_message.Message):
+    __slots__ = ("chassis_part_number", "chassis_part_serial", "board_mfg", "board_mfg_serial", "board_part_number", "product_manufacturer", "product_part_number", "product_serial")
+    CHASSIS_PART_NUMBER_FIELD_NUMBER: _ClassVar[int]
+    CHASSIS_PART_SERIAL_FIELD_NUMBER: _ClassVar[int]
+    BOARD_MFG_FIELD_NUMBER: _ClassVar[int]
+    BOARD_MFG_SERIAL_FIELD_NUMBER: _ClassVar[int]
+    BOARD_PART_NUMBER_FIELD_NUMBER: _ClassVar[int]
+    PRODUCT_MANUFACTURER_FIELD_NUMBER: _ClassVar[int]
+    PRODUCT_PART_NUMBER_FIELD_NUMBER: _ClassVar[int]
+    PRODUCT_SERIAL_FIELD_NUMBER: _ClassVar[int]
+    chassis_part_number: str
+    chassis_part_serial: str
+    board_mfg: str
+    board_mfg_serial: str
+    board_part_number: str
+    product_manufacturer: str
+    product_part_number: str
+    product_serial: str
+    def __init__(self, chassis_part_number: _Optional[str] = ..., chassis_part_serial: _Optional[str] = ..., board_mfg: _Optional[str] = ..., board_mfg_serial: _Optional[str] = ..., board_part_number: _Optional[str] = ..., product_manufacturer: _Optional[str] = ..., product_part_number: _Optional[str] = ..., product_serial: _Optional[str] = ...) -> None: ...
+
 class MachineRecentProvisioningEvents(_message.Message):
     __slots__ = ("events", "last_event_time", "last_error_event", "state")
     EVENTS_FIELD_NUMBER: _ClassVar[int]
diff --git a/python/metalstack/api/v2/method_pb2.py b/python/metalstack/api/v2/method_pb2.py
index db00bc4c..8d92f7f8 100644
--- a/python/metalstack/api/v2/method_pb2.py
+++ b/python/metalstack/api/v2/method_pb2.py
@@ -27,7 +27,7 @@
 from metalstack.api.v2 import token_pb2 as metalstack_dot_api_dot_v2_dot_token__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/method.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1dmetalstack/api/v2/token.proto\"\x1a\n\x18MethodServiceListRequest\"5\n\x19MethodServiceListResponse\x12\x18\n\x07methods\x18\x01 \x03(\tR\x07methods\"%\n#MethodServiceTokenScopedListRequest\"\xc0\x05\n$MethodServiceTokenScopedListResponse\x12\x45\n\x0bpermissions\x18\x01 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12n\n\rproject_roles\x18\x03 \x03(\x0b\x32I.metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntryR\x0cprojectRoles\x12k\n\x0ctenant_roles\x18\x04 \x03(\x0b\x32H.metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x05 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role2\x83\x02\n\rMethodService\x12g\n\x04List\x12+.metalstack.api.v2.MethodServiceListRequest\x1a,.metalstack.api.v2.MethodServiceListResponse\"\x04\xd8\xf3\x18\x01\x12\x88\x01\n\x0fTokenScopedList\x12\x36.metalstack.api.v2.MethodServiceTokenScopedListRequest\x1a\x37.metalstack.api.v2.MethodServiceTokenScopedListResponse\"\x04\xd8\xf3\x18\x03\x42\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0bMethodProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/method.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1dmetalstack/api/v2/token.proto\"\x1a\n\x18MethodServiceListRequest\"5\n\x19MethodServiceListResponse\x12\x18\n\x07methods\x18\x01 \x03(\tR\x07methods\"%\n#MethodServiceTokenScopedListRequest\"\x91\x07\n$MethodServiceTokenScopedListResponse\x12\x45\n\x0bpermissions\x18\x01 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12n\n\rproject_roles\x18\x03 \x03(\x0b\x32I.metalstack.api.v2.MethodServiceTokenScopedListResponse.ProjectRolesEntryR\x0cprojectRoles\x12k\n\x0ctenant_roles\x18\x04 \x03(\x0b\x32H.metalstack.api.v2.MethodServiceTokenScopedListResponse.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x05 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12n\n\rmachine_roles\x18\x07 \x03(\x0b\x32I.metalstack.api.v2.MethodServiceTokenScopedListResponse.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role2\x83\x02\n\rMethodService\x12g\n\x04List\x12+.metalstack.api.v2.MethodServiceListRequest\x1a,.metalstack.api.v2.MethodServiceListResponse\"\x04\xd8\xf3\x18\x01\x12\x88\x01\n\x0fTokenScopedList\x12\x36.metalstack.api.v2.MethodServiceTokenScopedListRequest\x1a\x37.metalstack.api.v2.MethodServiceTokenScopedListResponse\"\x04\xd8\xf3\x18\x03\x42\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0bMethodProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -39,6 +39,8 @@
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_PROJECTROLESENTRY']._serialized_options = b'8\001'
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_TENANTROLESENTRY']._loaded_options = None
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_TENANTROLESENTRY']._serialized_options = b'8\001'
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_MACHINEROLESENTRY']._loaded_options = None
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_MACHINEROLESENTRY']._serialized_options = b'8\001'
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE'].fields_by_name['admin_role']._loaded_options = None
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE'].fields_by_name['admin_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE'].fields_by_name['infra_role']._loaded_options = None
@@ -54,11 +56,13 @@
   _globals['_METHODSERVICETOKENSCOPEDLISTREQUEST']._serialized_start=228
   _globals['_METHODSERVICETOKENSCOPEDLISTREQUEST']._serialized_end=265
   _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE']._serialized_start=268
-  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE']._serialized_end=972
-  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_PROJECTROLESENTRY']._serialized_start=752
-  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_PROJECTROLESENTRY']._serialized_end=847
-  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_TENANTROLESENTRY']._serialized_start=849
-  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_TENANTROLESENTRY']._serialized_end=942
-  _globals['_METHODSERVICE']._serialized_start=975
-  _globals['_METHODSERVICE']._serialized_end=1234
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE']._serialized_end=1181
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_PROJECTROLESENTRY']._serialized_start=864
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_PROJECTROLESENTRY']._serialized_end=959
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_TENANTROLESENTRY']._serialized_start=961
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_TENANTROLESENTRY']._serialized_end=1054
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_MACHINEROLESENTRY']._serialized_start=1056
+  _globals['_METHODSERVICETOKENSCOPEDLISTRESPONSE_MACHINEROLESENTRY']._serialized_end=1151
+  _globals['_METHODSERVICE']._serialized_start=1184
+  _globals['_METHODSERVICE']._serialized_end=1443
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/method_pb2.pyi b/python/metalstack/api/v2/method_pb2.pyi
index 37253be1..2263889a 100644
--- a/python/metalstack/api/v2/method_pb2.pyi
+++ b/python/metalstack/api/v2/method_pb2.pyi
@@ -24,7 +24,7 @@ class MethodServiceTokenScopedListRequest(_message.Message):
     def __init__(self) -> None: ...
 
 class MethodServiceTokenScopedListResponse(_message.Message):
-    __slots__ = ("permissions", "project_roles", "tenant_roles", "admin_role", "infra_role")
+    __slots__ = ("permissions", "project_roles", "tenant_roles", "admin_role", "infra_role", "machine_roles")
     class ProjectRolesEntry(_message.Message):
         __slots__ = ("key", "value")
         KEY_FIELD_NUMBER: _ClassVar[int]
@@ -39,14 +39,23 @@ class MethodServiceTokenScopedListResponse(_message.Message):
         key: str
         value: _common_pb2.TenantRole
         def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.TenantRole, str]] = ...) -> None: ...
+    class MachineRolesEntry(_message.Message):
+        __slots__ = ("key", "value")
+        KEY_FIELD_NUMBER: _ClassVar[int]
+        VALUE_FIELD_NUMBER: _ClassVar[int]
+        key: str
+        value: _common_pb2.MachineRole
+        def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.MachineRole, str]] = ...) -> None: ...
     PERMISSIONS_FIELD_NUMBER: _ClassVar[int]
     PROJECT_ROLES_FIELD_NUMBER: _ClassVar[int]
     TENANT_ROLES_FIELD_NUMBER: _ClassVar[int]
     ADMIN_ROLE_FIELD_NUMBER: _ClassVar[int]
     INFRA_ROLE_FIELD_NUMBER: _ClassVar[int]
+    MACHINE_ROLES_FIELD_NUMBER: _ClassVar[int]
     permissions: _containers.RepeatedCompositeFieldContainer[_token_pb2.MethodPermission]
     project_roles: _containers.ScalarMap[str, _common_pb2.ProjectRole]
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     infra_role: _common_pb2.InfraRole
-    def __init__(self, permissions: _Optional[_Iterable[_Union[_token_pb2.MethodPermission, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ...) -> None: ...
+    machine_roles: _containers.ScalarMap[str, _common_pb2.MachineRole]
+    def __init__(self, permissions: _Optional[_Iterable[_Union[_token_pb2.MethodPermission, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ...) -> None: ...
diff --git a/python/metalstack/api/v2/partition_pb2.py b/python/metalstack/api/v2/partition_pb2.py
index e45b9027..73f2741b 100644
--- a/python/metalstack/api/v2/partition_pb2.py
+++ b/python/metalstack/api/v2/partition_pb2.py
@@ -27,7 +27,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/api/v2/partition.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xa5\x03\n\tPartition\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12\\\n\x12\x62oot_configuration\x18\x04 \x01(\x0b\x32-.metalstack.api.v2.PartitionBootConfigurationR\x11\x62ootConfiguration\x12\x45\n\ndns_server\x18\x05 \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x06 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12\x34\n\x16mgmt_service_addresses\x18\x07 \x03(\tR\x14mgmtServiceAddresses\"{\n\x0ePartitionQuery\x12\x1f\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x00R\x02id\x88\x01\x01\x12\x36\n\x06labels\x18\x02 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x01R\x06labels\x88\x01\x01\x42\x05\n\x03_idB\t\n\x07_labels\"\x94\x01\n\x1aPartitionBootConfiguration\x12(\n\timage_url\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01R\x08imageUrl\x12*\n\nkernel_url\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01R\tkernelUrl\x12 \n\x0b\x63ommandline\x18\x03 \x01(\tR\x0b\x63ommandline\"$\n\tDNSServer\x12\x17\n\x02ip\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x02ip\"/\n\tNTPServer\x12\"\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07\x61\x64\x64ress\"8\n\x1aPartitionServiceGetRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\"V\n\x1bPartitionServiceListRequest\x12\x37\n\x05query\x18\x01 \x01(\x0b\x32!.metalstack.api.v2.PartitionQueryR\x05query\"Y\n\x1bPartitionServiceGetResponse\x12:\n\tpartition\x18\x01 \x01(\x0b\x32\x1c.metalstack.api.v2.PartitionR\tpartition\"\\\n\x1cPartitionServiceListResponse\x12<\n\npartitions\x18\x01 \x03(\x0b\x32\x1c.metalstack.api.v2.PartitionR\npartitions2\xf5\x01\n\x10PartitionService\x12n\n\x03Get\x12-.metalstack.api.v2.PartitionServiceGetRequest\x1a..metalstack.api.v2.PartitionServiceGetResponse\"\x08\xd8\xf3\x18\x03\xe0\xf3\x18\x02\x12q\n\x04List\x12..metalstack.api.v2.PartitionServiceListRequest\x1a/.metalstack.api.v2.PartitionServiceListResponse\"\x08\xd8\xf3\x18\x03\xe0\xf3\x18\x02\x42\xc4\x01\n\x15\x63om.metalstack.api.v2B\x0ePartitionProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/api/v2/partition.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xa6\x03\n\tPartition\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\x02id\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12\\\n\x12\x62oot_configuration\x18\x04 \x01(\x0b\x32-.metalstack.api.v2.PartitionBootConfigurationR\x11\x62ootConfiguration\x12\x45\n\ndns_server\x18\x05 \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x06 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12\x34\n\x16mgmt_service_addresses\x18\x07 \x03(\tR\x14mgmtServiceAddresses\"|\n\x0ePartitionQuery\x12 \n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x00R\x02id\x88\x01\x01\x12\x36\n\x06labels\x18\x02 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x01R\x06labels\x88\x01\x01\x42\x05\n\x03_idB\t\n\x07_labels\"\x94\x01\n\x1aPartitionBootConfiguration\x12(\n\timage_url\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01R\x08imageUrl\x12*\n\nkernel_url\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01R\tkernelUrl\x12 \n\x0b\x63ommandline\x18\x03 \x01(\tR\x0b\x63ommandline\"$\n\tDNSServer\x12\x17\n\x02ip\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x02ip\"/\n\tNTPServer\x12\"\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07\x61\x64\x64ress\"9\n\x1aPartitionServiceGetRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\x02id\"V\n\x1bPartitionServiceListRequest\x12\x37\n\x05query\x18\x01 \x01(\x0b\x32!.metalstack.api.v2.PartitionQueryR\x05query\"Y\n\x1bPartitionServiceGetResponse\x12:\n\tpartition\x18\x01 \x01(\x0b\x32\x1c.metalstack.api.v2.PartitionR\tpartition\"\\\n\x1cPartitionServiceListResponse\x12<\n\npartitions\x18\x01 \x03(\x0b\x32\x1c.metalstack.api.v2.PartitionR\npartitions2\xf5\x01\n\x10PartitionService\x12n\n\x03Get\x12-.metalstack.api.v2.PartitionServiceGetRequest\x1a..metalstack.api.v2.PartitionServiceGetResponse\"\x08\xd8\xf3\x18\x03\xe0\xf3\x18\x02\x12q\n\x04List\x12..metalstack.api.v2.PartitionServiceListRequest\x1a/.metalstack.api.v2.PartitionServiceListResponse\"\x08\xd8\xf3\x18\x03\xe0\xf3\x18\x02\x42\xc4\x01\n\x15\x63om.metalstack.api.v2B\x0ePartitionProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -36,7 +36,7 @@
   _globals['DESCRIPTOR']._loaded_options = None
   _globals['DESCRIPTOR']._serialized_options = b'\n\025com.metalstack.api.v2B\016PartitionProtoP\001Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\242\002\003MAX\252\002\021Metalstack.Api.V2\312\002\021Metalstack\\Api\\V2\342\002\035Metalstack\\Api\\V2\\GPBMetadata\352\002\023Metalstack::Api::V2'
   _globals['_PARTITION'].fields_by_name['id']._loaded_options = None
-  _globals['_PARTITION'].fields_by_name['id']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
+  _globals['_PARTITION'].fields_by_name['id']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
   _globals['_PARTITION'].fields_by_name['description']._loaded_options = None
   _globals['_PARTITION'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_PARTITION'].fields_by_name['dns_server']._loaded_options = None
@@ -44,7 +44,7 @@
   _globals['_PARTITION'].fields_by_name['ntp_server']._loaded_options = None
   _globals['_PARTITION'].fields_by_name['ntp_server']._serialized_options = b'\272H\005\222\001\002\020\n'
   _globals['_PARTITIONQUERY'].fields_by_name['id']._loaded_options = None
-  _globals['_PARTITIONQUERY'].fields_by_name['id']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
+  _globals['_PARTITIONQUERY'].fields_by_name['id']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
   _globals['_PARTITIONBOOTCONFIGURATION'].fields_by_name['image_url']._loaded_options = None
   _globals['_PARTITIONBOOTCONFIGURATION'].fields_by_name['image_url']._serialized_options = b'\272H\010r\006\340\263\256\261\002\001'
   _globals['_PARTITIONBOOTCONFIGURATION'].fields_by_name['kernel_url']._loaded_options = None
@@ -54,29 +54,29 @@
   _globals['_NTPSERVER'].fields_by_name['address']._loaded_options = None
   _globals['_NTPSERVER'].fields_by_name['address']._serialized_options = b'\272H\005r\003\030\200\002'
   _globals['_PARTITIONSERVICEGETREQUEST'].fields_by_name['id']._loaded_options = None
-  _globals['_PARTITIONSERVICEGETREQUEST'].fields_by_name['id']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
+  _globals['_PARTITIONSERVICEGETREQUEST'].fields_by_name['id']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
   _globals['_PARTITIONSERVICE'].methods_by_name['Get']._loaded_options = None
   _globals['_PARTITIONSERVICE'].methods_by_name['Get']._serialized_options = b'\330\363\030\003\340\363\030\002'
   _globals['_PARTITIONSERVICE'].methods_by_name['List']._loaded_options = None
   _globals['_PARTITIONSERVICE'].methods_by_name['List']._serialized_options = b'\330\363\030\003\340\363\030\002'
   _globals['_PARTITION']._serialized_start=160
-  _globals['_PARTITION']._serialized_end=581
-  _globals['_PARTITIONQUERY']._serialized_start=583
-  _globals['_PARTITIONQUERY']._serialized_end=706
-  _globals['_PARTITIONBOOTCONFIGURATION']._serialized_start=709
-  _globals['_PARTITIONBOOTCONFIGURATION']._serialized_end=857
-  _globals['_DNSSERVER']._serialized_start=859
-  _globals['_DNSSERVER']._serialized_end=895
-  _globals['_NTPSERVER']._serialized_start=897
-  _globals['_NTPSERVER']._serialized_end=944
-  _globals['_PARTITIONSERVICEGETREQUEST']._serialized_start=946
-  _globals['_PARTITIONSERVICEGETREQUEST']._serialized_end=1002
-  _globals['_PARTITIONSERVICELISTREQUEST']._serialized_start=1004
-  _globals['_PARTITIONSERVICELISTREQUEST']._serialized_end=1090
-  _globals['_PARTITIONSERVICEGETRESPONSE']._serialized_start=1092
-  _globals['_PARTITIONSERVICEGETRESPONSE']._serialized_end=1181
-  _globals['_PARTITIONSERVICELISTRESPONSE']._serialized_start=1183
-  _globals['_PARTITIONSERVICELISTRESPONSE']._serialized_end=1275
-  _globals['_PARTITIONSERVICE']._serialized_start=1278
-  _globals['_PARTITIONSERVICE']._serialized_end=1523
+  _globals['_PARTITION']._serialized_end=582
+  _globals['_PARTITIONQUERY']._serialized_start=584
+  _globals['_PARTITIONQUERY']._serialized_end=708
+  _globals['_PARTITIONBOOTCONFIGURATION']._serialized_start=711
+  _globals['_PARTITIONBOOTCONFIGURATION']._serialized_end=859
+  _globals['_DNSSERVER']._serialized_start=861
+  _globals['_DNSSERVER']._serialized_end=897
+  _globals['_NTPSERVER']._serialized_start=899
+  _globals['_NTPSERVER']._serialized_end=946
+  _globals['_PARTITIONSERVICEGETREQUEST']._serialized_start=948
+  _globals['_PARTITIONSERVICEGETREQUEST']._serialized_end=1005
+  _globals['_PARTITIONSERVICELISTREQUEST']._serialized_start=1007
+  _globals['_PARTITIONSERVICELISTREQUEST']._serialized_end=1093
+  _globals['_PARTITIONSERVICEGETRESPONSE']._serialized_start=1095
+  _globals['_PARTITIONSERVICEGETRESPONSE']._serialized_end=1184
+  _globals['_PARTITIONSERVICELISTRESPONSE']._serialized_start=1186
+  _globals['_PARTITIONSERVICELISTRESPONSE']._serialized_end=1278
+  _globals['_PARTITIONSERVICE']._serialized_start=1281
+  _globals['_PARTITIONSERVICE']._serialized_end=1526
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/token_pb2.py b/python/metalstack/api/v2/token_pb2.py
index 5a600d7e..3c754142 100644
--- a/python/metalstack/api/v2/token_pb2.py
+++ b/python/metalstack/api/v2/token_pb2.py
@@ -29,7 +29,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xe0\x08\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\x82\x07\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x04 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xb0\x07\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\x37\n\x06labels\x18\t \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\x90\x05\n\x0cTokenService\x12\x62\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x04\xd8\xf3\x18\x03\x12\x65\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x04\xd8\xf3\x18\x03\x12n\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x04\xd8\xf3\x18\x03\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xde\x08\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x04 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12y\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cmachineRoles\x12\x31\n\x06labels\x18\n \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\x8c\t\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12y\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\x90\x05\n\x0cTokenService\x12\x62\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x04\xd8\xf3\x18\x03\x12\x65\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x04\xd8\xf3\x18\x03\x12n\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x04\xd8\xf3\x18\x03\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -41,6 +41,8 @@
   _globals['_TOKEN_PROJECTROLESENTRY']._serialized_options = b'8\001'
   _globals['_TOKEN_TENANTROLESENTRY']._loaded_options = None
   _globals['_TOKEN_TENANTROLESENTRY']._serialized_options = b'8\001'
+  _globals['_TOKEN_MACHINEROLESENTRY']._loaded_options = None
+  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_options = b'8\001'
   _globals['_TOKEN'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKEN'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKEN'].fields_by_name['user']._loaded_options = None
@@ -61,6 +63,8 @@
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_options = b'8\001'
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_options = b'8\001'
+  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._loaded_options = None
+  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_options = b'8\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['description']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['permissions']._loaded_options = None
@@ -75,6 +79,8 @@
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['admin_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['infra_role']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['infra_role']._serialized_options = b'\272H\005\202\001\002\020\001'
+  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['machine_roles']._loaded_options = None
+  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\021\232\001\016\"\005r\003\260\001\001*\005\202\001\002\020\001'
   _globals['_METHODPERMISSION'].fields_by_name['subject']._loaded_options = None
   _globals['_METHODPERMISSION'].fields_by_name['subject']._serialized_options = b'\272H\005r\003\030\200\002'
   _globals['_METHODPERMISSION'].fields_by_name['methods']._loaded_options = None
@@ -85,6 +91,8 @@
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_options = b'8\001'
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._loaded_options = None
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_options = b'8\001'
+  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._loaded_options = None
+  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_options = b'8\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['update_meta']._loaded_options = None
@@ -99,6 +107,8 @@
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['admin_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['infra_role']._loaded_options = None
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['infra_role']._serialized_options = b'\272H\005\202\001\002\020\001'
+  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['machine_roles']._loaded_options = None
+  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\021\232\001\016\"\005r\003\260\001\001*\005\202\001\002\020\001'
   _globals['_TOKENSERVICEGETREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEGETREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKENSERVICE'].methods_by_name['Get']._loaded_options = None
@@ -113,48 +123,54 @@
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\330\363\030\003'
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._serialized_options = b'\330\363\030\003'
-  _globals['_TOKENTYPE']._serialized_start=3922
-  _globals['_TOKENTYPE']._serialized_end=4002
+  _globals['_TOKENTYPE']._serialized_start=4540
+  _globals['_TOKENTYPE']._serialized_end=4620
   _globals['_TOKEN']._serialized_start=221
-  _globals['_TOKEN']._serialized_end=1341
-  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=959
-  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_end=1054
-  _globals['_TOKEN_TENANTROLESENTRY']._serialized_start=1056
-  _globals['_TOKEN_TENANTROLESENTRY']._serialized_end=1149
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1344
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2242
-  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=959
-  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1054
-  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1056
-  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1149
-  _globals['_METHODPERMISSION']._serialized_start=2244
-  _globals['_METHODPERMISSION']._serialized_end=2335
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2337
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=2437
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=2439
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=2464
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=2466
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=2542
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=2544
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=2601
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=2603
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=2631
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=2634
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=3578
-  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=959
-  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1054
-  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1056
-  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1149
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=3580
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=3656
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=3658
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=3712
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=3714
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=3787
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=3789
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=3817
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=3819
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=3920
-  _globals['_TOKENSERVICE']._serialized_start=4005
-  _globals['_TOKENSERVICE']._serialized_end=4661
+  _globals['_TOKEN']._serialized_end=1519
+  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=1040
+  _globals['_TOKEN_PROJECTROLESENTRY']._serialized_end=1135
+  _globals['_TOKEN_TENANTROLESENTRY']._serialized_start=1137
+  _globals['_TOKEN_TENANTROLESENTRY']._serialized_end=1230
+  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_start=1232
+  _globals['_TOKEN_MACHINEROLESENTRY']._serialized_end=1327
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1522
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2640
+  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
+  _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
+  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
+  _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
+  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
+  _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
+  _globals['_METHODPERMISSION']._serialized_start=2642
+  _globals['_METHODPERMISSION']._serialized_end=2733
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2735
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=2835
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=2837
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=2862
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=2864
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=2940
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=2942
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=2999
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3001
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3029
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3032
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4196
+  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
+  _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
+  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
+  _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
+  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
+  _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4198
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4274
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4276
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4330
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4332
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4405
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4407
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4435
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4437
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4538
+  _globals['_TOKENSERVICE']._serialized_start=4623
+  _globals['_TOKENSERVICE']._serialized_end=5279
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/token_pb2.pyi b/python/metalstack/api/v2/token_pb2.pyi
index 99bc3db7..f50e2fba 100644
--- a/python/metalstack/api/v2/token_pb2.pyi
+++ b/python/metalstack/api/v2/token_pb2.pyi
@@ -24,7 +24,7 @@ TOKEN_TYPE_API: TokenType
 TOKEN_TYPE_USER: TokenType
 
 class Token(_message.Message):
-    __slots__ = ("uuid", "user", "meta", "description", "permissions", "expires", "issued_at", "token_type", "project_roles", "tenant_roles", "admin_role", "infra_role")
+    __slots__ = ("uuid", "user", "meta", "description", "permissions", "expires", "issued_at", "token_type", "project_roles", "tenant_roles", "admin_role", "infra_role", "machine_roles")
     class ProjectRolesEntry(_message.Message):
         __slots__ = ("key", "value")
         KEY_FIELD_NUMBER: _ClassVar[int]
@@ -39,6 +39,13 @@ class Token(_message.Message):
         key: str
         value: _common_pb2.TenantRole
         def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.TenantRole, str]] = ...) -> None: ...
+    class MachineRolesEntry(_message.Message):
+        __slots__ = ("key", "value")
+        KEY_FIELD_NUMBER: _ClassVar[int]
+        VALUE_FIELD_NUMBER: _ClassVar[int]
+        key: str
+        value: _common_pb2.MachineRole
+        def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.MachineRole, str]] = ...) -> None: ...
     UUID_FIELD_NUMBER: _ClassVar[int]
     USER_FIELD_NUMBER: _ClassVar[int]
     META_FIELD_NUMBER: _ClassVar[int]
@@ -51,6 +58,7 @@ class Token(_message.Message):
     TENANT_ROLES_FIELD_NUMBER: _ClassVar[int]
     ADMIN_ROLE_FIELD_NUMBER: _ClassVar[int]
     INFRA_ROLE_FIELD_NUMBER: _ClassVar[int]
+    MACHINE_ROLES_FIELD_NUMBER: _ClassVar[int]
     uuid: str
     user: str
     meta: _common_pb2.Meta
@@ -63,10 +71,11 @@ class Token(_message.Message):
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     infra_role: _common_pb2.InfraRole
-    def __init__(self, uuid: _Optional[str] = ..., user: _Optional[str] = ..., meta: _Optional[_Union[_common_pb2.Meta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., expires: _Optional[_Union[datetime.datetime, _timestamp_pb2.Timestamp, _Mapping]] = ..., issued_at: _Optional[_Union[datetime.datetime, _timestamp_pb2.Timestamp, _Mapping]] = ..., token_type: _Optional[_Union[TokenType, str]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ...) -> None: ...
+    machine_roles: _containers.ScalarMap[str, _common_pb2.MachineRole]
+    def __init__(self, uuid: _Optional[str] = ..., user: _Optional[str] = ..., meta: _Optional[_Union[_common_pb2.Meta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., expires: _Optional[_Union[datetime.datetime, _timestamp_pb2.Timestamp, _Mapping]] = ..., issued_at: _Optional[_Union[datetime.datetime, _timestamp_pb2.Timestamp, _Mapping]] = ..., token_type: _Optional[_Union[TokenType, str]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ...) -> None: ...
 
 class TokenServiceCreateRequest(_message.Message):
-    __slots__ = ("description", "permissions", "expires", "project_roles", "tenant_roles", "admin_role", "infra_role", "labels")
+    __slots__ = ("description", "permissions", "expires", "project_roles", "tenant_roles", "admin_role", "infra_role", "machine_roles", "labels")
     class ProjectRolesEntry(_message.Message):
         __slots__ = ("key", "value")
         KEY_FIELD_NUMBER: _ClassVar[int]
@@ -81,6 +90,13 @@ class TokenServiceCreateRequest(_message.Message):
         key: str
         value: _common_pb2.TenantRole
         def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.TenantRole, str]] = ...) -> None: ...
+    class MachineRolesEntry(_message.Message):
+        __slots__ = ("key", "value")
+        KEY_FIELD_NUMBER: _ClassVar[int]
+        VALUE_FIELD_NUMBER: _ClassVar[int]
+        key: str
+        value: _common_pb2.MachineRole
+        def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.MachineRole, str]] = ...) -> None: ...
     DESCRIPTION_FIELD_NUMBER: _ClassVar[int]
     PERMISSIONS_FIELD_NUMBER: _ClassVar[int]
     EXPIRES_FIELD_NUMBER: _ClassVar[int]
@@ -88,6 +104,7 @@ class TokenServiceCreateRequest(_message.Message):
     TENANT_ROLES_FIELD_NUMBER: _ClassVar[int]
     ADMIN_ROLE_FIELD_NUMBER: _ClassVar[int]
     INFRA_ROLE_FIELD_NUMBER: _ClassVar[int]
+    MACHINE_ROLES_FIELD_NUMBER: _ClassVar[int]
     LABELS_FIELD_NUMBER: _ClassVar[int]
     description: str
     permissions: _containers.RepeatedCompositeFieldContainer[MethodPermission]
@@ -96,8 +113,9 @@ class TokenServiceCreateRequest(_message.Message):
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     infra_role: _common_pb2.InfraRole
+    machine_roles: _containers.ScalarMap[str, _common_pb2.MachineRole]
     labels: _common_pb2.Labels
-    def __init__(self, description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., expires: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
+    def __init__(self, description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., expires: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
 
 class MethodPermission(_message.Message):
     __slots__ = ("subject", "methods")
@@ -136,7 +154,7 @@ class TokenServiceRevokeResponse(_message.Message):
     def __init__(self) -> None: ...
 
 class TokenServiceUpdateRequest(_message.Message):
-    __slots__ = ("uuid", "update_meta", "description", "permissions", "project_roles", "tenant_roles", "admin_role", "infra_role", "labels")
+    __slots__ = ("uuid", "update_meta", "description", "permissions", "project_roles", "tenant_roles", "admin_role", "infra_role", "machine_roles", "labels")
     class ProjectRolesEntry(_message.Message):
         __slots__ = ("key", "value")
         KEY_FIELD_NUMBER: _ClassVar[int]
@@ -151,6 +169,13 @@ class TokenServiceUpdateRequest(_message.Message):
         key: str
         value: _common_pb2.TenantRole
         def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.TenantRole, str]] = ...) -> None: ...
+    class MachineRolesEntry(_message.Message):
+        __slots__ = ("key", "value")
+        KEY_FIELD_NUMBER: _ClassVar[int]
+        VALUE_FIELD_NUMBER: _ClassVar[int]
+        key: str
+        value: _common_pb2.MachineRole
+        def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[_common_pb2.MachineRole, str]] = ...) -> None: ...
     UUID_FIELD_NUMBER: _ClassVar[int]
     UPDATE_META_FIELD_NUMBER: _ClassVar[int]
     DESCRIPTION_FIELD_NUMBER: _ClassVar[int]
@@ -159,6 +184,7 @@ class TokenServiceUpdateRequest(_message.Message):
     TENANT_ROLES_FIELD_NUMBER: _ClassVar[int]
     ADMIN_ROLE_FIELD_NUMBER: _ClassVar[int]
     INFRA_ROLE_FIELD_NUMBER: _ClassVar[int]
+    MACHINE_ROLES_FIELD_NUMBER: _ClassVar[int]
     LABELS_FIELD_NUMBER: _ClassVar[int]
     uuid: str
     update_meta: _common_pb2.UpdateMeta
@@ -168,8 +194,9 @@ class TokenServiceUpdateRequest(_message.Message):
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     infra_role: _common_pb2.InfraRole
+    machine_roles: _containers.ScalarMap[str, _common_pb2.MachineRole]
     labels: _common_pb2.UpdateLabels
-    def __init__(self, uuid: _Optional[str] = ..., update_meta: _Optional[_Union[_common_pb2.UpdateMeta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., labels: _Optional[_Union[_common_pb2.UpdateLabels, _Mapping]] = ...) -> None: ...
+    def __init__(self, uuid: _Optional[str] = ..., update_meta: _Optional[_Union[_common_pb2.UpdateMeta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ..., labels: _Optional[_Union[_common_pb2.UpdateLabels, _Mapping]] = ...) -> None: ...
 
 class TokenServiceUpdateResponse(_message.Message):
     __slots__ = ("token",)
diff --git a/python/metalstack/client/client.py b/python/metalstack/client/client.py
index d1e42027..ea9d9b6b 100755
--- a/python/metalstack/client/client.py
+++ b/python/metalstack/client/client.py
@@ -30,6 +30,7 @@
 import metalstack.api.v2.version_connect as api_version_connect
 
 import metalstack.infra.v2.bmc_connect as infra_bmc_connect
+import metalstack.infra.v2.boot_connect as infra_boot_connect
 import metalstack.infra.v2.event_connect as infra_event_connect
 import metalstack.infra.v2.switch_connect as infra_switch_connect
 
@@ -155,6 +156,9 @@ def __init__(self, baseurl: str, session=None):
         def bmc(self):
             return infra_bmc_connect.BMCServiceClientSync(address=self._baseurl, session=self._session)
 
+        def boot(self):
+            return infra_boot_connect.BootServiceClientSync(address=self._baseurl, session=self._session)
+
         def event(self):
             return infra_event_connect.EventServiceClientSync(address=self._baseurl, session=self._session)
 
diff --git a/python/metalstack/infra/v2/boot_connect.py b/python/metalstack/infra/v2/boot_connect.py
new file mode 100644
index 00000000..1c3a8d2b
--- /dev/null
+++ b/python/metalstack/infra/v2/boot_connect.py
@@ -0,0 +1,444 @@
+# -*- coding: utf-8 -*-
+# Generated by https://github.com/connectrpc/connect-python.  DO NOT EDIT!
+# source: metalstack/infra/v2/boot.proto
+
+from collections.abc import AsyncIterator, Iterable, Iterator, Mapping
+from typing import Protocol
+
+from connectrpc.client import ConnectClient, ConnectClientSync
+from connectrpc.code import Code
+from connectrpc.errors import ConnectError
+from connectrpc.interceptor import Interceptor, InterceptorSync
+from connectrpc.method import IdempotencyLevel, MethodInfo
+from connectrpc.request import Headers, RequestContext
+from connectrpc.server import ConnectASGIApplication, ConnectWSGIApplication, Endpoint, EndpointSync
+import metalstack.infra.v2.boot_pb2 as metalstack_dot_infra_dot_v2_dot_boot__pb2
+
+
+class BootService(Protocol):
+    async def dhcp(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def boot(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def super_user_password(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def register(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    def wait(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest, ctx: RequestContext) -> AsyncIterator[metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse]:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def report(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class BootServiceASGIApplication(ConnectASGIApplication):
+    def __init__(self, service: BootService, *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/metalstack.infra.v2.BootService/Dhcp": Endpoint.unary(
+                    method=MethodInfo(
+                        name="Dhcp",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.dhcp,
+                ),
+                "/metalstack.infra.v2.BootService/Boot": Endpoint.unary(
+                    method=MethodInfo(
+                        name="Boot",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.boot,
+                ),
+                "/metalstack.infra.v2.BootService/SuperUserPassword": Endpoint.unary(
+                    method=MethodInfo(
+                        name="SuperUserPassword",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.super_user_password,
+                ),
+                "/metalstack.infra.v2.BootService/Register": Endpoint.unary(
+                    method=MethodInfo(
+                        name="Register",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.register,
+                ),
+                "/metalstack.infra.v2.BootService/Wait": Endpoint.server_stream(
+                    method=MethodInfo(
+                        name="Wait",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.wait,
+                ),
+                "/metalstack.infra.v2.BootService/Report": Endpoint.unary(
+                    method=MethodInfo(
+                        name="Report",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.report,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.infra.v2.BootService"
+
+
+class BootServiceClient(ConnectClient):
+    async def dhcp(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Dhcp",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def boot(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Boot",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def super_user_password(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="SuperUserPassword",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def register(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Register",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def wait(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> AsyncIterator[metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse]:
+        return self.execute_server_stream(
+            request=request,
+            method=MethodInfo(
+                name="Wait",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def report(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Report",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+
+class BootServiceSync(Protocol):
+    def dhcp(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def boot(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def super_user_password(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def register(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def wait(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest, ctx: RequestContext) -> Iterator[metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse]:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def report(self, request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class BootServiceWSGIApplication(ConnectWSGIApplication):
+    def __init__(self, service: BootServiceSync, interceptors: Iterable[InterceptorSync]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/metalstack.infra.v2.BootService/Dhcp": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="Dhcp",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.dhcp,
+                ),
+                "/metalstack.infra.v2.BootService/Boot": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="Boot",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.boot,
+                ),
+                "/metalstack.infra.v2.BootService/SuperUserPassword": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="SuperUserPassword",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.super_user_password,
+                ),
+                "/metalstack.infra.v2.BootService/Register": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="Register",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.register,
+                ),
+                "/metalstack.infra.v2.BootService/Wait": EndpointSync.server_stream(
+                    method=MethodInfo(
+                        name="Wait",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.wait,
+                ),
+                "/metalstack.infra.v2.BootService/Report": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="Report",
+                        service_name="metalstack.infra.v2.BootService",
+                        input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.report,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.infra.v2.BootService"
+
+
+class BootServiceClientSync(ConnectClientSync):
+    def dhcp(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Dhcp",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceDhcpResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def boot(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Boot",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceBootResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def super_user_password(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="SuperUserPassword",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceSuperUserPasswordResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def register(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Register",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceRegisterResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def wait(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> Iterator[metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse]:
+        return self.execute_server_stream(
+            request=request,
+            method=MethodInfo(
+                name="Wait",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceWaitResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def report(
+        self,
+        request: metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Report",
+                service_name="metalstack.infra.v2.BootService",
+                input=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportRequest,
+                output=metalstack_dot_infra_dot_v2_dot_boot__pb2.BootServiceReportResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
diff --git a/python/metalstack/infra/v2/boot_pb2.py b/python/metalstack/infra/v2/boot_pb2.py
new file mode 100644
index 00000000..520e5ee5
--- /dev/null
+++ b/python/metalstack/infra/v2/boot_pb2.py
@@ -0,0 +1,113 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# NO CHECKED-IN PROTOBUF GENCODE
+# source: metalstack/infra/v2/boot.proto
+# Protobuf Python Version: 6.32.1
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import runtime_version as _runtime_version
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+_runtime_version.ValidateProtobufRuntimeVersion(
+    _runtime_version.Domain.PUBLIC,
+    6,
+    32,
+    1,
+    '',
+    'metalstack/infra/v2/boot.proto'
+)
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
+from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
+from metalstack.api.v2 import machine_pb2 as metalstack_dot_api_dot_v2_dot_machine__pb2
+from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/infra/v2/boot.proto\x12\x13metalstack.infra.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\x1a(metalstack/api/v2/predefined_rules.proto\"a\n\x16\x42ootServiceDhcpRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12)\n\tpartition\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\"\x19\n\x17\x42ootServiceDhcpResponse\"b\n\x16\x42ootServiceBootRequest\x12\x1d\n\x03mac\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12)\n\tpartition\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\"\x9c\x01\n\x17\x42ootServiceBootResponse\x12#\n\x06kernel\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01R\x06kernel\x12$\n\x0einit_ram_disks\x18\x02 \x03(\tR\x0cinitRamDisks\x12*\n\x07\x63mdline\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x07\x63mdline\x88\x01\x01\x42\n\n\x08_cmdline\"\xe0\x02\n\x1a\x42ootServiceRegisterRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12>\n\x08hardware\x18\x02 \x01(\x0b\x32\".metalstack.api.v2.MachineHardwareR\x08hardware\x12\x32\n\x04\x62ios\x18\x03 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineBiosR\x04\x62ios\x12\x32\n\x04ipmi\x18\x04 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineIPMIR\x04ipmi\x12\x12\n\x04tags\x18\x05 \x03(\tR\x04tags\x12=\n\x14metal_hammer_version\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x12metalHammerVersion\x12)\n\tpartition\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\"\x87\x01\n\x1b\x42ootServiceRegisterResponse\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04size\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04size\x12)\n\tpartition\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\"6\n\x16\x42ootServiceWaitRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"_\n\x17\x42ootServiceWaitResponse\x12\x44\n\nallocation\x18\x01 \x01(\x0b\x32$.metalstack.api.v2.MachineAllocationR\nallocation\"\xaf\x01\n\x18\x42ootServiceReportRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x35\n\x10\x63onsole_password\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x0f\x63onsolePassword\x12\x18\n\x07success\x18\x04 \x01(\x08R\x07success\x12$\n\x07message\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x07message\"\x1b\n\x19\x42ootServiceReportResponse\"C\n#BootServiceSuperUserPasswordRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x8d\x01\n$BootServiceSuperUserPasswordResponse\x12)\n\x10\x66\x65\x61ture_disabled\x18\x01 \x01(\x08R\x0f\x66\x65\x61tureDisabled\x12:\n\x13super_user_password\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x11superUserPassword2\xde\x05\n\x0b\x42ootService\x12l\n\x04\x44hcp\x12+.metalstack.infra.v2.BootServiceDhcpRequest\x1a,.metalstack.infra.v2.BootServiceDhcpResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x12m\n\x04\x42oot\x12+.metalstack.infra.v2.BootServiceBootRequest\x1a,.metalstack.infra.v2.BootServiceBootResponse\"\n\xe0\xf3\x18\x02\xea\xf3\x18\x02\x01\x02\x12\x93\x01\n\x11SuperUserPassword\x12\x38.metalstack.infra.v2.BootServiceSuperUserPasswordRequest\x1a\x39.metalstack.infra.v2.BootServiceSuperUserPasswordResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01\x12x\n\x08Register\x12/.metalstack.infra.v2.BootServiceRegisterRequest\x1a\x30.metalstack.infra.v2.BootServiceRegisterResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01\x12n\n\x04Wait\x12+.metalstack.infra.v2.BootServiceWaitRequest\x1a,.metalstack.infra.v2.BootServiceWaitResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01\x30\x01\x12r\n\x06Report\x12-.metalstack.infra.v2.BootServiceReportRequest\x1a..metalstack.infra.v2.BootServiceReportResponse\"\t\xe0\xf3\x18\x02\xf2\xf3\x18\x01\x01\x42\xcd\x01\n\x17\x63om.metalstack.infra.v2B\tBootProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'metalstack.infra.v2.boot_pb2', _globals)
+if not _descriptor._USE_C_DESCRIPTORS:
+  _globals['DESCRIPTOR']._loaded_options = None
+  _globals['DESCRIPTOR']._serialized_options = b'\n\027com.metalstack.infra.v2B\tBootProtoP\001Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\242\002\003MIX\252\002\023Metalstack.Infra.V2\312\002\023Metalstack\\Infra\\V2\342\002\037Metalstack\\Infra\\V2\\GPBMetadata\352\002\025Metalstack::Infra::V2'
+  _globals['_BOOTSERVICEDHCPREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_BOOTSERVICEDHCPREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_BOOTSERVICEDHCPREQUEST'].fields_by_name['partition']._loaded_options = None
+  _globals['_BOOTSERVICEDHCPREQUEST'].fields_by_name['partition']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
+  _globals['_BOOTSERVICEBOOTREQUEST'].fields_by_name['mac']._loaded_options = None
+  _globals['_BOOTSERVICEBOOTREQUEST'].fields_by_name['mac']._serialized_options = b'\272H\010r\006\270\263\256\261\002\001'
+  _globals['_BOOTSERVICEBOOTREQUEST'].fields_by_name['partition']._loaded_options = None
+  _globals['_BOOTSERVICEBOOTREQUEST'].fields_by_name['partition']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
+  _globals['_BOOTSERVICEBOOTRESPONSE'].fields_by_name['kernel']._loaded_options = None
+  _globals['_BOOTSERVICEBOOTRESPONSE'].fields_by_name['kernel']._serialized_options = b'\272H\010r\006\340\263\256\261\002\001'
+  _globals['_BOOTSERVICEBOOTRESPONSE'].fields_by_name['cmdline']._loaded_options = None
+  _globals['_BOOTSERVICEBOOTRESPONSE'].fields_by_name['cmdline']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_BOOTSERVICEREGISTERREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_BOOTSERVICEREGISTERREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_BOOTSERVICEREGISTERREQUEST'].fields_by_name['metal_hammer_version']._loaded_options = None
+  _globals['_BOOTSERVICEREGISTERREQUEST'].fields_by_name['metal_hammer_version']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_BOOTSERVICEREGISTERREQUEST'].fields_by_name['partition']._loaded_options = None
+  _globals['_BOOTSERVICEREGISTERREQUEST'].fields_by_name['partition']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
+  _globals['_BOOTSERVICEREGISTERRESPONSE'].fields_by_name['uuid']._loaded_options = None
+  _globals['_BOOTSERVICEREGISTERRESPONSE'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_BOOTSERVICEREGISTERRESPONSE'].fields_by_name['size']._loaded_options = None
+  _globals['_BOOTSERVICEREGISTERRESPONSE'].fields_by_name['size']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
+  _globals['_BOOTSERVICEREGISTERRESPONSE'].fields_by_name['partition']._loaded_options = None
+  _globals['_BOOTSERVICEREGISTERRESPONSE'].fields_by_name['partition']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
+  _globals['_BOOTSERVICEWAITREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_BOOTSERVICEWAITREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_BOOTSERVICEREPORTREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_BOOTSERVICEREPORTREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_BOOTSERVICEREPORTREQUEST'].fields_by_name['console_password']._loaded_options = None
+  _globals['_BOOTSERVICEREPORTREQUEST'].fields_by_name['console_password']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
+  _globals['_BOOTSERVICEREPORTREQUEST'].fields_by_name['message']._loaded_options = None
+  _globals['_BOOTSERVICEREPORTREQUEST'].fields_by_name['message']._serialized_options = b'\272H\007r\005\020\002\030\200\004'
+  _globals['_BOOTSERVICESUPERUSERPASSWORDREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_BOOTSERVICESUPERUSERPASSWORDREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_BOOTSERVICESUPERUSERPASSWORDRESPONSE'].fields_by_name['super_user_password']._loaded_options = None
+  _globals['_BOOTSERVICESUPERUSERPASSWORDRESPONSE'].fields_by_name['super_user_password']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
+  _globals['_BOOTSERVICE'].methods_by_name['Dhcp']._loaded_options = None
+  _globals['_BOOTSERVICE'].methods_by_name['Dhcp']._serialized_options = b'\340\363\030\002\352\363\030\001\001'
+  _globals['_BOOTSERVICE'].methods_by_name['Boot']._loaded_options = None
+  _globals['_BOOTSERVICE'].methods_by_name['Boot']._serialized_options = b'\340\363\030\002\352\363\030\002\001\002'
+  _globals['_BOOTSERVICE'].methods_by_name['SuperUserPassword']._loaded_options = None
+  _globals['_BOOTSERVICE'].methods_by_name['SuperUserPassword']._serialized_options = b'\340\363\030\002\362\363\030\001\001'
+  _globals['_BOOTSERVICE'].methods_by_name['Register']._loaded_options = None
+  _globals['_BOOTSERVICE'].methods_by_name['Register']._serialized_options = b'\340\363\030\002\362\363\030\001\001'
+  _globals['_BOOTSERVICE'].methods_by_name['Wait']._loaded_options = None
+  _globals['_BOOTSERVICE'].methods_by_name['Wait']._serialized_options = b'\340\363\030\002\362\363\030\001\001'
+  _globals['_BOOTSERVICE'].methods_by_name['Report']._loaded_options = None
+  _globals['_BOOTSERVICE'].methods_by_name['Report']._serialized_options = b'\340\363\030\002\362\363\030\001\001'
+  _globals['_BOOTSERVICEDHCPREQUEST']._serialized_start=191
+  _globals['_BOOTSERVICEDHCPREQUEST']._serialized_end=288
+  _globals['_BOOTSERVICEDHCPRESPONSE']._serialized_start=290
+  _globals['_BOOTSERVICEDHCPRESPONSE']._serialized_end=315
+  _globals['_BOOTSERVICEBOOTREQUEST']._serialized_start=317
+  _globals['_BOOTSERVICEBOOTREQUEST']._serialized_end=415
+  _globals['_BOOTSERVICEBOOTRESPONSE']._serialized_start=418
+  _globals['_BOOTSERVICEBOOTRESPONSE']._serialized_end=574
+  _globals['_BOOTSERVICEREGISTERREQUEST']._serialized_start=577
+  _globals['_BOOTSERVICEREGISTERREQUEST']._serialized_end=929
+  _globals['_BOOTSERVICEREGISTERRESPONSE']._serialized_start=932
+  _globals['_BOOTSERVICEREGISTERRESPONSE']._serialized_end=1067
+  _globals['_BOOTSERVICEWAITREQUEST']._serialized_start=1069
+  _globals['_BOOTSERVICEWAITREQUEST']._serialized_end=1123
+  _globals['_BOOTSERVICEWAITRESPONSE']._serialized_start=1125
+  _globals['_BOOTSERVICEWAITRESPONSE']._serialized_end=1220
+  _globals['_BOOTSERVICEREPORTREQUEST']._serialized_start=1223
+  _globals['_BOOTSERVICEREPORTREQUEST']._serialized_end=1398
+  _globals['_BOOTSERVICEREPORTRESPONSE']._serialized_start=1400
+  _globals['_BOOTSERVICEREPORTRESPONSE']._serialized_end=1427
+  _globals['_BOOTSERVICESUPERUSERPASSWORDREQUEST']._serialized_start=1429
+  _globals['_BOOTSERVICESUPERUSERPASSWORDREQUEST']._serialized_end=1496
+  _globals['_BOOTSERVICESUPERUSERPASSWORDRESPONSE']._serialized_start=1499
+  _globals['_BOOTSERVICESUPERUSERPASSWORDRESPONSE']._serialized_end=1640
+  _globals['_BOOTSERVICE']._serialized_start=1643
+  _globals['_BOOTSERVICE']._serialized_end=2377
+# @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/infra/v2/boot_pb2.pyi b/python/metalstack/infra/v2/boot_pb2.pyi
new file mode 100644
index 00000000..e9f9529b
--- /dev/null
+++ b/python/metalstack/infra/v2/boot_pb2.pyi
@@ -0,0 +1,111 @@
+from buf.validate import validate_pb2 as _validate_pb2
+from metalstack.api.v2 import common_pb2 as _common_pb2
+from metalstack.api.v2 import machine_pb2 as _machine_pb2
+from metalstack.api.v2 import predefined_rules_pb2 as _predefined_rules_pb2
+from google.protobuf.internal import containers as _containers
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from collections.abc import Iterable as _Iterable, Mapping as _Mapping
+from typing import ClassVar as _ClassVar, Optional as _Optional, Union as _Union
+
+DESCRIPTOR: _descriptor.FileDescriptor
+
+class BootServiceDhcpRequest(_message.Message):
+    __slots__ = ("uuid", "partition")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    PARTITION_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    partition: str
+    def __init__(self, uuid: _Optional[str] = ..., partition: _Optional[str] = ...) -> None: ...
+
+class BootServiceDhcpResponse(_message.Message):
+    __slots__ = ()
+    def __init__(self) -> None: ...
+
+class BootServiceBootRequest(_message.Message):
+    __slots__ = ("mac", "partition")
+    MAC_FIELD_NUMBER: _ClassVar[int]
+    PARTITION_FIELD_NUMBER: _ClassVar[int]
+    mac: str
+    partition: str
+    def __init__(self, mac: _Optional[str] = ..., partition: _Optional[str] = ...) -> None: ...
+
+class BootServiceBootResponse(_message.Message):
+    __slots__ = ("kernel", "init_ram_disks", "cmdline")
+    KERNEL_FIELD_NUMBER: _ClassVar[int]
+    INIT_RAM_DISKS_FIELD_NUMBER: _ClassVar[int]
+    CMDLINE_FIELD_NUMBER: _ClassVar[int]
+    kernel: str
+    init_ram_disks: _containers.RepeatedScalarFieldContainer[str]
+    cmdline: str
+    def __init__(self, kernel: _Optional[str] = ..., init_ram_disks: _Optional[_Iterable[str]] = ..., cmdline: _Optional[str] = ...) -> None: ...
+
+class BootServiceRegisterRequest(_message.Message):
+    __slots__ = ("uuid", "hardware", "bios", "ipmi", "tags", "metal_hammer_version", "partition")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    HARDWARE_FIELD_NUMBER: _ClassVar[int]
+    BIOS_FIELD_NUMBER: _ClassVar[int]
+    IPMI_FIELD_NUMBER: _ClassVar[int]
+    TAGS_FIELD_NUMBER: _ClassVar[int]
+    METAL_HAMMER_VERSION_FIELD_NUMBER: _ClassVar[int]
+    PARTITION_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    hardware: _machine_pb2.MachineHardware
+    bios: _machine_pb2.MachineBios
+    ipmi: _machine_pb2.MachineIPMI
+    tags: _containers.RepeatedScalarFieldContainer[str]
+    metal_hammer_version: str
+    partition: str
+    def __init__(self, uuid: _Optional[str] = ..., hardware: _Optional[_Union[_machine_pb2.MachineHardware, _Mapping]] = ..., bios: _Optional[_Union[_machine_pb2.MachineBios, _Mapping]] = ..., ipmi: _Optional[_Union[_machine_pb2.MachineIPMI, _Mapping]] = ..., tags: _Optional[_Iterable[str]] = ..., metal_hammer_version: _Optional[str] = ..., partition: _Optional[str] = ...) -> None: ...
+
+class BootServiceRegisterResponse(_message.Message):
+    __slots__ = ("uuid", "size", "partition")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    SIZE_FIELD_NUMBER: _ClassVar[int]
+    PARTITION_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    size: str
+    partition: str
+    def __init__(self, uuid: _Optional[str] = ..., size: _Optional[str] = ..., partition: _Optional[str] = ...) -> None: ...
+
+class BootServiceWaitRequest(_message.Message):
+    __slots__ = ("uuid",)
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    def __init__(self, uuid: _Optional[str] = ...) -> None: ...
+
+class BootServiceWaitResponse(_message.Message):
+    __slots__ = ("allocation",)
+    ALLOCATION_FIELD_NUMBER: _ClassVar[int]
+    allocation: _machine_pb2.MachineAllocation
+    def __init__(self, allocation: _Optional[_Union[_machine_pb2.MachineAllocation, _Mapping]] = ...) -> None: ...
+
+class BootServiceReportRequest(_message.Message):
+    __slots__ = ("uuid", "console_password", "success", "message")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    CONSOLE_PASSWORD_FIELD_NUMBER: _ClassVar[int]
+    SUCCESS_FIELD_NUMBER: _ClassVar[int]
+    MESSAGE_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    console_password: str
+    success: bool
+    message: str
+    def __init__(self, uuid: _Optional[str] = ..., console_password: _Optional[str] = ..., success: _Optional[bool] = ..., message: _Optional[str] = ...) -> None: ...
+
+class BootServiceReportResponse(_message.Message):
+    __slots__ = ()
+    def __init__(self) -> None: ...
+
+class BootServiceSuperUserPasswordRequest(_message.Message):
+    __slots__ = ("uuid",)
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    def __init__(self, uuid: _Optional[str] = ...) -> None: ...
+
+class BootServiceSuperUserPasswordResponse(_message.Message):
+    __slots__ = ("feature_disabled", "super_user_password")
+    FEATURE_DISABLED_FIELD_NUMBER: _ClassVar[int]
+    SUPER_USER_PASSWORD_FIELD_NUMBER: _ClassVar[int]
+    feature_disabled: bool
+    super_user_password: str
+    def __init__(self, feature_disabled: _Optional[bool] = ..., super_user_password: _Optional[str] = ...) -> None: ...

From 2b9010349711c9475efa53fd72b9d7b5f0f9e294 Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Thu, 25 Dec 2025 18:43:24 +0100
Subject: [PATCH 2/3] Allow more granular machineroles

---
 go/metalstack/api/v2/token.pb.go      | 16 ++++---
 go/tests/validation/token_test.go     | 38 ++++++++++++++++
 proto/metalstack/api/v2/token.proto   | 30 ++++++++-----
 python/metalstack/api/v2/token_pb2.py | 64 +++++++++++++--------------
 4 files changed, 98 insertions(+), 50 deletions(-)

diff --git a/go/metalstack/api/v2/token.pb.go b/go/metalstack/api/v2/token.pb.go
index 162a5fbb..ed69c810 100644
--- a/go/metalstack/api/v2/token.pb.go
+++ b/go/metalstack/api/v2/token.pb.go
@@ -1038,7 +1038,8 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n" +
 	"\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n" +
 	"\v_admin_roleB\r\n" +
-	"\v_infra_role\"\xde\b\n" +
+	"\v_infra_role\"\xa7\n" +
+	"\n" +
 	"\x19TokenServiceCreateRequest\x12-\n" +
 	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12O\n" +
 	"\vpermissions\x18\x02 \x03(\v2#.metalstack.api.v2.MethodPermissionB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
@@ -1048,8 +1049,9 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
 	"admin_role\x18\a \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
-	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12y\n" +
-	"\rmachine_roles\x18\t \x03(\v2>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fmachineRoles\x121\n" +
+	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\xc1\x02\n" +
+	"\rmachine_roles\x18\t \x03(\v2>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\xba\x01\xc9\x01\n" +
+	"\x12machine_roles_keys\x123map keys must be empty string, '*', or a valid UUID\x1a~this.all(k, k == '' || k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))\x9a\x01\a*\x05\x82\x01\x02\x10\x01R\fmachineRoles\x121\n" +
 	"\x06labels\x18\n" +
 	" \x01(\v2\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n" +
 	"\x11ProjectRolesEntry\x12\x10\n" +
@@ -1074,7 +1076,8 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"9\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n" +
-	"\x1aTokenServiceRevokeResponse\"\x8c\t\n" +
+	"\x1aTokenServiceRevokeResponse\"\xd5\n" +
+	"\n" +
 	"\x19TokenServiceUpdateRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12F\n" +
 	"\vupdate_meta\x18\x02 \x01(\v2\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\n" +
@@ -1086,8 +1089,9 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\n" +
 	"admin_role\x18\a \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
-	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12y\n" +
-	"\rmachine_roles\x18\t \x03(\v2>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fmachineRoles\x127\n" +
+	"infra_role\x18\b \x01(\x0e2\x1c.metalstack.api.v2.InfraRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\xc1\x02\n" +
+	"\rmachine_roles\x18\t \x03(\v2>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\xba\x01\xc9\x01\n" +
+	"\x12machine_roles_keys\x123map keys must be empty string, '*', or a valid UUID\x1a~this.all(k, k == '' || k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))\x9a\x01\a*\x05\x82\x01\x02\x10\x01R\fmachineRoles\x127\n" +
 	"\x06labels\x18\n" +
 	" \x01(\v2\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n" +
 	"\x11ProjectRolesEntry\x12\x10\n" +
diff --git a/go/tests/validation/token_test.go b/go/tests/validation/token_test.go
index 7823b9ad..5c0add50 100644
--- a/go/tests/validation/token_test.go
+++ b/go/tests/validation/token_test.go
@@ -80,6 +80,44 @@ func TestValidateToken(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "Valid Token, api token with machineroles",
+			msg: &apiv2.TokenServiceUpdateRequest{
+				Uuid: "00000000-0000-0000-0000-000000000000",
+				MachineRoles: map[string]apiv2.MachineRole{
+					"":                                     apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+					"*":                                    apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+					"00000000-0000-0000-0000-000000000000": apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "InValid Token, api token with machineroles with invalid uuid",
+			msg: &apiv2.TokenServiceUpdateRequest{
+				Uuid: "00000000-0000-0000-0000-000000000000",
+				MachineRoles: map[string]apiv2.MachineRole{
+					"":                                     apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+					"*":                                    apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+					"y0000000-0000-0000-0000-000000000000": apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: machine_roles: map keys must be empty string, '*', or a valid UUID",
+		},
+		{
+			name: "InValid Token, api token with machineroles with invalid key",
+			msg: &apiv2.TokenServiceUpdateRequest{
+				Uuid: "00000000-0000-0000-0000-000000000000",
+				MachineRoles: map[string]apiv2.MachineRole{
+					"A":                                    apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+					"*":                                    apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+					"00000000-0000-0000-0000-000000000000": apiv2.MachineRole_MACHINE_ROLE_EDITOR,
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: machine_roles: map keys must be empty string, '*', or a valid UUID",
+		},
 	}
 
 	validateProtos(t, tests)
diff --git a/proto/metalstack/api/v2/token.proto b/proto/metalstack/api/v2/token.proto
index 1ac5efcc..63fd9ab4 100644
--- a/proto/metalstack/api/v2/token.proto
+++ b/proto/metalstack/api/v2/token.proto
@@ -134,14 +134,17 @@ message TokenServiceCreateRequest {
   // InfraRole defines the infrastructure role of the token owner
   optional InfraRole infra_role = 8 [(buf.validate.field).enum.defined_only = true];
   // MachineRoles associates a machine uuid with the corresponding role of the token owner
-  map<string, MachineRole> machine_roles = 9 [(buf.validate.field).map = {
-    keys: {
-      string: {uuid: true}
-    }
-    values: {
+  map<string, MachineRole> machine_roles = 9 [
+    (buf.validate.field).cel = {
+      id: "machine_roles_keys"
+      message: "map keys must be empty string, '*', or a valid UUID"
+      // UUID regex pattern: 8-4-4-4-12 hex digits
+      expression: "this.all(k, k == '' || k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))"
+    },
+    (buf.validate.field).map.values = {
       enum: {defined_only: true}
     }
-  }];
+  ];
   // Labels on this token
   Labels labels = 10;
 }
@@ -222,14 +225,17 @@ message TokenServiceUpdateRequest {
   // InfraRole defines the infrastructure role of the token owner
   optional InfraRole infra_role = 8 [(buf.validate.field).enum.defined_only = true];
   // MachineRoles associates a machine uuid with the corresponding role of the token owner
-  map<string, MachineRole> machine_roles = 9 [(buf.validate.field).map = {
-    keys: {
-      string: {uuid: true}
-    }
-    values: {
+  map<string, MachineRole> machine_roles = 9 [
+    (buf.validate.field).cel = {
+      id: "machine_roles_keys"
+      message: "map keys must be empty string, '*', or a valid UUID"
+      // UUID regex pattern: 8-4-4-4-12 hex digits
+      expression: "this.all(k, k == '' || k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))"
+    },
+    (buf.validate.field).map.values = {
       enum: {defined_only: true}
     }
-  }];
+  ];
   // Labels on this token
   UpdateLabels labels = 10;
 }
diff --git a/python/metalstack/api/v2/token_pb2.py b/python/metalstack/api/v2/token_pb2.py
index 3c754142..2a953823 100644
--- a/python/metalstack/api/v2/token_pb2.py
+++ b/python/metalstack/api/v2/token_pb2.py
@@ -29,7 +29,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xde\x08\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x04 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12y\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cmachineRoles\x12\x31\n\x06labels\x18\n \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\x8c\t\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12y\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\x90\x05\n\x0cTokenService\x12\x62\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x04\xd8\xf3\x18\x03\x12\x65\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x04\xd8\xf3\x18\x03\x12n\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x04\xd8\xf3\x18\x03\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xa7\n\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x04 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x31\n\x06labels\x18\n \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xd5\n\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\x90\x05\n\x0cTokenService\x12\x62\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x04\xd8\xf3\x18\x03\x12\x65\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x04\xd8\xf3\x18\x03\x12n\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x04\xd8\xf3\x18\x03\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -80,7 +80,7 @@
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['infra_role']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['infra_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['machine_roles']._loaded_options = None
-  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\021\232\001\016\"\005r\003\260\001\001*\005\202\001\002\020\001'
+  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\327\001\232\001\007*\005\202\001\002\020\001\272\001\311\001\n\022machine_roles_keys\0223map keys must be empty string, \'*\', or a valid UUID\032~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))'
   _globals['_METHODPERMISSION'].fields_by_name['subject']._loaded_options = None
   _globals['_METHODPERMISSION'].fields_by_name['subject']._serialized_options = b'\272H\005r\003\030\200\002'
   _globals['_METHODPERMISSION'].fields_by_name['methods']._loaded_options = None
@@ -108,7 +108,7 @@
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['infra_role']._loaded_options = None
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['infra_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['machine_roles']._loaded_options = None
-  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\021\232\001\016\"\005r\003\260\001\001*\005\202\001\002\020\001'
+  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['machine_roles']._serialized_options = b'\272H\327\001\232\001\007*\005\202\001\002\020\001\272\001\311\001\n\022machine_roles_keys\0223map keys must be empty string, \'*\', or a valid UUID\032~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))'
   _globals['_TOKENSERVICEGETREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEGETREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKENSERVICE'].methods_by_name['Get']._loaded_options = None
@@ -123,8 +123,8 @@
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\330\363\030\003'
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._serialized_options = b'\330\363\030\003'
-  _globals['_TOKENTYPE']._serialized_start=4540
-  _globals['_TOKENTYPE']._serialized_end=4620
+  _globals['_TOKENTYPE']._serialized_start=4942
+  _globals['_TOKENTYPE']._serialized_end=5022
   _globals['_TOKEN']._serialized_start=221
   _globals['_TOKEN']._serialized_end=1519
   _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=1040
@@ -134,43 +134,43 @@
   _globals['_TOKEN_MACHINEROLESENTRY']._serialized_start=1232
   _globals['_TOKEN_MACHINEROLESENTRY']._serialized_end=1327
   _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1522
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2640
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2841
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
   _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
   _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_METHODPERMISSION']._serialized_start=2642
-  _globals['_METHODPERMISSION']._serialized_end=2733
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2735
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=2835
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=2837
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=2862
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=2864
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=2940
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=2942
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=2999
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3001
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3029
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3032
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4196
+  _globals['_METHODPERMISSION']._serialized_start=2843
+  _globals['_METHODPERMISSION']._serialized_end=2934
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2936
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=3036
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=3038
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=3063
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=3065
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=3141
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=3143
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3200
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3202
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3230
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3233
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4598
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
   _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
   _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4198
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4274
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4276
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4330
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4332
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4405
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4407
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4435
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4437
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4538
-  _globals['_TOKENSERVICE']._serialized_start=4623
-  _globals['_TOKENSERVICE']._serialized_end=5279
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4600
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4676
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4678
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4732
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4734
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4807
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4809
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4837
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4839
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4940
+  _globals['_TOKENSERVICE']._serialized_start=5025
+  _globals['_TOKENSERVICE']._serialized_end=5681
 # @@protoc_insertion_point(module_scope)

From 13b4cbf1af75f4ec61ff274c9b52eda7c84f664b Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Fri, 26 Dec 2025 13:18:15 +0100
Subject: [PATCH 3/3] Waitformachineevent

---
 doc/index.html                                | 155 +++++++-
 go/metalstack/admin/v2/network.pb.go          |  12 +-
 go/metalstack/api/v2/machine.pb.go            | 361 +++++++++++-------
 go/metalstack/api/v2/network.pb.go            |  10 +-
 go/metalstack/api/v2/predefined_rules.pb.go   |  16 +-
 go/metalstack/api/v2/switch.pb.go             |   2 +-
 go/metalstack/infra/v2/bmc.pb.go              | 147 ++++++-
 .../infra/v2/infrav2connect/bmc.connect.go    |  33 +-
 go/permissions/servicepermissions.go          | 234 ++++++------
 .../v2/infrav2connect/BMCServiceClient.go     |  63 +++
 .../v2/infrav2connect/BMCServiceHandler.go    |  58 +++
 proto/metalstack/api/v2/machine.proto         |  26 ++
 .../metalstack/api/v2/predefined_rules.proto  |   4 +-
 proto/metalstack/infra/v2/bmc.proto           |  22 ++
 python/metalstack/admin/v2/network_pb2.py     |  14 +-
 python/metalstack/api/v2/machine_pb2.py       |  48 ++-
 python/metalstack/api/v2/machine_pb2.pyi      |  25 ++
 python/metalstack/api/v2/network_pb2.py       |  12 +-
 .../metalstack/api/v2/predefined_rules_pb2.py |   2 +-
 python/metalstack/api/v2/switch_pb2.py        |   4 +-
 python/metalstack/infra/v2/bmc_connect.py     |  65 ++++
 python/metalstack/infra/v2/bmc_pb2.py         |  25 +-
 python/metalstack/infra/v2/bmc_pb2.pyi        |  20 +-
 23 files changed, 1035 insertions(+), 323 deletions(-)

diff --git a/doc/index.html b/doc/index.html
index 647e777f..e7bb1ed5 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -1020,6 +1020,10 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.api.v2.MachineAllocationType"><span class="badge">E</span>MachineAllocationType</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.MachineBMCCommand"><span class="badge">E</span>MachineBMCCommand</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.MachineLiveliness"><span class="badge">E</span>MachineLiveliness</a>
                 </li>
@@ -1966,6 +1970,14 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.infra.v2.UpdateBMCInfoResponse"><span class="badge">M</span>UpdateBMCInfoResponse</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.infra.v2.WaitForMachineEventRequest"><span class="badge">M</span>WaitForMachineEventRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.infra.v2.WaitForMachineEventResponse"><span class="badge">M</span>WaitForMachineEventResponse</a>
+                </li>
+              
               
               
               
@@ -2689,7 +2701,7 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
                 <td>ips</td>
                 <td><a href="#bool">bool</a></td>
                 <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
-                <td>80048957</td>
+                <td>80058952</td>
                 <td><p>Ips validates if a slice of ips in string form are valid</p></td>
               </tr>
             
@@ -2697,7 +2709,7 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
                 <td>prefixes</td>
                 <td><a href="#bool">bool</a></td>
                 <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
-                <td>80048956</td>
+                <td>80058951</td>
                 <td><p>Prefixes validates if a slice of prefixes in string form are valid</p></td>
               </tr>
             
@@ -9041,6 +9053,83 @@ <h3 id="metalstack.api.v2.MachineAllocationType">MachineAllocationType</h3>
           </tbody>
         </table>
       
+        <h3 id="metalstack.api.v2.MachineBMCCommand">MachineBMCCommand</h3>
+        <p>MachineBMCCommand defines commands send to the BMC of the machine</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>MACHINE_BMC_COMMAND_UNSPECIFIED is not defined</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_ON</td>
+                <td>1</td>
+                <td><p>MACHINE_BMC_COMMAND_ON Power on the machine</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_OFF</td>
+                <td>2</td>
+                <td><p>MACHINE_BMC_COMMAND_OFF Power off the machine</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_RESET</td>
+                <td>3</td>
+                <td><p>MACHINE_BMC_COMMAND_RESET Power reset the machine</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_CYCLE</td>
+                <td>4</td>
+                <td><p>MACHINE_BMC_COMMAND_CYCLE Power cycle the machine</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_BOOT_TO_BIOS</td>
+                <td>5</td>
+                <td><p>MACHINE_BMC_COMMAND_BOOT_TO_BIOS boot the machine into bios</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_BOOT_FROM_DISK</td>
+                <td>6</td>
+                <td><p>MACHINE_BMC_COMMAND_BOOT_FROM_DISK boot the machine from hard disk</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_BOOT_FROM_PXE</td>
+                <td>7</td>
+                <td><p>MACHINE_BMC_COMMAND_BOOT_FROM_PXE boot the machine from pxe</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_IDENTIFY_LED_ON</td>
+                <td>8</td>
+                <td><p>MACHINE_BMC_COMMAND_IDENTIFY_LED_ON set identify led of the machine chassis to on</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF</td>
+                <td>9</td>
+                <td><p>MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF set identify led of the machine chassis to off</p></td>
+              </tr>
+            
+              <tr>
+                <td>MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE</td>
+                <td>10</td>
+                <td><p>MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE update the bmc firmware of this machine</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
         <h3 id="metalstack.api.v2.MachineLiveliness">MachineLiveliness</h3>
         <p>MachineLiveliness specifies the liveliness of a machine</p>
         <table class="enum-table">
@@ -15763,6 +15852,61 @@ <h3 id="metalstack.infra.v2.UpdateBMCInfoResponse">UpdateBMCInfoResponse</h3>
 
         
       
+        <h3 id="metalstack.infra.v2.WaitForMachineEventRequest">WaitForMachineEventRequest</h3>
+        <p>WaitForMachineEventRequest</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>partition</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Partition the partition id where metal-bmc wants to receive events </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.infra.v2.WaitForMachineEventResponse">WaitForMachineEventResponse</h3>
+        <p>WaitForMachineEventResponse</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>bmc_command</td>
+                  <td><a href="#metalstack.api.v2.MachineBMCCommand">metalstack.api.v2.MachineBMCCommand</a></td>
+                  <td></td>
+                  <td><p>BMCCommand to execute against the bmc of the machine </p></td>
+                </tr>
+              
+                <tr>
+                  <td>machine_ipmi</td>
+                  <td><a href="#metalstack.api.v2.MachineIPMI">metalstack.api.v2.MachineIPMI</a></td>
+                  <td></td>
+                  <td><p>MachineIPMI contains connection details of the machine to issue the bmcCommand to </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
 
       
 
@@ -15784,6 +15928,13 @@ <h3 id="metalstack.infra.v2.BMCService">BMCService</h3>
                 <td><p>UpdateBMCInfo</p></td>
               </tr>
             
+              <tr>
+                <td>WaitForMachineEvent</td>
+                <td><a href="#metalstack.infra.v2.WaitForMachineEventRequest">WaitForMachineEventRequest</a> stream</td>
+                <td><a href="#metalstack.infra.v2.WaitForMachineEventResponse">WaitForMachineEventResponse</a> stream</td>
+                <td><p>WaitForMachineEvent is called by the metal-bmc and is returned with a bmc command to execute.</p></td>
+              </tr>
+            
           </tbody>
         </table>
 
diff --git a/go/metalstack/admin/v2/network.pb.go b/go/metalstack/admin/v2/network.pb.go
index 96395c5f..84993551 100644
--- a/go/metalstack/admin/v2/network.pb.go
+++ b/go/metalstack/admin/v2/network.pb.go
@@ -745,15 +745,15 @@ const file_metalstack_admin_v2_network_proto_rawDesc = "" +
 	"\aproject\x18\x05 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x04R\aproject\x88\x01\x01\x12<\n" +
 	"\x04type\x18\x06 \x01(\x0e2\x1e.metalstack.api.v2.NetworkTypeB\b\xbaH\x05\x82\x01\x02\x10\x01R\x04type\x126\n" +
 	"\x06labels\x18\a \x01(\v2\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12(\n" +
-	"\bprefixes\x18\b \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\bprefixes\x12?\n" +
-	"\x14destination_prefixes\x18\t \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x13destinationPrefixes\x12c\n" +
+	"\bprefixes\x18\b \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\bprefixes\x12?\n" +
+	"\x14destination_prefixes\x18\t \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13destinationPrefixes\x12c\n" +
 	"\x1bdefault_child_prefix_length\x18\n" +
 	" \x01(\v2$.metalstack.api.v2.ChildPrefixLengthR\x18defaultChildPrefixLength\x12[\n" +
 	"\x17min_child_prefix_length\x18\v \x01(\v2$.metalstack.api.v2.ChildPrefixLengthR\x14minChildPrefixLength\x12D\n" +
 	"\bnat_type\x18\f \x01(\x0e2\x1a.metalstack.api.v2.NATTypeB\b\xbaH\x05\x82\x01\x02\x10\x01H\x06R\anatType\x88\x01\x01\x12\x15\n" +
 	"\x03vrf\x18\r \x01(\rH\aR\x03vrf\x88\x01\x01\x127\n" +
 	"\x0eparent_network\x18\x0e \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01H\bR\rparentNetwork\x88\x01\x01\x12N\n" +
-	"\x1cadditional_announcable_cidrs\x18\x0f \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x1aadditionalAnnouncableCidrs\x12A\n" +
+	"\x1cadditional_announcable_cidrs\x18\x0f \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x1aadditionalAnnouncableCidrs\x12A\n" +
 	"\x06length\x18\x10 \x01(\v2$.metalstack.api.v2.ChildPrefixLengthH\tR\x06length\x88\x01\x01\x12]\n" +
 	"\x0eaddress_family\x18\x11 \x01(\x0e2'.metalstack.api.v2.NetworkAddressFamilyB\b\xbaH\x05\x82\x01\x02\x10\x01H\n" +
 	"R\raddressFamily\x88\x01\x01B\x05\n" +
@@ -777,13 +777,13 @@ const file_metalstack_admin_v2_network_proto_rawDesc = "" +
 	"\x04name\x18\x03 \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x122\n" +
 	"\vdescription\x18\x04 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x01R\vdescription\x88\x01\x01\x12<\n" +
 	"\x06labels\x18\x05 \x01(\v2\x1f.metalstack.api.v2.UpdateLabelsH\x02R\x06labels\x88\x01\x01\x12(\n" +
-	"\bprefixes\x18\x06 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\bprefixes\x12?\n" +
-	"\x14destination_prefixes\x18\a \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x13destinationPrefixes\x12h\n" +
+	"\bprefixes\x18\x06 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\bprefixes\x12?\n" +
+	"\x14destination_prefixes\x18\a \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13destinationPrefixes\x12h\n" +
 	"\x1bdefault_child_prefix_length\x18\n" +
 	" \x01(\v2$.metalstack.api.v2.ChildPrefixLengthH\x03R\x18defaultChildPrefixLength\x88\x01\x01\x12`\n" +
 	"\x17min_child_prefix_length\x18\v \x01(\v2$.metalstack.api.v2.ChildPrefixLengthH\x04R\x14minChildPrefixLength\x88\x01\x01\x12D\n" +
 	"\bnat_type\x18\r \x01(\x0e2\x1a.metalstack.api.v2.NATTypeB\b\xbaH\x05\x82\x01\x02\x10\x01H\x05R\anatType\x88\x01\x01\x12N\n" +
-	"\x1cadditional_announcable_cidrs\x18\x10 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x1aadditionalAnnouncableCidrs\x12\x14\n" +
+	"\x1cadditional_announcable_cidrs\x18\x10 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x1aadditionalAnnouncableCidrs\x12\x14\n" +
 	"\x05force\x18\x14 \x01(\bR\x05forceB\a\n" +
 	"\x05_nameB\x0e\n" +
 	"\f_descriptionB\t\n" +
diff --git a/go/metalstack/api/v2/machine.pb.go b/go/metalstack/api/v2/machine.pb.go
index 3c7d43ac..ffcfb6b2 100644
--- a/go/metalstack/api/v2/machine.pb.go
+++ b/go/metalstack/api/v2/machine.pb.go
@@ -385,6 +385,91 @@ func (MachineAllocationType) EnumDescriptor() ([]byte, []int) {
 	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{5}
 }
 
+// MachineBMCCommand defines commands send to the BMC of the machine
+type MachineBMCCommand int32
+
+const (
+	// MACHINE_BMC_COMMAND_UNSPECIFIED is not defined
+	MachineBMCCommand_MACHINE_BMC_COMMAND_UNSPECIFIED MachineBMCCommand = 0
+	// MACHINE_BMC_COMMAND_ON Power on the machine
+	MachineBMCCommand_MACHINE_BMC_COMMAND_ON MachineBMCCommand = 1
+	// MACHINE_BMC_COMMAND_OFF Power off the machine
+	MachineBMCCommand_MACHINE_BMC_COMMAND_OFF MachineBMCCommand = 2
+	// MACHINE_BMC_COMMAND_RESET Power reset the machine
+	MachineBMCCommand_MACHINE_BMC_COMMAND_RESET MachineBMCCommand = 3
+	// MACHINE_BMC_COMMAND_CYCLE Power cycle the machine
+	MachineBMCCommand_MACHINE_BMC_COMMAND_CYCLE MachineBMCCommand = 4
+	// MACHINE_BMC_COMMAND_BOOT_TO_BIOS boot the machine into bios
+	MachineBMCCommand_MACHINE_BMC_COMMAND_BOOT_TO_BIOS MachineBMCCommand = 5
+	// MACHINE_BMC_COMMAND_BOOT_FROM_DISK boot the machine from hard disk
+	MachineBMCCommand_MACHINE_BMC_COMMAND_BOOT_FROM_DISK MachineBMCCommand = 6
+	// MACHINE_BMC_COMMAND_BOOT_FROM_PXE boot the machine from pxe
+	MachineBMCCommand_MACHINE_BMC_COMMAND_BOOT_FROM_PXE MachineBMCCommand = 7
+	// MACHINE_BMC_COMMAND_IDENTIFY_LED_ON set identify led of the machine chassis to on
+	MachineBMCCommand_MACHINE_BMC_COMMAND_IDENTIFY_LED_ON MachineBMCCommand = 8
+	// MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF set identify led of the machine chassis to off
+	MachineBMCCommand_MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF MachineBMCCommand = 9
+	// MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE update the bmc firmware of this machine
+	MachineBMCCommand_MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE MachineBMCCommand = 10
+)
+
+// Enum value maps for MachineBMCCommand.
+var (
+	MachineBMCCommand_name = map[int32]string{
+		0:  "MACHINE_BMC_COMMAND_UNSPECIFIED",
+		1:  "MACHINE_BMC_COMMAND_ON",
+		2:  "MACHINE_BMC_COMMAND_OFF",
+		3:  "MACHINE_BMC_COMMAND_RESET",
+		4:  "MACHINE_BMC_COMMAND_CYCLE",
+		5:  "MACHINE_BMC_COMMAND_BOOT_TO_BIOS",
+		6:  "MACHINE_BMC_COMMAND_BOOT_FROM_DISK",
+		7:  "MACHINE_BMC_COMMAND_BOOT_FROM_PXE",
+		8:  "MACHINE_BMC_COMMAND_IDENTIFY_LED_ON",
+		9:  "MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF",
+		10: "MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE",
+	}
+	MachineBMCCommand_value = map[string]int32{
+		"MACHINE_BMC_COMMAND_UNSPECIFIED":         0,
+		"MACHINE_BMC_COMMAND_ON":                  1,
+		"MACHINE_BMC_COMMAND_OFF":                 2,
+		"MACHINE_BMC_COMMAND_RESET":               3,
+		"MACHINE_BMC_COMMAND_CYCLE":               4,
+		"MACHINE_BMC_COMMAND_BOOT_TO_BIOS":        5,
+		"MACHINE_BMC_COMMAND_BOOT_FROM_DISK":      6,
+		"MACHINE_BMC_COMMAND_BOOT_FROM_PXE":       7,
+		"MACHINE_BMC_COMMAND_IDENTIFY_LED_ON":     8,
+		"MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF":    9,
+		"MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE": 10,
+	}
+)
+
+func (x MachineBMCCommand) Enum() *MachineBMCCommand {
+	p := new(MachineBMCCommand)
+	*p = x
+	return p
+}
+
+func (x MachineBMCCommand) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MachineBMCCommand) Descriptor() protoreflect.EnumDescriptor {
+	return file_metalstack_api_v2_machine_proto_enumTypes[6].Descriptor()
+}
+
+func (MachineBMCCommand) Type() protoreflect.EnumType {
+	return &file_metalstack_api_v2_machine_proto_enumTypes[6]
+}
+
+func (x MachineBMCCommand) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MachineBMCCommand.Descriptor instead.
+func (MachineBMCCommand) EnumDescriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_machine_proto_rawDescGZIP(), []int{6}
+}
+
 // MachineServiceGetRequest is the request payload for a machine get request
 type MachineServiceGetRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -3625,7 +3710,7 @@ const file_metalstack_api_v2_machine_proto_rawDesc = "" +
 	"\buserdata\x18\v \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02H\x04R\buserdata\x88\x01\x01\x121\n" +
 	"\x06labels\x18\f \x01(\v2\x19.metalstack.api.v2.LabelsR\x06labels\x12G\n" +
 	"\bnetworks\x18\r \x03(\v2+.metalstack.api.v2.MachineAllocationNetworkR\bnetworks\x12\x1e\n" +
-	"\x03ips\x18\x0e \x03(\tB\f\xbaH\t\x92\x01\x06賮\xb1\x02\x01R\x03ips\x12%\n" +
+	"\x03ips\x18\x0e \x03(\tB\f\xbaH\t\x92\x01\x06\xc0\xa4\xb3\xb1\x02\x01R\x03ips\x12%\n" +
 	"\x0eplacement_tags\x18\x0f \x03(\tR\rplacementTags\x12E\n" +
 	"\n" +
 	"dns_server\x18\x10 \x03(\v2\x1c.metalstack.api.v2.DNSServerB\b\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12E\n" +
@@ -3723,19 +3808,19 @@ const file_metalstack_api_v2_machine_proto_rawDesc = "" +
 	"\x12FirewallEgressRule\x12C\n" +
 	"\bprotocol\x18\x01 \x01(\x0e2\x1d.metalstack.api.v2.IPProtocolB\b\xbaH\x05\x82\x01\x02\x10\x01R\bprotocol\x12$\n" +
 	"\x05ports\x18\x02 \x03(\rB\x0e\xbaH\v\x92\x01\b\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n" +
-	"\x02to\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x02to\x121\n" +
+	"\x02to\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x02to\x121\n" +
 	"\acomment\x18\x04 \x01(\tB\x17\xbaH\x14\xd8\x01\x01r\x0f\x18d2\v^[a-z_ -]*$R\acomment\"\xf3\x01\n" +
 	"\x13FirewallIngressRule\x12C\n" +
 	"\bprotocol\x18\x01 \x01(\x0e2\x1d.metalstack.api.v2.IPProtocolB\b\xbaH\x05\x82\x01\x02\x10\x01R\bprotocol\x12$\n" +
 	"\x05ports\x18\x02 \x03(\rB\x0e\xbaH\v\x92\x01\b\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n" +
-	"\x02to\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x02to\x12 \n" +
-	"\x04from\x18\x04 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x04from\x121\n" +
+	"\x02to\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x02to\x12 \n" +
+	"\x04from\x18\x04 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x04from\x121\n" +
 	"\acomment\x18\x05 \x01(\tB\x17\xbaH\x14\xd8\x01\x01r\x0f\x18d2\v^[a-z_ -]*$R\acomment\"\xe7\x02\n" +
 	"\x0eMachineNetwork\x12\x18\n" +
 	"\anetwork\x18\x01 \x01(\tR\anetwork\x12(\n" +
-	"\bprefixes\x18\x02 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\bprefixes\x12?\n" +
-	"\x14destination_prefixes\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x13destinationPrefixes\x12\x1e\n" +
-	"\x03ips\x18\x04 \x03(\tB\f\xbaH\t\x92\x01\x06賮\xb1\x02\x01R\x03ips\x12K\n" +
+	"\bprefixes\x18\x02 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\bprefixes\x12?\n" +
+	"\x14destination_prefixes\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13destinationPrefixes\x12\x1e\n" +
+	"\x03ips\x18\x04 \x03(\tB\f\xbaH\t\x92\x01\x06\xc0\xa4\xb3\xb1\x02\x01R\x03ips\x12K\n" +
 	"\fnetwork_type\x18\x05 \x01(\x0e2\x1e.metalstack.api.v2.NetworkTypeB\b\xbaH\x05\x82\x01\x02\x10\x01R\vnetworkType\x12?\n" +
 	"\bnat_type\x18\x06 \x01(\x0e2\x1a.metalstack.api.v2.NATTypeB\b\xbaH\x05\x82\x01\x02\x10\x01R\anatType\x12\x10\n" +
 	"\x03vrf\x18\a \x01(\x04R\x03vrf\x12\x10\n" +
@@ -3881,9 +3966,9 @@ const file_metalstack_api_v2_machine_proto_rawDesc = "" +
 	"\a_labels\"\xe4\x01\n" +
 	"\x13MachineNetworkQuery\x12\x1a\n" +
 	"\bnetworks\x18\x01 \x03(\tR\bnetworks\x12(\n" +
-	"\bprefixes\x18\x02 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\bprefixes\x12?\n" +
-	"\x14destination_prefixes\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x13destinationPrefixes\x12\x1e\n" +
-	"\x03ips\x18\x04 \x03(\tB\f\xbaH\t\x92\x01\x06賮\xb1\x02\x01R\x03ips\x12\x12\n" +
+	"\bprefixes\x18\x02 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\bprefixes\x12?\n" +
+	"\x14destination_prefixes\x18\x03 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13destinationPrefixes\x12\x1e\n" +
+	"\x03ips\x18\x04 \x03(\tB\f\xbaH\t\x92\x01\x06\xc0\xa4\xb3\xb1\x02\x01R\x03ips\x12\x12\n" +
 	"\x04vrfs\x18\x05 \x03(\x04R\x04vrfs\x12\x12\n" +
 	"\x04asns\x18\x06 \x03(\rR\x04asns\"\xd9\x01\n" +
 	"\x0fMachineNicQuery\x12(\n" +
@@ -3967,7 +4052,20 @@ const file_metalstack_api_v2_machine_proto_rawDesc = "" +
 	"\x15MachineAllocationType\x12-\n" +
 	"#MACHINE_ALLOCATION_TYPE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x120\n" +
 	"\x1fMACHINE_ALLOCATION_TYPE_MACHINE\x10\x01\x1a\v\x82\xb2\x19\amachine\x122\n" +
-	" MACHINE_ALLOCATION_TYPE_FIREWALL\x10\x02\x1a\f\x82\xb2\x19\bfirewall2\xca\x04\n" +
+	" MACHINE_ALLOCATION_TYPE_FIREWALL\x10\x02\x1a\f\x82\xb2\x19\bfirewall*\xc8\x04\n" +
+	"\x11MachineBMCCommand\x12#\n" +
+	"\x1fMACHINE_BMC_COMMAND_UNSPECIFIED\x10\x00\x12\"\n" +
+	"\x16MACHINE_BMC_COMMAND_ON\x10\x01\x1a\x06\x82\xb2\x19\x02on\x12$\n" +
+	"\x17MACHINE_BMC_COMMAND_OFF\x10\x02\x1a\a\x82\xb2\x19\x03off\x12(\n" +
+	"\x19MACHINE_BMC_COMMAND_RESET\x10\x03\x1a\t\x82\xb2\x19\x05reset\x12(\n" +
+	"\x19MACHINE_BMC_COMMAND_CYCLE\x10\x04\x1a\t\x82\xb2\x19\x05cycle\x126\n" +
+	" MACHINE_BMC_COMMAND_BOOT_TO_BIOS\x10\x05\x1a\x10\x82\xb2\x19\fboot-to-bios\x12:\n" +
+	"\"MACHINE_BMC_COMMAND_BOOT_FROM_DISK\x10\x06\x1a\x12\x82\xb2\x19\x0eboot-from-disk\x128\n" +
+	"!MACHINE_BMC_COMMAND_BOOT_FROM_PXE\x10\a\x1a\x11\x82\xb2\x19\rboot-from-pxe\x12<\n" +
+	"#MACHINE_BMC_COMMAND_IDENTIFY_LED_ON\x10\b\x1a\x13\x82\xb2\x19\x0fidentify-led-on\x12>\n" +
+	"$MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF\x10\t\x1a\x14\x82\xb2\x19\x10identify-led-off\x12D\n" +
+	"'MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE\x10\n" +
+	"\x1a\x17\x82\xb2\x19\x13update-bmc-firmware2\xca\x04\n" +
 	"\x0eMachineService\x12m\n" +
 	"\x03Get\x12+.metalstack.api.v2.MachineServiceGetRequest\x1a,.metalstack.api.v2.MachineServiceGetResponse\"\v\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n" +
 	"\x06Create\x12..metalstack.api.v2.MachineServiceCreateRequest\x1a/.metalstack.api.v2.MachineServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n" +
@@ -3988,7 +4086,7 @@ func file_metalstack_api_v2_machine_proto_rawDescGZIP() []byte {
 	return file_metalstack_api_v2_machine_proto_rawDescData
 }
 
-var file_metalstack_api_v2_machine_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
+var file_metalstack_api_v2_machine_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
 var file_metalstack_api_v2_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 40)
 var file_metalstack_api_v2_machine_proto_goTypes = []any{
 	(IPProtocol)(0),                         // 0: metalstack.api.v2.IPProtocol
@@ -3997,136 +4095,137 @@ var file_metalstack_api_v2_machine_proto_goTypes = []any{
 	(MachineProvisioningEventType)(0),       // 3: metalstack.api.v2.MachineProvisioningEventType
 	(MachineLiveliness)(0),                  // 4: metalstack.api.v2.MachineLiveliness
 	(MachineAllocationType)(0),              // 5: metalstack.api.v2.MachineAllocationType
-	(*MachineServiceGetRequest)(nil),        // 6: metalstack.api.v2.MachineServiceGetRequest
-	(*MachineServiceGetResponse)(nil),       // 7: metalstack.api.v2.MachineServiceGetResponse
-	(*MachineServiceCreateRequest)(nil),     // 8: metalstack.api.v2.MachineServiceCreateRequest
-	(*FirewallSpec)(nil),                    // 9: metalstack.api.v2.FirewallSpec
-	(*MachineServiceCreateResponse)(nil),    // 10: metalstack.api.v2.MachineServiceCreateResponse
-	(*MachineServiceUpdateRequest)(nil),     // 11: metalstack.api.v2.MachineServiceUpdateRequest
-	(*MachineServiceUpdateResponse)(nil),    // 12: metalstack.api.v2.MachineServiceUpdateResponse
-	(*MachineServiceListRequest)(nil),       // 13: metalstack.api.v2.MachineServiceListRequest
-	(*MachineServiceListResponse)(nil),      // 14: metalstack.api.v2.MachineServiceListResponse
-	(*MachineServiceDeleteRequest)(nil),     // 15: metalstack.api.v2.MachineServiceDeleteRequest
-	(*MachineServiceDeleteResponse)(nil),    // 16: metalstack.api.v2.MachineServiceDeleteResponse
-	(*Machine)(nil),                         // 17: metalstack.api.v2.Machine
-	(*MachineStatus)(nil),                   // 18: metalstack.api.v2.MachineStatus
-	(*MachineCondition)(nil),                // 19: metalstack.api.v2.MachineCondition
-	(*MachineAllocation)(nil),               // 20: metalstack.api.v2.MachineAllocation
-	(*MachineAllocationNetwork)(nil),        // 21: metalstack.api.v2.MachineAllocationNetwork
-	(*FirewallRules)(nil),                   // 22: metalstack.api.v2.FirewallRules
-	(*FirewallEgressRule)(nil),              // 23: metalstack.api.v2.FirewallEgressRule
-	(*FirewallIngressRule)(nil),             // 24: metalstack.api.v2.FirewallIngressRule
-	(*MachineNetwork)(nil),                  // 25: metalstack.api.v2.MachineNetwork
-	(*MachineHardware)(nil),                 // 26: metalstack.api.v2.MachineHardware
-	(*MetalCPU)(nil),                        // 27: metalstack.api.v2.MetalCPU
-	(*MetalGPU)(nil),                        // 28: metalstack.api.v2.MetalGPU
-	(*MachineNic)(nil),                      // 29: metalstack.api.v2.MachineNic
-	(*MachineBlockDevice)(nil),              // 30: metalstack.api.v2.MachineBlockDevice
-	(*MachineChassisIdentifyLEDState)(nil),  // 31: metalstack.api.v2.MachineChassisIdentifyLEDState
-	(*MachineBios)(nil),                     // 32: metalstack.api.v2.MachineBios
-	(*MachineIPMI)(nil),                     // 33: metalstack.api.v2.MachineIPMI
-	(*MachineFRU)(nil),                      // 34: metalstack.api.v2.MachineFRU
-	(*MachineRecentProvisioningEvents)(nil), // 35: metalstack.api.v2.MachineRecentProvisioningEvents
-	(*MachineProvisioningEvent)(nil),        // 36: metalstack.api.v2.MachineProvisioningEvent
-	(*MachineVPN)(nil),                      // 37: metalstack.api.v2.MachineVPN
-	(*MachineQuery)(nil),                    // 38: metalstack.api.v2.MachineQuery
-	(*MachineAllocationQuery)(nil),          // 39: metalstack.api.v2.MachineAllocationQuery
-	(*MachineNetworkQuery)(nil),             // 40: metalstack.api.v2.MachineNetworkQuery
-	(*MachineNicQuery)(nil),                 // 41: metalstack.api.v2.MachineNicQuery
-	(*MachineDiskQuery)(nil),                // 42: metalstack.api.v2.MachineDiskQuery
-	(*MachineIPMIQuery)(nil),                // 43: metalstack.api.v2.MachineIPMIQuery
-	(*MachineFRUQuery)(nil),                 // 44: metalstack.api.v2.MachineFRUQuery
-	(*MachineHardwareQuery)(nil),            // 45: metalstack.api.v2.MachineHardwareQuery
-	(*Labels)(nil),                          // 46: metalstack.api.v2.Labels
-	(*DNSServer)(nil),                       // 47: metalstack.api.v2.DNSServer
-	(*NTPServer)(nil),                       // 48: metalstack.api.v2.NTPServer
-	(*UpdateMeta)(nil),                      // 49: metalstack.api.v2.UpdateMeta
-	(*UpdateLabels)(nil),                    // 50: metalstack.api.v2.UpdateLabels
-	(*Meta)(nil),                            // 51: metalstack.api.v2.Meta
-	(*Partition)(nil),                       // 52: metalstack.api.v2.Partition
-	(*Size)(nil),                            // 53: metalstack.api.v2.Size
-	(*Image)(nil),                           // 54: metalstack.api.v2.Image
-	(*FilesystemLayout)(nil),                // 55: metalstack.api.v2.FilesystemLayout
-	(NetworkType)(0),                        // 56: metalstack.api.v2.NetworkType
-	(NATType)(0),                            // 57: metalstack.api.v2.NATType
-	(*timestamppb.Timestamp)(nil),           // 58: google.protobuf.Timestamp
+	(MachineBMCCommand)(0),                  // 6: metalstack.api.v2.MachineBMCCommand
+	(*MachineServiceGetRequest)(nil),        // 7: metalstack.api.v2.MachineServiceGetRequest
+	(*MachineServiceGetResponse)(nil),       // 8: metalstack.api.v2.MachineServiceGetResponse
+	(*MachineServiceCreateRequest)(nil),     // 9: metalstack.api.v2.MachineServiceCreateRequest
+	(*FirewallSpec)(nil),                    // 10: metalstack.api.v2.FirewallSpec
+	(*MachineServiceCreateResponse)(nil),    // 11: metalstack.api.v2.MachineServiceCreateResponse
+	(*MachineServiceUpdateRequest)(nil),     // 12: metalstack.api.v2.MachineServiceUpdateRequest
+	(*MachineServiceUpdateResponse)(nil),    // 13: metalstack.api.v2.MachineServiceUpdateResponse
+	(*MachineServiceListRequest)(nil),       // 14: metalstack.api.v2.MachineServiceListRequest
+	(*MachineServiceListResponse)(nil),      // 15: metalstack.api.v2.MachineServiceListResponse
+	(*MachineServiceDeleteRequest)(nil),     // 16: metalstack.api.v2.MachineServiceDeleteRequest
+	(*MachineServiceDeleteResponse)(nil),    // 17: metalstack.api.v2.MachineServiceDeleteResponse
+	(*Machine)(nil),                         // 18: metalstack.api.v2.Machine
+	(*MachineStatus)(nil),                   // 19: metalstack.api.v2.MachineStatus
+	(*MachineCondition)(nil),                // 20: metalstack.api.v2.MachineCondition
+	(*MachineAllocation)(nil),               // 21: metalstack.api.v2.MachineAllocation
+	(*MachineAllocationNetwork)(nil),        // 22: metalstack.api.v2.MachineAllocationNetwork
+	(*FirewallRules)(nil),                   // 23: metalstack.api.v2.FirewallRules
+	(*FirewallEgressRule)(nil),              // 24: metalstack.api.v2.FirewallEgressRule
+	(*FirewallIngressRule)(nil),             // 25: metalstack.api.v2.FirewallIngressRule
+	(*MachineNetwork)(nil),                  // 26: metalstack.api.v2.MachineNetwork
+	(*MachineHardware)(nil),                 // 27: metalstack.api.v2.MachineHardware
+	(*MetalCPU)(nil),                        // 28: metalstack.api.v2.MetalCPU
+	(*MetalGPU)(nil),                        // 29: metalstack.api.v2.MetalGPU
+	(*MachineNic)(nil),                      // 30: metalstack.api.v2.MachineNic
+	(*MachineBlockDevice)(nil),              // 31: metalstack.api.v2.MachineBlockDevice
+	(*MachineChassisIdentifyLEDState)(nil),  // 32: metalstack.api.v2.MachineChassisIdentifyLEDState
+	(*MachineBios)(nil),                     // 33: metalstack.api.v2.MachineBios
+	(*MachineIPMI)(nil),                     // 34: metalstack.api.v2.MachineIPMI
+	(*MachineFRU)(nil),                      // 35: metalstack.api.v2.MachineFRU
+	(*MachineRecentProvisioningEvents)(nil), // 36: metalstack.api.v2.MachineRecentProvisioningEvents
+	(*MachineProvisioningEvent)(nil),        // 37: metalstack.api.v2.MachineProvisioningEvent
+	(*MachineVPN)(nil),                      // 38: metalstack.api.v2.MachineVPN
+	(*MachineQuery)(nil),                    // 39: metalstack.api.v2.MachineQuery
+	(*MachineAllocationQuery)(nil),          // 40: metalstack.api.v2.MachineAllocationQuery
+	(*MachineNetworkQuery)(nil),             // 41: metalstack.api.v2.MachineNetworkQuery
+	(*MachineNicQuery)(nil),                 // 42: metalstack.api.v2.MachineNicQuery
+	(*MachineDiskQuery)(nil),                // 43: metalstack.api.v2.MachineDiskQuery
+	(*MachineIPMIQuery)(nil),                // 44: metalstack.api.v2.MachineIPMIQuery
+	(*MachineFRUQuery)(nil),                 // 45: metalstack.api.v2.MachineFRUQuery
+	(*MachineHardwareQuery)(nil),            // 46: metalstack.api.v2.MachineHardwareQuery
+	(*Labels)(nil),                          // 47: metalstack.api.v2.Labels
+	(*DNSServer)(nil),                       // 48: metalstack.api.v2.DNSServer
+	(*NTPServer)(nil),                       // 49: metalstack.api.v2.NTPServer
+	(*UpdateMeta)(nil),                      // 50: metalstack.api.v2.UpdateMeta
+	(*UpdateLabels)(nil),                    // 51: metalstack.api.v2.UpdateLabels
+	(*Meta)(nil),                            // 52: metalstack.api.v2.Meta
+	(*Partition)(nil),                       // 53: metalstack.api.v2.Partition
+	(*Size)(nil),                            // 54: metalstack.api.v2.Size
+	(*Image)(nil),                           // 55: metalstack.api.v2.Image
+	(*FilesystemLayout)(nil),                // 56: metalstack.api.v2.FilesystemLayout
+	(NetworkType)(0),                        // 57: metalstack.api.v2.NetworkType
+	(NATType)(0),                            // 58: metalstack.api.v2.NATType
+	(*timestamppb.Timestamp)(nil),           // 59: google.protobuf.Timestamp
 }
 var file_metalstack_api_v2_machine_proto_depIdxs = []int32{
-	17, // 0: metalstack.api.v2.MachineServiceGetResponse.machine:type_name -> metalstack.api.v2.Machine
-	46, // 1: metalstack.api.v2.MachineServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
-	21, // 2: metalstack.api.v2.MachineServiceCreateRequest.networks:type_name -> metalstack.api.v2.MachineAllocationNetwork
-	47, // 3: metalstack.api.v2.MachineServiceCreateRequest.dns_server:type_name -> metalstack.api.v2.DNSServer
-	48, // 4: metalstack.api.v2.MachineServiceCreateRequest.ntp_server:type_name -> metalstack.api.v2.NTPServer
+	18, // 0: metalstack.api.v2.MachineServiceGetResponse.machine:type_name -> metalstack.api.v2.Machine
+	47, // 1: metalstack.api.v2.MachineServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	22, // 2: metalstack.api.v2.MachineServiceCreateRequest.networks:type_name -> metalstack.api.v2.MachineAllocationNetwork
+	48, // 3: metalstack.api.v2.MachineServiceCreateRequest.dns_server:type_name -> metalstack.api.v2.DNSServer
+	49, // 4: metalstack.api.v2.MachineServiceCreateRequest.ntp_server:type_name -> metalstack.api.v2.NTPServer
 	5,  // 5: metalstack.api.v2.MachineServiceCreateRequest.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
-	9,  // 6: metalstack.api.v2.MachineServiceCreateRequest.firewall_spec:type_name -> metalstack.api.v2.FirewallSpec
-	22, // 7: metalstack.api.v2.FirewallSpec.firewall_rules:type_name -> metalstack.api.v2.FirewallRules
-	17, // 8: metalstack.api.v2.MachineServiceCreateResponse.machine:type_name -> metalstack.api.v2.Machine
-	49, // 9: metalstack.api.v2.MachineServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
-	50, // 10: metalstack.api.v2.MachineServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
-	17, // 11: metalstack.api.v2.MachineServiceUpdateResponse.machine:type_name -> metalstack.api.v2.Machine
-	38, // 12: metalstack.api.v2.MachineServiceListRequest.query:type_name -> metalstack.api.v2.MachineQuery
-	17, // 13: metalstack.api.v2.MachineServiceListResponse.machines:type_name -> metalstack.api.v2.Machine
-	17, // 14: metalstack.api.v2.MachineServiceDeleteResponse.machine:type_name -> metalstack.api.v2.Machine
-	51, // 15: metalstack.api.v2.Machine.meta:type_name -> metalstack.api.v2.Meta
-	52, // 16: metalstack.api.v2.Machine.partition:type_name -> metalstack.api.v2.Partition
-	53, // 17: metalstack.api.v2.Machine.size:type_name -> metalstack.api.v2.Size
-	26, // 18: metalstack.api.v2.Machine.hardware:type_name -> metalstack.api.v2.MachineHardware
-	32, // 19: metalstack.api.v2.Machine.bios:type_name -> metalstack.api.v2.MachineBios
-	20, // 20: metalstack.api.v2.Machine.allocation:type_name -> metalstack.api.v2.MachineAllocation
-	18, // 21: metalstack.api.v2.Machine.status:type_name -> metalstack.api.v2.MachineStatus
-	35, // 22: metalstack.api.v2.Machine.recent_provisioning_events:type_name -> metalstack.api.v2.MachineRecentProvisioningEvents
-	19, // 23: metalstack.api.v2.MachineStatus.condition:type_name -> metalstack.api.v2.MachineCondition
-	31, // 24: metalstack.api.v2.MachineStatus.led_state:type_name -> metalstack.api.v2.MachineChassisIdentifyLEDState
+	10, // 6: metalstack.api.v2.MachineServiceCreateRequest.firewall_spec:type_name -> metalstack.api.v2.FirewallSpec
+	23, // 7: metalstack.api.v2.FirewallSpec.firewall_rules:type_name -> metalstack.api.v2.FirewallRules
+	18, // 8: metalstack.api.v2.MachineServiceCreateResponse.machine:type_name -> metalstack.api.v2.Machine
+	50, // 9: metalstack.api.v2.MachineServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
+	51, // 10: metalstack.api.v2.MachineServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
+	18, // 11: metalstack.api.v2.MachineServiceUpdateResponse.machine:type_name -> metalstack.api.v2.Machine
+	39, // 12: metalstack.api.v2.MachineServiceListRequest.query:type_name -> metalstack.api.v2.MachineQuery
+	18, // 13: metalstack.api.v2.MachineServiceListResponse.machines:type_name -> metalstack.api.v2.Machine
+	18, // 14: metalstack.api.v2.MachineServiceDeleteResponse.machine:type_name -> metalstack.api.v2.Machine
+	52, // 15: metalstack.api.v2.Machine.meta:type_name -> metalstack.api.v2.Meta
+	53, // 16: metalstack.api.v2.Machine.partition:type_name -> metalstack.api.v2.Partition
+	54, // 17: metalstack.api.v2.Machine.size:type_name -> metalstack.api.v2.Size
+	27, // 18: metalstack.api.v2.Machine.hardware:type_name -> metalstack.api.v2.MachineHardware
+	33, // 19: metalstack.api.v2.Machine.bios:type_name -> metalstack.api.v2.MachineBios
+	21, // 20: metalstack.api.v2.Machine.allocation:type_name -> metalstack.api.v2.MachineAllocation
+	19, // 21: metalstack.api.v2.Machine.status:type_name -> metalstack.api.v2.MachineStatus
+	36, // 22: metalstack.api.v2.Machine.recent_provisioning_events:type_name -> metalstack.api.v2.MachineRecentProvisioningEvents
+	20, // 23: metalstack.api.v2.MachineStatus.condition:type_name -> metalstack.api.v2.MachineCondition
+	32, // 24: metalstack.api.v2.MachineStatus.led_state:type_name -> metalstack.api.v2.MachineChassisIdentifyLEDState
 	4,  // 25: metalstack.api.v2.MachineStatus.liveliness:type_name -> metalstack.api.v2.MachineLiveliness
 	1,  // 26: metalstack.api.v2.MachineCondition.state:type_name -> metalstack.api.v2.MachineState
-	51, // 27: metalstack.api.v2.MachineAllocation.meta:type_name -> metalstack.api.v2.Meta
-	54, // 28: metalstack.api.v2.MachineAllocation.image:type_name -> metalstack.api.v2.Image
-	55, // 29: metalstack.api.v2.MachineAllocation.filesystem_layout:type_name -> metalstack.api.v2.FilesystemLayout
-	25, // 30: metalstack.api.v2.MachineAllocation.networks:type_name -> metalstack.api.v2.MachineNetwork
+	52, // 27: metalstack.api.v2.MachineAllocation.meta:type_name -> metalstack.api.v2.Meta
+	55, // 28: metalstack.api.v2.MachineAllocation.image:type_name -> metalstack.api.v2.Image
+	56, // 29: metalstack.api.v2.MachineAllocation.filesystem_layout:type_name -> metalstack.api.v2.FilesystemLayout
+	26, // 30: metalstack.api.v2.MachineAllocation.networks:type_name -> metalstack.api.v2.MachineNetwork
 	5,  // 31: metalstack.api.v2.MachineAllocation.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
-	22, // 32: metalstack.api.v2.MachineAllocation.firewall_rules:type_name -> metalstack.api.v2.FirewallRules
-	47, // 33: metalstack.api.v2.MachineAllocation.dns_server:type_name -> metalstack.api.v2.DNSServer
-	48, // 34: metalstack.api.v2.MachineAllocation.ntp_server:type_name -> metalstack.api.v2.NTPServer
-	37, // 35: metalstack.api.v2.MachineAllocation.vpn:type_name -> metalstack.api.v2.MachineVPN
-	23, // 36: metalstack.api.v2.FirewallRules.egress:type_name -> metalstack.api.v2.FirewallEgressRule
-	24, // 37: metalstack.api.v2.FirewallRules.ingress:type_name -> metalstack.api.v2.FirewallIngressRule
+	23, // 32: metalstack.api.v2.MachineAllocation.firewall_rules:type_name -> metalstack.api.v2.FirewallRules
+	48, // 33: metalstack.api.v2.MachineAllocation.dns_server:type_name -> metalstack.api.v2.DNSServer
+	49, // 34: metalstack.api.v2.MachineAllocation.ntp_server:type_name -> metalstack.api.v2.NTPServer
+	38, // 35: metalstack.api.v2.MachineAllocation.vpn:type_name -> metalstack.api.v2.MachineVPN
+	24, // 36: metalstack.api.v2.FirewallRules.egress:type_name -> metalstack.api.v2.FirewallEgressRule
+	25, // 37: metalstack.api.v2.FirewallRules.ingress:type_name -> metalstack.api.v2.FirewallIngressRule
 	0,  // 38: metalstack.api.v2.FirewallEgressRule.protocol:type_name -> metalstack.api.v2.IPProtocol
 	0,  // 39: metalstack.api.v2.FirewallIngressRule.protocol:type_name -> metalstack.api.v2.IPProtocol
-	56, // 40: metalstack.api.v2.MachineNetwork.network_type:type_name -> metalstack.api.v2.NetworkType
-	57, // 41: metalstack.api.v2.MachineNetwork.nat_type:type_name -> metalstack.api.v2.NATType
-	30, // 42: metalstack.api.v2.MachineHardware.disks:type_name -> metalstack.api.v2.MachineBlockDevice
-	27, // 43: metalstack.api.v2.MachineHardware.cpus:type_name -> metalstack.api.v2.MetalCPU
-	28, // 44: metalstack.api.v2.MachineHardware.gpus:type_name -> metalstack.api.v2.MetalGPU
-	29, // 45: metalstack.api.v2.MachineHardware.nics:type_name -> metalstack.api.v2.MachineNic
-	29, // 46: metalstack.api.v2.MachineNic.neighbors:type_name -> metalstack.api.v2.MachineNic
-	34, // 47: metalstack.api.v2.MachineIPMI.fru:type_name -> metalstack.api.v2.MachineFRU
-	36, // 48: metalstack.api.v2.MachineRecentProvisioningEvents.events:type_name -> metalstack.api.v2.MachineProvisioningEvent
-	58, // 49: metalstack.api.v2.MachineRecentProvisioningEvents.last_event_time:type_name -> google.protobuf.Timestamp
-	36, // 50: metalstack.api.v2.MachineRecentProvisioningEvents.last_error_event:type_name -> metalstack.api.v2.MachineProvisioningEvent
+	57, // 40: metalstack.api.v2.MachineNetwork.network_type:type_name -> metalstack.api.v2.NetworkType
+	58, // 41: metalstack.api.v2.MachineNetwork.nat_type:type_name -> metalstack.api.v2.NATType
+	31, // 42: metalstack.api.v2.MachineHardware.disks:type_name -> metalstack.api.v2.MachineBlockDevice
+	28, // 43: metalstack.api.v2.MachineHardware.cpus:type_name -> metalstack.api.v2.MetalCPU
+	29, // 44: metalstack.api.v2.MachineHardware.gpus:type_name -> metalstack.api.v2.MetalGPU
+	30, // 45: metalstack.api.v2.MachineHardware.nics:type_name -> metalstack.api.v2.MachineNic
+	30, // 46: metalstack.api.v2.MachineNic.neighbors:type_name -> metalstack.api.v2.MachineNic
+	35, // 47: metalstack.api.v2.MachineIPMI.fru:type_name -> metalstack.api.v2.MachineFRU
+	37, // 48: metalstack.api.v2.MachineRecentProvisioningEvents.events:type_name -> metalstack.api.v2.MachineProvisioningEvent
+	59, // 49: metalstack.api.v2.MachineRecentProvisioningEvents.last_event_time:type_name -> google.protobuf.Timestamp
+	37, // 50: metalstack.api.v2.MachineRecentProvisioningEvents.last_error_event:type_name -> metalstack.api.v2.MachineProvisioningEvent
 	2,  // 51: metalstack.api.v2.MachineRecentProvisioningEvents.state:type_name -> metalstack.api.v2.MachineProvisioningEventState
-	58, // 52: metalstack.api.v2.MachineProvisioningEvent.time:type_name -> google.protobuf.Timestamp
+	59, // 52: metalstack.api.v2.MachineProvisioningEvent.time:type_name -> google.protobuf.Timestamp
 	3,  // 53: metalstack.api.v2.MachineProvisioningEvent.event:type_name -> metalstack.api.v2.MachineProvisioningEventType
-	46, // 54: metalstack.api.v2.MachineQuery.labels:type_name -> metalstack.api.v2.Labels
-	39, // 55: metalstack.api.v2.MachineQuery.allocation:type_name -> metalstack.api.v2.MachineAllocationQuery
-	40, // 56: metalstack.api.v2.MachineQuery.network:type_name -> metalstack.api.v2.MachineNetworkQuery
-	41, // 57: metalstack.api.v2.MachineQuery.nic:type_name -> metalstack.api.v2.MachineNicQuery
-	42, // 58: metalstack.api.v2.MachineQuery.disk:type_name -> metalstack.api.v2.MachineDiskQuery
-	43, // 59: metalstack.api.v2.MachineQuery.ipmi:type_name -> metalstack.api.v2.MachineIPMIQuery
-	44, // 60: metalstack.api.v2.MachineQuery.fru:type_name -> metalstack.api.v2.MachineFRUQuery
-	45, // 61: metalstack.api.v2.MachineQuery.hardware:type_name -> metalstack.api.v2.MachineHardwareQuery
+	47, // 54: metalstack.api.v2.MachineQuery.labels:type_name -> metalstack.api.v2.Labels
+	40, // 55: metalstack.api.v2.MachineQuery.allocation:type_name -> metalstack.api.v2.MachineAllocationQuery
+	41, // 56: metalstack.api.v2.MachineQuery.network:type_name -> metalstack.api.v2.MachineNetworkQuery
+	42, // 57: metalstack.api.v2.MachineQuery.nic:type_name -> metalstack.api.v2.MachineNicQuery
+	43, // 58: metalstack.api.v2.MachineQuery.disk:type_name -> metalstack.api.v2.MachineDiskQuery
+	44, // 59: metalstack.api.v2.MachineQuery.ipmi:type_name -> metalstack.api.v2.MachineIPMIQuery
+	45, // 60: metalstack.api.v2.MachineQuery.fru:type_name -> metalstack.api.v2.MachineFRUQuery
+	46, // 61: metalstack.api.v2.MachineQuery.hardware:type_name -> metalstack.api.v2.MachineHardwareQuery
 	1,  // 62: metalstack.api.v2.MachineQuery.state:type_name -> metalstack.api.v2.MachineState
 	5,  // 63: metalstack.api.v2.MachineAllocationQuery.allocation_type:type_name -> metalstack.api.v2.MachineAllocationType
-	46, // 64: metalstack.api.v2.MachineAllocationQuery.labels:type_name -> metalstack.api.v2.Labels
-	6,  // 65: metalstack.api.v2.MachineService.Get:input_type -> metalstack.api.v2.MachineServiceGetRequest
-	8,  // 66: metalstack.api.v2.MachineService.Create:input_type -> metalstack.api.v2.MachineServiceCreateRequest
-	11, // 67: metalstack.api.v2.MachineService.Update:input_type -> metalstack.api.v2.MachineServiceUpdateRequest
-	13, // 68: metalstack.api.v2.MachineService.List:input_type -> metalstack.api.v2.MachineServiceListRequest
-	15, // 69: metalstack.api.v2.MachineService.Delete:input_type -> metalstack.api.v2.MachineServiceDeleteRequest
-	7,  // 70: metalstack.api.v2.MachineService.Get:output_type -> metalstack.api.v2.MachineServiceGetResponse
-	10, // 71: metalstack.api.v2.MachineService.Create:output_type -> metalstack.api.v2.MachineServiceCreateResponse
-	12, // 72: metalstack.api.v2.MachineService.Update:output_type -> metalstack.api.v2.MachineServiceUpdateResponse
-	14, // 73: metalstack.api.v2.MachineService.List:output_type -> metalstack.api.v2.MachineServiceListResponse
-	16, // 74: metalstack.api.v2.MachineService.Delete:output_type -> metalstack.api.v2.MachineServiceDeleteResponse
+	47, // 64: metalstack.api.v2.MachineAllocationQuery.labels:type_name -> metalstack.api.v2.Labels
+	7,  // 65: metalstack.api.v2.MachineService.Get:input_type -> metalstack.api.v2.MachineServiceGetRequest
+	9,  // 66: metalstack.api.v2.MachineService.Create:input_type -> metalstack.api.v2.MachineServiceCreateRequest
+	12, // 67: metalstack.api.v2.MachineService.Update:input_type -> metalstack.api.v2.MachineServiceUpdateRequest
+	14, // 68: metalstack.api.v2.MachineService.List:input_type -> metalstack.api.v2.MachineServiceListRequest
+	16, // 69: metalstack.api.v2.MachineService.Delete:input_type -> metalstack.api.v2.MachineServiceDeleteRequest
+	8,  // 70: metalstack.api.v2.MachineService.Get:output_type -> metalstack.api.v2.MachineServiceGetResponse
+	11, // 71: metalstack.api.v2.MachineService.Create:output_type -> metalstack.api.v2.MachineServiceCreateResponse
+	13, // 72: metalstack.api.v2.MachineService.Update:output_type -> metalstack.api.v2.MachineServiceUpdateResponse
+	15, // 73: metalstack.api.v2.MachineService.List:output_type -> metalstack.api.v2.MachineServiceListResponse
+	17, // 74: metalstack.api.v2.MachineService.Delete:output_type -> metalstack.api.v2.MachineServiceDeleteResponse
 	70, // [70:75] is the sub-list for method output_type
 	65, // [65:70] is the sub-list for method input_type
 	65, // [65:65] is the sub-list for extension type_name
@@ -4160,7 +4259,7 @@ func file_metalstack_api_v2_machine_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_machine_proto_rawDesc), len(file_metalstack_api_v2_machine_proto_rawDesc)),
-			NumEnums:      6,
+			NumEnums:      7,
 			NumMessages:   40,
 			NumExtensions: 0,
 			NumServices:   1,
diff --git a/go/metalstack/api/v2/network.pb.go b/go/metalstack/api/v2/network.pb.go
index 132b1685..5d3d96f3 100644
--- a/go/metalstack/api/v2/network.pb.go
+++ b/go/metalstack/api/v2/network.pb.go
@@ -1521,8 +1521,8 @@ const file_metalstack_api_v2_network_proto_rawDesc = "" +
 	"\tpartition\x18\x05 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01H\x02R\tpartition\x88\x01\x01\x12'\n" +
 	"\aproject\x18\x06 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x03R\aproject\x88\x01\x01\x12+\n" +
 	"\tnamespace\x18\a \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x04R\tnamespace\x88\x01\x01\x12(\n" +
-	"\bprefixes\x18\b \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\bprefixes\x12?\n" +
-	"\x14destination_prefixes\x18\t \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x13destinationPrefixes\x12c\n" +
+	"\bprefixes\x18\b \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\bprefixes\x12?\n" +
+	"\x14destination_prefixes\x18\t \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13destinationPrefixes\x12c\n" +
 	"\x1bdefault_child_prefix_length\x18\n" +
 	" \x01(\v2$.metalstack.api.v2.ChildPrefixLengthR\x18defaultChildPrefixLength\x12[\n" +
 	"\x17min_child_prefix_length\x18\v \x01(\v2$.metalstack.api.v2.ChildPrefixLengthR\x14minChildPrefixLength\x12A\n" +
@@ -1530,7 +1530,7 @@ const file_metalstack_api_v2_network_proto_rawDesc = "" +
 	"\bnat_type\x18\r \x01(\x0e2\x1a.metalstack.api.v2.NATTypeB\b\xbaH\x05\x82\x01\x02\x10\x01H\x06R\anatType\x88\x01\x01\x12\x15\n" +
 	"\x03vrf\x18\x0e \x01(\rH\aR\x03vrf\x88\x01\x01\x127\n" +
 	"\x0eparent_network\x18\x0f \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01H\bR\rparentNetwork\x88\x01\x01\x12N\n" +
-	"\x1cadditional_announcable_cidrs\x18\x10 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x1aadditionalAnnouncableCidrs\x12G\n" +
+	"\x1cadditional_announcable_cidrs\x18\x10 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x1aadditionalAnnouncableCidrs\x12G\n" +
 	"\vconsumption\x18\x11 \x01(\v2%.metalstack.api.v2.NetworkConsumptionR\vconsumptionB\a\n" +
 	"\x05_nameB\x0e\n" +
 	"\f_descriptionB\f\n" +
@@ -1552,8 +1552,8 @@ const file_metalstack_api_v2_network_proto_rawDesc = "" +
 	"\tpartition\x18\x04 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01H\x03R\tpartition\x88\x01\x01\x12'\n" +
 	"\aproject\x18\x05 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x04R\aproject\x88\x01\x01\x12+\n" +
 	"\tnamespace\x18\x06 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x05R\tnamespace\x88\x01\x01\x12(\n" +
-	"\bprefixes\x18\a \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\bprefixes\x12?\n" +
-	"\x14destination_prefixes\x18\b \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x13destinationPrefixes\x12\x15\n" +
+	"\bprefixes\x18\a \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\bprefixes\x12?\n" +
+	"\x14destination_prefixes\x18\b \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13destinationPrefixes\x12\x15\n" +
 	"\x03vrf\x18\t \x01(\rH\x06R\x03vrf\x88\x01\x01\x127\n" +
 	"\x0eparent_network\x18\n" +
 	" \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01H\aR\rparentNetwork\x88\x01\x01\x12]\n" +
diff --git a/go/metalstack/api/v2/predefined_rules.pb.go b/go/metalstack/api/v2/predefined_rules.pb.go
index decc252e..2af9f29b 100644
--- a/go/metalstack/api/v2/predefined_rules.pb.go
+++ b/go/metalstack/api/v2/predefined_rules.pb.go
@@ -73,17 +73,17 @@ var file_metalstack_api_v2_predefined_rules_proto_extTypes = []protoimpl.Extensi
 	{
 		ExtendedType:  (*validate.RepeatedRules)(nil),
 		ExtensionType: (*bool)(nil),
-		Field:         80048956,
+		Field:         80058951,
 		Name:          "metalstack.api.v2.prefixes",
-		Tag:           "varint,80048956,opt,name=prefixes",
+		Tag:           "varint,80058951,opt,name=prefixes",
 		Filename:      "metalstack/api/v2/predefined_rules.proto",
 	},
 	{
 		ExtendedType:  (*validate.RepeatedRules)(nil),
 		ExtensionType: (*bool)(nil),
-		Field:         80048957,
+		Field:         80058952,
 		Name:          "metalstack.api.v2.ips",
-		Tag:           "varint,80048957,opt,name=ips",
+		Tag:           "varint,80058952,opt,name=ips",
 		Filename:      "metalstack/api/v2/predefined_rules.proto",
 	},
 }
@@ -120,11 +120,11 @@ var (
 var (
 	// Prefixes validates if a slice of prefixes in string form are valid
 	//
-	// optional bool prefixes = 80048956;
+	// optional bool prefixes = 80058951;
 	E_Prefixes = &file_metalstack_api_v2_predefined_rules_proto_extTypes[6]
 	// Ips validates if a slice of ips in string form are valid
 	//
-	// optional bool ips = 80048957;
+	// optional bool ips = 80058952;
 	E_Ips = &file_metalstack_api_v2_predefined_rules_proto_extTypes[7]
 )
 
@@ -154,10 +154,10 @@ const file_metalstack_api_v2_predefined_rules_proto_rawDesc = "" +
 	"3\n" +
 	"\n" +
 	"string.uri\x12\x17given uri must be valid\x1a\fthis.isUri()R\x05isUri:\x8f\x01\n" +
-	"\bprefixes\x12\x1b.buf.validate.RepeatedRules\x18\xbc\xe6\x95& \x01(\bBS\xc2HP\n" +
+	"\bprefixes\x12\x1b.buf.validate.RepeatedRules\x18Ǵ\x96& \x01(\bBS\xc2HP\n" +
 	"N\n" +
 	"\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\bprefixes:u\n" +
-	"\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xbd\xe6\x95& \x01(\bBC\xc2H@\n" +
+	"\x03ips\x12\x1b.buf.validate.RepeatedRules\x18ȴ\x96& \x01(\bBC\xc2H@\n" +
 	">\n" +
 	"\frepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ipsB\xca\x01\n" +
 	"\x15com.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2"
diff --git a/go/metalstack/api/v2/switch.pb.go b/go/metalstack/api/v2/switch.pb.go
index b5c92c55..34bd9a42 100644
--- a/go/metalstack/api/v2/switch.pb.go
+++ b/go/metalstack/api/v2/switch.pb.go
@@ -1002,7 +1002,7 @@ const file_metalstack_api_v2_switch_proto_rawDesc = "" +
 	"\v_bgp_filterB\x11\n" +
 	"\x0f_bgp_port_state\"T\n" +
 	"\tBGPFilter\x12\"\n" +
-	"\x05cidrs\x18\x01 \x03(\tB\f\xbaH\t\x92\x01\x06೮\xb1\x02\x01R\x05cidrs\x12#\n" +
+	"\x05cidrs\x18\x01 \x03(\tB\f\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x05cidrs\x12#\n" +
 	"\x04vnis\x18\x02 \x03(\tB\x0f\xbaH\f\x92\x01\t\"\ar\x05\x10\x02\x18\x80\x01R\x04vnis\"\x92\x03\n" +
 	"\x12SwitchBGPPortState\x12'\n" +
 	"\bneighbor\x18\x01 \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01R\bneighbor\x12*\n" +
diff --git a/go/metalstack/infra/v2/bmc.pb.go b/go/metalstack/infra/v2/bmc.pb.go
index f5457b09..c1cb08b8 100644
--- a/go/metalstack/infra/v2/bmc.pb.go
+++ b/go/metalstack/infra/v2/bmc.pb.go
@@ -7,7 +7,8 @@
 package infrav2
 
 import (
-	_ "github.com/metal-stack/api/go/metalstack/api/v2"
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -96,16 +97,124 @@ func (*UpdateBMCInfoResponse) Descriptor() ([]byte, []int) {
 	return file_metalstack_infra_v2_bmc_proto_rawDescGZIP(), []int{1}
 }
 
+// WaitForMachineEventRequest
+type WaitForMachineEventRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Partition the partition id where metal-bmc wants to receive events
+	Partition     string `protobuf:"bytes,1,opt,name=partition,proto3" json:"partition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WaitForMachineEventRequest) Reset() {
+	*x = WaitForMachineEventRequest{}
+	mi := &file_metalstack_infra_v2_bmc_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitForMachineEventRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitForMachineEventRequest) ProtoMessage() {}
+
+func (x *WaitForMachineEventRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_bmc_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitForMachineEventRequest.ProtoReflect.Descriptor instead.
+func (*WaitForMachineEventRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_bmc_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *WaitForMachineEventRequest) GetPartition() string {
+	if x != nil {
+		return x.Partition
+	}
+	return ""
+}
+
+// WaitForMachineEventResponse
+type WaitForMachineEventResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// BMCCommand to execute against the bmc of the machine
+	BmcCommand v2.MachineBMCCommand `protobuf:"varint,1,opt,name=bmc_command,json=bmcCommand,proto3,enum=metalstack.api.v2.MachineBMCCommand" json:"bmc_command,omitempty"`
+	// MachineIPMI contains connection details of the machine to issue the bmcCommand to
+	MachineIpmi   *v2.MachineIPMI `protobuf:"bytes,2,opt,name=machine_ipmi,json=machineIpmi,proto3" json:"machine_ipmi,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WaitForMachineEventResponse) Reset() {
+	*x = WaitForMachineEventResponse{}
+	mi := &file_metalstack_infra_v2_bmc_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitForMachineEventResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitForMachineEventResponse) ProtoMessage() {}
+
+func (x *WaitForMachineEventResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_infra_v2_bmc_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitForMachineEventResponse.ProtoReflect.Descriptor instead.
+func (*WaitForMachineEventResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_infra_v2_bmc_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *WaitForMachineEventResponse) GetBmcCommand() v2.MachineBMCCommand {
+	if x != nil {
+		return x.BmcCommand
+	}
+	return v2.MachineBMCCommand(0)
+}
+
+func (x *WaitForMachineEventResponse) GetMachineIpmi() *v2.MachineIPMI {
+	if x != nil {
+		return x.MachineIpmi
+	}
+	return nil
+}
+
 var File_metalstack_infra_v2_bmc_proto protoreflect.FileDescriptor
 
 const file_metalstack_infra_v2_bmc_proto_rawDesc = "" +
 	"\n" +
-	"\x1dmetalstack/infra/v2/bmc.proto\x12\x13metalstack.infra.v2\x1a\x1emetalstack/api/v2/common.proto\"\x16\n" +
+	"\x1dmetalstack/infra/v2/bmc.proto\x12\x13metalstack.infra.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x16\n" +
 	"\x14UpdateBMCInfoRequest\"\x17\n" +
-	"\x15UpdateBMCInfoResponse2\x7f\n" +
+	"\x15UpdateBMCInfoResponse\"G\n" +
+	"\x1aWaitForMachineEventRequest\x12)\n" +
+	"\tpartition\x18\x01 \x01(\tB\v\xbaH\br\x06г\xae\xb1\x02\x01R\tpartition\"\xa7\x01\n" +
+	"\x1bWaitForMachineEventResponse\x12E\n" +
+	"\vbmc_command\x18\x01 \x01(\x0e2$.metalstack.api.v2.MachineBMCCommandR\n" +
+	"bmcCommand\x12A\n" +
+	"\fmachine_ipmi\x18\x02 \x01(\v2\x1e.metalstack.api.v2.MachineIPMIR\vmachineIpmi2\x89\x02\n" +
 	"\n" +
 	"BMCService\x12q\n" +
-	"\rUpdateBMCInfo\x12).metalstack.infra.v2.UpdateBMCInfoRequest\x1a*.metalstack.infra.v2.UpdateBMCInfoResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01B\xcc\x01\n" +
+	"\rUpdateBMCInfo\x12).metalstack.infra.v2.UpdateBMCInfoRequest\x1a*.metalstack.infra.v2.UpdateBMCInfoResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x12\x87\x01\n" +
+	"\x13WaitForMachineEvent\x12/.metalstack.infra.v2.WaitForMachineEventRequest\x1a0.metalstack.infra.v2.WaitForMachineEventResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01(\x010\x01B\xcc\x01\n" +
 	"\x17com.metalstack.infra.v2B\bBmcProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3"
 
 var (
@@ -120,19 +229,27 @@ func file_metalstack_infra_v2_bmc_proto_rawDescGZIP() []byte {
 	return file_metalstack_infra_v2_bmc_proto_rawDescData
 }
 
-var file_metalstack_infra_v2_bmc_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_metalstack_infra_v2_bmc_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
 var file_metalstack_infra_v2_bmc_proto_goTypes = []any{
-	(*UpdateBMCInfoRequest)(nil),  // 0: metalstack.infra.v2.UpdateBMCInfoRequest
-	(*UpdateBMCInfoResponse)(nil), // 1: metalstack.infra.v2.UpdateBMCInfoResponse
+	(*UpdateBMCInfoRequest)(nil),        // 0: metalstack.infra.v2.UpdateBMCInfoRequest
+	(*UpdateBMCInfoResponse)(nil),       // 1: metalstack.infra.v2.UpdateBMCInfoResponse
+	(*WaitForMachineEventRequest)(nil),  // 2: metalstack.infra.v2.WaitForMachineEventRequest
+	(*WaitForMachineEventResponse)(nil), // 3: metalstack.infra.v2.WaitForMachineEventResponse
+	(v2.MachineBMCCommand)(0),           // 4: metalstack.api.v2.MachineBMCCommand
+	(*v2.MachineIPMI)(nil),              // 5: metalstack.api.v2.MachineIPMI
 }
 var file_metalstack_infra_v2_bmc_proto_depIdxs = []int32{
-	0, // 0: metalstack.infra.v2.BMCService.UpdateBMCInfo:input_type -> metalstack.infra.v2.UpdateBMCInfoRequest
-	1, // 1: metalstack.infra.v2.BMCService.UpdateBMCInfo:output_type -> metalstack.infra.v2.UpdateBMCInfoResponse
-	1, // [1:2] is the sub-list for method output_type
-	0, // [0:1] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	4, // 0: metalstack.infra.v2.WaitForMachineEventResponse.bmc_command:type_name -> metalstack.api.v2.MachineBMCCommand
+	5, // 1: metalstack.infra.v2.WaitForMachineEventResponse.machine_ipmi:type_name -> metalstack.api.v2.MachineIPMI
+	0, // 2: metalstack.infra.v2.BMCService.UpdateBMCInfo:input_type -> metalstack.infra.v2.UpdateBMCInfoRequest
+	2, // 3: metalstack.infra.v2.BMCService.WaitForMachineEvent:input_type -> metalstack.infra.v2.WaitForMachineEventRequest
+	1, // 4: metalstack.infra.v2.BMCService.UpdateBMCInfo:output_type -> metalstack.infra.v2.UpdateBMCInfoResponse
+	3, // 5: metalstack.infra.v2.BMCService.WaitForMachineEvent:output_type -> metalstack.infra.v2.WaitForMachineEventResponse
+	4, // [4:6] is the sub-list for method output_type
+	2, // [2:4] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_infra_v2_bmc_proto_init() }
@@ -146,7 +263,7 @@ func file_metalstack_infra_v2_bmc_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_infra_v2_bmc_proto_rawDesc), len(file_metalstack_infra_v2_bmc_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   4,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/metalstack/infra/v2/infrav2connect/bmc.connect.go b/go/metalstack/infra/v2/infrav2connect/bmc.connect.go
index 33234330..1dc2648d 100644
--- a/go/metalstack/infra/v2/infrav2connect/bmc.connect.go
+++ b/go/metalstack/infra/v2/infrav2connect/bmc.connect.go
@@ -36,12 +36,17 @@ const (
 	// BMCServiceUpdateBMCInfoProcedure is the fully-qualified name of the BMCService's UpdateBMCInfo
 	// RPC.
 	BMCServiceUpdateBMCInfoProcedure = "/metalstack.infra.v2.BMCService/UpdateBMCInfo"
+	// BMCServiceWaitForMachineEventProcedure is the fully-qualified name of the BMCService's
+	// WaitForMachineEvent RPC.
+	BMCServiceWaitForMachineEventProcedure = "/metalstack.infra.v2.BMCService/WaitForMachineEvent"
 )
 
 // BMCServiceClient is a client for the metalstack.infra.v2.BMCService service.
 type BMCServiceClient interface {
 	// UpdateBMCInfo
 	UpdateBMCInfo(context.Context, *v2.UpdateBMCInfoRequest) (*v2.UpdateBMCInfoResponse, error)
+	// WaitForMachineEvent is called by the metal-bmc and is returned with a bmc command to execute.
+	WaitForMachineEvent(context.Context) (*connect.BidiStreamForClientSimple[v2.WaitForMachineEventRequest, v2.WaitForMachineEventResponse], error)
 }
 
 // NewBMCServiceClient constructs a client for the metalstack.infra.v2.BMCService service. By
@@ -61,12 +66,19 @@ func NewBMCServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...
 			connect.WithSchema(bMCServiceMethods.ByName("UpdateBMCInfo")),
 			connect.WithClientOptions(opts...),
 		),
+		waitForMachineEvent: connect.NewClient[v2.WaitForMachineEventRequest, v2.WaitForMachineEventResponse](
+			httpClient,
+			baseURL+BMCServiceWaitForMachineEventProcedure,
+			connect.WithSchema(bMCServiceMethods.ByName("WaitForMachineEvent")),
+			connect.WithClientOptions(opts...),
+		),
 	}
 }
 
 // bMCServiceClient implements BMCServiceClient.
 type bMCServiceClient struct {
-	updateBMCInfo *connect.Client[v2.UpdateBMCInfoRequest, v2.UpdateBMCInfoResponse]
+	updateBMCInfo       *connect.Client[v2.UpdateBMCInfoRequest, v2.UpdateBMCInfoResponse]
+	waitForMachineEvent *connect.Client[v2.WaitForMachineEventRequest, v2.WaitForMachineEventResponse]
 }
 
 // UpdateBMCInfo calls metalstack.infra.v2.BMCService.UpdateBMCInfo.
@@ -78,10 +90,17 @@ func (c *bMCServiceClient) UpdateBMCInfo(ctx context.Context, req *v2.UpdateBMCI
 	return nil, err
 }
 
+// WaitForMachineEvent calls metalstack.infra.v2.BMCService.WaitForMachineEvent.
+func (c *bMCServiceClient) WaitForMachineEvent(ctx context.Context) (*connect.BidiStreamForClientSimple[v2.WaitForMachineEventRequest, v2.WaitForMachineEventResponse], error) {
+	return c.waitForMachineEvent.CallBidiStreamSimple(ctx)
+}
+
 // BMCServiceHandler is an implementation of the metalstack.infra.v2.BMCService service.
 type BMCServiceHandler interface {
 	// UpdateBMCInfo
 	UpdateBMCInfo(context.Context, *v2.UpdateBMCInfoRequest) (*v2.UpdateBMCInfoResponse, error)
+	// WaitForMachineEvent is called by the metal-bmc and is returned with a bmc command to execute.
+	WaitForMachineEvent(context.Context, *connect.BidiStream[v2.WaitForMachineEventRequest, v2.WaitForMachineEventResponse]) error
 }
 
 // NewBMCServiceHandler builds an HTTP handler from the service implementation. It returns the path
@@ -97,10 +116,18 @@ func NewBMCServiceHandler(svc BMCServiceHandler, opts ...connect.HandlerOption)
 		connect.WithSchema(bMCServiceMethods.ByName("UpdateBMCInfo")),
 		connect.WithHandlerOptions(opts...),
 	)
+	bMCServiceWaitForMachineEventHandler := connect.NewBidiStreamHandler(
+		BMCServiceWaitForMachineEventProcedure,
+		svc.WaitForMachineEvent,
+		connect.WithSchema(bMCServiceMethods.ByName("WaitForMachineEvent")),
+		connect.WithHandlerOptions(opts...),
+	)
 	return "/metalstack.infra.v2.BMCService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case BMCServiceUpdateBMCInfoProcedure:
 			bMCServiceUpdateBMCInfoHandler.ServeHTTP(w, r)
+		case BMCServiceWaitForMachineEventProcedure:
+			bMCServiceWaitForMachineEventHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -113,3 +140,7 @@ type UnimplementedBMCServiceHandler struct{}
 func (UnimplementedBMCServiceHandler) UpdateBMCInfo(context.Context, *v2.UpdateBMCInfoRequest) (*v2.UpdateBMCInfoResponse, error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BMCService.UpdateBMCInfo is not implemented"))
 }
+
+func (UnimplementedBMCServiceHandler) WaitForMachineEvent(context.Context, *connect.BidiStream[v2.WaitForMachineEventRequest, v2.WaitForMachineEventResponse]) error {
+	return connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.infra.v2.BMCService.WaitForMachineEvent is not implemented"))
+}
diff --git a/go/permissions/servicepermissions.go b/go/permissions/servicepermissions.go
index 20bd54c4..716ff982 100755
--- a/go/permissions/servicepermissions.go
+++ b/go/permissions/servicepermissions.go
@@ -97,6 +97,7 @@ func GetServicePermissions() *ServicePermissions {
 			Infra: Infra{
 				"INFRA_ROLE_EDITOR": []string{
 					"/metalstack.infra.v2.BMCService/UpdateBMCInfo",
+					"/metalstack.infra.v2.BMCService/WaitForMachineEvent",
 					"/metalstack.infra.v2.BootService/Dhcp",
 					"/metalstack.infra.v2.BootService/Boot",
 					"/metalstack.infra.v2.EventService/Send",
@@ -304,6 +305,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.api.v2.UserService/Get":                             true,
 			"/metalstack.api.v2.VersionService/Get":                          true,
 			"/metalstack.infra.v2.BMCService/UpdateBMCInfo":                  true,
+			"/metalstack.infra.v2.BMCService/WaitForMachineEvent":            true,
 			"/metalstack.infra.v2.BootService/Boot":                          true,
 			"/metalstack.infra.v2.BootService/Dhcp":                          true,
 			"/metalstack.infra.v2.BootService/Register":                      true,
@@ -387,13 +389,14 @@ func GetServicePermissions() *ServicePermissions {
 				"/metalstack.admin.v2.TokenService/Revoke":       true,
 			},
 			Infra: map[string]bool{
-				"/metalstack.infra.v2.BMCService/UpdateBMCInfo": true,
-				"/metalstack.infra.v2.BootService/Boot":         true,
-				"/metalstack.infra.v2.BootService/Dhcp":         true,
-				"/metalstack.infra.v2.EventService/Send":        true,
-				"/metalstack.infra.v2.SwitchService/Get":        true,
-				"/metalstack.infra.v2.SwitchService/Heartbeat":  true,
-				"/metalstack.infra.v2.SwitchService/Register":   true,
+				"/metalstack.infra.v2.BMCService/UpdateBMCInfo":       true,
+				"/metalstack.infra.v2.BMCService/WaitForMachineEvent": true,
+				"/metalstack.infra.v2.BootService/Boot":               true,
+				"/metalstack.infra.v2.BootService/Dhcp":               true,
+				"/metalstack.infra.v2.EventService/Send":              true,
+				"/metalstack.infra.v2.SwitchService/Get":              true,
+				"/metalstack.infra.v2.SwitchService/Heartbeat":        true,
+				"/metalstack.infra.v2.SwitchService/Register":         true,
 			},
 			Machine: map[string]bool{
 				"/metalstack.infra.v2.BootService/Register":          true,
@@ -442,114 +445,115 @@ func GetServicePermissions() *ServicePermissions {
 			},
 		},
 		Auditable: map[string]bool{
-			"/metalstack.admin.v2.FilesystemService/Create":      true,
-			"/metalstack.admin.v2.FilesystemService/Delete":      true,
-			"/metalstack.admin.v2.FilesystemService/Update":      true,
-			"/metalstack.admin.v2.IPService/List":                false,
-			"/metalstack.admin.v2.ImageService/Create":           true,
-			"/metalstack.admin.v2.ImageService/Delete":           true,
-			"/metalstack.admin.v2.ImageService/Update":           true,
-			"/metalstack.admin.v2.ImageService/Usage":            true,
-			"/metalstack.admin.v2.MachineService/Get":            false,
-			"/metalstack.admin.v2.MachineService/List":           false,
-			"/metalstack.admin.v2.NetworkService/Create":         true,
-			"/metalstack.admin.v2.NetworkService/Delete":         true,
-			"/metalstack.admin.v2.NetworkService/Get":            false,
-			"/metalstack.admin.v2.NetworkService/List":           false,
-			"/metalstack.admin.v2.NetworkService/Update":         true,
-			"/metalstack.admin.v2.PartitionService/Capacity":     false,
-			"/metalstack.admin.v2.PartitionService/Create":       true,
-			"/metalstack.admin.v2.PartitionService/Delete":       true,
-			"/metalstack.admin.v2.PartitionService/Update":       true,
-			"/metalstack.admin.v2.ProjectService/List":           false,
-			"/metalstack.admin.v2.SizeService/Create":            true,
-			"/metalstack.admin.v2.SizeService/Delete":            true,
-			"/metalstack.admin.v2.SizeService/Update":            true,
-			"/metalstack.admin.v2.SwitchService/Delete":          true,
-			"/metalstack.admin.v2.SwitchService/Get":             false,
-			"/metalstack.admin.v2.SwitchService/List":            false,
-			"/metalstack.admin.v2.SwitchService/Migrate":         true,
-			"/metalstack.admin.v2.SwitchService/Port":            true,
-			"/metalstack.admin.v2.SwitchService/Update":          true,
-			"/metalstack.admin.v2.TenantService/Create":          true,
-			"/metalstack.admin.v2.TenantService/List":            true,
-			"/metalstack.admin.v2.TokenService/Create":           true,
-			"/metalstack.admin.v2.TokenService/List":             true,
-			"/metalstack.admin.v2.TokenService/Revoke":           true,
-			"/metalstack.api.v2.FilesystemService/Get":           false,
-			"/metalstack.api.v2.FilesystemService/List":          false,
-			"/metalstack.api.v2.FilesystemService/Match":         false,
-			"/metalstack.api.v2.HealthService/Get":               false,
-			"/metalstack.api.v2.IPService/Create":                true,
-			"/metalstack.api.v2.IPService/Delete":                true,
-			"/metalstack.api.v2.IPService/Get":                   false,
-			"/metalstack.api.v2.IPService/List":                  false,
-			"/metalstack.api.v2.IPService/Update":                true,
-			"/metalstack.api.v2.ImageService/Get":                false,
-			"/metalstack.api.v2.ImageService/Latest":             false,
-			"/metalstack.api.v2.ImageService/List":               false,
-			"/metalstack.api.v2.MachineService/Create":           true,
-			"/metalstack.api.v2.MachineService/Delete":           true,
-			"/metalstack.api.v2.MachineService/Get":              false,
-			"/metalstack.api.v2.MachineService/List":             false,
-			"/metalstack.api.v2.MachineService/Update":           true,
-			"/metalstack.api.v2.MethodService/List":              true,
-			"/metalstack.api.v2.MethodService/TokenScopedList":   true,
-			"/metalstack.api.v2.NetworkService/Create":           true,
-			"/metalstack.api.v2.NetworkService/Delete":           true,
-			"/metalstack.api.v2.NetworkService/Get":              false,
-			"/metalstack.api.v2.NetworkService/List":             false,
-			"/metalstack.api.v2.NetworkService/ListBaseNetworks": false,
-			"/metalstack.api.v2.NetworkService/Update":           true,
-			"/metalstack.api.v2.PartitionService/Get":            false,
-			"/metalstack.api.v2.PartitionService/List":           false,
-			"/metalstack.api.v2.ProjectService/Create":           true,
-			"/metalstack.api.v2.ProjectService/Delete":           true,
-			"/metalstack.api.v2.ProjectService/Get":              false,
-			"/metalstack.api.v2.ProjectService/Invite":           true,
-			"/metalstack.api.v2.ProjectService/InviteAccept":     true,
-			"/metalstack.api.v2.ProjectService/InviteDelete":     true,
-			"/metalstack.api.v2.ProjectService/InviteGet":        false,
-			"/metalstack.api.v2.ProjectService/InvitesList":      false,
-			"/metalstack.api.v2.ProjectService/Leave":            true,
-			"/metalstack.api.v2.ProjectService/List":             false,
-			"/metalstack.api.v2.ProjectService/RemoveMember":     true,
-			"/metalstack.api.v2.ProjectService/Update":           true,
-			"/metalstack.api.v2.ProjectService/UpdateMember":     true,
-			"/metalstack.api.v2.SizeService/Get":                 false,
-			"/metalstack.api.v2.SizeService/List":                false,
-			"/metalstack.api.v2.TenantService/Create":            true,
-			"/metalstack.api.v2.TenantService/Delete":            true,
-			"/metalstack.api.v2.TenantService/Get":               false,
-			"/metalstack.api.v2.TenantService/Invite":            true,
-			"/metalstack.api.v2.TenantService/InviteAccept":      true,
-			"/metalstack.api.v2.TenantService/InviteDelete":      true,
-			"/metalstack.api.v2.TenantService/InviteGet":         false,
-			"/metalstack.api.v2.TenantService/InvitesList":       false,
-			"/metalstack.api.v2.TenantService/Leave":             true,
-			"/metalstack.api.v2.TenantService/List":              false,
-			"/metalstack.api.v2.TenantService/RemoveMember":      true,
-			"/metalstack.api.v2.TenantService/Update":            true,
-			"/metalstack.api.v2.TenantService/UpdateMember":      true,
-			"/metalstack.api.v2.TokenService/Create":             true,
-			"/metalstack.api.v2.TokenService/Get":                true,
-			"/metalstack.api.v2.TokenService/List":               true,
-			"/metalstack.api.v2.TokenService/Refresh":            true,
-			"/metalstack.api.v2.TokenService/Revoke":             true,
-			"/metalstack.api.v2.TokenService/Update":             true,
-			"/metalstack.api.v2.UserService/Get":                 true,
-			"/metalstack.api.v2.VersionService/Get":              false,
-			"/metalstack.infra.v2.BMCService/UpdateBMCInfo":      false,
-			"/metalstack.infra.v2.BootService/Boot":              false,
-			"/metalstack.infra.v2.BootService/Dhcp":              false,
-			"/metalstack.infra.v2.BootService/Register":          false,
-			"/metalstack.infra.v2.BootService/Report":            false,
-			"/metalstack.infra.v2.BootService/SuperUserPassword": false,
-			"/metalstack.infra.v2.BootService/Wait":              false,
-			"/metalstack.infra.v2.EventService/Send":             false,
-			"/metalstack.infra.v2.SwitchService/Get":             false,
-			"/metalstack.infra.v2.SwitchService/Heartbeat":       false,
-			"/metalstack.infra.v2.SwitchService/Register":        false,
+			"/metalstack.admin.v2.FilesystemService/Create":       true,
+			"/metalstack.admin.v2.FilesystemService/Delete":       true,
+			"/metalstack.admin.v2.FilesystemService/Update":       true,
+			"/metalstack.admin.v2.IPService/List":                 false,
+			"/metalstack.admin.v2.ImageService/Create":            true,
+			"/metalstack.admin.v2.ImageService/Delete":            true,
+			"/metalstack.admin.v2.ImageService/Update":            true,
+			"/metalstack.admin.v2.ImageService/Usage":             true,
+			"/metalstack.admin.v2.MachineService/Get":             false,
+			"/metalstack.admin.v2.MachineService/List":            false,
+			"/metalstack.admin.v2.NetworkService/Create":          true,
+			"/metalstack.admin.v2.NetworkService/Delete":          true,
+			"/metalstack.admin.v2.NetworkService/Get":             false,
+			"/metalstack.admin.v2.NetworkService/List":            false,
+			"/metalstack.admin.v2.NetworkService/Update":          true,
+			"/metalstack.admin.v2.PartitionService/Capacity":      false,
+			"/metalstack.admin.v2.PartitionService/Create":        true,
+			"/metalstack.admin.v2.PartitionService/Delete":        true,
+			"/metalstack.admin.v2.PartitionService/Update":        true,
+			"/metalstack.admin.v2.ProjectService/List":            false,
+			"/metalstack.admin.v2.SizeService/Create":             true,
+			"/metalstack.admin.v2.SizeService/Delete":             true,
+			"/metalstack.admin.v2.SizeService/Update":             true,
+			"/metalstack.admin.v2.SwitchService/Delete":           true,
+			"/metalstack.admin.v2.SwitchService/Get":              false,
+			"/metalstack.admin.v2.SwitchService/List":             false,
+			"/metalstack.admin.v2.SwitchService/Migrate":          true,
+			"/metalstack.admin.v2.SwitchService/Port":             true,
+			"/metalstack.admin.v2.SwitchService/Update":           true,
+			"/metalstack.admin.v2.TenantService/Create":           true,
+			"/metalstack.admin.v2.TenantService/List":             true,
+			"/metalstack.admin.v2.TokenService/Create":            true,
+			"/metalstack.admin.v2.TokenService/List":              true,
+			"/metalstack.admin.v2.TokenService/Revoke":            true,
+			"/metalstack.api.v2.FilesystemService/Get":            false,
+			"/metalstack.api.v2.FilesystemService/List":           false,
+			"/metalstack.api.v2.FilesystemService/Match":          false,
+			"/metalstack.api.v2.HealthService/Get":                false,
+			"/metalstack.api.v2.IPService/Create":                 true,
+			"/metalstack.api.v2.IPService/Delete":                 true,
+			"/metalstack.api.v2.IPService/Get":                    false,
+			"/metalstack.api.v2.IPService/List":                   false,
+			"/metalstack.api.v2.IPService/Update":                 true,
+			"/metalstack.api.v2.ImageService/Get":                 false,
+			"/metalstack.api.v2.ImageService/Latest":              false,
+			"/metalstack.api.v2.ImageService/List":                false,
+			"/metalstack.api.v2.MachineService/Create":            true,
+			"/metalstack.api.v2.MachineService/Delete":            true,
+			"/metalstack.api.v2.MachineService/Get":               false,
+			"/metalstack.api.v2.MachineService/List":              false,
+			"/metalstack.api.v2.MachineService/Update":            true,
+			"/metalstack.api.v2.MethodService/List":               true,
+			"/metalstack.api.v2.MethodService/TokenScopedList":    true,
+			"/metalstack.api.v2.NetworkService/Create":            true,
+			"/metalstack.api.v2.NetworkService/Delete":            true,
+			"/metalstack.api.v2.NetworkService/Get":               false,
+			"/metalstack.api.v2.NetworkService/List":              false,
+			"/metalstack.api.v2.NetworkService/ListBaseNetworks":  false,
+			"/metalstack.api.v2.NetworkService/Update":            true,
+			"/metalstack.api.v2.PartitionService/Get":             false,
+			"/metalstack.api.v2.PartitionService/List":            false,
+			"/metalstack.api.v2.ProjectService/Create":            true,
+			"/metalstack.api.v2.ProjectService/Delete":            true,
+			"/metalstack.api.v2.ProjectService/Get":               false,
+			"/metalstack.api.v2.ProjectService/Invite":            true,
+			"/metalstack.api.v2.ProjectService/InviteAccept":      true,
+			"/metalstack.api.v2.ProjectService/InviteDelete":      true,
+			"/metalstack.api.v2.ProjectService/InviteGet":         false,
+			"/metalstack.api.v2.ProjectService/InvitesList":       false,
+			"/metalstack.api.v2.ProjectService/Leave":             true,
+			"/metalstack.api.v2.ProjectService/List":              false,
+			"/metalstack.api.v2.ProjectService/RemoveMember":      true,
+			"/metalstack.api.v2.ProjectService/Update":            true,
+			"/metalstack.api.v2.ProjectService/UpdateMember":      true,
+			"/metalstack.api.v2.SizeService/Get":                  false,
+			"/metalstack.api.v2.SizeService/List":                 false,
+			"/metalstack.api.v2.TenantService/Create":             true,
+			"/metalstack.api.v2.TenantService/Delete":             true,
+			"/metalstack.api.v2.TenantService/Get":                false,
+			"/metalstack.api.v2.TenantService/Invite":             true,
+			"/metalstack.api.v2.TenantService/InviteAccept":       true,
+			"/metalstack.api.v2.TenantService/InviteDelete":       true,
+			"/metalstack.api.v2.TenantService/InviteGet":          false,
+			"/metalstack.api.v2.TenantService/InvitesList":        false,
+			"/metalstack.api.v2.TenantService/Leave":              true,
+			"/metalstack.api.v2.TenantService/List":               false,
+			"/metalstack.api.v2.TenantService/RemoveMember":       true,
+			"/metalstack.api.v2.TenantService/Update":             true,
+			"/metalstack.api.v2.TenantService/UpdateMember":       true,
+			"/metalstack.api.v2.TokenService/Create":              true,
+			"/metalstack.api.v2.TokenService/Get":                 true,
+			"/metalstack.api.v2.TokenService/List":                true,
+			"/metalstack.api.v2.TokenService/Refresh":             true,
+			"/metalstack.api.v2.TokenService/Revoke":              true,
+			"/metalstack.api.v2.TokenService/Update":              true,
+			"/metalstack.api.v2.UserService/Get":                  true,
+			"/metalstack.api.v2.VersionService/Get":               false,
+			"/metalstack.infra.v2.BMCService/UpdateBMCInfo":       false,
+			"/metalstack.infra.v2.BMCService/WaitForMachineEvent": false,
+			"/metalstack.infra.v2.BootService/Boot":               false,
+			"/metalstack.infra.v2.BootService/Dhcp":               false,
+			"/metalstack.infra.v2.BootService/Register":           false,
+			"/metalstack.infra.v2.BootService/Report":             false,
+			"/metalstack.infra.v2.BootService/SuperUserPassword":  false,
+			"/metalstack.infra.v2.BootService/Wait":               false,
+			"/metalstack.infra.v2.EventService/Send":              false,
+			"/metalstack.infra.v2.SwitchService/Get":              false,
+			"/metalstack.infra.v2.SwitchService/Heartbeat":        false,
+			"/metalstack.infra.v2.SwitchService/Register":         false,
 		},
 	}
 }
diff --git a/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceClient.go b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceClient.go
index da746095..381cd1c1 100644
--- a/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceClient.go
+++ b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceClient.go
@@ -7,6 +7,7 @@ package infrav2connect
 import (
 	"context"
 
+	"connectrpc.com/connect"
 	"github.com/metal-stack/api/go/metalstack/infra/v2"
 	mock "github.com/stretchr/testify/mock"
 )
@@ -105,3 +106,65 @@ func (_c *BMCServiceClient_UpdateBMCInfo_Call) RunAndReturn(run func(context1 co
 	_c.Call.Return(run)
 	return _c
 }
+
+// WaitForMachineEvent provides a mock function for the type BMCServiceClient
+func (_mock *BMCServiceClient) WaitForMachineEvent(context1 context.Context) (*connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse], error) {
+	ret := _mock.Called(context1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for WaitForMachineEvent")
+	}
+
+	var r0 *connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context) (*connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse], error)); ok {
+		return returnFunc(context1)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context) *connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]); ok {
+		r0 = returnFunc(context1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse])
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = returnFunc(context1)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// BMCServiceClient_WaitForMachineEvent_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'WaitForMachineEvent'
+type BMCServiceClient_WaitForMachineEvent_Call struct {
+	*mock.Call
+}
+
+// WaitForMachineEvent is a helper method to define mock.On call
+//   - context1 context.Context
+func (_e *BMCServiceClient_Expecter) WaitForMachineEvent(context1 interface{}) *BMCServiceClient_WaitForMachineEvent_Call {
+	return &BMCServiceClient_WaitForMachineEvent_Call{Call: _e.mock.On("WaitForMachineEvent", context1)}
+}
+
+func (_c *BMCServiceClient_WaitForMachineEvent_Call) Run(run func(context1 context.Context)) *BMCServiceClient_WaitForMachineEvent_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *BMCServiceClient_WaitForMachineEvent_Call) Return(bidiStreamForClientSimple *connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse], err error) *BMCServiceClient_WaitForMachineEvent_Call {
+	_c.Call.Return(bidiStreamForClientSimple, err)
+	return _c
+}
+
+func (_c *BMCServiceClient_WaitForMachineEvent_Call) RunAndReturn(run func(context1 context.Context) (*connect.BidiStreamForClientSimple[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse], error)) *BMCServiceClient_WaitForMachineEvent_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceHandler.go b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceHandler.go
index 6442a23d..0cf74cf7 100644
--- a/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceHandler.go
+++ b/go/tests/mocks/metalstack/infra/v2/infrav2connect/BMCServiceHandler.go
@@ -7,6 +7,7 @@ package infrav2connect
 import (
 	"context"
 
+	"connectrpc.com/connect"
 	"github.com/metal-stack/api/go/metalstack/infra/v2"
 	mock "github.com/stretchr/testify/mock"
 )
@@ -105,3 +106,60 @@ func (_c *BMCServiceHandler_UpdateBMCInfo_Call) RunAndReturn(run func(context1 c
 	_c.Call.Return(run)
 	return _c
 }
+
+// WaitForMachineEvent provides a mock function for the type BMCServiceHandler
+func (_mock *BMCServiceHandler) WaitForMachineEvent(context1 context.Context, bidiStream *connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]) error {
+	ret := _mock.Called(context1, bidiStream)
+
+	if len(ret) == 0 {
+		panic("no return value specified for WaitForMachineEvent")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]) error); ok {
+		r0 = returnFunc(context1, bidiStream)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// BMCServiceHandler_WaitForMachineEvent_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'WaitForMachineEvent'
+type BMCServiceHandler_WaitForMachineEvent_Call struct {
+	*mock.Call
+}
+
+// WaitForMachineEvent is a helper method to define mock.On call
+//   - context1 context.Context
+//   - bidiStream *connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]
+func (_e *BMCServiceHandler_Expecter) WaitForMachineEvent(context1 interface{}, bidiStream interface{}) *BMCServiceHandler_WaitForMachineEvent_Call {
+	return &BMCServiceHandler_WaitForMachineEvent_Call{Call: _e.mock.On("WaitForMachineEvent", context1, bidiStream)}
+}
+
+func (_c *BMCServiceHandler_WaitForMachineEvent_Call) Run(run func(context1 context.Context, bidiStream *connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse])) *BMCServiceHandler_WaitForMachineEvent_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]
+		if args[1] != nil {
+			arg1 = args[1].(*connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse])
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *BMCServiceHandler_WaitForMachineEvent_Call) Return(err error) *BMCServiceHandler_WaitForMachineEvent_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *BMCServiceHandler_WaitForMachineEvent_Call) RunAndReturn(run func(context1 context.Context, bidiStream *connect.BidiStream[infrav2.WaitForMachineEventRequest, infrav2.WaitForMachineEventResponse]) error) *BMCServiceHandler_WaitForMachineEvent_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/proto/metalstack/api/v2/machine.proto b/proto/metalstack/api/v2/machine.proto
index 8c60d270..998ee96e 100644
--- a/proto/metalstack/api/v2/machine.proto
+++ b/proto/metalstack/api/v2/machine.proto
@@ -620,6 +620,32 @@ enum MachineAllocationType {
   MACHINE_ALLOCATION_TYPE_FIREWALL = 2 [(enum_string_value) = "firewall"];
 }
 
+// MachineBMCCommand defines commands send to the BMC of the machine
+enum MachineBMCCommand {
+  // MACHINE_BMC_COMMAND_UNSPECIFIED is not defined
+  MACHINE_BMC_COMMAND_UNSPECIFIED = 0;
+  // MACHINE_BMC_COMMAND_ON Power on the machine
+  MACHINE_BMC_COMMAND_ON = 1 [(enum_string_value) = "on"];
+  // MACHINE_BMC_COMMAND_OFF Power off the machine
+  MACHINE_BMC_COMMAND_OFF = 2 [(enum_string_value) = "off"];
+  // MACHINE_BMC_COMMAND_RESET Power reset the machine
+  MACHINE_BMC_COMMAND_RESET = 3 [(enum_string_value) = "reset"];
+  // MACHINE_BMC_COMMAND_CYCLE Power cycle the machine
+  MACHINE_BMC_COMMAND_CYCLE = 4 [(enum_string_value) = "cycle"];
+  // MACHINE_BMC_COMMAND_BOOT_TO_BIOS boot the machine into bios
+  MACHINE_BMC_COMMAND_BOOT_TO_BIOS = 5 [(enum_string_value) = "boot-to-bios"];
+  // MACHINE_BMC_COMMAND_BOOT_FROM_DISK boot the machine from hard disk
+  MACHINE_BMC_COMMAND_BOOT_FROM_DISK = 6 [(enum_string_value) = "boot-from-disk"];
+  // MACHINE_BMC_COMMAND_BOOT_FROM_PXE boot the machine from pxe
+  MACHINE_BMC_COMMAND_BOOT_FROM_PXE = 7 [(enum_string_value) = "boot-from-pxe"];
+  // MACHINE_BMC_COMMAND_IDENTIFY_LED_ON set identify led of the machine chassis to on
+  MACHINE_BMC_COMMAND_IDENTIFY_LED_ON = 8 [(enum_string_value) = "identify-led-on"];
+  // MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF set identify led of the machine chassis to off
+  MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF = 9 [(enum_string_value) = "identify-led-off"];
+  // MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE update the bmc firmware of this machine
+  MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE = 10 [(enum_string_value) = "update-bmc-firmware"];
+}
+
 // MachineQuery contains fields which can be specified to list specific machines.
 message MachineQuery {
   // UUID of the machine to get
diff --git a/proto/metalstack/api/v2/predefined_rules.proto b/proto/metalstack/api/v2/predefined_rules.proto
index 155ac7a5..ef64aa48 100644
--- a/proto/metalstack/api/v2/predefined_rules.proto
+++ b/proto/metalstack/api/v2/predefined_rules.proto
@@ -47,13 +47,13 @@ extend buf.validate.StringRules {
 
 extend buf.validate.RepeatedRules {
   // Prefixes validates if a slice of prefixes in string form are valid
-  optional bool prefixes = 80048956 [(buf.validate.predefined).cel = {
+  optional bool prefixes = 80058951 [(buf.validate.predefined).cel = {
     id: "repeated.prefixes"
     message: "given prefixes must be valid"
     expression: "this.all(m, m.isIpPrefix())"
   }];
   // Ips validates if a slice of ips in string form are valid
-  optional bool ips = 80048957 [(buf.validate.predefined).cel = {
+  optional bool ips = 80058952 [(buf.validate.predefined).cel = {
     id: "repeated.ips"
     message: "given ips must be valid"
     expression: "this.all(m, m.isIp())"
diff --git a/proto/metalstack/infra/v2/bmc.proto b/proto/metalstack/infra/v2/bmc.proto
index 06de6530..978ccfe9 100644
--- a/proto/metalstack/infra/v2/bmc.proto
+++ b/proto/metalstack/infra/v2/bmc.proto
@@ -2,7 +2,10 @@ syntax = "proto3";
 
 package metalstack.infra.v2;
 
+import "buf/validate/validate.proto";
 import "metalstack/api/v2/common.proto";
+import "metalstack/api/v2/machine.proto";
+import "metalstack/api/v2/predefined_rules.proto";
 
 // BMCService serves bmc related functions
 service BMCService {
@@ -11,6 +14,11 @@ service BMCService {
     option (metalstack.api.v2.infra_roles) = INFRA_ROLE_EDITOR;
     option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
   }
+  // WaitForMachineEvent is called by the metal-bmc and is returned with a bmc command to execute.
+  rpc WaitForMachineEvent(stream WaitForMachineEventRequest) returns (stream WaitForMachineEventResponse) {
+    option (metalstack.api.v2.infra_roles) = INFRA_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_EXCLUDED;
+  }
 }
 
 // UpdateBMCInfoRequest
@@ -18,3 +26,17 @@ message UpdateBMCInfoRequest {}
 
 // UpdateBMCInfoResponse
 message UpdateBMCInfoResponse {}
+
+// WaitForMachineEventRequest
+message WaitForMachineEventRequest {
+  // Partition the partition id where metal-bmc wants to receive events
+  string partition = 1 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
+}
+
+// WaitForMachineEventResponse
+message WaitForMachineEventResponse {
+  // BMCCommand to execute against the bmc of the machine
+  metalstack.api.v2.MachineBMCCommand bmc_command = 1;
+  // MachineIPMI contains connection details of the machine to issue the bmcCommand to
+  metalstack.api.v2.MachineIPMI machine_ipmi = 2;
+}
diff --git a/python/metalstack/admin/v2/network_pb2.py b/python/metalstack/admin/v2/network_pb2.py
index 6b5c7170..cbb69336 100644
--- a/python/metalstack/admin/v2/network_pb2.py
+++ b/python/metalstack/admin/v2/network_pb2.py
@@ -28,7 +28,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/admin/v2/network.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/network.proto\x1a(metalstack/api/v2/predefined_rules.proto\"6\n\x18NetworkServiceGetRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\"Q\n\x19NetworkServiceGetResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xa7\t\n\x1bNetworkServiceCreateRequest\x12\x1f\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x00R\x02id\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x03R\tpartition\x88\x01\x01\x12\'\n\x07project\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\x07project\x88\x01\x01\x12<\n\x04type\x18\x06 \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04type\x12\x36\n\x06labels\x18\x07 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12(\n\x08prefixes\x18\x08 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\t \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x63\n\x1b\x64\x65\x66\x61ult_child_prefix_length\x18\n \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x18\x64\x65\x66\x61ultChildPrefixLength\x12[\n\x17min_child_prefix_length\x18\x0b \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x14minChildPrefixLength\x12\x44\n\x08nat_type\x18\x0c \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x07natType\x88\x01\x01\x12\x15\n\x03vrf\x18\r \x01(\rH\x07R\x03vrf\x88\x01\x01\x12\x37\n\x0eparent_network\x18\x0e \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x08R\rparentNetwork\x88\x01\x01\x12N\n\x1c\x61\x64\x64itional_announcable_cidrs\x18\x0f \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x1a\x61\x64\x64itionalAnnouncableCidrs\x12\x41\n\x06length\x18\x10 \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\tR\x06length\x88\x01\x01\x12]\n\x0e\x61\x64\x64ress_family\x18\x11 \x01(\x0e\x32\'.metalstack.api.v2.NetworkAddressFamilyB\x08\xbaH\x05\x82\x01\x02\x10\x01H\nR\raddressFamily\x88\x01\x01\x42\x05\n\x03_idB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\n\n\x08_projectB\t\n\x07_labelsB\x0b\n\t_nat_typeB\x06\n\x04_vrfB\x11\n\x0f_parent_networkB\t\n\x07_lengthB\x11\n\x0f_address_family\"\xea\x06\n\x1bNetworkServiceUpdateRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12$\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x05 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x02R\x06labels\x88\x01\x01\x12(\n\x08prefixes\x18\x06 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x07 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12h\n\x1b\x64\x65\x66\x61ult_child_prefix_length\x18\n \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\x03R\x18\x64\x65\x66\x61ultChildPrefixLength\x88\x01\x01\x12`\n\x17min_child_prefix_length\x18\x0b \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\x04R\x14minChildPrefixLength\x88\x01\x01\x12\x44\n\x08nat_type\x18\r \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x05R\x07natType\x88\x01\x01\x12N\n\x1c\x61\x64\x64itional_announcable_cidrs\x18\x10 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x1a\x61\x64\x64itionalAnnouncableCidrs\x12\x14\n\x05\x66orce\x18\x14 \x01(\x08R\x05\x66orceB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\t\n\x07_labelsB\x1e\n\x1c_default_child_prefix_lengthB\x1a\n\x18_min_child_prefix_lengthB\x0b\n\t_nat_type\"9\n\x1bNetworkServiceDeleteRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\"R\n\x19NetworkServiceListRequest\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkQueryR\x05query\"T\n\x1cNetworkServiceCreateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"T\n\x1cNetworkServiceUpdateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"T\n\x1cNetworkServiceDeleteResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"T\n\x1aNetworkServiceListResponse\x12\x36\n\x08networks\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x08networks2\xe5\x04\n\x0eNetworkService\x12p\n\x03Get\x12-.metalstack.admin.v2.NetworkServiceGetRequest\x1a..metalstack.admin.v2.NetworkServiceGetResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x12x\n\x06\x43reate\x12\x30.metalstack.admin.v2.NetworkServiceCreateRequest\x1a\x31.metalstack.admin.v2.NetworkServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12x\n\x06Update\x12\x30.metalstack.admin.v2.NetworkServiceUpdateRequest\x1a\x31.metalstack.admin.v2.NetworkServiceUpdateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12x\n\x06\x44\x65lete\x12\x30.metalstack.admin.v2.NetworkServiceDeleteRequest\x1a\x31.metalstack.admin.v2.NetworkServiceDeleteResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12s\n\x04List\x12..metalstack.admin.v2.NetworkServiceListRequest\x1a/.metalstack.admin.v2.NetworkServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x42\xd0\x01\n\x17\x63om.metalstack.admin.v2B\x0cNetworkProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/admin/v2/network.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/network.proto\x1a(metalstack/api/v2/predefined_rules.proto\"6\n\x18NetworkServiceGetRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\"Q\n\x19NetworkServiceGetResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xa7\t\n\x1bNetworkServiceCreateRequest\x12\x1f\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x00R\x02id\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x03R\tpartition\x88\x01\x01\x12\'\n\x07project\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\x07project\x88\x01\x01\x12<\n\x04type\x18\x06 \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04type\x12\x36\n\x06labels\x18\x07 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12(\n\x08prefixes\x18\x08 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\t \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x63\n\x1b\x64\x65\x66\x61ult_child_prefix_length\x18\n \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x18\x64\x65\x66\x61ultChildPrefixLength\x12[\n\x17min_child_prefix_length\x18\x0b \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x14minChildPrefixLength\x12\x44\n\x08nat_type\x18\x0c \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x07natType\x88\x01\x01\x12\x15\n\x03vrf\x18\r \x01(\rH\x07R\x03vrf\x88\x01\x01\x12\x37\n\x0eparent_network\x18\x0e \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x08R\rparentNetwork\x88\x01\x01\x12N\n\x1c\x61\x64\x64itional_announcable_cidrs\x18\x0f \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x1a\x61\x64\x64itionalAnnouncableCidrs\x12\x41\n\x06length\x18\x10 \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\tR\x06length\x88\x01\x01\x12]\n\x0e\x61\x64\x64ress_family\x18\x11 \x01(\x0e\x32\'.metalstack.api.v2.NetworkAddressFamilyB\x08\xbaH\x05\x82\x01\x02\x10\x01H\nR\raddressFamily\x88\x01\x01\x42\x05\n\x03_idB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\n\n\x08_projectB\t\n\x07_labelsB\x0b\n\t_nat_typeB\x06\n\x04_vrfB\x11\n\x0f_parent_networkB\t\n\x07_lengthB\x11\n\x0f_address_family\"\xea\x06\n\x1bNetworkServiceUpdateRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12$\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x05 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x02R\x06labels\x88\x01\x01\x12(\n\x08prefixes\x18\x06 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x07 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12h\n\x1b\x64\x65\x66\x61ult_child_prefix_length\x18\n \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\x03R\x18\x64\x65\x66\x61ultChildPrefixLength\x88\x01\x01\x12`\n\x17min_child_prefix_length\x18\x0b \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\x04R\x14minChildPrefixLength\x88\x01\x01\x12\x44\n\x08nat_type\x18\r \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x05R\x07natType\x88\x01\x01\x12N\n\x1c\x61\x64\x64itional_announcable_cidrs\x18\x10 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x1a\x61\x64\x64itionalAnnouncableCidrs\x12\x14\n\x05\x66orce\x18\x14 \x01(\x08R\x05\x66orceB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\t\n\x07_labelsB\x1e\n\x1c_default_child_prefix_lengthB\x1a\n\x18_min_child_prefix_lengthB\x0b\n\t_nat_type\"9\n\x1bNetworkServiceDeleteRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\"R\n\x19NetworkServiceListRequest\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkQueryR\x05query\"T\n\x1cNetworkServiceCreateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"T\n\x1cNetworkServiceUpdateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"T\n\x1cNetworkServiceDeleteResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"T\n\x1aNetworkServiceListResponse\x12\x36\n\x08networks\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x08networks2\xe5\x04\n\x0eNetworkService\x12p\n\x03Get\x12-.metalstack.admin.v2.NetworkServiceGetRequest\x1a..metalstack.admin.v2.NetworkServiceGetResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x12x\n\x06\x43reate\x12\x30.metalstack.admin.v2.NetworkServiceCreateRequest\x1a\x31.metalstack.admin.v2.NetworkServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12x\n\x06Update\x12\x30.metalstack.admin.v2.NetworkServiceUpdateRequest\x1a\x31.metalstack.admin.v2.NetworkServiceUpdateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12x\n\x06\x44\x65lete\x12\x30.metalstack.admin.v2.NetworkServiceDeleteRequest\x1a\x31.metalstack.admin.v2.NetworkServiceDeleteResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12s\n\x04List\x12..metalstack.admin.v2.NetworkServiceListRequest\x1a/.metalstack.admin.v2.NetworkServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x42\xd0\x01\n\x17\x63om.metalstack.admin.v2B\x0cNetworkProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -51,15 +51,15 @@
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['type']._loaded_options = None
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['prefixes']._loaded_options = None
-  _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['destination_prefixes']._loaded_options = None
-  _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['nat_type']._loaded_options = None
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['nat_type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['parent_network']._loaded_options = None
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['parent_network']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['additional_announcable_cidrs']._loaded_options = None
-  _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['additional_announcable_cidrs']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['additional_announcable_cidrs']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['address_family']._loaded_options = None
   _globals['_NETWORKSERVICECREATEREQUEST'].fields_by_name['address_family']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['id']._loaded_options = None
@@ -71,13 +71,13 @@
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['description']._loaded_options = None
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['prefixes']._loaded_options = None
-  _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['destination_prefixes']._loaded_options = None
-  _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['nat_type']._loaded_options = None
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['nat_type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['additional_announcable_cidrs']._loaded_options = None
-  _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['additional_announcable_cidrs']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKSERVICEUPDATEREQUEST'].fields_by_name['additional_announcable_cidrs']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKSERVICEDELETEREQUEST'].fields_by_name['id']._loaded_options = None
   _globals['_NETWORKSERVICEDELETEREQUEST'].fields_by_name['id']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
   _globals['_NETWORKSERVICE'].methods_by_name['Get']._loaded_options = None
diff --git a/python/metalstack/api/v2/machine_pb2.py b/python/metalstack/api/v2/machine_pb2.py
index 9bdc7c5d..fb2717c6 100644
--- a/python/metalstack/api/v2/machine_pb2.py
+++ b/python/metalstack/api/v2/machine_pb2.py
@@ -33,7 +33,7 @@
 from metalstack.api.v2 import size_pb2 as metalstack_dot_api_dot_v2_dot_size__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/api/v2/machine.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\"metalstack/api/v2/filesystem.proto\x1a\x1dmetalstack/api/v2/image.proto\x1a\x1fmetalstack/api/v2/network.proto\x1a!metalstack/api/v2/partition.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1cmetalstack/api/v2/size.proto\"\\\n\x18MachineServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"Q\n\x19MachineServiceGetResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xa2\x08\n\x1bMachineServiceCreateRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12!\n\x04uuid\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12(\n\x08hostname\x18\x05 \x01(\tB\x07\xbaH\x04r\x02h\x01H\x02R\x08hostname\x88\x01\x01\x12)\n\tpartition\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\x12\x1c\n\x04size\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04size\x12\x1e\n\x05image\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05image\x12\x30\n\x11\x66ilesystem_layout\x18\t \x01(\tH\x03R\x10\x66ilesystemLayout\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\n \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12*\n\x08userdata\x18\x0b \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02H\x04R\x08userdata\x88\x01\x01\x12\x31\n\x06labels\x18\x0c \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x12G\n\x08networks\x18\r \x03(\x0b\x32+.metalstack.api.v2.MachineAllocationNetworkR\x08networks\x12\x1e\n\x03ips\x18\x0e \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12%\n\x0eplacement_tags\x18\x0f \x03(\tR\rplacementTags\x12\x45\n\ndns_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x11 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12[\n\x0f\x61llocation_type\x18\x12 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12\x44\n\rfirewall_spec\x18\x13 \x01(\x0b\x32\x1f.metalstack.api.v2.FirewallSpecR\x0c\x66irewallSpecB\x07\n\x05_uuidB\x0e\n\x0c_descriptionB\x0b\n\t_hostnameB\x14\n\x12_filesystem_layoutB\x0b\n\t_userdata\"W\n\x0c\x46irewallSpec\x12G\n\x0e\x66irewall_rules\x18\x13 \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\"T\n\x1cMachineServiceCreateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xef\x02\n\x1bMachineServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12\"\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x05 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x01R\x06labels\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\x06 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeysB\x0e\n\x0c_descriptionB\t\n\x07_labels\"T\n\x1cMachineServiceUpdateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"v\n\x19MachineServiceListRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.MachineQueryR\x05query\"T\n\x1aMachineServiceListResponse\x12\x36\n\x08machines\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.MachineR\x08machines\"_\n\x1bMachineServiceDeleteRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"T\n\x1cMachineServiceDeleteResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xc1\x04\n\x07Machine\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12:\n\tpartition\x18\x03 \x01(\x0b\x32\x1c.metalstack.api.v2.PartitionR\tpartition\x12\x1c\n\x04rack\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04rack\x12+\n\x04size\x18\x05 \x01(\x0b\x32\x17.metalstack.api.v2.SizeR\x04size\x12>\n\x08hardware\x18\x06 \x01(\x0b\x32\".metalstack.api.v2.MachineHardwareR\x08hardware\x12\x32\n\x04\x62ios\x18\x07 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineBiosR\x04\x62ios\x12\x44\n\nallocation\x18\x08 \x01(\x0b\x32$.metalstack.api.v2.MachineAllocationR\nallocation\x12\x38\n\x06status\x18\t \x01(\x0b\x32 .metalstack.api.v2.MachineStatusR\x06status\x12p\n\x1arecent_provisioning_events\x18\n \x01(\x0b\x32\x32.metalstack.api.v2.MachineRecentProvisioningEventsR\x18recentProvisioningEvents\"\xa4\x02\n\rMachineStatus\x12\x41\n\tcondition\x18\x01 \x01(\x0b\x32#.metalstack.api.v2.MachineConditionR\tcondition\x12N\n\tled_state\x18\x02 \x01(\x0b\x32\x31.metalstack.api.v2.MachineChassisIdentifyLEDStateR\x08ledState\x12N\n\nliveliness\x18\x03 \x01(\x0e\x32$.metalstack.api.v2.MachineLivelinessB\x08\xbaH\x05\x82\x01\x02\x10\x01R\nliveliness\x12\x30\n\x14metal_hammer_version\x18\x04 \x01(\tR\x12metalHammerVersion\"\xa4\x01\n\x10MachineCondition\x12?\n\x05state\x18\x01 \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12 \n\x06issuer\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06issuer\"\xa8\x07\n\x11MachineAllocation\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12\'\n\ncreated_by\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\tcreatedBy\x12\"\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12.\n\x05image\x18\x07 \x01(\x0b\x32\x18.metalstack.api.v2.ImageR\x05image\x12P\n\x11\x66ilesystem_layout\x18\x08 \x01(\x0b\x32#.metalstack.api.v2.FilesystemLayoutR\x10\x66ilesystemLayout\x12=\n\x08networks\x18\t \x03(\x0b\x32!.metalstack.api.v2.MachineNetworkR\x08networks\x12#\n\x08hostname\x18\n \x01(\tB\x07\xbaH\x04r\x02h\x01R\x08hostname\x12\x39\n\x0fssh_public_keys\x18\x0b \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12%\n\x08userdata\x18\x0c \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02R\x08userdata\x12[\n\x0f\x61llocation_type\x18\r \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12G\n\x0e\x66irewall_rules\x18\x0e \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\x12\x45\n\ndns_server\x18\x0f \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12/\n\x03vpn\x18\x11 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineVPNR\x03vpn\"}\n\x18MachineAllocationNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12\x30\n\x12no_auto_acquire_ip\x18\x02 \x01(\x08H\x00R\x0fnoAutoAcquireIp\x88\x01\x01\x42\x15\n\x13_no_auto_acquire_ip\"\x90\x01\n\rFirewallRules\x12=\n\x06\x65gress\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.FirewallEgressRuleR\x06\x65gress\x12@\n\x07ingress\x18\x02 \x03(\x0b\x32&.metalstack.api.v2.FirewallIngressRuleR\x07ingress\"\xd0\x01\n\x12\x46irewallEgressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x02to\x12\x31\n\x07\x63omment\x18\x04 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xf3\x01\n\x13\x46irewallIngressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x02to\x12 \n\x04\x66rom\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x04\x66rom\x12\x31\n\x07\x63omment\x18\x05 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xe7\x02\n\x0eMachineNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12K\n\x0cnetwork_type\x18\x05 \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0bnetworkType\x12?\n\x08nat_type\x18\x06 \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x07natType\x12\x10\n\x03vrf\x18\x07 \x01(\x04R\x03vrf\x12\x10\n\x03\x61sn\x18\x08 \x01(\rR\x03\x61sn\"\xfb\x01\n\x0fMachineHardware\x12\x16\n\x06memory\x18\x01 \x01(\x04R\x06memory\x12;\n\x05\x64isks\x18\x03 \x03(\x0b\x32%.metalstack.api.v2.MachineBlockDeviceR\x05\x64isks\x12/\n\x04\x63pus\x18\x04 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalCPUR\x04\x63pus\x12/\n\x04gpus\x18\x05 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalGPUR\x04gpus\x12\x31\n\x04nics\x18\x06 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\x04nics\"|\n\x08MetalCPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\x12\x14\n\x05\x63ores\x18\x03 \x01(\rR\x05\x63ores\x12\x18\n\x07threads\x18\x04 \x01(\rR\x07threads\"L\n\x08MetalGPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\"\xa7\x02\n\nMachineNic\x12\x1d\n\x03mac\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12(\n\nidentifier\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\nidentifier\x12 \n\x06vendor\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x06vendor\x12\x1e\n\x05model\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05model\x12\x14\n\x05speed\x18\x06 \x01(\x04R\x05speed\x12;\n\tneighbors\x18\x07 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\tneighbors\x12\x1a\n\x08hostname\x18\x08 \x01(\tR\x08hostname\"I\n\x12MachineBlockDevice\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x12\n\x04size\x18\x02 \x01(\x04R\x04size\"o\n\x1eMachineChassisIdentifyLEDState\x12\x1e\n\x05value\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05value\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\"z\n\x0bMachineBios\x12%\n\x07version\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x07version\x12#\n\x06vendor\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x06vendor\x12\x1f\n\x04\x64\x61te\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04\x64\x61te\"\xd1\x02\n\x0bMachineIPMI\x12!\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x07\x61\x64\x64ress\x12\x1d\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04user\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04user\x12\'\n\x08password\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x08password\x12)\n\tinterface\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\tinterface\x12/\n\x03\x66ru\x18\x06 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineFRUR\x03\x66ru\x12,\n\x0b\x62mc_version\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\nbmcVersion\x12,\n\x0bpower_state\x18\x08 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\npowerState\"\xa6\x05\n\nMachineFRU\x12@\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12@\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12-\n\tboard_mfg\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12:\n\x10\x62oard_mfg_serial\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x03R\x0e\x62oardMfgSerial\x88\x01\x01\x12<\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12\x43\n\x14product_manufacturer\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x05R\x13productManufacturer\x88\x01\x01\x12@\n\x13product_part_number\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x37\n\x0eproduct_serial\x18\x08 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x13\n\x11_board_mfg_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"\xd3\x02\n\x1fMachineRecentProvisioningEvents\x12\x43\n\x06\x65vents\x18\x01 \x03(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x06\x65vents\x12\x42\n\x0flast_event_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\rlastEventTime\x12U\n\x10last_error_event\x18\x03 \x01(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x0elastErrorEvent\x12P\n\x05state\x18\x04 \x01(\x0e\x32\x30.metalstack.api.v2.MachineProvisioningEventStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\"\xab\x01\n\x18MachineProvisioningEvent\x12.\n\x04time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x04time\x12\x45\n\x05\x65vent\x18\x02 \x01(\x0e\x32/.metalstack.api.v2.MachineProvisioningEventTypeR\x05\x65vent\x12\x18\n\x07message\x18\x03 \x01(\tR\x07message\"y\n\nMachineVPN\x12\x32\n\x15\x63ontrol_plane_address\x18\x01 \x01(\tR\x13\x63ontrolPlaneAddress\x12\x19\n\x08\x61uth_key\x18\x02 \x01(\tR\x07\x61uthKey\x12\x1c\n\tconnected\x18\x03 \x01(\x08R\tconnected\"\xa8\x07\n\x0cMachineQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12-\n\tpartition\x18\x03 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x02R\tpartition\x88\x01\x01\x12#\n\x04size\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x04size\x88\x01\x01\x12#\n\x04rack\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x04rack\x88\x01\x01\x12\x36\n\x06labels\x18\x06 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12N\n\nallocation\x18\x07 \x01(\x0b\x32).metalstack.api.v2.MachineAllocationQueryH\x06R\nallocation\x88\x01\x01\x12\x45\n\x07network\x18\x08 \x01(\x0b\x32&.metalstack.api.v2.MachineNetworkQueryH\x07R\x07network\x88\x01\x01\x12\x39\n\x03nic\x18\t \x01(\x0b\x32\".metalstack.api.v2.MachineNicQueryH\x08R\x03nic\x88\x01\x01\x12<\n\x04\x64isk\x18\n \x01(\x0b\x32#.metalstack.api.v2.MachineDiskQueryH\tR\x04\x64isk\x88\x01\x01\x12<\n\x04ipmi\x18\x0b \x01(\x0b\x32#.metalstack.api.v2.MachineIPMIQueryH\nR\x04ipmi\x88\x01\x01\x12\x39\n\x03\x66ru\x18\x0c \x01(\x0b\x32\".metalstack.api.v2.MachineFRUQueryH\x0bR\x03\x66ru\x88\x01\x01\x12H\n\x08hardware\x18\r \x01(\x0b\x32\'.metalstack.api.v2.MachineHardwareQueryH\x0cR\x08hardware\x88\x01\x01\x12:\n\x05state\x18\x0e \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateH\rR\x05state\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\x0c\n\n_partitionB\x07\n\x05_sizeB\x07\n\x05_rackB\t\n\x07_labelsB\r\n\x0b_allocationB\n\n\x08_networkB\x06\n\x04_nicB\x07\n\x05_diskB\x07\n\x05_ipmiB\x06\n\x04_fruB\x0b\n\t_hardwareB\x08\n\x06_state\"\xa0\x04\n\x16MachineAllocationQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\'\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x02R\x07project\x88\x01\x01\x12%\n\x05image\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x05image\x88\x01\x01\x12<\n\x11\x66ilesystem_layout\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x10\x66ilesystemLayout\x88\x01\x01\x12+\n\x08hostname\x18\x06 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x05R\x08hostname\x88\x01\x01\x12`\n\x0f\x61llocation_type\x18\x07 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x0e\x61llocationType\x88\x01\x01\x12\x36\n\x06labels\x18\x08 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x07R\x06labels\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\n\n\x08_projectB\x08\n\x06_imageB\x14\n\x12_filesystem_layoutB\x0b\n\t_hostnameB\x12\n\x10_allocation_typeB\t\n\x07_labels\"\xe4\x01\n\x13MachineNetworkQuery\x12\x1a\n\x08networks\x18\x01 \x03(\tR\x08networks\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe8\xb3\xae\xb1\x02\x01R\x03ips\x12\x12\n\x04vrfs\x18\x05 \x03(\x04R\x04vrfs\x12\x12\n\x04\x61sns\x18\x06 \x03(\rR\x04\x61sns\"\xd9\x01\n\x0fMachineNicQuery\x12(\n\x04macs\x18\x01 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x04macs\x12\'\n\x05names\x18\x02 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\x05names\x12\x39\n\rneighbor_macs\x18\x03 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x0cneighborMacs\x12\x38\n\x0eneighbor_names\x18\x04 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\rneighborNames\"Y\n\x10MachineDiskQuery\x12%\n\x05names\x18\x01 \x03(\tB\x0f\xbaH\x0c\x92\x01\t\x10\x64\"\x05r\x03\x18\x80\x01R\x05names\x12\x1e\n\x05sizes\x18\x02 \x03(\x04\x42\x08\xbaH\x05\x92\x01\x02\x10\x64R\x05sizes\"\xd9\x01\n\x10MachineIPMIQuery\x12&\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01H\x00R\x07\x61\x64\x64ress\x88\x01\x01\x12\"\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01H\x01R\x03mac\x88\x01\x01\x12!\n\x04user\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x04user\x88\x01\x01\x12+\n\tinterface\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\tinterface\x88\x01\x01\x42\n\n\x08_addressB\x06\n\x04_macB\x07\n\x05_userB\x0c\n\n_interface\"\x88\x05\n\x0fMachineFRUQuery\x12=\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12=\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12*\n\tboard_mfg\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12\x30\n\x0c\x62oard_serial\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\x0b\x62oardSerial\x88\x01\x01\x12\x39\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12@\n\x14product_manufacturer\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x05R\x13productManufacturer\x88\x01\x01\x12=\n\x13product_part_number\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x34\n\x0eproduct_serial\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x0f\n\r_board_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"n\n\x14MachineHardwareQuery\x12\x1b\n\x06memory\x18\x01 \x01(\x04H\x00R\x06memory\x88\x01\x01\x12 \n\tcpu_cores\x18\x02 \x01(\rH\x01R\x08\x63puCores\x88\x01\x01\x42\t\n\x07_memoryB\x0c\n\n_cpu_cores*e\n\nIPProtocol\x12\x1b\n\x17IP_PROTOCOL_UNSPECIFIED\x10\x00\x12\x1c\n\x0fIP_PROTOCOL_TCP\x10\x01\x1a\x07\x82\xb2\x19\x03tcp\x12\x1c\n\x0fIP_PROTOCOL_UDP\x10\x02\x1a\x07\x82\xb2\x19\x03udp*\xaf\x01\n\x0cMachineState\x12#\n\x19MACHINE_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12(\n\x16MACHINE_STATE_RESERVED\x10\x01\x1a\x0c\x82\xb2\x19\x08reserved\x12$\n\x14MACHINE_STATE_LOCKED\x10\x02\x1a\n\x82\xb2\x19\x06locked\x12*\n\x17MACHINE_STATE_AVAILABLE\x10\x03\x1a\r\x82\xb2\x19\tavailable*\xdf\x01\n\x1dMachineProvisioningEventState\x12\x36\n,MACHINE_PROVISIONING_EVENT_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12=\n*MACHINE_PROVISIONING_EVENT_STATE_CRASHLOOP\x10\x01\x1a\r\x82\xb2\x19\tcrashloop\x12G\n/MACHINE_PROVISIONING_EVENT_STATE_FAILED_RECLAIM\x10\x02\x1a\x12\x82\xb2\x19\x0e\x66\x61iled-reclaim*\x9f\x06\n\x1cMachineProvisioningEventType\x12/\n+MACHINE_PROVISIONING_EVENT_TYPE_UNSPECIFIED\x10\x00\x12\x34\n%MACHINE_PROVISIONING_EVENT_TYPE_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x41live\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_CRASHED\x10\x02\x1a\x0b\x82\xb2\x19\x07\x43rashed\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PXE_BOOTING\x10\x03\x1a\x0f\x82\xb2\x19\x0bPXE Booting\x12\x46\n.MACHINE_PROVISIONING_EVENT_TYPE_PLANNED_REBOOT\x10\x04\x1a\x12\x82\xb2\x19\x0ePlanned Reboot\x12<\n)MACHINE_PROVISIONING_EVENT_TYPE_PREPARING\x10\x05\x1a\r\x82\xb2\x19\tPreparing\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_REGISTERING\x10\x06\x1a\x0f\x82\xb2\x19\x0bRegistering\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_WAITING\x10\x07\x1a\x0b\x82\xb2\x19\x07Waiting\x12>\n*MACHINE_PROVISIONING_EVENT_TYPE_INSTALLING\x10\x08\x1a\x0e\x82\xb2\x19\nInstalling\x12N\n2MACHINE_PROVISIONING_EVENT_TYPE_BOOTING_NEW_KERNEL\x10\t\x1a\x16\x82\xb2\x19\x12\x42ooting New Kernel\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PHONED_HOME\x10\n\x1a\x0f\x82\xb2\x19\x0bPhoned Home\x12H\n/MACHINE_PROVISIONING_EVENT_TYPE_MACHINE_RECLAIM\x10\x0b\x1a\x13\x82\xb2\x19\x0fMachine Reclaim*\xba\x01\n\x11MachineLiveliness\x12(\n\x1eMACHINE_LIVELINESS_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\'\n\x18MACHINE_LIVELINESS_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x61live\x12%\n\x17MACHINE_LIVELINESS_DEAD\x10\x02\x1a\x08\x82\xb2\x19\x04\x64\x65\x61\x64\x12+\n\x1aMACHINE_LIVELINESS_UNKNOWN\x10\x03\x1a\x0b\x82\xb2\x19\x07unknown*\xac\x01\n\x15MachineAllocationType\x12-\n#MACHINE_ALLOCATION_TYPE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\x30\n\x1fMACHINE_ALLOCATION_TYPE_MACHINE\x10\x01\x1a\x0b\x82\xb2\x19\x07machine\x12\x32\n MACHINE_ALLOCATION_TYPE_FIREWALL\x10\x02\x1a\x0c\x82\xb2\x19\x08\x66irewall2\xca\x04\n\x0eMachineService\x12m\n\x03Get\x12+.metalstack.api.v2.MachineServiceGetRequest\x1a,.metalstack.api.v2.MachineServiceGetResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x43reate\x12..metalstack.api.v2.MachineServiceCreateRequest\x1a/.metalstack.api.v2.MachineServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n\x06Update\x12..metalstack.api.v2.MachineServiceUpdateRequest\x1a/.metalstack.api.v2.MachineServiceUpdateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12p\n\x04List\x12,.metalstack.api.v2.MachineServiceListRequest\x1a-.metalstack.api.v2.MachineServiceListResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x44\x65lete\x12..metalstack.api.v2.MachineServiceDeleteRequest\x1a/.metalstack.api.v2.MachineServiceDeleteResponse\"\x06\xca\xf3\x18\x02\x01\x02\x42\xc2\x01\n\x15\x63om.metalstack.api.v2B\x0cMachineProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/api/v2/machine.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\"metalstack/api/v2/filesystem.proto\x1a\x1dmetalstack/api/v2/image.proto\x1a\x1fmetalstack/api/v2/network.proto\x1a!metalstack/api/v2/partition.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1cmetalstack/api/v2/size.proto\"\\\n\x18MachineServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"Q\n\x19MachineServiceGetResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xa2\x08\n\x1bMachineServiceCreateRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12!\n\x04uuid\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12(\n\x08hostname\x18\x05 \x01(\tB\x07\xbaH\x04r\x02h\x01H\x02R\x08hostname\x88\x01\x01\x12)\n\tpartition\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\x12\x1c\n\x04size\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04size\x12\x1e\n\x05image\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05image\x12\x30\n\x11\x66ilesystem_layout\x18\t \x01(\tH\x03R\x10\x66ilesystemLayout\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\n \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12*\n\x08userdata\x18\x0b \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02H\x04R\x08userdata\x88\x01\x01\x12\x31\n\x06labels\x18\x0c \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x12G\n\x08networks\x18\r \x03(\x0b\x32+.metalstack.api.v2.MachineAllocationNetworkR\x08networks\x12\x1e\n\x03ips\x18\x0e \x03(\tB\x0c\xbaH\t\x92\x01\x06\xc0\xa4\xb3\xb1\x02\x01R\x03ips\x12%\n\x0eplacement_tags\x18\x0f \x03(\tR\rplacementTags\x12\x45\n\ndns_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x11 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12[\n\x0f\x61llocation_type\x18\x12 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12\x44\n\rfirewall_spec\x18\x13 \x01(\x0b\x32\x1f.metalstack.api.v2.FirewallSpecR\x0c\x66irewallSpecB\x07\n\x05_uuidB\x0e\n\x0c_descriptionB\x0b\n\t_hostnameB\x14\n\x12_filesystem_layoutB\x0b\n\t_userdata\"W\n\x0c\x46irewallSpec\x12G\n\x0e\x66irewall_rules\x18\x13 \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\"T\n\x1cMachineServiceCreateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xef\x02\n\x1bMachineServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12\"\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x05 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x01R\x06labels\x88\x01\x01\x12\x39\n\x0fssh_public_keys\x18\x06 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeysB\x0e\n\x0c_descriptionB\t\n\x07_labels\"T\n\x1cMachineServiceUpdateResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"v\n\x19MachineServiceListRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.MachineQueryR\x05query\"T\n\x1aMachineServiceListResponse\x12\x36\n\x08machines\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.MachineR\x08machines\"_\n\x1bMachineServiceDeleteRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"T\n\x1cMachineServiceDeleteResponse\x12\x34\n\x07machine\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.MachineR\x07machine\"\xc1\x04\n\x07Machine\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12:\n\tpartition\x18\x03 \x01(\x0b\x32\x1c.metalstack.api.v2.PartitionR\tpartition\x12\x1c\n\x04rack\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x04rack\x12+\n\x04size\x18\x05 \x01(\x0b\x32\x17.metalstack.api.v2.SizeR\x04size\x12>\n\x08hardware\x18\x06 \x01(\x0b\x32\".metalstack.api.v2.MachineHardwareR\x08hardware\x12\x32\n\x04\x62ios\x18\x07 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineBiosR\x04\x62ios\x12\x44\n\nallocation\x18\x08 \x01(\x0b\x32$.metalstack.api.v2.MachineAllocationR\nallocation\x12\x38\n\x06status\x18\t \x01(\x0b\x32 .metalstack.api.v2.MachineStatusR\x06status\x12p\n\x1arecent_provisioning_events\x18\n \x01(\x0b\x32\x32.metalstack.api.v2.MachineRecentProvisioningEventsR\x18recentProvisioningEvents\"\xa4\x02\n\rMachineStatus\x12\x41\n\tcondition\x18\x01 \x01(\x0b\x32#.metalstack.api.v2.MachineConditionR\tcondition\x12N\n\tled_state\x18\x02 \x01(\x0b\x32\x31.metalstack.api.v2.MachineChassisIdentifyLEDStateR\x08ledState\x12N\n\nliveliness\x18\x03 \x01(\x0e\x32$.metalstack.api.v2.MachineLivelinessB\x08\xbaH\x05\x82\x01\x02\x10\x01R\nliveliness\x12\x30\n\x14metal_hammer_version\x18\x04 \x01(\tR\x12metalHammerVersion\"\xa4\x01\n\x10MachineCondition\x12?\n\x05state\x18\x01 \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12 \n\x06issuer\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06issuer\"\xa8\x07\n\x11MachineAllocation\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12\x1f\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12\'\n\ncreated_by\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\tcreatedBy\x12\"\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12.\n\x05image\x18\x07 \x01(\x0b\x32\x18.metalstack.api.v2.ImageR\x05image\x12P\n\x11\x66ilesystem_layout\x18\x08 \x01(\x0b\x32#.metalstack.api.v2.FilesystemLayoutR\x10\x66ilesystemLayout\x12=\n\x08networks\x18\t \x03(\x0b\x32!.metalstack.api.v2.MachineNetworkR\x08networks\x12#\n\x08hostname\x18\n \x01(\tB\x07\xbaH\x04r\x02h\x01R\x08hostname\x12\x39\n\x0fssh_public_keys\x18\x0b \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x32\"\x07r\x05\x10\x01\x18\x80@R\rsshPublicKeys\x12%\n\x08userdata\x18\x0c \x01(\tB\t\xbaH\x06r\x04\x18\x80\x80\x02R\x08userdata\x12[\n\x0f\x61llocation_type\x18\r \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0e\x61llocationType\x12G\n\x0e\x66irewall_rules\x18\x0e \x01(\x0b\x32 .metalstack.api.v2.FirewallRulesR\rfirewallRules\x12\x45\n\ndns_server\x18\x0f \x03(\x0b\x32\x1c.metalstack.api.v2.DNSServerB\x08\xbaH\x05\x92\x01\x02\x10\x03R\tdnsServer\x12\x45\n\nntp_server\x18\x10 \x03(\x0b\x32\x1c.metalstack.api.v2.NTPServerB\x08\xbaH\x05\x92\x01\x02\x10\nR\tntpServer\x12/\n\x03vpn\x18\x11 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineVPNR\x03vpn\"}\n\x18MachineAllocationNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12\x30\n\x12no_auto_acquire_ip\x18\x02 \x01(\x08H\x00R\x0fnoAutoAcquireIp\x88\x01\x01\x42\x15\n\x13_no_auto_acquire_ip\"\x90\x01\n\rFirewallRules\x12=\n\x06\x65gress\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.FirewallEgressRuleR\x06\x65gress\x12@\n\x07ingress\x18\x02 \x03(\x0b\x32&.metalstack.api.v2.FirewallIngressRuleR\x07ingress\"\xd0\x01\n\x12\x46irewallEgressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x02to\x12\x31\n\x07\x63omment\x18\x04 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xf3\x01\n\x13\x46irewallIngressRule\x12\x43\n\x08protocol\x18\x01 \x01(\x0e\x32\x1d.metalstack.api.v2.IPProtocolB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08protocol\x12$\n\x05ports\x18\x02 \x03(\rB\x0e\xbaH\x0b\x92\x01\x08\"\x06*\x04\x18\xfc\xff\x03R\x05ports\x12\x1c\n\x02to\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x02to\x12 \n\x04\x66rom\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x04\x66rom\x12\x31\n\x07\x63omment\x18\x05 \x01(\tB\x17\xbaH\x14r\x0f\x18\x64\x32\x0b^[a-z_ -]*$\xd8\x01\x01R\x07\x63omment\"\xe7\x02\n\x0eMachineNetwork\x12\x18\n\x07network\x18\x01 \x01(\tR\x07network\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xc0\xa4\xb3\xb1\x02\x01R\x03ips\x12K\n\x0cnetwork_type\x18\x05 \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0bnetworkType\x12?\n\x08nat_type\x18\x06 \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x07natType\x12\x10\n\x03vrf\x18\x07 \x01(\x04R\x03vrf\x12\x10\n\x03\x61sn\x18\x08 \x01(\rR\x03\x61sn\"\xfb\x01\n\x0fMachineHardware\x12\x16\n\x06memory\x18\x01 \x01(\x04R\x06memory\x12;\n\x05\x64isks\x18\x03 \x03(\x0b\x32%.metalstack.api.v2.MachineBlockDeviceR\x05\x64isks\x12/\n\x04\x63pus\x18\x04 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalCPUR\x04\x63pus\x12/\n\x04gpus\x18\x05 \x03(\x0b\x32\x1b.metalstack.api.v2.MetalGPUR\x04gpus\x12\x31\n\x04nics\x18\x06 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\x04nics\"|\n\x08MetalCPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\x12\x14\n\x05\x63ores\x18\x03 \x01(\rR\x05\x63ores\x12\x18\n\x07threads\x18\x04 \x01(\rR\x07threads\"L\n\x08MetalGPU\x12 \n\x06vendor\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x06vendor\x12\x1e\n\x05model\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x05model\"\xa7\x02\n\nMachineNic\x12\x1d\n\x03mac\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12(\n\nidentifier\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\nidentifier\x12 \n\x06vendor\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x06vendor\x12\x1e\n\x05model\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05model\x12\x14\n\x05speed\x18\x06 \x01(\x04R\x05speed\x12;\n\tneighbors\x18\x07 \x03(\x0b\x32\x1d.metalstack.api.v2.MachineNicR\tneighbors\x12\x1a\n\x08hostname\x18\x08 \x01(\tR\x08hostname\"I\n\x12MachineBlockDevice\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x12\n\x04size\x18\x02 \x01(\x04R\x04size\"o\n\x1eMachineChassisIdentifyLEDState\x12\x1e\n\x05value\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01R\x05value\x12-\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\"z\n\x0bMachineBios\x12%\n\x07version\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x07version\x12#\n\x06vendor\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x06vendor\x12\x1f\n\x04\x64\x61te\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04\x64\x61te\"\xd1\x02\n\x0bMachineIPMI\x12!\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x07\x61\x64\x64ress\x12\x1d\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\x1f\n\x04user\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x04user\x12\'\n\x08password\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x08password\x12)\n\tinterface\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\tinterface\x12/\n\x03\x66ru\x18\x06 \x01(\x0b\x32\x1d.metalstack.api.v2.MachineFRUR\x03\x66ru\x12,\n\x0b\x62mc_version\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\nbmcVersion\x12,\n\x0bpower_state\x18\x08 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\npowerState\"\xa6\x05\n\nMachineFRU\x12@\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12@\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12-\n\tboard_mfg\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12:\n\x10\x62oard_mfg_serial\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x03R\x0e\x62oardMfgSerial\x88\x01\x01\x12<\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12\x43\n\x14product_manufacturer\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x05R\x13productManufacturer\x88\x01\x01\x12@\n\x13product_part_number\x18\x07 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x37\n\x0eproduct_serial\x18\x08 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x13\n\x11_board_mfg_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"\xd3\x02\n\x1fMachineRecentProvisioningEvents\x12\x43\n\x06\x65vents\x18\x01 \x03(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x06\x65vents\x12\x42\n\x0flast_event_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\rlastEventTime\x12U\n\x10last_error_event\x18\x03 \x01(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x0elastErrorEvent\x12P\n\x05state\x18\x04 \x01(\x0e\x32\x30.metalstack.api.v2.MachineProvisioningEventStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x05state\"\xab\x01\n\x18MachineProvisioningEvent\x12.\n\x04time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x04time\x12\x45\n\x05\x65vent\x18\x02 \x01(\x0e\x32/.metalstack.api.v2.MachineProvisioningEventTypeR\x05\x65vent\x12\x18\n\x07message\x18\x03 \x01(\tR\x07message\"y\n\nMachineVPN\x12\x32\n\x15\x63ontrol_plane_address\x18\x01 \x01(\tR\x13\x63ontrolPlaneAddress\x12\x19\n\x08\x61uth_key\x18\x02 \x01(\tR\x07\x61uthKey\x12\x1c\n\tconnected\x18\x03 \x01(\x08R\tconnected\"\xa8\x07\n\x0cMachineQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12-\n\tpartition\x18\x03 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x02R\tpartition\x88\x01\x01\x12#\n\x04size\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x04size\x88\x01\x01\x12#\n\x04rack\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x04rack\x88\x01\x01\x12\x36\n\x06labels\x18\x06 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x05R\x06labels\x88\x01\x01\x12N\n\nallocation\x18\x07 \x01(\x0b\x32).metalstack.api.v2.MachineAllocationQueryH\x06R\nallocation\x88\x01\x01\x12\x45\n\x07network\x18\x08 \x01(\x0b\x32&.metalstack.api.v2.MachineNetworkQueryH\x07R\x07network\x88\x01\x01\x12\x39\n\x03nic\x18\t \x01(\x0b\x32\".metalstack.api.v2.MachineNicQueryH\x08R\x03nic\x88\x01\x01\x12<\n\x04\x64isk\x18\n \x01(\x0b\x32#.metalstack.api.v2.MachineDiskQueryH\tR\x04\x64isk\x88\x01\x01\x12<\n\x04ipmi\x18\x0b \x01(\x0b\x32#.metalstack.api.v2.MachineIPMIQueryH\nR\x04ipmi\x88\x01\x01\x12\x39\n\x03\x66ru\x18\x0c \x01(\x0b\x32\".metalstack.api.v2.MachineFRUQueryH\x0bR\x03\x66ru\x88\x01\x01\x12H\n\x08hardware\x18\r \x01(\x0b\x32\'.metalstack.api.v2.MachineHardwareQueryH\x0cR\x08hardware\x88\x01\x01\x12:\n\x05state\x18\x0e \x01(\x0e\x32\x1f.metalstack.api.v2.MachineStateH\rR\x05state\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\x0c\n\n_partitionB\x07\n\x05_sizeB\x07\n\x05_rackB\t\n\x07_labelsB\r\n\x0b_allocationB\n\n\x08_networkB\x06\n\x04_nicB\x07\n\x05_diskB\x07\n\x05_ipmiB\x06\n\x04_fruB\x0b\n\t_hardwareB\x08\n\x06_state\"\xa0\x04\n\x16MachineAllocationQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\'\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x02R\x07project\x88\x01\x01\x12%\n\x05image\x18\x04 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x03R\x05image\x88\x01\x01\x12<\n\x11\x66ilesystem_layout\x18\x05 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x04R\x10\x66ilesystemLayout\x88\x01\x01\x12+\n\x08hostname\x18\x06 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x05R\x08hostname\x88\x01\x01\x12`\n\x0f\x61llocation_type\x18\x07 \x01(\x0e\x32(.metalstack.api.v2.MachineAllocationTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x0e\x61llocationType\x88\x01\x01\x12\x36\n\x06labels\x18\x08 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x07R\x06labels\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_nameB\n\n\x08_projectB\x08\n\x06_imageB\x14\n\x12_filesystem_layoutB\x0b\n\t_hostnameB\x12\n\x10_allocation_typeB\t\n\x07_labels\"\xe4\x01\n\x13MachineNetworkQuery\x12\x1a\n\x08networks\x18\x01 \x03(\tR\x08networks\x12(\n\x08prefixes\x18\x02 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x03 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x1e\n\x03ips\x18\x04 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xc0\xa4\xb3\xb1\x02\x01R\x03ips\x12\x12\n\x04vrfs\x18\x05 \x03(\x04R\x04vrfs\x12\x12\n\x04\x61sns\x18\x06 \x03(\rR\x04\x61sns\"\xd9\x01\n\x0fMachineNicQuery\x12(\n\x04macs\x18\x01 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x04macs\x12\'\n\x05names\x18\x02 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\x05names\x12\x39\n\rneighbor_macs\x18\x03 \x03(\tB\x14\xbaH\x11\x92\x01\x0e\x10\x64\x18\x01\"\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x0cneighborMacs\x12\x38\n\x0eneighbor_names\x18\x04 \x03(\tB\x11\xbaH\x0e\x92\x01\x0b\x10\x64\x18\x01\"\x05r\x03\x18\x80\x01R\rneighborNames\"Y\n\x10MachineDiskQuery\x12%\n\x05names\x18\x01 \x03(\tB\x0f\xbaH\x0c\x92\x01\t\x10\x64\"\x05r\x03\x18\x80\x01R\x05names\x12\x1e\n\x05sizes\x18\x02 \x03(\x04\x42\x08\xbaH\x05\x92\x01\x02\x10\x64R\x05sizes\"\xd9\x01\n\x10MachineIPMIQuery\x12&\n\x07\x61\x64\x64ress\x18\x01 \x01(\tB\x07\xbaH\x04r\x02p\x01H\x00R\x07\x61\x64\x64ress\x88\x01\x01\x12\"\n\x03mac\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01H\x01R\x03mac\x88\x01\x01\x12!\n\x04user\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x04user\x88\x01\x01\x12+\n\tinterface\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\tinterface\x88\x01\x01\x42\n\n\x08_addressB\x06\n\x04_macB\x07\n\x05_userB\x0c\n\n_interface\"\x88\x05\n\x0fMachineFRUQuery\x12=\n\x13\x63hassis_part_number\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x00R\x11\x63hassisPartNumber\x88\x01\x01\x12=\n\x13\x63hassis_part_serial\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x01R\x11\x63hassisPartSerial\x88\x01\x01\x12*\n\tboard_mfg\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x02R\x08\x62oardMfg\x88\x01\x01\x12\x30\n\x0c\x62oard_serial\x18\x04 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x03R\x0b\x62oardSerial\x88\x01\x01\x12\x39\n\x11\x62oard_part_number\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x04R\x0f\x62oardPartNumber\x88\x01\x01\x12@\n\x14product_manufacturer\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x05R\x13productManufacturer\x88\x01\x01\x12=\n\x13product_part_number\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x06R\x11productPartNumber\x88\x01\x01\x12\x34\n\x0eproduct_serial\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x01H\x07R\rproductSerial\x88\x01\x01\x42\x16\n\x14_chassis_part_numberB\x16\n\x14_chassis_part_serialB\x0c\n\n_board_mfgB\x0f\n\r_board_serialB\x14\n\x12_board_part_numberB\x17\n\x15_product_manufacturerB\x16\n\x14_product_part_numberB\x11\n\x0f_product_serial\"n\n\x14MachineHardwareQuery\x12\x1b\n\x06memory\x18\x01 \x01(\x04H\x00R\x06memory\x88\x01\x01\x12 \n\tcpu_cores\x18\x02 \x01(\rH\x01R\x08\x63puCores\x88\x01\x01\x42\t\n\x07_memoryB\x0c\n\n_cpu_cores*e\n\nIPProtocol\x12\x1b\n\x17IP_PROTOCOL_UNSPECIFIED\x10\x00\x12\x1c\n\x0fIP_PROTOCOL_TCP\x10\x01\x1a\x07\x82\xb2\x19\x03tcp\x12\x1c\n\x0fIP_PROTOCOL_UDP\x10\x02\x1a\x07\x82\xb2\x19\x03udp*\xaf\x01\n\x0cMachineState\x12#\n\x19MACHINE_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12(\n\x16MACHINE_STATE_RESERVED\x10\x01\x1a\x0c\x82\xb2\x19\x08reserved\x12$\n\x14MACHINE_STATE_LOCKED\x10\x02\x1a\n\x82\xb2\x19\x06locked\x12*\n\x17MACHINE_STATE_AVAILABLE\x10\x03\x1a\r\x82\xb2\x19\tavailable*\xdf\x01\n\x1dMachineProvisioningEventState\x12\x36\n,MACHINE_PROVISIONING_EVENT_STATE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12=\n*MACHINE_PROVISIONING_EVENT_STATE_CRASHLOOP\x10\x01\x1a\r\x82\xb2\x19\tcrashloop\x12G\n/MACHINE_PROVISIONING_EVENT_STATE_FAILED_RECLAIM\x10\x02\x1a\x12\x82\xb2\x19\x0e\x66\x61iled-reclaim*\x9f\x06\n\x1cMachineProvisioningEventType\x12/\n+MACHINE_PROVISIONING_EVENT_TYPE_UNSPECIFIED\x10\x00\x12\x34\n%MACHINE_PROVISIONING_EVENT_TYPE_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x41live\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_CRASHED\x10\x02\x1a\x0b\x82\xb2\x19\x07\x43rashed\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PXE_BOOTING\x10\x03\x1a\x0f\x82\xb2\x19\x0bPXE Booting\x12\x46\n.MACHINE_PROVISIONING_EVENT_TYPE_PLANNED_REBOOT\x10\x04\x1a\x12\x82\xb2\x19\x0ePlanned Reboot\x12<\n)MACHINE_PROVISIONING_EVENT_TYPE_PREPARING\x10\x05\x1a\r\x82\xb2\x19\tPreparing\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_REGISTERING\x10\x06\x1a\x0f\x82\xb2\x19\x0bRegistering\x12\x38\n\'MACHINE_PROVISIONING_EVENT_TYPE_WAITING\x10\x07\x1a\x0b\x82\xb2\x19\x07Waiting\x12>\n*MACHINE_PROVISIONING_EVENT_TYPE_INSTALLING\x10\x08\x1a\x0e\x82\xb2\x19\nInstalling\x12N\n2MACHINE_PROVISIONING_EVENT_TYPE_BOOTING_NEW_KERNEL\x10\t\x1a\x16\x82\xb2\x19\x12\x42ooting New Kernel\x12@\n+MACHINE_PROVISIONING_EVENT_TYPE_PHONED_HOME\x10\n\x1a\x0f\x82\xb2\x19\x0bPhoned Home\x12H\n/MACHINE_PROVISIONING_EVENT_TYPE_MACHINE_RECLAIM\x10\x0b\x1a\x13\x82\xb2\x19\x0fMachine Reclaim*\xba\x01\n\x11MachineLiveliness\x12(\n\x1eMACHINE_LIVELINESS_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\'\n\x18MACHINE_LIVELINESS_ALIVE\x10\x01\x1a\t\x82\xb2\x19\x05\x61live\x12%\n\x17MACHINE_LIVELINESS_DEAD\x10\x02\x1a\x08\x82\xb2\x19\x04\x64\x65\x61\x64\x12+\n\x1aMACHINE_LIVELINESS_UNKNOWN\x10\x03\x1a\x0b\x82\xb2\x19\x07unknown*\xac\x01\n\x15MachineAllocationType\x12-\n#MACHINE_ALLOCATION_TYPE_UNSPECIFIED\x10\x00\x1a\x04\x82\xb2\x19\x00\x12\x30\n\x1fMACHINE_ALLOCATION_TYPE_MACHINE\x10\x01\x1a\x0b\x82\xb2\x19\x07machine\x12\x32\n MACHINE_ALLOCATION_TYPE_FIREWALL\x10\x02\x1a\x0c\x82\xb2\x19\x08\x66irewall*\xc8\x04\n\x11MachineBMCCommand\x12#\n\x1fMACHINE_BMC_COMMAND_UNSPECIFIED\x10\x00\x12\"\n\x16MACHINE_BMC_COMMAND_ON\x10\x01\x1a\x06\x82\xb2\x19\x02on\x12$\n\x17MACHINE_BMC_COMMAND_OFF\x10\x02\x1a\x07\x82\xb2\x19\x03off\x12(\n\x19MACHINE_BMC_COMMAND_RESET\x10\x03\x1a\t\x82\xb2\x19\x05reset\x12(\n\x19MACHINE_BMC_COMMAND_CYCLE\x10\x04\x1a\t\x82\xb2\x19\x05\x63ycle\x12\x36\n MACHINE_BMC_COMMAND_BOOT_TO_BIOS\x10\x05\x1a\x10\x82\xb2\x19\x0c\x62oot-to-bios\x12:\n\"MACHINE_BMC_COMMAND_BOOT_FROM_DISK\x10\x06\x1a\x12\x82\xb2\x19\x0e\x62oot-from-disk\x12\x38\n!MACHINE_BMC_COMMAND_BOOT_FROM_PXE\x10\x07\x1a\x11\x82\xb2\x19\rboot-from-pxe\x12<\n#MACHINE_BMC_COMMAND_IDENTIFY_LED_ON\x10\x08\x1a\x13\x82\xb2\x19\x0fidentify-led-on\x12>\n$MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF\x10\t\x1a\x14\x82\xb2\x19\x10identify-led-off\x12\x44\n\'MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE\x10\n\x1a\x17\x82\xb2\x19\x13update-bmc-firmware2\xca\x04\n\x0eMachineService\x12m\n\x03Get\x12+.metalstack.api.v2.MachineServiceGetRequest\x1a,.metalstack.api.v2.MachineServiceGetResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x43reate\x12..metalstack.api.v2.MachineServiceCreateRequest\x1a/.metalstack.api.v2.MachineServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n\x06Update\x12..metalstack.api.v2.MachineServiceUpdateRequest\x1a/.metalstack.api.v2.MachineServiceUpdateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12p\n\x04List\x12,.metalstack.api.v2.MachineServiceListRequest\x1a-.metalstack.api.v2.MachineServiceListResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x44\x65lete\x12..metalstack.api.v2.MachineServiceDeleteRequest\x1a/.metalstack.api.v2.MachineServiceDeleteResponse\"\x06\xca\xf3\x18\x02\x01\x02\x42\xc2\x01\n\x15\x63om.metalstack.api.v2B\x0cMachineProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -95,6 +95,26 @@
   _globals['_MACHINEALLOCATIONTYPE'].values_by_name["MACHINE_ALLOCATION_TYPE_MACHINE"]._serialized_options = b'\202\262\031\007machine'
   _globals['_MACHINEALLOCATIONTYPE'].values_by_name["MACHINE_ALLOCATION_TYPE_FIREWALL"]._loaded_options = None
   _globals['_MACHINEALLOCATIONTYPE'].values_by_name["MACHINE_ALLOCATION_TYPE_FIREWALL"]._serialized_options = b'\202\262\031\010firewall'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_ON"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_ON"]._serialized_options = b'\202\262\031\002on'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_OFF"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_OFF"]._serialized_options = b'\202\262\031\003off'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_RESET"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_RESET"]._serialized_options = b'\202\262\031\005reset'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_CYCLE"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_CYCLE"]._serialized_options = b'\202\262\031\005cycle'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_BOOT_TO_BIOS"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_BOOT_TO_BIOS"]._serialized_options = b'\202\262\031\014boot-to-bios'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_BOOT_FROM_DISK"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_BOOT_FROM_DISK"]._serialized_options = b'\202\262\031\016boot-from-disk'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_BOOT_FROM_PXE"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_BOOT_FROM_PXE"]._serialized_options = b'\202\262\031\rboot-from-pxe'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_IDENTIFY_LED_ON"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_IDENTIFY_LED_ON"]._serialized_options = b'\202\262\031\017identify-led-on'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF"]._serialized_options = b'\202\262\031\020identify-led-off'
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE"]._loaded_options = None
+  _globals['_MACHINEBMCCOMMAND'].values_by_name["MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE"]._serialized_options = b'\202\262\031\023update-bmc-firmware'
   _globals['_MACHINESERVICEGETREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_MACHINESERVICEGETREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_MACHINESERVICEGETREQUEST'].fields_by_name['project']._loaded_options = None
@@ -120,7 +140,7 @@
   _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['userdata']._loaded_options = None
   _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['userdata']._serialized_options = b'\272H\006r\004\030\200\200\002'
   _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['ips']._loaded_options = None
-  _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['ips']._serialized_options = b'\272H\t\222\001\006\350\263\256\261\002\001'
+  _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['ips']._serialized_options = b'\272H\t\222\001\006\300\244\263\261\002\001'
   _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['dns_server']._loaded_options = None
   _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['dns_server']._serialized_options = b'\272H\005\222\001\002\020\003'
   _globals['_MACHINESERVICECREATEREQUEST'].fields_by_name['ntp_server']._loaded_options = None
@@ -182,7 +202,7 @@
   _globals['_FIREWALLEGRESSRULE'].fields_by_name['ports']._loaded_options = None
   _globals['_FIREWALLEGRESSRULE'].fields_by_name['ports']._serialized_options = b'\272H\013\222\001\010\"\006*\004\030\374\377\003'
   _globals['_FIREWALLEGRESSRULE'].fields_by_name['to']._loaded_options = None
-  _globals['_FIREWALLEGRESSRULE'].fields_by_name['to']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_FIREWALLEGRESSRULE'].fields_by_name['to']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_FIREWALLEGRESSRULE'].fields_by_name['comment']._loaded_options = None
   _globals['_FIREWALLEGRESSRULE'].fields_by_name['comment']._serialized_options = b'\272H\024r\017\030d2\013^[a-z_ -]*$\330\001\001'
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['protocol']._loaded_options = None
@@ -190,17 +210,17 @@
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['ports']._loaded_options = None
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['ports']._serialized_options = b'\272H\013\222\001\010\"\006*\004\030\374\377\003'
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['to']._loaded_options = None
-  _globals['_FIREWALLINGRESSRULE'].fields_by_name['to']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_FIREWALLINGRESSRULE'].fields_by_name['to']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['from']._loaded_options = None
-  _globals['_FIREWALLINGRESSRULE'].fields_by_name['from']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_FIREWALLINGRESSRULE'].fields_by_name['from']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['comment']._loaded_options = None
   _globals['_FIREWALLINGRESSRULE'].fields_by_name['comment']._serialized_options = b'\272H\024r\017\030d2\013^[a-z_ -]*$\330\001\001'
   _globals['_MACHINENETWORK'].fields_by_name['prefixes']._loaded_options = None
-  _globals['_MACHINENETWORK'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_MACHINENETWORK'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_MACHINENETWORK'].fields_by_name['destination_prefixes']._loaded_options = None
-  _globals['_MACHINENETWORK'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_MACHINENETWORK'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_MACHINENETWORK'].fields_by_name['ips']._loaded_options = None
-  _globals['_MACHINENETWORK'].fields_by_name['ips']._serialized_options = b'\272H\t\222\001\006\350\263\256\261\002\001'
+  _globals['_MACHINENETWORK'].fields_by_name['ips']._serialized_options = b'\272H\t\222\001\006\300\244\263\261\002\001'
   _globals['_MACHINENETWORK'].fields_by_name['network_type']._loaded_options = None
   _globals['_MACHINENETWORK'].fields_by_name['network_type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_MACHINENETWORK'].fields_by_name['nat_type']._loaded_options = None
@@ -292,11 +312,11 @@
   _globals['_MACHINEALLOCATIONQUERY'].fields_by_name['allocation_type']._loaded_options = None
   _globals['_MACHINEALLOCATIONQUERY'].fields_by_name['allocation_type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_MACHINENETWORKQUERY'].fields_by_name['prefixes']._loaded_options = None
-  _globals['_MACHINENETWORKQUERY'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_MACHINENETWORKQUERY'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_MACHINENETWORKQUERY'].fields_by_name['destination_prefixes']._loaded_options = None
-  _globals['_MACHINENETWORKQUERY'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_MACHINENETWORKQUERY'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_MACHINENETWORKQUERY'].fields_by_name['ips']._loaded_options = None
-  _globals['_MACHINENETWORKQUERY'].fields_by_name['ips']._serialized_options = b'\272H\t\222\001\006\350\263\256\261\002\001'
+  _globals['_MACHINENETWORKQUERY'].fields_by_name['ips']._serialized_options = b'\272H\t\222\001\006\300\244\263\261\002\001'
   _globals['_MACHINENICQUERY'].fields_by_name['macs']._loaded_options = None
   _globals['_MACHINENICQUERY'].fields_by_name['macs']._serialized_options = b'\272H\021\222\001\016\020d\030\001\"\010r\006\270\263\256\261\002\001'
   _globals['_MACHINENICQUERY'].fields_by_name['names']._loaded_options = None
@@ -355,6 +375,8 @@
   _globals['_MACHINELIVELINESS']._serialized_end=12922
   _globals['_MACHINEALLOCATIONTYPE']._serialized_start=12925
   _globals['_MACHINEALLOCATIONTYPE']._serialized_end=13097
+  _globals['_MACHINEBMCCOMMAND']._serialized_start=13100
+  _globals['_MACHINEBMCCOMMAND']._serialized_end=13684
   _globals['_MACHINESERVICEGETREQUEST']._serialized_start=355
   _globals['_MACHINESERVICEGETREQUEST']._serialized_end=447
   _globals['_MACHINESERVICEGETRESPONSE']._serialized_start=449
@@ -435,6 +457,6 @@
   _globals['_MACHINEFRUQUERY']._serialized_end=11312
   _globals['_MACHINEHARDWAREQUERY']._serialized_start=11314
   _globals['_MACHINEHARDWAREQUERY']._serialized_end=11424
-  _globals['_MACHINESERVICE']._serialized_start=13100
-  _globals['_MACHINESERVICE']._serialized_end=13686
+  _globals['_MACHINESERVICE']._serialized_start=13687
+  _globals['_MACHINESERVICE']._serialized_end=14273
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/machine_pb2.pyi b/python/metalstack/api/v2/machine_pb2.pyi
index 03435633..4cb21636 100644
--- a/python/metalstack/api/v2/machine_pb2.pyi
+++ b/python/metalstack/api/v2/machine_pb2.pyi
@@ -64,6 +64,20 @@ class MachineAllocationType(int, metaclass=_enum_type_wrapper.EnumTypeWrapper):
     MACHINE_ALLOCATION_TYPE_UNSPECIFIED: _ClassVar[MachineAllocationType]
     MACHINE_ALLOCATION_TYPE_MACHINE: _ClassVar[MachineAllocationType]
     MACHINE_ALLOCATION_TYPE_FIREWALL: _ClassVar[MachineAllocationType]
+
+class MachineBMCCommand(int, metaclass=_enum_type_wrapper.EnumTypeWrapper):
+    __slots__ = ()
+    MACHINE_BMC_COMMAND_UNSPECIFIED: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_ON: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_OFF: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_RESET: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_CYCLE: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_BOOT_TO_BIOS: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_BOOT_FROM_DISK: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_BOOT_FROM_PXE: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_IDENTIFY_LED_ON: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF: _ClassVar[MachineBMCCommand]
+    MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE: _ClassVar[MachineBMCCommand]
 IP_PROTOCOL_UNSPECIFIED: IPProtocol
 IP_PROTOCOL_TCP: IPProtocol
 IP_PROTOCOL_UDP: IPProtocol
@@ -93,6 +107,17 @@ MACHINE_LIVELINESS_UNKNOWN: MachineLiveliness
 MACHINE_ALLOCATION_TYPE_UNSPECIFIED: MachineAllocationType
 MACHINE_ALLOCATION_TYPE_MACHINE: MachineAllocationType
 MACHINE_ALLOCATION_TYPE_FIREWALL: MachineAllocationType
+MACHINE_BMC_COMMAND_UNSPECIFIED: MachineBMCCommand
+MACHINE_BMC_COMMAND_ON: MachineBMCCommand
+MACHINE_BMC_COMMAND_OFF: MachineBMCCommand
+MACHINE_BMC_COMMAND_RESET: MachineBMCCommand
+MACHINE_BMC_COMMAND_CYCLE: MachineBMCCommand
+MACHINE_BMC_COMMAND_BOOT_TO_BIOS: MachineBMCCommand
+MACHINE_BMC_COMMAND_BOOT_FROM_DISK: MachineBMCCommand
+MACHINE_BMC_COMMAND_BOOT_FROM_PXE: MachineBMCCommand
+MACHINE_BMC_COMMAND_IDENTIFY_LED_ON: MachineBMCCommand
+MACHINE_BMC_COMMAND_IDENTIFY_LED_OFF: MachineBMCCommand
+MACHINE_BMC_COMMAND_UPDATE_BMC_FIRMWARE: MachineBMCCommand
 
 class MachineServiceGetRequest(_message.Message):
     __slots__ = ("uuid", "project")
diff --git a/python/metalstack/api/v2/network_pb2.py b/python/metalstack/api/v2/network_pb2.py
index 8f9b196c..a95fe620 100644
--- a/python/metalstack/api/v2/network_pb2.py
+++ b/python/metalstack/api/v2/network_pb2.py
@@ -27,7 +27,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/api/v2/network.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"]\n\x18NetworkServiceGetRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\x12%\n\x07project\x18\x02 \x01(\tB\x0b\xbaH\x08r\x03\xb0\x01\x01\xd8\x01\x01R\x07project\"Q\n\x19NetworkServiceGetResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xb1\x04\n\x1bNetworkServiceCreateRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x02R\tpartition\x88\x01\x01\x12\x31\n\x06labels\x18\x05 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x12\x37\n\x0eparent_network\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x03R\rparentNetwork\x88\x01\x01\x12\x41\n\x06length\x18\x07 \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\x04R\x06length\x88\x01\x01\x12]\n\x0e\x61\x64\x64ress_family\x18\x08 \x01(\x0e\x32\'.metalstack.api.v2.NetworkAddressFamilyB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x05R\raddressFamily\x88\x01\x01\x42\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\x11\n\x0f_parent_networkB\t\n\x07_lengthB\x11\n\x0f_address_family\"T\n\x1cNetworkServiceCreateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xe2\x02\n\x1bNetworkServiceUpdateRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12\"\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12$\n\x04name\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x06 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x02R\x06labels\x88\x01\x01\x42\x07\n\x05_nameB\x0e\n\x0c_descriptionB\t\n\x07_labels\"T\n\x1cNetworkServiceUpdateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"y\n\x19NetworkServiceListRequest\x12%\n\x07project\x18\x01 \x01(\tB\x0b\xbaH\x08r\x03\xb0\x01\x01\xd8\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkQueryR\x05query\"T\n\x1aNetworkServiceListResponse\x12\x36\n\x08networks\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x08networks\"\x85\x01\n%NetworkServiceListBaseNetworksRequest\x12%\n\x07project\x18\x01 \x01(\tB\x0b\xbaH\x08r\x03\xb0\x01\x01\xd8\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkQueryR\x05query\"`\n&NetworkServiceListBaseNetworksResponse\x12\x36\n\x08networks\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x08networks\"^\n\x1bNetworkServiceDeleteRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"T\n\x1cNetworkServiceDeleteResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xc4\x08\n\x07Network\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12$\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x02R\tpartition\x88\x01\x01\x12\'\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x03R\x07project\x88\x01\x01\x12+\n\tnamespace\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\tnamespace\x88\x01\x01\x12(\n\x08prefixes\x18\x08 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\t \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x63\n\x1b\x64\x65\x66\x61ult_child_prefix_length\x18\n \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x18\x64\x65\x66\x61ultChildPrefixLength\x12[\n\x17min_child_prefix_length\x18\x0b \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x14minChildPrefixLength\x12\x41\n\x04type\x18\x0c \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x05R\x04type\x88\x01\x01\x12\x44\n\x08nat_type\x18\r \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x07natType\x88\x01\x01\x12\x15\n\x03vrf\x18\x0e \x01(\rH\x07R\x03vrf\x88\x01\x01\x12\x37\n\x0eparent_network\x18\x0f \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x08R\rparentNetwork\x88\x01\x01\x12N\n\x1c\x61\x64\x64itional_announcable_cidrs\x18\x10 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x1a\x61\x64\x64itionalAnnouncableCidrs\x12G\n\x0b\x63onsumption\x18\x11 \x01(\x0b\x32%.metalstack.api.v2.NetworkConsumptionR\x0b\x63onsumptionB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\n\n\x08_projectB\x0c\n\n_namespaceB\x07\n\x05_typeB\x0b\n\t_nat_typeB\x06\n\x04_vrfB\x11\n\x0f_parent_network\"\x81\x07\n\x0cNetworkQuery\x12\x1f\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x00R\x02id\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x03R\tpartition\x88\x01\x01\x12\'\n\x07project\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\x07project\x88\x01\x01\x12+\n\tnamespace\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x05R\tnamespace\x88\x01\x01\x12(\n\x08prefixes\x18\x07 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x08 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x15\n\x03vrf\x18\t \x01(\rH\x06R\x03vrf\x88\x01\x01\x12\x37\n\x0eparent_network\x18\n \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x07R\rparentNetwork\x88\x01\x01\x12]\n\x0e\x61\x64\x64ress_family\x18\x0b \x01(\x0e\x32\'.metalstack.api.v2.NetworkAddressFamilyB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x08R\raddressFamily\x88\x01\x01\x12\x41\n\x04type\x18\x0c \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\tR\x04type\x88\x01\x01\x12\x44\n\x08nat_type\x18\r \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\nR\x07natType\x88\x01\x01\x12\x36\n\x06labels\x18\x0e \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x0bR\x06labels\x88\x01\x01\x42\x05\n\x03_idB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\n\n\x08_projectB\x0c\n\n_namespaceB\x06\n\x04_vrfB\x11\n\x0f_parent_networkB\x11\n\x0f_address_familyB\x07\n\x05_typeB\x0b\n\t_nat_typeB\t\n\x07_labels\"n\n\x11\x43hildPrefixLength\x12\"\n\x04ipv4\x18\x01 \x01(\rB\t\xbaH\x06*\x04\x18  \x00H\x00R\x04ipv4\x88\x01\x01\x12#\n\x04ipv6\x18\x02 \x01(\rB\n\xbaH\x07*\x05\x18\x80\x01 \x00H\x01R\x04ipv6\x88\x01\x01\x42\x07\n\x05_ipv4B\x07\n\x05_ipv6\"~\n\x12NetworkConsumption\x12\x33\n\x04ipv4\x18\x01 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkUsageR\x04ipv4\x12\x33\n\x04ipv6\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkUsageR\x04ipv6\"\xa2\x01\n\x0cNetworkUsage\x12#\n\ravailable_ips\x18\x02 \x01(\x04R\x0c\x61vailableIps\x12\x19\n\x08used_ips\x18\x03 \x01(\x04R\x07usedIps\x12-\n\x12\x61vailable_prefixes\x18\x04 \x01(\x04R\x11\x61vailablePrefixes\x12#\n\rused_prefixes\x18\x05 \x01(\x04R\x0cusedPrefixes*m\n\x07NATType\x12\x18\n\x14NAT_TYPE_UNSPECIFIED\x10\x00\x12\x1b\n\rNAT_TYPE_NONE\x10\x01\x1a\x08\x82\xb2\x19\x04none\x12+\n\x18NAT_TYPE_IPV4_MASQUERADE\x10\x02\x1a\r\x82\xb2\x19\tipv4-masq*\xad\x02\n\x0bNetworkType\x12\x1c\n\x18NETWORK_TYPE_UNSPECIFIED\x10\x00\x12\'\n\x15NETWORK_TYPE_EXTERNAL\x10\x01\x1a\x0c\x82\xb2\x19\x08\x65xternal\x12\'\n\x15NETWORK_TYPE_UNDERLAY\x10\x02\x1a\x0c\x82\xb2\x19\x08underlay\x12!\n\x12NETWORK_TYPE_SUPER\x10\x03\x1a\t\x82\xb2\x19\x05super\x12\x37\n\x1dNETWORK_TYPE_SUPER_NAMESPACED\x10\x04\x1a\x14\x82\xb2\x19\x10super-namespaced\x12!\n\x12NETWORK_TYPE_CHILD\x10\x05\x1a\t\x82\xb2\x19\x05\x63hild\x12/\n\x19NETWORK_TYPE_CHILD_SHARED\x10\x06\x1a\x10\x82\xb2\x19\x0c\x63hild-shared*\xc7\x01\n\x14NetworkAddressFamily\x12&\n\"NETWORK_ADDRESS_FAMILY_UNSPECIFIED\x10\x00\x12\'\n\x19NETWORK_ADDRESS_FAMILY_V4\x10\x01\x1a\x08\x82\xb2\x19\x04ipv4\x12\'\n\x19NETWORK_ADDRESS_FAMILY_V6\x10\x02\x1a\x08\x82\xb2\x19\x04ipv6\x12\x35\n!NETWORK_ADDRESS_FAMILY_DUAL_STACK\x10\x03\x1a\x0e\x82\xb2\x19\ndual-stack2\xe1\x05\n\x0eNetworkService\x12m\n\x03Get\x12+.metalstack.api.v2.NetworkServiceGetRequest\x1a,.metalstack.api.v2.NetworkServiceGetResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x43reate\x12..metalstack.api.v2.NetworkServiceCreateRequest\x1a/.metalstack.api.v2.NetworkServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n\x06Update\x12..metalstack.api.v2.NetworkServiceUpdateRequest\x1a/.metalstack.api.v2.NetworkServiceUpdateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12p\n\x04List\x12,.metalstack.api.v2.NetworkServiceListRequest\x1a-.metalstack.api.v2.NetworkServiceListResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12\x94\x01\n\x10ListBaseNetworks\x12\x38.metalstack.api.v2.NetworkServiceListBaseNetworksRequest\x1a\x39.metalstack.api.v2.NetworkServiceListBaseNetworksResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x44\x65lete\x12..metalstack.api.v2.NetworkServiceDeleteRequest\x1a/.metalstack.api.v2.NetworkServiceDeleteResponse\"\x06\xca\xf3\x18\x02\x01\x02\x42\xc2\x01\n\x15\x63om.metalstack.api.v2B\x0cNetworkProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/api/v2/network.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"]\n\x18NetworkServiceGetRequest\x12\x1a\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01R\x02id\x12%\n\x07project\x18\x02 \x01(\tB\x0b\xbaH\x08r\x03\xb0\x01\x01\xd8\x01\x01R\x07project\"Q\n\x19NetworkServiceGetResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xb1\x04\n\x1bNetworkServiceCreateRequest\x12\"\n\x07project\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x02R\tpartition\x88\x01\x01\x12\x31\n\x06labels\x18\x05 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x12\x37\n\x0eparent_network\x18\x06 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x03R\rparentNetwork\x88\x01\x01\x12\x41\n\x06length\x18\x07 \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthH\x04R\x06length\x88\x01\x01\x12]\n\x0e\x61\x64\x64ress_family\x18\x08 \x01(\x0e\x32\'.metalstack.api.v2.NetworkAddressFamilyB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x05R\raddressFamily\x88\x01\x01\x42\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\x11\n\x0f_parent_networkB\t\n\x07_lengthB\x11\n\x0f_address_family\"T\n\x1cNetworkServiceCreateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xe2\x02\n\x1bNetworkServiceUpdateRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x01R\nupdateMeta\x12\"\n\x07project\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\x12$\n\x04name\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12<\n\x06labels\x18\x06 \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsH\x02R\x06labels\x88\x01\x01\x42\x07\n\x05_nameB\x0e\n\x0c_descriptionB\t\n\x07_labels\"T\n\x1cNetworkServiceUpdateResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"y\n\x19NetworkServiceListRequest\x12%\n\x07project\x18\x01 \x01(\tB\x0b\xbaH\x08r\x03\xb0\x01\x01\xd8\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkQueryR\x05query\"T\n\x1aNetworkServiceListResponse\x12\x36\n\x08networks\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x08networks\"\x85\x01\n%NetworkServiceListBaseNetworksRequest\x12%\n\x07project\x18\x01 \x01(\tB\x0b\xbaH\x08r\x03\xb0\x01\x01\xd8\x01\x01R\x07project\x12\x35\n\x05query\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkQueryR\x05query\"`\n&NetworkServiceListBaseNetworksResponse\x12\x36\n\x08networks\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x08networks\"^\n\x1bNetworkServiceDeleteRequest\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12\"\n\x07project\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x07project\"T\n\x1cNetworkServiceDeleteResponse\x12\x34\n\x07network\x18\x01 \x01(\x0b\x32\x1a.metalstack.api.v2.NetworkR\x07network\"\xc4\x08\n\x07Network\x12\x1b\n\x02id\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x02id\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12$\n\x04name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x01R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x02R\tpartition\x88\x01\x01\x12\'\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x03R\x07project\x88\x01\x01\x12+\n\tnamespace\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\tnamespace\x88\x01\x01\x12(\n\x08prefixes\x18\x08 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\t \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x63\n\x1b\x64\x65\x66\x61ult_child_prefix_length\x18\n \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x18\x64\x65\x66\x61ultChildPrefixLength\x12[\n\x17min_child_prefix_length\x18\x0b \x01(\x0b\x32$.metalstack.api.v2.ChildPrefixLengthR\x14minChildPrefixLength\x12\x41\n\x04type\x18\x0c \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x05R\x04type\x88\x01\x01\x12\x44\n\x08nat_type\x18\r \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x06R\x07natType\x88\x01\x01\x12\x15\n\x03vrf\x18\x0e \x01(\rH\x07R\x03vrf\x88\x01\x01\x12\x37\n\x0eparent_network\x18\x0f \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x08R\rparentNetwork\x88\x01\x01\x12N\n\x1c\x61\x64\x64itional_announcable_cidrs\x18\x10 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x1a\x61\x64\x64itionalAnnouncableCidrs\x12G\n\x0b\x63onsumption\x18\x11 \x01(\x0b\x32%.metalstack.api.v2.NetworkConsumptionR\x0b\x63onsumptionB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\n\n\x08_projectB\x0c\n\n_namespaceB\x07\n\x05_typeB\x0b\n\t_nat_typeB\x06\n\x04_vrfB\x11\n\x0f_parent_network\"\x81\x07\n\x0cNetworkQuery\x12\x1f\n\x02id\x18\x01 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x00R\x02id\x88\x01\x01\x12$\n\x04name\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x04name\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12.\n\tpartition\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x03R\tpartition\x88\x01\x01\x12\'\n\x07project\x18\x05 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\x07project\x88\x01\x01\x12+\n\tnamespace\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x05R\tnamespace\x88\x01\x01\x12(\n\x08prefixes\x18\x07 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x08prefixes\x12?\n\x14\x64\x65stination_prefixes\x18\x08 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x13\x64\x65stinationPrefixes\x12\x15\n\x03vrf\x18\t \x01(\rH\x06R\x03vrf\x88\x01\x01\x12\x37\n\x0eparent_network\x18\n \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x07R\rparentNetwork\x88\x01\x01\x12]\n\x0e\x61\x64\x64ress_family\x18\x0b \x01(\x0e\x32\'.metalstack.api.v2.NetworkAddressFamilyB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x08R\raddressFamily\x88\x01\x01\x12\x41\n\x04type\x18\x0c \x01(\x0e\x32\x1e.metalstack.api.v2.NetworkTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\tR\x04type\x88\x01\x01\x12\x44\n\x08nat_type\x18\r \x01(\x0e\x32\x1a.metalstack.api.v2.NATTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\nR\x07natType\x88\x01\x01\x12\x36\n\x06labels\x18\x0e \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x0bR\x06labels\x88\x01\x01\x42\x05\n\x03_idB\x07\n\x05_nameB\x0e\n\x0c_descriptionB\x0c\n\n_partitionB\n\n\x08_projectB\x0c\n\n_namespaceB\x06\n\x04_vrfB\x11\n\x0f_parent_networkB\x11\n\x0f_address_familyB\x07\n\x05_typeB\x0b\n\t_nat_typeB\t\n\x07_labels\"n\n\x11\x43hildPrefixLength\x12\"\n\x04ipv4\x18\x01 \x01(\rB\t\xbaH\x06*\x04\x18  \x00H\x00R\x04ipv4\x88\x01\x01\x12#\n\x04ipv6\x18\x02 \x01(\rB\n\xbaH\x07*\x05\x18\x80\x01 \x00H\x01R\x04ipv6\x88\x01\x01\x42\x07\n\x05_ipv4B\x07\n\x05_ipv6\"~\n\x12NetworkConsumption\x12\x33\n\x04ipv4\x18\x01 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkUsageR\x04ipv4\x12\x33\n\x04ipv6\x18\x02 \x01(\x0b\x32\x1f.metalstack.api.v2.NetworkUsageR\x04ipv6\"\xa2\x01\n\x0cNetworkUsage\x12#\n\ravailable_ips\x18\x02 \x01(\x04R\x0c\x61vailableIps\x12\x19\n\x08used_ips\x18\x03 \x01(\x04R\x07usedIps\x12-\n\x12\x61vailable_prefixes\x18\x04 \x01(\x04R\x11\x61vailablePrefixes\x12#\n\rused_prefixes\x18\x05 \x01(\x04R\x0cusedPrefixes*m\n\x07NATType\x12\x18\n\x14NAT_TYPE_UNSPECIFIED\x10\x00\x12\x1b\n\rNAT_TYPE_NONE\x10\x01\x1a\x08\x82\xb2\x19\x04none\x12+\n\x18NAT_TYPE_IPV4_MASQUERADE\x10\x02\x1a\r\x82\xb2\x19\tipv4-masq*\xad\x02\n\x0bNetworkType\x12\x1c\n\x18NETWORK_TYPE_UNSPECIFIED\x10\x00\x12\'\n\x15NETWORK_TYPE_EXTERNAL\x10\x01\x1a\x0c\x82\xb2\x19\x08\x65xternal\x12\'\n\x15NETWORK_TYPE_UNDERLAY\x10\x02\x1a\x0c\x82\xb2\x19\x08underlay\x12!\n\x12NETWORK_TYPE_SUPER\x10\x03\x1a\t\x82\xb2\x19\x05super\x12\x37\n\x1dNETWORK_TYPE_SUPER_NAMESPACED\x10\x04\x1a\x14\x82\xb2\x19\x10super-namespaced\x12!\n\x12NETWORK_TYPE_CHILD\x10\x05\x1a\t\x82\xb2\x19\x05\x63hild\x12/\n\x19NETWORK_TYPE_CHILD_SHARED\x10\x06\x1a\x10\x82\xb2\x19\x0c\x63hild-shared*\xc7\x01\n\x14NetworkAddressFamily\x12&\n\"NETWORK_ADDRESS_FAMILY_UNSPECIFIED\x10\x00\x12\'\n\x19NETWORK_ADDRESS_FAMILY_V4\x10\x01\x1a\x08\x82\xb2\x19\x04ipv4\x12\'\n\x19NETWORK_ADDRESS_FAMILY_V6\x10\x02\x1a\x08\x82\xb2\x19\x04ipv6\x12\x35\n!NETWORK_ADDRESS_FAMILY_DUAL_STACK\x10\x03\x1a\x0e\x82\xb2\x19\ndual-stack2\xe1\x05\n\x0eNetworkService\x12m\n\x03Get\x12+.metalstack.api.v2.NetworkServiceGetRequest\x1a,.metalstack.api.v2.NetworkServiceGetResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x43reate\x12..metalstack.api.v2.NetworkServiceCreateRequest\x1a/.metalstack.api.v2.NetworkServiceCreateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12q\n\x06Update\x12..metalstack.api.v2.NetworkServiceUpdateRequest\x1a/.metalstack.api.v2.NetworkServiceUpdateResponse\"\x06\xca\xf3\x18\x02\x01\x02\x12p\n\x04List\x12,.metalstack.api.v2.NetworkServiceListRequest\x1a-.metalstack.api.v2.NetworkServiceListResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12\x94\x01\n\x10ListBaseNetworks\x12\x38.metalstack.api.v2.NetworkServiceListBaseNetworksRequest\x1a\x39.metalstack.api.v2.NetworkServiceListBaseNetworksResponse\"\x0b\xca\xf3\x18\x03\x01\x02\x03\xe0\xf3\x18\x02\x12q\n\x06\x44\x65lete\x12..metalstack.api.v2.NetworkServiceDeleteRequest\x1a/.metalstack.api.v2.NetworkServiceDeleteResponse\"\x06\xca\xf3\x18\x02\x01\x02\x42\xc2\x01\n\x15\x63om.metalstack.api.v2B\x0cNetworkProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -104,9 +104,9 @@
   _globals['_NETWORK'].fields_by_name['namespace']._loaded_options = None
   _globals['_NETWORK'].fields_by_name['namespace']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_NETWORK'].fields_by_name['prefixes']._loaded_options = None
-  _globals['_NETWORK'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORK'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORK'].fields_by_name['destination_prefixes']._loaded_options = None
-  _globals['_NETWORK'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORK'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORK'].fields_by_name['type']._loaded_options = None
   _globals['_NETWORK'].fields_by_name['type']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_NETWORK'].fields_by_name['nat_type']._loaded_options = None
@@ -114,7 +114,7 @@
   _globals['_NETWORK'].fields_by_name['parent_network']._loaded_options = None
   _globals['_NETWORK'].fields_by_name['parent_network']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
   _globals['_NETWORK'].fields_by_name['additional_announcable_cidrs']._loaded_options = None
-  _globals['_NETWORK'].fields_by_name['additional_announcable_cidrs']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORK'].fields_by_name['additional_announcable_cidrs']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKQUERY'].fields_by_name['id']._loaded_options = None
   _globals['_NETWORKQUERY'].fields_by_name['id']._serialized_options = b'\272H\007r\005\020\002\030\200\001'
   _globals['_NETWORKQUERY'].fields_by_name['name']._loaded_options = None
@@ -128,9 +128,9 @@
   _globals['_NETWORKQUERY'].fields_by_name['namespace']._loaded_options = None
   _globals['_NETWORKQUERY'].fields_by_name['namespace']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_NETWORKQUERY'].fields_by_name['prefixes']._loaded_options = None
-  _globals['_NETWORKQUERY'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKQUERY'].fields_by_name['prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKQUERY'].fields_by_name['destination_prefixes']._loaded_options = None
-  _globals['_NETWORKQUERY'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_NETWORKQUERY'].fields_by_name['destination_prefixes']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_NETWORKQUERY'].fields_by_name['parent_network']._loaded_options = None
   _globals['_NETWORKQUERY'].fields_by_name['parent_network']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
   _globals['_NETWORKQUERY'].fields_by_name['address_family']._loaded_options = None
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.py b/python/metalstack/api/v2/predefined_rules_pb2.py
index 4bac89d5..4831f311 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.py
+++ b/python/metalstack/api/v2/predefined_rules_pb2.py
@@ -25,7 +25,7 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xbc\xe6\x95& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xbd\xe6\x95& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ipsB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ipsB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
diff --git a/python/metalstack/api/v2/switch_pb2.py b/python/metalstack/api/v2/switch_pb2.py
index bcedf32e..18fbe9ee 100644
--- a/python/metalstack/api/v2/switch_pb2.py
+++ b/python/metalstack/api/v2/switch_pb2.py
@@ -28,7 +28,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/switch.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xb0\x05\n\x06Switch\x12\x1d\n\x02id\x18\x01 \x01(\tB\r\xbaH\nr\x08h\x01\xc0\xb3\xae\xb1\x02\x01R\x02id\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12$\n\x04rack\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04rack\x88\x01\x01\x12)\n\tpartition\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\x12Q\n\x0creplace_mode\x18\x06 \x01(\x0e\x32$.metalstack.api.v2.SwitchReplaceModeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0breplaceMode\x12,\n\rmanagement_ip\x18\x07 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x0cmanagementIp\x12\x38\n\x0fmanagement_user\x18\x08 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x01R\x0emanagementUser\x88\x01\x01\x12\x38\n\x0f\x63onsole_command\x18\t \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x02R\x0e\x63onsoleCommand\x88\x01\x01\x12\x30\n\x04nics\x18\n \x03(\x0b\x32\x1c.metalstack.api.v2.SwitchNicR\x04nics\x12+\n\x02os\x18\x0b \x01(\x0b\x32\x1b.metalstack.api.v2.SwitchOSR\x02os\x12U\n\x13machine_connections\x18\x0c \x03(\x0b\x32$.metalstack.api.v2.MachineConnectionR\x12machineConnectionsB\x07\n\x05_rackB\x12\n\x10_management_userB\x12\n\x10_console_command\"\xb1\x01\n\x08SwitchOS\x12\x43\n\x06vendor\x18\x01 \x01(\x0e\x32!.metalstack.api.v2.SwitchOSVendorB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x06vendor\x12%\n\x07version\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x07version\x12\x39\n\x12metal_core_version\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x10metalCoreVersion\"\x9c\x03\n\tSwitchNic\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12+\n\nidentifier\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\nidentifier\x12\x1d\n\x03mac\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\"\n\x03vrf\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x03vrf\x88\x01\x01\x12\x36\n\x05state\x18\x05 \x01(\x0b\x32\x1b.metalstack.api.v2.NicStateH\x01R\x05state\x88\x01\x01\x12@\n\nbgp_filter\x18\x06 \x01(\x0b\x32\x1c.metalstack.api.v2.BGPFilterH\x02R\tbgpFilter\x88\x01\x01\x12P\n\x0e\x62gp_port_state\x18\x07 \x01(\x0b\x32%.metalstack.api.v2.SwitchBGPPortStateH\x03R\x0c\x62gpPortState\x88\x01\x01\x42\x06\n\x04_vrfB\x08\n\x06_stateB\r\n\x0b_bgp_filterB\x11\n\x0f_bgp_port_state\"T\n\tBGPFilter\x12\"\n\x05\x63idrs\x18\x01 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xe0\xb3\xae\xb1\x02\x01R\x05\x63idrs\x12#\n\x04vnis\x18\x02 \x03(\tB\x0f\xbaH\x0c\x92\x01\t\"\x07r\x05\x10\x02\x18\x80\x01R\x04vnis\"\x92\x03\n\x12SwitchBGPPortState\x12\'\n\x08neighbor\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x08neighbor\x12*\n\npeer_group\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\tpeerGroup\x12&\n\x08vrf_name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x07vrfName\x12\x42\n\tbgp_state\x18\x04 \x01(\x0e\x32\x1b.metalstack.api.v2.BGPStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08\x62gpState\x12S\n\x18\x62gp_timer_up_established\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x15\x62gpTimerUpEstablished\x12.\n\x13sent_prefix_counter\x18\x06 \x01(\x04R\x11sentPrefixCounter\x12\x36\n\x17\x61\x63\x63\x65pted_prefix_counter\x18\x07 \x01(\x04R\x15\x61\x63\x63\x65ptedPrefixCounter\"\xab\x01\n\x08NicState\x12L\n\x07\x64\x65sired\x18\x01 \x01(\x0e\x32#.metalstack.api.v2.SwitchPortStatusB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x07\x64\x65sired\x88\x01\x01\x12\x45\n\x06\x61\x63tual\x18\x02 \x01(\x0e\x32#.metalstack.api.v2.SwitchPortStatusB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x06\x61\x63tualB\n\n\x08_desired\"b\n\x11MachineConnection\x12\x1d\n\nmachine_id\x18\x01 \x01(\tR\tmachineId\x12.\n\x03nic\x18\x02 \x01(\x0b\x32\x1c.metalstack.api.v2.SwitchNicR\x03nic\"\xe3\x01\n\x0bSwitchQuery\x12\"\n\x02id\x18\x01 \x01(\tB\r\xbaH\nr\x08h\x01\xc0\xb3\xae\xb1\x02\x01H\x00R\x02id\x88\x01\x01\x12.\n\tpartition\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x01R\tpartition\x88\x01\x01\x12$\n\x04rack\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x02R\x04rack\x88\x01\x01\x12\x35\n\x02os\x18\x04 \x01(\x0b\x32 .metalstack.api.v2.SwitchOSQueryH\x03R\x02os\x88\x01\x01\x42\x05\n\x03_idB\x0c\n\n_partitionB\x07\n\x05_rackB\x05\n\x03_os\"\x9c\x01\n\rSwitchOSQuery\x12H\n\x06vendor\x18\x01 \x01(\x0e\x32!.metalstack.api.v2.SwitchOSVendorB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x06vendor\x88\x01\x01\x12*\n\x07version\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x07version\x88\x01\x01\x42\t\n\x07_vendorB\n\n\x08_version*\x8b\x02\n\x08\x42GPState\x12\x19\n\x15\x42GP_STATE_UNSPECIFIED\x10\x00\x12\x1c\n\x0e\x42GP_STATE_IDLE\x10\x01\x1a\x08\x82\xb2\x19\x04idle\x12\"\n\x11\x42GP_STATE_CONNECT\x10\x02\x1a\x0b\x82\xb2\x19\x07\x63onnect\x12 \n\x10\x42GP_STATE_ACTIVE\x10\x03\x1a\n\x82\xb2\x19\x06\x61\x63tive\x12&\n\x13\x42GP_STATE_OPEN_SENT\x10\x04\x1a\r\x82\xb2\x19\topen-sent\x12,\n\x16\x42GP_STATE_OPEN_CONFIRM\x10\x05\x1a\x10\x82\xb2\x19\x0copen-confirm\x12*\n\x15\x42GP_STATE_ESTABLISHED\x10\x06\x1a\x0f\x82\xb2\x19\x0b\x65stablished*\x9c\x01\n\x11SwitchReplaceMode\x12#\n\x1fSWITCH_REPLACE_MODE_UNSPECIFIED\x10\x00\x12,\n\x1bSWITCH_REPLACE_MODE_REPLACE\x10\x01\x1a\x0b\x82\xb2\x19\x07replace\x12\x34\n\x1fSWITCH_REPLACE_MODE_OPERATIONAL\x10\x02\x1a\x0f\x82\xb2\x19\x0boperational*\x84\x01\n\x0eSwitchOSVendor\x12 \n\x1cSWITCH_OS_VENDOR_UNSPECIFIED\x10\x00\x12)\n\x18SWITCH_OS_VENDOR_CUMULUS\x10\x01\x1a\x0b\x82\xb2\x19\x07\x43umulus\x12%\n\x16SWITCH_OS_VENDOR_SONIC\x10\x02\x1a\t\x82\xb2\x19\x05SONiC*\xad\x01\n\x10SwitchPortStatus\x12\"\n\x1eSWITCH_PORT_STATUS_UNSPECIFIED\x10\x00\x12!\n\x15SWITCH_PORT_STATUS_UP\x10\x01\x1a\x06\x82\xb2\x19\x02up\x12%\n\x17SWITCH_PORT_STATUS_DOWN\x10\x02\x1a\x08\x82\xb2\x19\x04\x64own\x12+\n\x1aSWITCH_PORT_STATUS_UNKNOWN\x10\x03\x1a\x0b\x82\xb2\x19\x07unknownB\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0bSwitchProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/switch.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xb0\x05\n\x06Switch\x12\x1d\n\x02id\x18\x01 \x01(\tB\r\xbaH\nr\x08h\x01\xc0\xb3\xae\xb1\x02\x01R\x02id\x12+\n\x04meta\x18\x02 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12$\n\x04rack\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x04rack\x88\x01\x01\x12)\n\tpartition\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\x12Q\n\x0creplace_mode\x18\x06 \x01(\x0e\x32$.metalstack.api.v2.SwitchReplaceModeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0breplaceMode\x12,\n\rmanagement_ip\x18\x07 \x01(\tB\x07\xbaH\x04r\x02p\x01R\x0cmanagementIp\x12\x38\n\x0fmanagement_user\x18\x08 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x01R\x0emanagementUser\x88\x01\x01\x12\x38\n\x0f\x63onsole_command\x18\t \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x01H\x02R\x0e\x63onsoleCommand\x88\x01\x01\x12\x30\n\x04nics\x18\n \x03(\x0b\x32\x1c.metalstack.api.v2.SwitchNicR\x04nics\x12+\n\x02os\x18\x0b \x01(\x0b\x32\x1b.metalstack.api.v2.SwitchOSR\x02os\x12U\n\x13machine_connections\x18\x0c \x03(\x0b\x32$.metalstack.api.v2.MachineConnectionR\x12machineConnectionsB\x07\n\x05_rackB\x12\n\x10_management_userB\x12\n\x10_console_command\"\xb1\x01\n\x08SwitchOS\x12\x43\n\x06vendor\x18\x01 \x01(\x0e\x32!.metalstack.api.v2.SwitchOSVendorB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x06vendor\x12%\n\x07version\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x07version\x12\x39\n\x12metal_core_version\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x10metalCoreVersion\"\x9c\x03\n\tSwitchNic\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12+\n\nidentifier\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\nidentifier\x12\x1d\n\x03mac\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xb8\xb3\xae\xb1\x02\x01R\x03mac\x12\"\n\x03vrf\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x00R\x03vrf\x88\x01\x01\x12\x36\n\x05state\x18\x05 \x01(\x0b\x32\x1b.metalstack.api.v2.NicStateH\x01R\x05state\x88\x01\x01\x12@\n\nbgp_filter\x18\x06 \x01(\x0b\x32\x1c.metalstack.api.v2.BGPFilterH\x02R\tbgpFilter\x88\x01\x01\x12P\n\x0e\x62gp_port_state\x18\x07 \x01(\x0b\x32%.metalstack.api.v2.SwitchBGPPortStateH\x03R\x0c\x62gpPortState\x88\x01\x01\x42\x06\n\x04_vrfB\x08\n\x06_stateB\r\n\x0b_bgp_filterB\x11\n\x0f_bgp_port_state\"T\n\tBGPFilter\x12\"\n\x05\x63idrs\x18\x01 \x03(\tB\x0c\xbaH\t\x92\x01\x06\xb8\xa4\xb3\xb1\x02\x01R\x05\x63idrs\x12#\n\x04vnis\x18\x02 \x03(\tB\x0f\xbaH\x0c\x92\x01\t\"\x07r\x05\x10\x02\x18\x80\x01R\x04vnis\"\x92\x03\n\x12SwitchBGPPortState\x12\'\n\x08neighbor\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x08neighbor\x12*\n\npeer_group\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\tpeerGroup\x12&\n\x08vrf_name\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x07vrfName\x12\x42\n\tbgp_state\x18\x04 \x01(\x0e\x32\x1b.metalstack.api.v2.BGPStateB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x08\x62gpState\x12S\n\x18\x62gp_timer_up_established\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x15\x62gpTimerUpEstablished\x12.\n\x13sent_prefix_counter\x18\x06 \x01(\x04R\x11sentPrefixCounter\x12\x36\n\x17\x61\x63\x63\x65pted_prefix_counter\x18\x07 \x01(\x04R\x15\x61\x63\x63\x65ptedPrefixCounter\"\xab\x01\n\x08NicState\x12L\n\x07\x64\x65sired\x18\x01 \x01(\x0e\x32#.metalstack.api.v2.SwitchPortStatusB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x07\x64\x65sired\x88\x01\x01\x12\x45\n\x06\x61\x63tual\x18\x02 \x01(\x0e\x32#.metalstack.api.v2.SwitchPortStatusB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x06\x61\x63tualB\n\n\x08_desired\"b\n\x11MachineConnection\x12\x1d\n\nmachine_id\x18\x01 \x01(\tR\tmachineId\x12.\n\x03nic\x18\x02 \x01(\x0b\x32\x1c.metalstack.api.v2.SwitchNicR\x03nic\"\xe3\x01\n\x0bSwitchQuery\x12\"\n\x02id\x18\x01 \x01(\tB\r\xbaH\nr\x08h\x01\xc0\xb3\xae\xb1\x02\x01H\x00R\x02id\x88\x01\x01\x12.\n\tpartition\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01H\x01R\tpartition\x88\x01\x01\x12$\n\x04rack\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x02R\x04rack\x88\x01\x01\x12\x35\n\x02os\x18\x04 \x01(\x0b\x32 .metalstack.api.v2.SwitchOSQueryH\x03R\x02os\x88\x01\x01\x42\x05\n\x03_idB\x0c\n\n_partitionB\x07\n\x05_rackB\x05\n\x03_os\"\x9c\x01\n\rSwitchOSQuery\x12H\n\x06vendor\x18\x01 \x01(\x0e\x32!.metalstack.api.v2.SwitchOSVendorB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x06vendor\x88\x01\x01\x12*\n\x07version\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x01R\x07version\x88\x01\x01\x42\t\n\x07_vendorB\n\n\x08_version*\x8b\x02\n\x08\x42GPState\x12\x19\n\x15\x42GP_STATE_UNSPECIFIED\x10\x00\x12\x1c\n\x0e\x42GP_STATE_IDLE\x10\x01\x1a\x08\x82\xb2\x19\x04idle\x12\"\n\x11\x42GP_STATE_CONNECT\x10\x02\x1a\x0b\x82\xb2\x19\x07\x63onnect\x12 \n\x10\x42GP_STATE_ACTIVE\x10\x03\x1a\n\x82\xb2\x19\x06\x61\x63tive\x12&\n\x13\x42GP_STATE_OPEN_SENT\x10\x04\x1a\r\x82\xb2\x19\topen-sent\x12,\n\x16\x42GP_STATE_OPEN_CONFIRM\x10\x05\x1a\x10\x82\xb2\x19\x0copen-confirm\x12*\n\x15\x42GP_STATE_ESTABLISHED\x10\x06\x1a\x0f\x82\xb2\x19\x0b\x65stablished*\x9c\x01\n\x11SwitchReplaceMode\x12#\n\x1fSWITCH_REPLACE_MODE_UNSPECIFIED\x10\x00\x12,\n\x1bSWITCH_REPLACE_MODE_REPLACE\x10\x01\x1a\x0b\x82\xb2\x19\x07replace\x12\x34\n\x1fSWITCH_REPLACE_MODE_OPERATIONAL\x10\x02\x1a\x0f\x82\xb2\x19\x0boperational*\x84\x01\n\x0eSwitchOSVendor\x12 \n\x1cSWITCH_OS_VENDOR_UNSPECIFIED\x10\x00\x12)\n\x18SWITCH_OS_VENDOR_CUMULUS\x10\x01\x1a\x0b\x82\xb2\x19\x07\x43umulus\x12%\n\x16SWITCH_OS_VENDOR_SONIC\x10\x02\x1a\t\x82\xb2\x19\x05SONiC*\xad\x01\n\x10SwitchPortStatus\x12\"\n\x1eSWITCH_PORT_STATUS_UNSPECIFIED\x10\x00\x12!\n\x15SWITCH_PORT_STATUS_UP\x10\x01\x1a\x06\x82\xb2\x19\x02up\x12%\n\x17SWITCH_PORT_STATUS_DOWN\x10\x02\x1a\x08\x82\xb2\x19\x04\x64own\x12+\n\x1aSWITCH_PORT_STATUS_UNKNOWN\x10\x03\x1a\x0b\x82\xb2\x19\x07unknownB\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0bSwitchProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -93,7 +93,7 @@
   _globals['_SWITCHNIC'].fields_by_name['vrf']._loaded_options = None
   _globals['_SWITCHNIC'].fields_by_name['vrf']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
   _globals['_BGPFILTER'].fields_by_name['cidrs']._loaded_options = None
-  _globals['_BGPFILTER'].fields_by_name['cidrs']._serialized_options = b'\272H\t\222\001\006\340\263\256\261\002\001'
+  _globals['_BGPFILTER'].fields_by_name['cidrs']._serialized_options = b'\272H\t\222\001\006\270\244\263\261\002\001'
   _globals['_BGPFILTER'].fields_by_name['vnis']._loaded_options = None
   _globals['_BGPFILTER'].fields_by_name['vnis']._serialized_options = b'\272H\014\222\001\t\"\007r\005\020\002\030\200\001'
   _globals['_SWITCHBGPPORTSTATE'].fields_by_name['neighbor']._loaded_options = None
diff --git a/python/metalstack/infra/v2/bmc_connect.py b/python/metalstack/infra/v2/bmc_connect.py
index 1afc8521..df0a3143 100644
--- a/python/metalstack/infra/v2/bmc_connect.py
+++ b/python/metalstack/infra/v2/bmc_connect.py
@@ -19,6 +19,9 @@ class BMCService(Protocol):
     async def update_b_m_c_info(self, request: metalstack_dot_infra_dot_v2_dot_bmc__pb2.UpdateBMCInfoRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_bmc__pb2.UpdateBMCInfoResponse:
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
 
+    def wait_for_machine_event(self, request: AsyncIterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest], ctx: RequestContext) -> AsyncIterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse]:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
 
 class BMCServiceASGIApplication(ConnectASGIApplication):
     def __init__(self, service: BMCService, *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None) -> None:
@@ -34,6 +37,16 @@ def __init__(self, service: BMCService, *, interceptors: Iterable[Interceptor]=(
                     ),
                     function=service.update_b_m_c_info,
                 ),
+                "/metalstack.infra.v2.BMCService/WaitForMachineEvent": Endpoint.bidi_stream(
+                    method=MethodInfo(
+                        name="WaitForMachineEvent",
+                        service_name="metalstack.infra.v2.BMCService",
+                        input=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.wait_for_machine_event,
+                ),
             },
             interceptors=interceptors,
             read_max_bytes=read_max_bytes,
@@ -66,10 +79,32 @@ async def update_b_m_c_info(
             timeout_ms=timeout_ms,
         )
 
+    def wait_for_machine_event(
+        self,
+        request: AsyncIterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest],
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> AsyncIterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse]:
+        return self.execute_bidi_stream(
+            request=request,
+            method=MethodInfo(
+                name="WaitForMachineEvent",
+                service_name="metalstack.infra.v2.BMCService",
+                input=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest,
+                output=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
 
 class BMCServiceSync(Protocol):
     def update_b_m_c_info(self, request: metalstack_dot_infra_dot_v2_dot_bmc__pb2.UpdateBMCInfoRequest, ctx: RequestContext) -> metalstack_dot_infra_dot_v2_dot_bmc__pb2.UpdateBMCInfoResponse:
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def wait_for_machine_event(self, request: Iterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest], ctx: RequestContext) -> Iterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse]:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
 
 
 class BMCServiceWSGIApplication(ConnectWSGIApplication):
@@ -86,6 +121,16 @@ def __init__(self, service: BMCServiceSync, interceptors: Iterable[InterceptorSy
                     ),
                     function=service.update_b_m_c_info,
                 ),
+                "/metalstack.infra.v2.BMCService/WaitForMachineEvent": EndpointSync.bidi_stream(
+                    method=MethodInfo(
+                        name="WaitForMachineEvent",
+                        service_name="metalstack.infra.v2.BMCService",
+                        input=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest,
+                        output=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.wait_for_machine_event,
+                ),
             },
             interceptors=interceptors,
             read_max_bytes=read_max_bytes,
@@ -117,3 +162,23 @@ def update_b_m_c_info(
             headers=headers,
             timeout_ms=timeout_ms,
         )
+
+    def wait_for_machine_event(
+        self,
+        request: Iterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest],
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> Iterator[metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse]:
+        return self.execute_bidi_stream(
+            request=request,
+            method=MethodInfo(
+                name="WaitForMachineEvent",
+                service_name="metalstack.infra.v2.BMCService",
+                input=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventRequest,
+                output=metalstack_dot_infra_dot_v2_dot_bmc__pb2.WaitForMachineEventResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
diff --git a/python/metalstack/infra/v2/bmc_pb2.py b/python/metalstack/infra/v2/bmc_pb2.py
index 6a849b24..882e9688 100644
--- a/python/metalstack/infra/v2/bmc_pb2.py
+++ b/python/metalstack/infra/v2/bmc_pb2.py
@@ -22,10 +22,13 @@
 _sym_db = _symbol_database.Default()
 
 
+from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
+from metalstack.api.v2 import machine_pb2 as metalstack_dot_api_dot_v2_dot_machine__pb2
+from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/infra/v2/bmc.proto\x12\x13metalstack.infra.v2\x1a\x1emetalstack/api/v2/common.proto\"\x16\n\x14UpdateBMCInfoRequest\"\x17\n\x15UpdateBMCInfoResponse2\x7f\n\nBMCService\x12q\n\rUpdateBMCInfo\x12).metalstack.infra.v2.UpdateBMCInfoRequest\x1a*.metalstack.infra.v2.UpdateBMCInfoResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x42\xcc\x01\n\x17\x63om.metalstack.infra.v2B\x08\x42mcProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/infra/v2/bmc.proto\x12\x13metalstack.infra.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x16\n\x14UpdateBMCInfoRequest\"\x17\n\x15UpdateBMCInfoResponse\"G\n\x1aWaitForMachineEventRequest\x12)\n\tpartition\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xd0\xb3\xae\xb1\x02\x01R\tpartition\"\xa7\x01\n\x1bWaitForMachineEventResponse\x12\x45\n\x0b\x62mc_command\x18\x01 \x01(\x0e\x32$.metalstack.api.v2.MachineBMCCommandR\nbmcCommand\x12\x41\n\x0cmachine_ipmi\x18\x02 \x01(\x0b\x32\x1e.metalstack.api.v2.MachineIPMIR\x0bmachineIpmi2\x89\x02\n\nBMCService\x12q\n\rUpdateBMCInfo\x12).metalstack.infra.v2.UpdateBMCInfoRequest\x1a*.metalstack.infra.v2.UpdateBMCInfoResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x12\x87\x01\n\x13WaitForMachineEvent\x12/.metalstack.infra.v2.WaitForMachineEventRequest\x1a\x30.metalstack.infra.v2.WaitForMachineEventResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01(\x01\x30\x01\x42\xcc\x01\n\x17\x63om.metalstack.infra.v2B\x08\x42mcProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -33,12 +36,20 @@
 if not _descriptor._USE_C_DESCRIPTORS:
   _globals['DESCRIPTOR']._loaded_options = None
   _globals['DESCRIPTOR']._serialized_options = b'\n\027com.metalstack.infra.v2B\010BmcProtoP\001Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\242\002\003MIX\252\002\023Metalstack.Infra.V2\312\002\023Metalstack\\Infra\\V2\342\002\037Metalstack\\Infra\\V2\\GPBMetadata\352\002\025Metalstack::Infra::V2'
+  _globals['_WAITFORMACHINEEVENTREQUEST'].fields_by_name['partition']._loaded_options = None
+  _globals['_WAITFORMACHINEEVENTREQUEST'].fields_by_name['partition']._serialized_options = b'\272H\010r\006\320\263\256\261\002\001'
   _globals['_BMCSERVICE'].methods_by_name['UpdateBMCInfo']._loaded_options = None
   _globals['_BMCSERVICE'].methods_by_name['UpdateBMCInfo']._serialized_options = b'\340\363\030\002\352\363\030\001\001'
-  _globals['_UPDATEBMCINFOREQUEST']._serialized_start=86
-  _globals['_UPDATEBMCINFOREQUEST']._serialized_end=108
-  _globals['_UPDATEBMCINFORESPONSE']._serialized_start=110
-  _globals['_UPDATEBMCINFORESPONSE']._serialized_end=133
-  _globals['_BMCSERVICE']._serialized_start=135
-  _globals['_BMCSERVICE']._serialized_end=262
+  _globals['_BMCSERVICE'].methods_by_name['WaitForMachineEvent']._loaded_options = None
+  _globals['_BMCSERVICE'].methods_by_name['WaitForMachineEvent']._serialized_options = b'\340\363\030\002\352\363\030\001\001'
+  _globals['_UPDATEBMCINFOREQUEST']._serialized_start=190
+  _globals['_UPDATEBMCINFOREQUEST']._serialized_end=212
+  _globals['_UPDATEBMCINFORESPONSE']._serialized_start=214
+  _globals['_UPDATEBMCINFORESPONSE']._serialized_end=237
+  _globals['_WAITFORMACHINEEVENTREQUEST']._serialized_start=239
+  _globals['_WAITFORMACHINEEVENTREQUEST']._serialized_end=310
+  _globals['_WAITFORMACHINEEVENTRESPONSE']._serialized_start=313
+  _globals['_WAITFORMACHINEEVENTRESPONSE']._serialized_end=480
+  _globals['_BMCSERVICE']._serialized_start=483
+  _globals['_BMCSERVICE']._serialized_end=748
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/infra/v2/bmc_pb2.pyi b/python/metalstack/infra/v2/bmc_pb2.pyi
index fa266305..7cc09070 100644
--- a/python/metalstack/infra/v2/bmc_pb2.pyi
+++ b/python/metalstack/infra/v2/bmc_pb2.pyi
@@ -1,7 +1,11 @@
+from buf.validate import validate_pb2 as _validate_pb2
 from metalstack.api.v2 import common_pb2 as _common_pb2
+from metalstack.api.v2 import machine_pb2 as _machine_pb2
+from metalstack.api.v2 import predefined_rules_pb2 as _predefined_rules_pb2
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import message as _message
-from typing import ClassVar as _ClassVar
+from collections.abc import Mapping as _Mapping
+from typing import ClassVar as _ClassVar, Optional as _Optional, Union as _Union
 
 DESCRIPTOR: _descriptor.FileDescriptor
 
@@ -12,3 +16,17 @@ class UpdateBMCInfoRequest(_message.Message):
 class UpdateBMCInfoResponse(_message.Message):
     __slots__ = ()
     def __init__(self) -> None: ...
+
+class WaitForMachineEventRequest(_message.Message):
+    __slots__ = ("partition",)
+    PARTITION_FIELD_NUMBER: _ClassVar[int]
+    partition: str
+    def __init__(self, partition: _Optional[str] = ...) -> None: ...
+
+class WaitForMachineEventResponse(_message.Message):
+    __slots__ = ("bmc_command", "machine_ipmi")
+    BMC_COMMAND_FIELD_NUMBER: _ClassVar[int]
+    MACHINE_IPMI_FIELD_NUMBER: _ClassVar[int]
+    bmc_command: _machine_pb2.MachineBMCCommand
+    machine_ipmi: _machine_pb2.MachineIPMI
+    def __init__(self, bmc_command: _Optional[_Union[_machine_pb2.MachineBMCCommand, str]] = ..., machine_ipmi: _Optional[_Union[_machine_pb2.MachineIPMI, _Mapping]] = ...) -> None: ...