From 4d250ca8f0b2be4726953a972622f38d809d5f17 Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Thu, 9 Apr 2026 10:02:12 +0200
Subject: [PATCH] Map validations

---
 doc/index.html                                | 354 ++++++++++--------
 go.mod                                        |  10 +-
 go.sum                                        |  20 +-
 go/metalstack/api/v2/common.pb.go             |   9 +-
 go/metalstack/api/v2/predefined_rules.pb.go   |  49 ++-
 go/metalstack/api/v2/token.pb.go              |  16 +-
 go/tests/validation/labels_test.go            |  53 +++
 go/tests/validation/token_test.go             |  16 +
 js/metalstack/api/v2/common_pb.js             |   3 +-
 js/metalstack/api/v2/common_pb.ts             |   3 +-
 js/metalstack/api/v2/predefined_rules_pb.d.ts |  14 +-
 js/metalstack/api/v2/predefined_rules_pb.js   |  14 +-
 js/metalstack/api/v2/predefined_rules_pb.ts   |  20 +-
 js/metalstack/api/v2/token_pb.js              |   2 +-
 js/metalstack/api/v2/token_pb.ts              |   2 +-
 proto/metalstack/api/v2/common.proto          |  28 +-
 .../metalstack/api/v2/predefined_rules.proto  |  15 +
 proto/metalstack/api/v2/token.proto           |  84 +++--
 python/metalstack/api/v2/common_pb2.py        |  61 +--
 python/metalstack/api/v2/common_pb2.pyi       |   1 +
 .../metalstack/api/v2/predefined_rules_pb2.py |   6 +-
 .../api/v2/predefined_rules_pb2.pyi           |   4 +
 python/metalstack/api/v2/token_pb2.py         |  68 ++--
 23 files changed, 533 insertions(+), 319 deletions(-)
 create mode 100644 go/tests/validation/labels_test.go

diff --git a/doc/index.html b/doc/index.html
index c24b8419..338fa340 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -175,156 +175,164 @@ <h2>Table of Contents</h2>
         
           
           <li>
-            <a href="#metalstack%2fapi%2fv2%2fcommon.proto">metalstack/api/v2/common.proto</a>
+            <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto">metalstack/api/v2/predefined_rules.proto</a>
             <ul>
               
+              
+              
                 <li>
-                  <a href="#metalstack.api.v2.Labels"><span class="badge">M</span>Labels</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.Labels.LabelsEntry"><span class="badge">M</span>Labels.LabelsEntry</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.Meta"><span class="badge">M</span>Meta</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.Paging"><span class="badge">M</span>Paging</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.UpdateLabels"><span class="badge">M</span>UpdateLabels</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.UpdateMeta"><span class="badge">M</span>UpdateMeta</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
-              
                 <li>
-                  <a href="#metalstack.api.v2.AdminRole"><span class="badge">E</span>AdminRole</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.Auditing"><span class="badge">E</span>Auditing</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.InfraRole"><span class="badge">E</span>InfraRole</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.MachineRole"><span class="badge">E</span>MachineRole</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.OptimisticLockingStrategy"><span class="badge">E</span>OptimisticLockingStrategy</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.ProjectRole"><span class="badge">E</span>ProjectRole</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.TenantRole"><span class="badge">E</span>TenantRole</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack.api.v2.Visibility"><span class="badge">E</span>Visibility</a>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
               
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#metalstack%2fapi%2fv2%2fcommon.proto">metalstack/api/v2/common.proto</a>
+            <ul>
+              
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.Labels"><span class="badge">M</span>Labels</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.Labels.LabelsEntry"><span class="badge">M</span>Labels.LabelsEntry</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.Meta"><span class="badge">M</span>Meta</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.Paging"><span class="badge">M</span>Paging</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.UpdateLabels"><span class="badge">M</span>UpdateLabels</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.UpdateMeta"><span class="badge">M</span>UpdateMeta</a>
                 </li>
               
+              
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.AdminRole"><span class="badge">E</span>AdminRole</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.Auditing"><span class="badge">E</span>Auditing</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.InfraRole"><span class="badge">E</span>InfraRole</a>
+                </li>
               
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto">metalstack/api/v2/predefined_rules.proto</a>
-            <ul>
-              
-              
+                <li>
+                  <a href="#metalstack.api.v2.MachineRole"><span class="badge">E</span>MachineRole</a>
+                </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.OptimisticLockingStrategy"><span class="badge">E</span>OptimisticLockingStrategy</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.ProjectRole"><span class="badge">E</span>ProjectRole</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.TenantRole"><span class="badge">E</span>TenantRole</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack.api.v2.Visibility"><span class="badge">E</span>Visibility</a>
                 </li>
               
+              
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#metalstack%2fapi%2fv2%2fcommon.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
               
@@ -2699,6 +2707,142 @@ <h2>Table of Contents</h2>
 
     
       
+      <div class="file-heading">
+        <h2 id="metalstack/api/v2/predefined_rules.proto">metalstack/api/v2/predefined_rules.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+
+      
+
+      
+        <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensions</h3>
+        <table class="extension-table">
+          <thead>
+            <tr><td>Extension</td><td>Type</td><td>Base</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>keys_and_values_trimmed</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.MapRules">.buf.validate.MapRules</a></td>
+                <td>80068951</td>
+                <td><p>Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end</p></td>
+              </tr>
+            
+              <tr>
+                <td>keys_trimmed</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.MapRules">.buf.validate.MapRules</a></td>
+                <td>80068952</td>
+                <td><p>Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end</p></td>
+              </tr>
+            
+              <tr>
+                <td>all_trimmed</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
+                <td>80058954</td>
+                <td><p>All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end</p></td>
+              </tr>
+            
+              <tr>
+                <td>are_host_and_port</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
+                <td>80058953</td>
+                <td><p>AreHostAndPort validates if a slice of strings are all in the form of &lt;ip | host&gt;:&lt;port&gt;</p></td>
+              </tr>
+            
+              <tr>
+                <td>ips</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
+                <td>80058952</td>
+                <td><p>Ips validates if a slice of ips in string form are valid</p></td>
+              </tr>
+            
+              <tr>
+                <td>prefixes</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
+                <td>80058951</td>
+                <td><p>Prefixes validates if a slice of prefixes in string form are valid</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_description</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048953</td>
+                <td><p>IsDescription returns true if description field satisfies our requirements</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_ip_or_hostname</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048957</td>
+                <td><p>IsIpOrHostname validates that the given string is either a ip or a hostname</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_name</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048952</td>
+                <td><p>IsName returns true if name field satisfies our requirements</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_partition</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048954</td>
+                <td><p>IsPartition returns true if partition field satisfies our requirements</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_prefix</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048955</td>
+                <td><p>IsPrefix validates if the given string is a valid prefix</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_uri</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048956</td>
+                <td><p>IsUri validates if the given string is a valid URI</p></td>
+              </tr>
+            
+              <tr>
+                <td>macaddress</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048951</td>
+                <td><p>Macaddress returns true if the given string is a valid macadress</p></td>
+              </tr>
+            
+              <tr>
+                <td>trimmed</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048958</td>
+                <td><p>Trimmed enforces the string to be trimmed, e.g. no whitespaces at the begin and end</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+    
+      
       <div class="file-heading">
         <h2 id="metalstack/api/v2/common.proto">metalstack/api/v2/common.proto</h2><a href="#title">Top</a>
       </div>
@@ -3236,126 +3380,6 @@ <h3 id="metalstack/api/v2/common.proto-extensions">File-level Extensions</h3>
       
     
       
-      <div class="file-heading">
-        <h2 id="metalstack/api/v2/predefined_rules.proto">metalstack/api/v2/predefined_rules.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
-
-      
-
-      
-
-      
-        <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensions</h3>
-        <table class="extension-table">
-          <thead>
-            <tr><td>Extension</td><td>Type</td><td>Base</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>all_trimmed</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
-                <td>80058954</td>
-                <td><p>All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end</p></td>
-              </tr>
-            
-              <tr>
-                <td>are_host_and_port</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
-                <td>80058953</td>
-                <td><p>AreHostAndPort validates if a slice of strings are all in the form of &lt;ip | host&gt;:&lt;port&gt;</p></td>
-              </tr>
-            
-              <tr>
-                <td>ips</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
-                <td>80058952</td>
-                <td><p>Ips validates if a slice of ips in string form are valid</p></td>
-              </tr>
-            
-              <tr>
-                <td>prefixes</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.RepeatedRules">.buf.validate.RepeatedRules</a></td>
-                <td>80058951</td>
-                <td><p>Prefixes validates if a slice of prefixes in string form are valid</p></td>
-              </tr>
-            
-              <tr>
-                <td>is_description</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048953</td>
-                <td><p>IsDescription returns true if description field satisfies our requirements</p></td>
-              </tr>
-            
-              <tr>
-                <td>is_ip_or_hostname</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048957</td>
-                <td><p>IsIpOrHostname validates that the given string is either a ip or a hostname</p></td>
-              </tr>
-            
-              <tr>
-                <td>is_name</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048952</td>
-                <td><p>IsName returns true if name field satisfies our requirements</p></td>
-              </tr>
-            
-              <tr>
-                <td>is_partition</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048954</td>
-                <td><p>IsPartition returns true if partition field satisfies our requirements</p></td>
-              </tr>
-            
-              <tr>
-                <td>is_prefix</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048955</td>
-                <td><p>IsPrefix validates if the given string is a valid prefix</p></td>
-              </tr>
-            
-              <tr>
-                <td>is_uri</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048956</td>
-                <td><p>IsUri validates if the given string is a valid URI</p></td>
-              </tr>
-            
-              <tr>
-                <td>macaddress</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048951</td>
-                <td><p>Macaddress returns true if the given string is a valid macadress</p></td>
-              </tr>
-            
-              <tr>
-                <td>trimmed</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048958</td>
-                <td><p>Trimmed enforces the string to be trimmed, e.g. no whitespaces at the begin and end</p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-
-      
-    
-      
       <div class="file-heading">
         <h2 id="metalstack/api/v2/audit.proto">metalstack/api/v2/audit.proto</h2><a href="#title">Top</a>
       </div>
diff --git a/go.mod b/go.mod
index 5fc34ea2..196ff52f 100644
--- a/go.mod
+++ b/go.mod
@@ -20,16 +20,16 @@ require (
 	cel.dev/expr v0.25.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/google/cel-go v0.27.0 // indirect
-	github.com/klauspost/compress v1.18.4 // indirect
+	github.com/google/cel-go v0.28.0 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/minio/minlz v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index d6b0c5c1..665d2569 100644
--- a/go.sum
+++ b/go.sum
@@ -19,14 +19,14 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/google/cel-go v0.27.0 h1:e7ih85+4qVrBuqQWTW4FKSqZYokVuc3HnhH5keboFTo=
-github.com/google/cel-go v0.27.0/go.mod h1:tTJ11FWqnhw5KKpnWpvW9CJC3Y9GK4EIS0WXnBbebzw=
+github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc=
+github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/connect-compress/v2 v2.1.1 h1:ycZNp4rWOZBodVE2Ls5AzK4aHkyK+GteEfzRZgKNs+c=
 github.com/klauspost/connect-compress/v2 v2.1.1/go.mod h1:9oilsPHJMzGKkjafSBk9J7iVo4mO+dw0G0KSdVpnlVE=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -53,12 +53,12 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
 golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 h1:aJmi6DVGGIStN9Mobk/tZOOQUBbj0BPjZjjnOdoZKts=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d h1:/aDRtSZJjyLQzm75d+a1wOJaqyKBMvIAfeQmoa3ORiI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:etfGUgejTiadZAUaEP14NP97xi1RGeawqkjDARA/UOs=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/go/metalstack/api/v2/common.pb.go b/go/metalstack/api/v2/common.pb.go
index 04201d1e..3f043254 100644
--- a/go/metalstack/api/v2/common.pb.go
+++ b/go/metalstack/api/v2/common.pb.go
@@ -864,14 +864,14 @@ var File_metalstack_api_v2_common_proto protoreflect.FileDescriptor
 
 const file_metalstack_api_v2_common_proto_rawDesc = "" +
 	"\n" +
-	"\x1emetalstack/api/v2/common.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"O\n" +
+	"\x1emetalstack/api/v2/common.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a(metalstack/api/v2/predefined_rules.proto\"O\n" +
 	"\x06Paging\x12\x17\n" +
 	"\x04page\x18\x01 \x01(\x04H\x00R\x04page\x88\x01\x01\x12\x19\n" +
 	"\x05count\x18\x02 \x01(\x04H\x01R\x05count\x88\x01\x01B\a\n" +
 	"\x05_pageB\b\n" +
-	"\x06_count\"\x9c\x01\n" +
-	"\x06Labels\x12W\n" +
-	"\x06labels\x18\x01 \x03(\v2%.metalstack.api.v2.Labels.LabelsEntryB\x18\xbaH\x15\x9a\x01\x12\"\ar\x05\x10\x01\x18\x80\x02*\ar\x05\x10\x00\x18\x80\x02R\x06labels\x1a9\n" +
+	"\x06_count\"\xa2\x01\n" +
+	"\x06Labels\x12]\n" +
+	"\x06labels\x18\x01 \x03(\v2%.metalstack.api.v2.Labels.LabelsEntryB\x1e\xbaH\x1b\x9a\x01\x18\xb8\x95\xb8\xb1\x02\x01\"\ar\x05\x10\x01\x18\x80\x02*\ar\x05\x10\x00\x18\x80\x02R\x06labels\x1a9\n" +
 	"\vLabelsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xdf\x01\n" +
@@ -1012,6 +1012,7 @@ func file_metalstack_api_v2_common_proto_init() {
 	if File_metalstack_api_v2_common_proto != nil {
 		return
 	}
+	file_metalstack_api_v2_predefined_rules_proto_init()
 	file_metalstack_api_v2_common_proto_msgTypes[0].OneofWrappers = []any{}
 	file_metalstack_api_v2_common_proto_msgTypes[2].OneofWrappers = []any{}
 	type x struct{}
diff --git a/go/metalstack/api/v2/predefined_rules.pb.go b/go/metalstack/api/v2/predefined_rules.pb.go
index 46770b2e..0f74480d 100644
--- a/go/metalstack/api/v2/predefined_rules.pb.go
+++ b/go/metalstack/api/v2/predefined_rules.pb.go
@@ -118,6 +118,22 @@ var file_metalstack_api_v2_predefined_rules_proto_extTypes = []protoimpl.Extensi
 		Tag:           "varint,80058954,opt,name=all_trimmed",
 		Filename:      "metalstack/api/v2/predefined_rules.proto",
 	},
+	{
+		ExtendedType:  (*validate.MapRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80068951,
+		Name:          "metalstack.api.v2.keys_and_values_trimmed",
+		Tag:           "varint,80068951,opt,name=keys_and_values_trimmed",
+		Filename:      "metalstack/api/v2/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.MapRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80068952,
+		Name:          "metalstack.api.v2.keys_trimmed",
+		Tag:           "varint,80068952,opt,name=keys_trimmed",
+		Filename:      "metalstack/api/v2/predefined_rules.proto",
+	},
 }
 
 // Extension fields to validate.StringRules.
@@ -176,6 +192,18 @@ var (
 	E_AllTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[11]
 )
 
+// Extension fields to validate.MapRules.
+var (
+	// Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+	//
+	// optional bool keys_and_values_trimmed = 80068951;
+	E_KeysAndValuesTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[12]
+	// Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+	//
+	// optional bool keys_trimmed = 80068952;
+	E_KeysTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[13]
+)
+
 var File_metalstack_api_v2_predefined_rules_proto protoreflect.FileDescriptor
 
 const file_metalstack_api_v2_predefined_rules_proto_rawDesc = "" +
@@ -220,12 +248,19 @@ const file_metalstack_api_v2_predefined_rules_proto_rawDesc = "" +
 	"\vall_trimmed\x12\x1b.buf.validate.RepeatedRules\x18ʴ\x96& \x01(\bBy\xc2Hv\n" +
 	"t\n" +
 	"\x14repeated.all_trimmed\x122given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\n" +
-	"allTrimmedB\xca\x01\n" +
+	"allTrimmed:\x84\x02\n" +
+	"\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18ׂ\x97& \x01(\bB\xb1\x01\xc2H\xad\x01\n" +
+	"\xaa\x01\n" +
+	"\x1bmap.keys_and_values_trimmed\x125keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n" +
+	"\fkeys_trimmed\x12\x16.buf.validate.MapRules\x18\u0602\x97& \x01(\bBm\xc2Hj\n" +
+	"h\n" +
+	"\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\vkeysTrimmedB\xca\x01\n" +
 	"\x15com.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2"
 
 var file_metalstack_api_v2_predefined_rules_proto_goTypes = []any{
 	(*validate.StringRules)(nil),   // 0: buf.validate.StringRules
 	(*validate.RepeatedRules)(nil), // 1: buf.validate.RepeatedRules
+	(*validate.MapRules)(nil),      // 2: buf.validate.MapRules
 }
 var file_metalstack_api_v2_predefined_rules_proto_depIdxs = []int32{
 	0,  // 0: metalstack.api.v2.macaddress:extendee -> buf.validate.StringRules
@@ -240,10 +275,12 @@ var file_metalstack_api_v2_predefined_rules_proto_depIdxs = []int32{
 	1,  // 9: metalstack.api.v2.ips:extendee -> buf.validate.RepeatedRules
 	1,  // 10: metalstack.api.v2.are_host_and_port:extendee -> buf.validate.RepeatedRules
 	1,  // 11: metalstack.api.v2.all_trimmed:extendee -> buf.validate.RepeatedRules
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	0,  // [0:12] is the sub-list for extension extendee
+	2,  // 12: metalstack.api.v2.keys_and_values_trimmed:extendee -> buf.validate.MapRules
+	2,  // 13: metalstack.api.v2.keys_trimmed:extendee -> buf.validate.MapRules
+	14, // [14:14] is the sub-list for method output_type
+	14, // [14:14] is the sub-list for method input_type
+	14, // [14:14] is the sub-list for extension type_name
+	0,  // [0:14] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
 }
 
@@ -259,7 +296,7 @@ func file_metalstack_api_v2_predefined_rules_proto_init() {
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_predefined_rules_proto_rawDesc), len(file_metalstack_api_v2_predefined_rules_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   0,
-			NumExtensions: 12,
+			NumExtensions: 14,
 			NumServices:   0,
 		},
 		GoTypes:           file_metalstack_api_v2_predefined_rules_proto_goTypes,
diff --git a/go/metalstack/api/v2/token.pb.go b/go/metalstack/api/v2/token.pb.go
index b731bc02..084cfd9a 100644
--- a/go/metalstack/api/v2/token.pb.go
+++ b/go/metalstack/api/v2/token.pb.go
@@ -1038,14 +1038,14 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n" +
 	"\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n" +
 	"\v_admin_roleB\r\n" +
-	"\v_infra_role\"\xa7\n" +
+	"\v_infra_role\"\xb3\n" +
 	"\n" +
 	"\x19TokenServiceCreateRequest\x12-\n" +
 	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12O\n" +
 	"\vpermissions\x18\x02 \x03(\v2#.metalstack.api.v2.MethodPermissionB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
-	"\aexpires\x18\x03 \x01(\v2\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\f\x1a\x05\b\x81\xe7\x84\x0f2\x03\b\xd8\x04R\aexpires\x12y\n" +
-	"\rproject_roles\x18\x04 \x03(\v2>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12x\n" +
-	"\ftenant_roles\x18\x05 \x03(\v2=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\ar\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12J\n" +
+	"\aexpires\x18\x03 \x01(\v2\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\f\x1a\x05\b\x81\xe7\x84\x0f2\x03\b\xd8\x04R\aexpires\x12\x7f\n" +
+	"\rproject_roles\x18\x04 \x03(\v2>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\xc0\x95\xb8\xb1\x02\x01\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12~\n" +
+	"\ftenant_roles\x18\x05 \x03(\v2=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\xc0\x95\xb8\xb1\x02\x01\"\ar\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12J\n" +
 	"\n" +
 	"admin_role\x18\x06 \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
@@ -1075,16 +1075,16 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"9\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n" +
-	"\x1aTokenServiceRevokeResponse\"\xd5\n" +
+	"\x1aTokenServiceRevokeResponse\"\xe1\n" +
 	"\n" +
 	"\x19TokenServiceUpdateRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12F\n" +
 	"\vupdate_meta\x18\x02 \x01(\v2\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\n" +
 	"updateMeta\x122\n" +
 	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\vdescription\x88\x01\x01\x12E\n" +
-	"\vpermissions\x18\x04 \x03(\v2#.metalstack.api.v2.MethodPermissionR\vpermissions\x12y\n" +
-	"\rproject_roles\x18\x05 \x03(\v2>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12x\n" +
-	"\ftenant_roles\x18\x06 \x03(\v2=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\ar\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12J\n" +
+	"\vpermissions\x18\x04 \x03(\v2#.metalstack.api.v2.MethodPermissionR\vpermissions\x12\x7f\n" +
+	"\rproject_roles\x18\x05 \x03(\v2>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\xc0\x95\xb8\xb1\x02\x01\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12~\n" +
+	"\ftenant_roles\x18\x06 \x03(\v2=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\xc0\x95\xb8\xb1\x02\x01\"\ar\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12J\n" +
 	"\n" +
 	"admin_role\x18\a \x01(\x0e2\x1c.metalstack.api.v2.AdminRoleB\b\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n" +
 	"\n" +
diff --git a/go/tests/validation/labels_test.go b/go/tests/validation/labels_test.go
new file mode 100644
index 00000000..26e01518
--- /dev/null
+++ b/go/tests/validation/labels_test.go
@@ -0,0 +1,53 @@
+package validation
+
+import (
+	"testing"
+
+	apiv2 "github.com/metal-stack/api/go/metalstack/api/v2"
+)
+
+func TestValidateLabels(t *testing.T) {
+	tests := prototests{
+		{
+			name: "Valid Labels minimal possible",
+			msg: &apiv2.Labels{
+				Labels: map[string]string{
+					"k": "",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "Valid Labels keys are trimmed",
+			msg: &apiv2.Labels{
+				Labels: map[string]string{
+					"k ": "",
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: labels: keys and values must not start or end with whitespace",
+		},
+		{
+			name: "Valid Labels keys are trimmed",
+			msg: &apiv2.Labels{
+				Labels: map[string]string{
+					"k ": " asdf",
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: labels: keys and values must not start or end with whitespace",
+		},
+		{
+			name: "Valid Labels keys are trimmed",
+			msg: &apiv2.Labels{
+				Labels: map[string]string{
+					"k ":    " asdf",
+					"color": "blue",
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: labels: keys and values must not start or end with whitespace",
+		},
+	}
+	validateProtos(t, tests)
+}
diff --git a/go/tests/validation/token_test.go b/go/tests/validation/token_test.go
index 5c0add50..ad29b048 100644
--- a/go/tests/validation/token_test.go
+++ b/go/tests/validation/token_test.go
@@ -118,6 +118,22 @@ func TestValidateToken(t *testing.T) {
 			wantErr:          true,
 			wantErrorMessage: "validation error: machine_roles: map keys must be empty string, '*', or a valid UUID",
 		},
+		{
+			name: "InValid Token Create Request, token role not trimmed",
+			msg: &apiv2.TokenServiceCreateRequest{
+				Description: "A Token",
+				ProjectRoles: map[string]apiv2.ProjectRole{
+					"00000000-0000-0000-0000-000000000000": apiv2.ProjectRole_PROJECT_ROLE_EDITOR,
+					"00000000-0000-0000-0000-000000000001": apiv2.ProjectRole_PROJECT_ROLE_VIEWER,
+					"00000000-0000-0000-0000-000000000002": apiv2.ProjectRole_PROJECT_ROLE_OWNER,
+				},
+				TenantRoles: map[string]apiv2.TenantRole{
+					" t12": apiv2.TenantRole_TENANT_ROLE_EDITOR,
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: tenant_roles: keys must not start or end with whitespace",
+		},
 	}
 
 	validateProtos(t, tests)
diff --git a/js/metalstack/api/v2/common_pb.js b/js/metalstack/api/v2/common_pb.js
index 798cfcf0..89fa4c24 100644
--- a/js/metalstack/api/v2/common_pb.js
+++ b/js/metalstack/api/v2/common_pb.js
@@ -4,10 +4,11 @@
 import { enumDesc, extDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 import { file_google_protobuf_descriptor, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
 /**
  * Describes the file metalstack/api/v2/common.proto.
  */
-export const file_metalstack_api_v2_common = /*@__PURE__*/ fileDesc("Ch5tZXRhbHN0YWNrL2FwaS92Mi9jb21tb24ucHJvdG8SEW1ldGFsc3RhY2suYXBpLnYyIkIKBlBhZ2luZxIRCgRwYWdlGAEgASgESACIAQESEgoFY291bnQYAiABKARIAYgBAUIHCgVfcGFnZUIICgZfY291bnQiiAEKBkxhYmVscxJPCgZsYWJlbHMYASADKAsyJS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMuTGFiZWxzRW50cnlCGLpIFZoBEiIHcgUQARiAAioHcgUQABiAAhotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIrUBCgRNZXRhEi4KBmxhYmVscxgBIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0gAiAEBEi4KCmNyZWF0ZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCmdlbmVyYXRpb24YBCABKARCCQoHX2xhYmVscyJJCgxVcGRhdGVMYWJlbHMSKQoGdXBkYXRlGAEgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzEg4KBnJlbW92ZRgCIAMoCSKOAQoKVXBkYXRlTWV0YRIuCgp1cGRhdGVkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJQChBsb2NraW5nX3N0cmF0ZWd5GAIgASgOMiwubWV0YWxzdGFjay5hcGkudjIuT3B0aW1pc3RpY0xvY2tpbmdTdHJhdGVneUIIukgFggECEAEqhwEKClRlbmFudFJvbGUSGwoXVEVOQU5UX1JPTEVfVU5TUEVDSUZJRUQQABIVChFURU5BTlRfUk9MRV9PV05FUhABEhYKElRFTkFOVF9ST0xFX0VESVRPUhACEhYKElRFTkFOVF9ST0xFX1ZJRVdFUhADEhUKEVRFTkFOVF9ST0xFX0dVRVNUEAQqdQoLUHJvamVjdFJvbGUSHAoYUFJPSkVDVF9ST0xFX1VOU1BFQ0lGSUVEEAASFgoSUFJPSkVDVF9ST0xFX09XTkVSEAESFwoTUFJPSkVDVF9ST0xFX0VESVRPUhACEhcKE1BST0pFQ1RfUk9MRV9WSUVXRVIQAypVCglBZG1pblJvbGUSGgoWQURNSU5fUk9MRV9VTlNQRUNJRklFRBAAEhUKEUFETUlOX1JPTEVfRURJVE9SEAESFQoRQURNSU5fUk9MRV9WSUVXRVIQAipVCglJbmZyYVJvbGUSGgoWSU5GUkFfUk9MRV9VTlNQRUNJRklFRBAAEhUKEUlORlJBX1JPTEVfRURJVE9SEAESFQoRSU5GUkFfUk9MRV9WSUVXRVIQAipdCgtNYWNoaW5lUm9sZRIcChhNQUNISU5FX1JPTEVfVU5TUEVDSUZJRUQQABIXChNNQUNISU5FX1JPTEVfRURJVE9SEAESFwoTTUFDSElORV9ST0xFX1ZJRVdFUhACKlQKClZpc2liaWxpdHkSGgoWVklTSUJJTElUWV9VTlNQRUNJRklFRBAAEhUKEVZJU0lCSUxJVFlfUFVCTElDEAESEwoPVklTSUJJTElUWV9TRUxGEAMqUgoIQXVkaXRpbmcSGAoUQVVESVRJTkdfVU5TUEVDSUZJRUQQABIVChFBVURJVElOR19JTkNMVURFRBABEhUKEUFVRElUSU5HX0VYQ0xVREVEEAIqmAEKGU9wdGltaXN0aWNMb2NraW5nU3RyYXRlZ3kSKwonT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX1VOU1BFQ0lGSUVEEAASJgoiT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX0NMSUVOVBABEiYKIk9QVElNSVNUSUNfTE9DS0lOR19TVFJBVEVHWV9TRVJWRVIQAjpiCgx0ZW5hbnRfcm9sZXMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi4jgMgAygOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZVILdGVuYW50Um9sZXM6ZQoNcHJvamVjdF9yb2xlcxIeLmdvb2dsZS5wcm90b2J1Zi5NZXRob2RPcHRpb25zGLmOAyADKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZVIMcHJvamVjdFJvbGVzOl8KC2FkbWluX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYuo4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZVIKYWRtaW5Sb2xlczpfCgp2aXNpYmlsaXR5Eh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYu44DIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlZpc2liaWxpdHlSCnZpc2liaWxpdHk6WQoIYXVkaXRpbmcSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi8jgMgASgOMhsubWV0YWxzdGFjay5hcGkudjIuQXVkaXRpbmdSCGF1ZGl0aW5nOl8KC2luZnJhX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvY4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZVIKaW5mcmFSb2xlczplCg1tYWNoaW5lX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvo4DIAMoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlUgxtYWNoaW5lUm9sZXM6TwoRZW51bV9zdHJpbmdfdmFsdWUSIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxiglgMgASgJUg9lbnVtU3RyaW5nVmFsdWVCwQEKFWNvbS5tZXRhbHN0YWNrLmFwaS52MkILQ29tbW9uUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_descriptor, file_google_protobuf_timestamp]);
+export const file_metalstack_api_v2_common = /*@__PURE__*/ fileDesc("Ch5tZXRhbHN0YWNrL2FwaS92Mi9jb21tb24ucHJvdG8SEW1ldGFsc3RhY2suYXBpLnYyIkIKBlBhZ2luZxIRCgRwYWdlGAEgASgESACIAQESEgoFY291bnQYAiABKARIAYgBAUIHCgVfcGFnZUIICgZfY291bnQijgEKBkxhYmVscxJVCgZsYWJlbHMYASADKAsyJS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMuTGFiZWxzRW50cnlCHrpIG5oBGLiVuLECASIHcgUQARiAAioHcgUQABiAAhotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIrUBCgRNZXRhEi4KBmxhYmVscxgBIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0gAiAEBEi4KCmNyZWF0ZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCmdlbmVyYXRpb24YBCABKARCCQoHX2xhYmVscyJJCgxVcGRhdGVMYWJlbHMSKQoGdXBkYXRlGAEgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzEg4KBnJlbW92ZRgCIAMoCSKOAQoKVXBkYXRlTWV0YRIuCgp1cGRhdGVkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJQChBsb2NraW5nX3N0cmF0ZWd5GAIgASgOMiwubWV0YWxzdGFjay5hcGkudjIuT3B0aW1pc3RpY0xvY2tpbmdTdHJhdGVneUIIukgFggECEAEqhwEKClRlbmFudFJvbGUSGwoXVEVOQU5UX1JPTEVfVU5TUEVDSUZJRUQQABIVChFURU5BTlRfUk9MRV9PV05FUhABEhYKElRFTkFOVF9ST0xFX0VESVRPUhACEhYKElRFTkFOVF9ST0xFX1ZJRVdFUhADEhUKEVRFTkFOVF9ST0xFX0dVRVNUEAQqdQoLUHJvamVjdFJvbGUSHAoYUFJPSkVDVF9ST0xFX1VOU1BFQ0lGSUVEEAASFgoSUFJPSkVDVF9ST0xFX09XTkVSEAESFwoTUFJPSkVDVF9ST0xFX0VESVRPUhACEhcKE1BST0pFQ1RfUk9MRV9WSUVXRVIQAypVCglBZG1pblJvbGUSGgoWQURNSU5fUk9MRV9VTlNQRUNJRklFRBAAEhUKEUFETUlOX1JPTEVfRURJVE9SEAESFQoRQURNSU5fUk9MRV9WSUVXRVIQAipVCglJbmZyYVJvbGUSGgoWSU5GUkFfUk9MRV9VTlNQRUNJRklFRBAAEhUKEUlORlJBX1JPTEVfRURJVE9SEAESFQoRSU5GUkFfUk9MRV9WSUVXRVIQAipdCgtNYWNoaW5lUm9sZRIcChhNQUNISU5FX1JPTEVfVU5TUEVDSUZJRUQQABIXChNNQUNISU5FX1JPTEVfRURJVE9SEAESFwoTTUFDSElORV9ST0xFX1ZJRVdFUhACKlQKClZpc2liaWxpdHkSGgoWVklTSUJJTElUWV9VTlNQRUNJRklFRBAAEhUKEVZJU0lCSUxJVFlfUFVCTElDEAESEwoPVklTSUJJTElUWV9TRUxGEAMqUgoIQXVkaXRpbmcSGAoUQVVESVRJTkdfVU5TUEVDSUZJRUQQABIVChFBVURJVElOR19JTkNMVURFRBABEhUKEUFVRElUSU5HX0VYQ0xVREVEEAIqmAEKGU9wdGltaXN0aWNMb2NraW5nU3RyYXRlZ3kSKwonT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX1VOU1BFQ0lGSUVEEAASJgoiT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX0NMSUVOVBABEiYKIk9QVElNSVNUSUNfTE9DS0lOR19TVFJBVEVHWV9TRVJWRVIQAjpiCgx0ZW5hbnRfcm9sZXMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi4jgMgAygOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZVILdGVuYW50Um9sZXM6ZQoNcHJvamVjdF9yb2xlcxIeLmdvb2dsZS5wcm90b2J1Zi5NZXRob2RPcHRpb25zGLmOAyADKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZVIMcHJvamVjdFJvbGVzOl8KC2FkbWluX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYuo4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZVIKYWRtaW5Sb2xlczpfCgp2aXNpYmlsaXR5Eh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYu44DIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlZpc2liaWxpdHlSCnZpc2liaWxpdHk6WQoIYXVkaXRpbmcSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi8jgMgASgOMhsubWV0YWxzdGFjay5hcGkudjIuQXVkaXRpbmdSCGF1ZGl0aW5nOl8KC2luZnJhX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvY4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZVIKaW5mcmFSb2xlczplCg1tYWNoaW5lX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvo4DIAMoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlUgxtYWNoaW5lUm9sZXM6TwoRZW51bV9zdHJpbmdfdmFsdWUSIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxiglgMgASgJUg9lbnVtU3RyaW5nVmFsdWVCwQEKFWNvbS5tZXRhbHN0YWNrLmFwaS52MkILQ29tbW9uUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_descriptor, file_google_protobuf_timestamp, file_metalstack_api_v2_predefined_rules]);
 /**
  * Describes the message metalstack.api.v2.Paging.
  * Use `create(PagingSchema)` to create a new message.
diff --git a/js/metalstack/api/v2/common_pb.ts b/js/metalstack/api/v2/common_pb.ts
index 0fa12301..66a7fca5 100644
--- a/js/metalstack/api/v2/common_pb.ts
+++ b/js/metalstack/api/v2/common_pb.ts
@@ -7,13 +7,14 @@ import { enumDesc, extDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/cod
 import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 import type { EnumValueOptions, MethodOptions, Timestamp } from "@bufbuild/protobuf/wkt";
 import { file_google_protobuf_descriptor, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
 import type { Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file metalstack/api/v2/common.proto.
  */
 export const file_metalstack_api_v2_common: GenFile = /*@__PURE__*/
-  fileDesc("Ch5tZXRhbHN0YWNrL2FwaS92Mi9jb21tb24ucHJvdG8SEW1ldGFsc3RhY2suYXBpLnYyIkIKBlBhZ2luZxIRCgRwYWdlGAEgASgESACIAQESEgoFY291bnQYAiABKARIAYgBAUIHCgVfcGFnZUIICgZfY291bnQiiAEKBkxhYmVscxJPCgZsYWJlbHMYASADKAsyJS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMuTGFiZWxzRW50cnlCGLpIFZoBEiIHcgUQARiAAioHcgUQABiAAhotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIrUBCgRNZXRhEi4KBmxhYmVscxgBIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0gAiAEBEi4KCmNyZWF0ZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCmdlbmVyYXRpb24YBCABKARCCQoHX2xhYmVscyJJCgxVcGRhdGVMYWJlbHMSKQoGdXBkYXRlGAEgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzEg4KBnJlbW92ZRgCIAMoCSKOAQoKVXBkYXRlTWV0YRIuCgp1cGRhdGVkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJQChBsb2NraW5nX3N0cmF0ZWd5GAIgASgOMiwubWV0YWxzdGFjay5hcGkudjIuT3B0aW1pc3RpY0xvY2tpbmdTdHJhdGVneUIIukgFggECEAEqhwEKClRlbmFudFJvbGUSGwoXVEVOQU5UX1JPTEVfVU5TUEVDSUZJRUQQABIVChFURU5BTlRfUk9MRV9PV05FUhABEhYKElRFTkFOVF9ST0xFX0VESVRPUhACEhYKElRFTkFOVF9ST0xFX1ZJRVdFUhADEhUKEVRFTkFOVF9ST0xFX0dVRVNUEAQqdQoLUHJvamVjdFJvbGUSHAoYUFJPSkVDVF9ST0xFX1VOU1BFQ0lGSUVEEAASFgoSUFJPSkVDVF9ST0xFX09XTkVSEAESFwoTUFJPSkVDVF9ST0xFX0VESVRPUhACEhcKE1BST0pFQ1RfUk9MRV9WSUVXRVIQAypVCglBZG1pblJvbGUSGgoWQURNSU5fUk9MRV9VTlNQRUNJRklFRBAAEhUKEUFETUlOX1JPTEVfRURJVE9SEAESFQoRQURNSU5fUk9MRV9WSUVXRVIQAipVCglJbmZyYVJvbGUSGgoWSU5GUkFfUk9MRV9VTlNQRUNJRklFRBAAEhUKEUlORlJBX1JPTEVfRURJVE9SEAESFQoRSU5GUkFfUk9MRV9WSUVXRVIQAipdCgtNYWNoaW5lUm9sZRIcChhNQUNISU5FX1JPTEVfVU5TUEVDSUZJRUQQABIXChNNQUNISU5FX1JPTEVfRURJVE9SEAESFwoTTUFDSElORV9ST0xFX1ZJRVdFUhACKlQKClZpc2liaWxpdHkSGgoWVklTSUJJTElUWV9VTlNQRUNJRklFRBAAEhUKEVZJU0lCSUxJVFlfUFVCTElDEAESEwoPVklTSUJJTElUWV9TRUxGEAMqUgoIQXVkaXRpbmcSGAoUQVVESVRJTkdfVU5TUEVDSUZJRUQQABIVChFBVURJVElOR19JTkNMVURFRBABEhUKEUFVRElUSU5HX0VYQ0xVREVEEAIqmAEKGU9wdGltaXN0aWNMb2NraW5nU3RyYXRlZ3kSKwonT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX1VOU1BFQ0lGSUVEEAASJgoiT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX0NMSUVOVBABEiYKIk9QVElNSVNUSUNfTE9DS0lOR19TVFJBVEVHWV9TRVJWRVIQAjpiCgx0ZW5hbnRfcm9sZXMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi4jgMgAygOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZVILdGVuYW50Um9sZXM6ZQoNcHJvamVjdF9yb2xlcxIeLmdvb2dsZS5wcm90b2J1Zi5NZXRob2RPcHRpb25zGLmOAyADKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZVIMcHJvamVjdFJvbGVzOl8KC2FkbWluX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYuo4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZVIKYWRtaW5Sb2xlczpfCgp2aXNpYmlsaXR5Eh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYu44DIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlZpc2liaWxpdHlSCnZpc2liaWxpdHk6WQoIYXVkaXRpbmcSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi8jgMgASgOMhsubWV0YWxzdGFjay5hcGkudjIuQXVkaXRpbmdSCGF1ZGl0aW5nOl8KC2luZnJhX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvY4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZVIKaW5mcmFSb2xlczplCg1tYWNoaW5lX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvo4DIAMoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlUgxtYWNoaW5lUm9sZXM6TwoRZW51bV9zdHJpbmdfdmFsdWUSIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxiglgMgASgJUg9lbnVtU3RyaW5nVmFsdWVCwQEKFWNvbS5tZXRhbHN0YWNrLmFwaS52MkILQ29tbW9uUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_descriptor, file_google_protobuf_timestamp]);
+  fileDesc("Ch5tZXRhbHN0YWNrL2FwaS92Mi9jb21tb24ucHJvdG8SEW1ldGFsc3RhY2suYXBpLnYyIkIKBlBhZ2luZxIRCgRwYWdlGAEgASgESACIAQESEgoFY291bnQYAiABKARIAYgBAUIHCgVfcGFnZUIICgZfY291bnQijgEKBkxhYmVscxJVCgZsYWJlbHMYASADKAsyJS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMuTGFiZWxzRW50cnlCHrpIG5oBGLiVuLECASIHcgUQARiAAioHcgUQABiAAhotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIrUBCgRNZXRhEi4KBmxhYmVscxgBIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0gAiAEBEi4KCmNyZWF0ZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCmdlbmVyYXRpb24YBCABKARCCQoHX2xhYmVscyJJCgxVcGRhdGVMYWJlbHMSKQoGdXBkYXRlGAEgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzEg4KBnJlbW92ZRgCIAMoCSKOAQoKVXBkYXRlTWV0YRIuCgp1cGRhdGVkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJQChBsb2NraW5nX3N0cmF0ZWd5GAIgASgOMiwubWV0YWxzdGFjay5hcGkudjIuT3B0aW1pc3RpY0xvY2tpbmdTdHJhdGVneUIIukgFggECEAEqhwEKClRlbmFudFJvbGUSGwoXVEVOQU5UX1JPTEVfVU5TUEVDSUZJRUQQABIVChFURU5BTlRfUk9MRV9PV05FUhABEhYKElRFTkFOVF9ST0xFX0VESVRPUhACEhYKElRFTkFOVF9ST0xFX1ZJRVdFUhADEhUKEVRFTkFOVF9ST0xFX0dVRVNUEAQqdQoLUHJvamVjdFJvbGUSHAoYUFJPSkVDVF9ST0xFX1VOU1BFQ0lGSUVEEAASFgoSUFJPSkVDVF9ST0xFX09XTkVSEAESFwoTUFJPSkVDVF9ST0xFX0VESVRPUhACEhcKE1BST0pFQ1RfUk9MRV9WSUVXRVIQAypVCglBZG1pblJvbGUSGgoWQURNSU5fUk9MRV9VTlNQRUNJRklFRBAAEhUKEUFETUlOX1JPTEVfRURJVE9SEAESFQoRQURNSU5fUk9MRV9WSUVXRVIQAipVCglJbmZyYVJvbGUSGgoWSU5GUkFfUk9MRV9VTlNQRUNJRklFRBAAEhUKEUlORlJBX1JPTEVfRURJVE9SEAESFQoRSU5GUkFfUk9MRV9WSUVXRVIQAipdCgtNYWNoaW5lUm9sZRIcChhNQUNISU5FX1JPTEVfVU5TUEVDSUZJRUQQABIXChNNQUNISU5FX1JPTEVfRURJVE9SEAESFwoTTUFDSElORV9ST0xFX1ZJRVdFUhACKlQKClZpc2liaWxpdHkSGgoWVklTSUJJTElUWV9VTlNQRUNJRklFRBAAEhUKEVZJU0lCSUxJVFlfUFVCTElDEAESEwoPVklTSUJJTElUWV9TRUxGEAMqUgoIQXVkaXRpbmcSGAoUQVVESVRJTkdfVU5TUEVDSUZJRUQQABIVChFBVURJVElOR19JTkNMVURFRBABEhUKEUFVRElUSU5HX0VYQ0xVREVEEAIqmAEKGU9wdGltaXN0aWNMb2NraW5nU3RyYXRlZ3kSKwonT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX1VOU1BFQ0lGSUVEEAASJgoiT1BUSU1JU1RJQ19MT0NLSU5HX1NUUkFURUdZX0NMSUVOVBABEiYKIk9QVElNSVNUSUNfTE9DS0lOR19TVFJBVEVHWV9TRVJWRVIQAjpiCgx0ZW5hbnRfcm9sZXMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi4jgMgAygOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZVILdGVuYW50Um9sZXM6ZQoNcHJvamVjdF9yb2xlcxIeLmdvb2dsZS5wcm90b2J1Zi5NZXRob2RPcHRpb25zGLmOAyADKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZVIMcHJvamVjdFJvbGVzOl8KC2FkbWluX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYuo4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZVIKYWRtaW5Sb2xlczpfCgp2aXNpYmlsaXR5Eh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYu44DIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlZpc2liaWxpdHlSCnZpc2liaWxpdHk6WQoIYXVkaXRpbmcSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxi8jgMgASgOMhsubWV0YWxzdGFjay5hcGkudjIuQXVkaXRpbmdSCGF1ZGl0aW5nOl8KC2luZnJhX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvY4DIAMoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZVIKaW5mcmFSb2xlczplCg1tYWNoaW5lX3JvbGVzEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYvo4DIAMoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlUgxtYWNoaW5lUm9sZXM6TwoRZW51bV9zdHJpbmdfdmFsdWUSIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxiglgMgASgJUg9lbnVtU3RyaW5nVmFsdWVCwQEKFWNvbS5tZXRhbHN0YWNrLmFwaS52MkILQ29tbW9uUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_descriptor, file_google_protobuf_timestamp, file_metalstack_api_v2_predefined_rules]);
 
 /**
  * Paging defines paging for methods with a lot of results
diff --git a/js/metalstack/api/v2/predefined_rules_pb.d.ts b/js/metalstack/api/v2/predefined_rules_pb.d.ts
index 46d31cda..c8927f34 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.d.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.d.ts
@@ -1,5 +1,5 @@
 import type { GenExtension, GenFile } from "@bufbuild/protobuf/codegenv2";
-import type { RepeatedRules, StringRules } from "../../../buf/validate/validate_pb";
+import type { MapRules, RepeatedRules, StringRules } from "../../../buf/validate/validate_pb";
 /**
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
@@ -76,3 +76,15 @@ export declare const are_host_and_port: GenExtension<RepeatedRules, boolean>;
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
 export declare const all_trimmed: GenExtension<RepeatedRules, boolean>;
+/**
+ * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+ *
+ * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
+ */
+export declare const keys_and_values_trimmed: GenExtension<MapRules, boolean>;
+/**
+ * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+ *
+ * @generated from extension: optional bool keys_trimmed = 80068952;
+ */
+export declare const keys_trimmed: GenExtension<MapRules, boolean>;
diff --git a/js/metalstack/api/v2/predefined_rules_pb.js b/js/metalstack/api/v2/predefined_rules_pb.js
index 14d087a3..e8f3bb6a 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.js
+++ b/js/metalstack/api/v2/predefined_rules_pb.js
@@ -6,7 +6,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 /**
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
-export const file_metalstack_api_v2_predefined_rules = /*@__PURE__*/ fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZELKAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQhRQcmVkZWZpbmVkUnVsZXNQcm90b1ABWjVnaXRodWIuY29tL21ldGFsLXN0YWNrL2FwaS9nby9tZXRhbHN0YWNrL2FwaS92MjthcGl2MqICA01BWKoCEU1ldGFsc3RhY2suQXBpLlYyygIRTWV0YWxzdGFja1xBcGlcVjLiAh1NZXRhbHN0YWNrXEFwaVxWMlxHUEJNZXRhZGF0YeoCE01ldGFsc3RhY2s6OkFwaTo6VjI", [file_buf_validate_validate]);
+export const file_metalstack_api_v2_predefined_rules = /*@__PURE__*/ fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
 /**
  * Macaddress returns true if the given string is a valid macadress
  *
@@ -79,3 +79,15 @@ export const are_host_and_port = /*@__PURE__*/ extDesc(file_metalstack_api_v2_pr
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
 export const all_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 11);
+/**
+ * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+ *
+ * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
+ */
+export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 12);
+/**
+ * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+ *
+ * @generated from extension: optional bool keys_trimmed = 80068952;
+ */
+export const keys_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 13);
diff --git a/js/metalstack/api/v2/predefined_rules_pb.ts b/js/metalstack/api/v2/predefined_rules_pb.ts
index 30c9655b..7feebb71 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.ts
@@ -4,14 +4,14 @@
 
 import type { GenExtension, GenFile } from "@bufbuild/protobuf/codegenv2";
 import { extDesc, fileDesc } from "@bufbuild/protobuf/codegenv2";
-import type { RepeatedRules, StringRules } from "../../../buf/validate/validate_pb";
+import type { MapRules, RepeatedRules, StringRules } from "../../../buf/validate/validate_pb";
 import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 
 /**
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
 export const file_metalstack_api_v2_predefined_rules: GenFile = /*@__PURE__*/
-  fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZELKAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQhRQcmVkZWZpbmVkUnVsZXNQcm90b1ABWjVnaXRodWIuY29tL21ldGFsLXN0YWNrL2FwaS9nby9tZXRhbHN0YWNrL2FwaS92MjthcGl2MqICA01BWKoCEU1ldGFsc3RhY2suQXBpLlYyygIRTWV0YWxzdGFja1xBcGlcVjLiAh1NZXRhbHN0YWNrXEFwaVxWMlxHUEJNZXRhZGF0YeoCE01ldGFsc3RhY2s6OkFwaTo6VjI", [file_buf_validate_validate]);
+  fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
 
 /**
  * Macaddress returns true if the given string is a valid macadress
@@ -109,3 +109,19 @@ export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE
 export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
   extDesc(file_metalstack_api_v2_predefined_rules, 11);
 
+/**
+ * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+ *
+ * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
+ */
+export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
+  extDesc(file_metalstack_api_v2_predefined_rules, 12);
+
+/**
+ * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+ *
+ * @generated from extension: optional bool keys_trimmed = 80068952;
+ */
+export const keys_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
+  extDesc(file_metalstack_api_v2_predefined_rules, 13);
+
diff --git a/js/metalstack/api/v2/token_pb.js b/js/metalstack/api/v2/token_pb.js
index 13a69174..4bef51b8 100644
--- a/js/metalstack/api/v2/token_pb.js
+++ b/js/metalstack/api/v2/token_pb.js
@@ -9,7 +9,7 @@ import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
 /**
  * Describes the file metalstack/api/v2/token.proto.
  */
-export const file_metalstack_api_v2_token = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5QgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSJQoEbWV0YRgDIAEoCzIXLm1ldGFsc3RhY2suYXBpLnYyLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAUgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASOgoKdG9rZW5fdHlwZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAESQQoNcHJvamVjdF9yb2xlcxgJIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlByb2plY3RSb2xlc0VudHJ5Ej8KDHRlbmFudF9yb2xlcxgKIAMoCzIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlRlbmFudFJvbGVzRW50cnkSPwoKYWRtaW5fcm9sZRgLIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAwgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEkEKDW1hY2hpbmVfcm9sZXMYDSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5NYWNoaW5lUm9sZXNFbnRyeRpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUimQkKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkIKC3Blcm1pc3Npb25zGAIgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEmsKDXByb2plY3Rfcm9sZXMYBCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5QhS6SBGaAQ4iBXIDsAEBKgWCAQIQARJrCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCFrpIE5oBECIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBErMCCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIlUKGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIr4JChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJrCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIUukgRmgEOIgVyA7ABASoFggECEAESawoMdGVuYW50X3JvbGVzGAYgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qha6SBOaARAiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYByABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSAGIAQESPwoKaW5mcmFfcm9sZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAogBARKzAgoNbWFjaGluZV9yb2xlcxgJIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESLwoGbGFiZWxzGAogASgLMh8ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiRQoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIkIKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiVgobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjKQBQoMVG9rZW5TZXJ2aWNlEmIKA0dldBIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlcXVlc3QaKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSIE2PMYAxJrCgZDcmVhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiBNjzGAMSawoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgTY8xgDEmUKBExpc3QSKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBorLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSIE2PMYAxJrCgZSZXZva2USLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiBNjzGAMSbgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgTY8xgDQsABChVjb20ubWV0YWxzdGFjay5hcGkudjJCClRva2VuUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+export const file_metalstack_api_v2_token = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5QgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSJQoEbWV0YRgDIAEoCzIXLm1ldGFsc3RhY2suYXBpLnYyLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAUgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASOgoKdG9rZW5fdHlwZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAESQQoNcHJvamVjdF9yb2xlcxgJIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlByb2plY3RSb2xlc0VudHJ5Ej8KDHRlbmFudF9yb2xlcxgKIAMoCzIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlRlbmFudFJvbGVzRW50cnkSPwoKYWRtaW5fcm9sZRgLIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAwgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEkEKDW1hY2hpbmVfcm9sZXMYDSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5NYWNoaW5lUm9sZXNFbnRyeRpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUipQkKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkIKC3Blcm1pc3Npb25zGAIgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEnEKDXByb2plY3Rfcm9sZXMYBCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJxCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBErMCCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIlUKGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIsoJChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJxCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIaukgXmgEUwJW4sQIBIgVyA7ABASoFggECEAEScQoMdGVuYW50X3JvbGVzGAYgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhy6SBmaARbAlbixAgEiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYByABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSAGIAQESPwoKaW5mcmFfcm9sZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAogBARKzAgoNbWFjaGluZV9yb2xlcxgJIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESLwoGbGFiZWxzGAogASgLMh8ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiRQoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIkIKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiVgobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjKQBQoMVG9rZW5TZXJ2aWNlEmIKA0dldBIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlcXVlc3QaKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSIE2PMYAxJrCgZDcmVhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiBNjzGAMSawoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgTY8xgDEmUKBExpc3QSKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBorLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSIE2PMYAxJrCgZSZXZva2USLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiBNjzGAMSbgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgTY8xgDQsABChVjb20ubWV0YWxzdGFjay5hcGkudjJCClRva2VuUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
 /**
  * Describes the message metalstack.api.v2.Token.
  * Use `create(TokenSchema)` to create a new message.
diff --git a/js/metalstack/api/v2/token_pb.ts b/js/metalstack/api/v2/token_pb.ts
index bf9b40a9..c262b6b7 100644
--- a/js/metalstack/api/v2/token_pb.ts
+++ b/js/metalstack/api/v2/token_pb.ts
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/api/v2/token.proto.
  */
 export const file_metalstack_api_v2_token: GenFile = /*@__PURE__*/
-  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5QgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSJQoEbWV0YRgDIAEoCzIXLm1ldGFsc3RhY2suYXBpLnYyLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAUgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASOgoKdG9rZW5fdHlwZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAESQQoNcHJvamVjdF9yb2xlcxgJIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlByb2plY3RSb2xlc0VudHJ5Ej8KDHRlbmFudF9yb2xlcxgKIAMoCzIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlRlbmFudFJvbGVzRW50cnkSPwoKYWRtaW5fcm9sZRgLIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAwgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEkEKDW1hY2hpbmVfcm9sZXMYDSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5NYWNoaW5lUm9sZXNFbnRyeRpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUimQkKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkIKC3Blcm1pc3Npb25zGAIgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEmsKDXByb2plY3Rfcm9sZXMYBCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5QhS6SBGaAQ4iBXIDsAEBKgWCAQIQARJrCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCFrpIE5oBECIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBErMCCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIlUKGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIr4JChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJrCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIUukgRmgEOIgVyA7ABASoFggECEAESawoMdGVuYW50X3JvbGVzGAYgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qha6SBOaARAiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYByABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSAGIAQESPwoKaW5mcmFfcm9sZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAogBARKzAgoNbWFjaGluZV9yb2xlcxgJIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESLwoGbGFiZWxzGAogASgLMh8ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiRQoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIkIKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiVgobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjKQBQoMVG9rZW5TZXJ2aWNlEmIKA0dldBIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlcXVlc3QaKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSIE2PMYAxJrCgZDcmVhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiBNjzGAMSawoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgTY8xgDEmUKBExpc3QSKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBorLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSIE2PMYAxJrCgZSZXZva2USLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiBNjzGAMSbgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgTY8xgDQsABChVjb20ubWV0YWxzdGFjay5hcGkudjJCClRva2VuUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIi5QgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSJQoEbWV0YRgDIAEoCzIXLm1ldGFsc3RhY2suYXBpLnYyLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAUgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASOgoKdG9rZW5fdHlwZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAESQQoNcHJvamVjdF9yb2xlcxgJIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlByb2plY3RSb2xlc0VudHJ5Ej8KDHRlbmFudF9yb2xlcxgKIAMoCzIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuLlRlbmFudFJvbGVzRW50cnkSPwoKYWRtaW5fcm9sZRgLIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAwgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEkEKDW1hY2hpbmVfcm9sZXMYDSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5NYWNoaW5lUm9sZXNFbnRyeRpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUipQkKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkIKC3Blcm1pc3Npb25zGAIgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbkIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEnEKDXByb2plY3Rfcm9sZXMYBCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJxCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBErMCCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeULbAbpI1wG6AckBChJtYWNoaW5lX3JvbGVzX2tleXMSM21hcCBrZXlzIG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBp+dGhpcy5hbGwoaywgayA9PSAnJyB8fCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpmgEHKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIlUKGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIsoJChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJxCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIaukgXmgEUwJW4sQIBIgVyA7ABASoFggECEAEScQoMdGVuYW50X3JvbGVzGAYgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhy6SBmaARbAlbixAgEiB3IFEAMYgAEqBYIBAhABEj8KCmFkbWluX3JvbGUYByABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSAGIAQESPwoKaW5mcmFfcm9sZRgIIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAogBARKzAgoNbWFjaGluZV9yb2xlcxgJIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuTWFjaGluZVJvbGVzRW50cnlC2wG6SNcBugHJAQoSbWFjaGluZV9yb2xlc19rZXlzEjNtYXAga2V5cyBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKZoBByoFggECEAESLwoGbGFiZWxzGAogASgLMh8ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTGFiZWxzGlMKEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RSb2xlOgI4ARpRChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLlRlbmFudFJvbGU6AjgBGlMKEU1hY2hpbmVSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiRQoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIkIKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiVgobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjKQBQoMVG9rZW5TZXJ2aWNlEmIKA0dldBIpLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUdldFJlcXVlc3QaKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSIE2PMYAxJrCgZDcmVhdGUSLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2UiBNjzGAMSawoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgTY8xgDEmUKBExpc3QSKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBorLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSIE2PMYAxJrCgZSZXZva2USLC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiBNjzGAMSbgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgTY8xgDQsABChVjb20ubWV0YWxzdGFjay5hcGkudjJCClRva2VuUHJvdG9QAVo1Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hcGkvdjI7YXBpdjKiAgNNQViqAhFNZXRhbHN0YWNrLkFwaS5WMsoCEU1ldGFsc3RhY2tcQXBpXFYy4gIdTWV0YWxzdGFja1xBcGlcVjJcR1BCTWV0YWRhdGHqAhNNZXRhbHN0YWNrOjpBcGk6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
 
 /**
  * Token generates a jwt authentication token to access the api
diff --git a/proto/metalstack/api/v2/common.proto b/proto/metalstack/api/v2/common.proto
index 6e560ffd..50374439 100644
--- a/proto/metalstack/api/v2/common.proto
+++ b/proto/metalstack/api/v2/common.proto
@@ -5,6 +5,7 @@ package metalstack.api.v2;
 import "buf/validate/validate.proto";
 import "google/protobuf/descriptor.proto";
 import "google/protobuf/timestamp.proto";
+import "metalstack/api/v2/predefined_rules.proto";
 
 // TenantRole specifies what role a logged in user needs to call this tenant scoped service
 enum TenantRole {
@@ -122,20 +123,23 @@ message Paging {
 // Labels define additional information to a entity
 message Labels {
   // Labels consists labels
-  map<string, string> labels = 1 [(buf.validate.field).map = {
-    keys: {
-      string: {
-        min_len: 1
-        max_len: 256
+  map<string, string> labels = 1 [
+    (buf.validate.field).map = {
+      keys: {
+        string: {
+          min_len: 1
+          max_len: 256
+        }
       }
-    }
-    values: {
-      string: {
-        min_len: 0
-        max_len: 256
+      values: {
+        string: {
+          min_len: 0
+          max_len: 256
+        }
       }
-    }
-  }];
+    },
+    (buf.validate.field).map.(metalstack.api.v2.keys_and_values_trimmed) = true
+  ];
 }
 
 // Meta of a message
diff --git a/proto/metalstack/api/v2/predefined_rules.proto b/proto/metalstack/api/v2/predefined_rules.proto
index dc0ab638..8ca4a0a5 100644
--- a/proto/metalstack/api/v2/predefined_rules.proto
+++ b/proto/metalstack/api/v2/predefined_rules.proto
@@ -83,3 +83,18 @@ extend buf.validate.RepeatedRules {
     expression: "this.all(m, m.trim().size() == m.size())"
   }];
 }
+
+extend buf.validate.MapRules {
+  // Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+  optional bool keys_and_values_trimmed = 80068951 [(buf.validate.predefined).cel = {
+    id: "map.keys_and_values_trimmed"
+    message: "keys and values must not start or end with whitespace"
+    expression: "this.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())"
+  }];
+  // Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
+  optional bool keys_trimmed = 80068952 [(buf.validate.predefined).cel = {
+    id: "map.keys_trimmed"
+    message: "keys must not start or end with whitespace"
+    expression: "this.all(k, k.trim().size() == k.size())"
+  }];
+}
diff --git a/proto/metalstack/api/v2/token.proto b/proto/metalstack/api/v2/token.proto
index ad8b0efd..51e8d248 100644
--- a/proto/metalstack/api/v2/token.proto
+++ b/proto/metalstack/api/v2/token.proto
@@ -109,26 +109,32 @@ message TokenServiceCreateRequest {
     gte: {seconds: 600}
   }];
   // ProjectRoles associates a project id with the corresponding role of the token owner
-  map<string, ProjectRole> project_roles = 4 [(buf.validate.field).map = {
-    keys: {
-      string: {uuid: true}
-    }
-    values: {
-      enum: {defined_only: true}
-    }
-  }];
+  map<string, ProjectRole> project_roles = 4 [
+    (buf.validate.field).map = {
+      keys: {
+        string: {uuid: true}
+      }
+      values: {
+        enum: {defined_only: true}
+      }
+    },
+    (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
+  ];
   // TenantRoles_associates a tenant id with the corresponding role of the token owner
-  map<string, TenantRole> tenant_roles = 5 [(buf.validate.field).map = {
-    keys: {
-      string: {
-        min_len: 3
-        max_len: 128
+  map<string, TenantRole> tenant_roles = 5 [
+    (buf.validate.field).map = {
+      keys: {
+        string: {
+          min_len: 3
+          max_len: 128
+        }
       }
-    }
-    values: {
-      enum: {defined_only: true}
-    }
-  }];
+      values: {
+        enum: {defined_only: true}
+      }
+    },
+    (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
+  ];
   // AdminRole defines the admin role of the token owner
   optional AdminRole admin_role = 6 [(buf.validate.field).enum.defined_only = true];
   // InfraRole defines the infrastructure role of the token owner
@@ -200,26 +206,32 @@ message TokenServiceUpdateRequest {
   // Permissions is a list of service methods this token can be used for
   repeated MethodPermission permissions = 4;
   // ProjectRoles associates a project id with the corresponding role of the token owner
-  map<string, ProjectRole> project_roles = 5 [(buf.validate.field).map = {
-    keys: {
-      string: {uuid: true}
-    }
-    values: {
-      enum: {defined_only: true}
-    }
-  }];
+  map<string, ProjectRole> project_roles = 5 [
+    (buf.validate.field).map = {
+      keys: {
+        string: {uuid: true}
+      }
+      values: {
+        enum: {defined_only: true}
+      }
+    },
+    (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
+  ];
   // TenantRoles associates a tenant id with the corresponding role of the token owner
-  map<string, TenantRole> tenant_roles = 6 [(buf.validate.field).map = {
-    keys: {
-      string: {
-        min_len: 3
-        max_len: 128
+  map<string, TenantRole> tenant_roles = 6 [
+    (buf.validate.field).map = {
+      keys: {
+        string: {
+          min_len: 3
+          max_len: 128
+        }
       }
-    }
-    values: {
-      enum: {defined_only: true}
-    }
-  }];
+      values: {
+        enum: {defined_only: true}
+      }
+    },
+    (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
+  ];
   // AdminRole defines the admin role of the token owner
   optional AdminRole admin_role = 7 [(buf.validate.field).enum.defined_only = true];
   // InfraRole defines the infrastructure role of the token owner
diff --git a/python/metalstack/api/v2/common_pb2.py b/python/metalstack/api/v2/common_pb2.py
index a02f16e0..50ccddec 100644
--- a/python/metalstack/api/v2/common_pb2.py
+++ b/python/metalstack/api/v2/common_pb2.py
@@ -25,9 +25,10 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 from google.protobuf import descriptor_pb2 as google_dot_protobuf_dot_descriptor__pb2
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
+from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/common.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"O\n\x06Paging\x12\x17\n\x04page\x18\x01 \x01(\x04H\x00R\x04page\x88\x01\x01\x12\x19\n\x05\x63ount\x18\x02 \x01(\x04H\x01R\x05\x63ount\x88\x01\x01\x42\x07\n\x05_pageB\x08\n\x06_count\"\x9c\x01\n\x06Labels\x12W\n\x06labels\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.Labels.LabelsEntryB\x18\xbaH\x15\x9a\x01\x12\"\x07r\x05\x10\x01\x18\x80\x02*\x07r\x05\x10\x00\x18\x80\x02R\x06labels\x1a\x39\n\x0bLabelsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\"\xdf\x01\n\x04Meta\x12\x36\n\x06labels\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x00R\x06labels\x88\x01\x01\x12\x39\n\ncreated_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tcreatedAt\x12\x39\n\nupdated_at\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x1e\n\ngeneration\x18\x04 \x01(\x04R\ngenerationB\t\n\x07_labels\"Y\n\x0cUpdateLabels\x12\x31\n\x06update\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06update\x12\x16\n\x06remove\x18\x02 \x03(\tR\x06remove\"\xaa\x01\n\nUpdateMeta\x12\x39\n\nupdated_at\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x61\n\x10locking_strategy\x18\x02 \x01(\x0e\x32,.metalstack.api.v2.OptimisticLockingStrategyB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0flockingStrategy*\x87\x01\n\nTenantRole\x12\x1b\n\x17TENANT_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11TENANT_ROLE_OWNER\x10\x01\x12\x16\n\x12TENANT_ROLE_EDITOR\x10\x02\x12\x16\n\x12TENANT_ROLE_VIEWER\x10\x03\x12\x15\n\x11TENANT_ROLE_GUEST\x10\x04*u\n\x0bProjectRole\x12\x1c\n\x18PROJECT_ROLE_UNSPECIFIED\x10\x00\x12\x16\n\x12PROJECT_ROLE_OWNER\x10\x01\x12\x17\n\x13PROJECT_ROLE_EDITOR\x10\x02\x12\x17\n\x13PROJECT_ROLE_VIEWER\x10\x03*U\n\tAdminRole\x12\x1a\n\x16\x41\x44MIN_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41\x44MIN_ROLE_EDITOR\x10\x01\x12\x15\n\x11\x41\x44MIN_ROLE_VIEWER\x10\x02*U\n\tInfraRole\x12\x1a\n\x16INFRA_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11INFRA_ROLE_EDITOR\x10\x01\x12\x15\n\x11INFRA_ROLE_VIEWER\x10\x02*]\n\x0bMachineRole\x12\x1c\n\x18MACHINE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n\x13MACHINE_ROLE_EDITOR\x10\x01\x12\x17\n\x13MACHINE_ROLE_VIEWER\x10\x02*T\n\nVisibility\x12\x1a\n\x16VISIBILITY_UNSPECIFIED\x10\x00\x12\x15\n\x11VISIBILITY_PUBLIC\x10\x01\x12\x13\n\x0fVISIBILITY_SELF\x10\x03*R\n\x08\x41uditing\x12\x18\n\x14\x41UDITING_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41UDITING_INCLUDED\x10\x01\x12\x15\n\x11\x41UDITING_EXCLUDED\x10\x02*\x98\x01\n\x19OptimisticLockingStrategy\x12+\n\'OPTIMISTIC_LOCKING_STRATEGY_UNSPECIFIED\x10\x00\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_CLIENT\x10\x01\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_SERVER\x10\x02:b\n\x0ctenant_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb8\x8e\x03 \x03(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x0btenantRoles:e\n\rproject_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb9\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x0cprojectRoles:_\n\x0b\x61\x64min_roles\x12\x1e.google.protobuf.MethodOptions\x18\xba\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.AdminRoleR\nadminRoles:_\n\nvisibility\x12\x1e.google.protobuf.MethodOptions\x18\xbb\x8e\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.VisibilityR\nvisibility:Y\n\x08\x61uditing\x12\x1e.google.protobuf.MethodOptions\x18\xbc\x8e\x03 \x01(\x0e\x32\x1b.metalstack.api.v2.AuditingR\x08\x61uditing:_\n\x0binfra_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbd\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.InfraRoleR\ninfraRoles:e\n\rmachine_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbe\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x0cmachineRoles:O\n\x11\x65num_string_value\x12!.google.protobuf.EnumValueOptions\x18\xa0\x96\x03 \x01(\tR\x0f\x65numStringValueB\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0b\x43ommonProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1emetalstack/api/v2/common.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a(metalstack/api/v2/predefined_rules.proto\"O\n\x06Paging\x12\x17\n\x04page\x18\x01 \x01(\x04H\x00R\x04page\x88\x01\x01\x12\x19\n\x05\x63ount\x18\x02 \x01(\x04H\x01R\x05\x63ount\x88\x01\x01\x42\x07\n\x05_pageB\x08\n\x06_count\"\xa2\x01\n\x06Labels\x12]\n\x06labels\x18\x01 \x03(\x0b\x32%.metalstack.api.v2.Labels.LabelsEntryB\x1e\xbaH\x1b\x9a\x01\x18\"\x07r\x05\x10\x01\x18\x80\x02*\x07r\x05\x10\x00\x18\x80\x02\xb8\x95\xb8\xb1\x02\x01R\x06labels\x1a\x39\n\x0bLabelsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\"\xdf\x01\n\x04Meta\x12\x36\n\x06labels\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x00R\x06labels\x88\x01\x01\x12\x39\n\ncreated_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tcreatedAt\x12\x39\n\nupdated_at\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x1e\n\ngeneration\x18\x04 \x01(\x04R\ngenerationB\t\n\x07_labels\"Y\n\x0cUpdateLabels\x12\x31\n\x06update\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06update\x12\x16\n\x06remove\x18\x02 \x03(\tR\x06remove\"\xaa\x01\n\nUpdateMeta\x12\x39\n\nupdated_at\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tupdatedAt\x12\x61\n\x10locking_strategy\x18\x02 \x01(\x0e\x32,.metalstack.api.v2.OptimisticLockingStrategyB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0flockingStrategy*\x87\x01\n\nTenantRole\x12\x1b\n\x17TENANT_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11TENANT_ROLE_OWNER\x10\x01\x12\x16\n\x12TENANT_ROLE_EDITOR\x10\x02\x12\x16\n\x12TENANT_ROLE_VIEWER\x10\x03\x12\x15\n\x11TENANT_ROLE_GUEST\x10\x04*u\n\x0bProjectRole\x12\x1c\n\x18PROJECT_ROLE_UNSPECIFIED\x10\x00\x12\x16\n\x12PROJECT_ROLE_OWNER\x10\x01\x12\x17\n\x13PROJECT_ROLE_EDITOR\x10\x02\x12\x17\n\x13PROJECT_ROLE_VIEWER\x10\x03*U\n\tAdminRole\x12\x1a\n\x16\x41\x44MIN_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41\x44MIN_ROLE_EDITOR\x10\x01\x12\x15\n\x11\x41\x44MIN_ROLE_VIEWER\x10\x02*U\n\tInfraRole\x12\x1a\n\x16INFRA_ROLE_UNSPECIFIED\x10\x00\x12\x15\n\x11INFRA_ROLE_EDITOR\x10\x01\x12\x15\n\x11INFRA_ROLE_VIEWER\x10\x02*]\n\x0bMachineRole\x12\x1c\n\x18MACHINE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n\x13MACHINE_ROLE_EDITOR\x10\x01\x12\x17\n\x13MACHINE_ROLE_VIEWER\x10\x02*T\n\nVisibility\x12\x1a\n\x16VISIBILITY_UNSPECIFIED\x10\x00\x12\x15\n\x11VISIBILITY_PUBLIC\x10\x01\x12\x13\n\x0fVISIBILITY_SELF\x10\x03*R\n\x08\x41uditing\x12\x18\n\x14\x41UDITING_UNSPECIFIED\x10\x00\x12\x15\n\x11\x41UDITING_INCLUDED\x10\x01\x12\x15\n\x11\x41UDITING_EXCLUDED\x10\x02*\x98\x01\n\x19OptimisticLockingStrategy\x12+\n\'OPTIMISTIC_LOCKING_STRATEGY_UNSPECIFIED\x10\x00\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_CLIENT\x10\x01\x12&\n\"OPTIMISTIC_LOCKING_STRATEGY_SERVER\x10\x02:b\n\x0ctenant_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb8\x8e\x03 \x03(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x0btenantRoles:e\n\rproject_roles\x12\x1e.google.protobuf.MethodOptions\x18\xb9\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x0cprojectRoles:_\n\x0b\x61\x64min_roles\x12\x1e.google.protobuf.MethodOptions\x18\xba\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.AdminRoleR\nadminRoles:_\n\nvisibility\x12\x1e.google.protobuf.MethodOptions\x18\xbb\x8e\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.VisibilityR\nvisibility:Y\n\x08\x61uditing\x12\x1e.google.protobuf.MethodOptions\x18\xbc\x8e\x03 \x01(\x0e\x32\x1b.metalstack.api.v2.AuditingR\x08\x61uditing:_\n\x0binfra_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbd\x8e\x03 \x03(\x0e\x32\x1c.metalstack.api.v2.InfraRoleR\ninfraRoles:e\n\rmachine_roles\x12\x1e.google.protobuf.MethodOptions\x18\xbe\x8e\x03 \x03(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x0cmachineRoles:O\n\x11\x65num_string_value\x12!.google.protobuf.EnumValueOptions\x18\xa0\x96\x03 \x01(\tR\x0f\x65numStringValueB\xc1\x01\n\x15\x63om.metalstack.api.v2B\x0b\x43ommonProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -38,35 +39,35 @@
   _globals['_LABELS_LABELSENTRY']._loaded_options = None
   _globals['_LABELS_LABELSENTRY']._serialized_options = b'8\001'
   _globals['_LABELS'].fields_by_name['labels']._loaded_options = None
-  _globals['_LABELS'].fields_by_name['labels']._serialized_options = b'\272H\025\232\001\022\"\007r\005\020\001\030\200\002*\007r\005\020\000\030\200\002'
+  _globals['_LABELS'].fields_by_name['labels']._serialized_options = b'\272H\033\232\001\030\"\007r\005\020\001\030\200\002*\007r\005\020\000\030\200\002\270\225\270\261\002\001'
   _globals['_UPDATEMETA'].fields_by_name['locking_strategy']._loaded_options = None
   _globals['_UPDATEMETA'].fields_by_name['locking_strategy']._serialized_options = b'\272H\005\202\001\002\020\001'
-  _globals['_TENANTROLE']._serialized_start=880
-  _globals['_TENANTROLE']._serialized_end=1015
-  _globals['_PROJECTROLE']._serialized_start=1017
-  _globals['_PROJECTROLE']._serialized_end=1134
-  _globals['_ADMINROLE']._serialized_start=1136
-  _globals['_ADMINROLE']._serialized_end=1221
-  _globals['_INFRAROLE']._serialized_start=1223
-  _globals['_INFRAROLE']._serialized_end=1308
-  _globals['_MACHINEROLE']._serialized_start=1310
-  _globals['_MACHINEROLE']._serialized_end=1403
-  _globals['_VISIBILITY']._serialized_start=1405
-  _globals['_VISIBILITY']._serialized_end=1489
-  _globals['_AUDITING']._serialized_start=1491
-  _globals['_AUDITING']._serialized_end=1573
-  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_start=1576
-  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_end=1728
-  _globals['_PAGING']._serialized_start=149
-  _globals['_PAGING']._serialized_end=228
-  _globals['_LABELS']._serialized_start=231
-  _globals['_LABELS']._serialized_end=387
-  _globals['_LABELS_LABELSENTRY']._serialized_start=330
-  _globals['_LABELS_LABELSENTRY']._serialized_end=387
-  _globals['_META']._serialized_start=390
-  _globals['_META']._serialized_end=613
-  _globals['_UPDATELABELS']._serialized_start=615
-  _globals['_UPDATELABELS']._serialized_end=704
-  _globals['_UPDATEMETA']._serialized_start=707
-  _globals['_UPDATEMETA']._serialized_end=877
+  _globals['_TENANTROLE']._serialized_start=928
+  _globals['_TENANTROLE']._serialized_end=1063
+  _globals['_PROJECTROLE']._serialized_start=1065
+  _globals['_PROJECTROLE']._serialized_end=1182
+  _globals['_ADMINROLE']._serialized_start=1184
+  _globals['_ADMINROLE']._serialized_end=1269
+  _globals['_INFRAROLE']._serialized_start=1271
+  _globals['_INFRAROLE']._serialized_end=1356
+  _globals['_MACHINEROLE']._serialized_start=1358
+  _globals['_MACHINEROLE']._serialized_end=1451
+  _globals['_VISIBILITY']._serialized_start=1453
+  _globals['_VISIBILITY']._serialized_end=1537
+  _globals['_AUDITING']._serialized_start=1539
+  _globals['_AUDITING']._serialized_end=1621
+  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_start=1624
+  _globals['_OPTIMISTICLOCKINGSTRATEGY']._serialized_end=1776
+  _globals['_PAGING']._serialized_start=191
+  _globals['_PAGING']._serialized_end=270
+  _globals['_LABELS']._serialized_start=273
+  _globals['_LABELS']._serialized_end=435
+  _globals['_LABELS_LABELSENTRY']._serialized_start=378
+  _globals['_LABELS_LABELSENTRY']._serialized_end=435
+  _globals['_META']._serialized_start=438
+  _globals['_META']._serialized_end=661
+  _globals['_UPDATELABELS']._serialized_start=663
+  _globals['_UPDATELABELS']._serialized_end=752
+  _globals['_UPDATEMETA']._serialized_start=755
+  _globals['_UPDATEMETA']._serialized_end=925
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/common_pb2.pyi b/python/metalstack/api/v2/common_pb2.pyi
index 4e014f5a..b7856a90 100644
--- a/python/metalstack/api/v2/common_pb2.pyi
+++ b/python/metalstack/api/v2/common_pb2.pyi
@@ -3,6 +3,7 @@ import datetime
 from buf.validate import validate_pb2 as _validate_pb2
 from google.protobuf import descriptor_pb2 as _descriptor_pb2
 from google.protobuf import timestamp_pb2 as _timestamp_pb2
+from metalstack.api.v2 import predefined_rules_pb2 as _predefined_rules_pb2
 from google.protobuf.internal import containers as _containers
 from google.protobuf.internal import enum_type_wrapper as _enum_type_wrapper
 from google.protobuf import descriptor as _descriptor
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.py b/python/metalstack/api/v2/predefined_rules_pb2.py
index 3165b8d5..2fbe2cb6 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.py
+++ b/python/metalstack/api/v2/predefined_rules_pb2.py
@@ -25,7 +25,7 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmedB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmedB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -57,4 +57,8 @@
   _globals['are_host_and_port']._serialized_options = b'\302H\226\001\n\223\001\n\032repeated.are_host_and_port\022Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\032#this.all(m, m.isHostAndPort(false))'
   _globals['all_trimmed']._loaded_options = None
   _globals['all_trimmed']._serialized_options = b'\302Hv\nt\n\024repeated.all_trimmed\0222given values must not start or end with whitespace\032(this.all(m, m.trim().size() == m.size())'
+  _globals['keys_and_values_trimmed']._loaded_options = None
+  _globals['keys_and_values_trimmed']._serialized_options = b'\302H\255\001\n\252\001\n\033map.keys_and_values_trimmed\0225keys and values must not start or end with whitespace\032Tthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())'
+  _globals['keys_trimmed']._loaded_options = None
+  _globals['keys_trimmed']._serialized_options = b'\302Hj\nh\n\020map.keys_trimmed\022*keys must not start or end with whitespace\032(this.all(k, k.trim().size() == k.size())'
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.pyi b/python/metalstack/api/v2/predefined_rules_pb2.pyi
index 4741dab8..6290e37c 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.pyi
+++ b/python/metalstack/api/v2/predefined_rules_pb2.pyi
@@ -27,3 +27,7 @@ ARE_HOST_AND_PORT_FIELD_NUMBER: _ClassVar[int]
 are_host_and_port: _descriptor.FieldDescriptor
 ALL_TRIMMED_FIELD_NUMBER: _ClassVar[int]
 all_trimmed: _descriptor.FieldDescriptor
+KEYS_AND_VALUES_TRIMMED_FIELD_NUMBER: _ClassVar[int]
+keys_and_values_trimmed: _descriptor.FieldDescriptor
+KEYS_TRIMMED_FIELD_NUMBER: _ClassVar[int]
+keys_trimmed: _descriptor.FieldDescriptor
diff --git a/python/metalstack/api/v2/token_pb2.py b/python/metalstack/api/v2/token_pb2.py
index c7caf0ed..3b338a5f 100644
--- a/python/metalstack/api/v2/token_pb2.py
+++ b/python/metalstack/api/v2/token_pb2.py
@@ -29,7 +29,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xa7\n\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x04 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\x08 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xd5\n\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x14\xbaH\x11\x9a\x01\x0e\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x16\xbaH\x13\x9a\x01\x10\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\x90\x05\n\x0cTokenService\x12\x62\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x04\xd8\xf3\x18\x03\x12\x65\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x04\xd8\xf3\x18\x03\x12n\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x04\xd8\xf3\x18\x03\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\x92\n\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12O\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryR\x0cprojectRoles\x12L\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryR\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12O\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryR\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xb3\n\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12\x7f\n\rproject_roles\x18\x04 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12~\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\x08 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xe1\n\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12\x7f\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12~\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12\xc1\x02\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\xdb\x01\xbaH\xd7\x01\x9a\x01\x07*\x05\x82\x01\x02\x10\x01\xba\x01\xc9\x01\n\x12machine_roles_keys\x12\x33map keys must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\x90\x05\n\x0cTokenService\x12\x62\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x04\xd8\xf3\x18\x03\x12\x65\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x04\xd8\xf3\x18\x03\x12k\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x04\xd8\xf3\x18\x03\x12n\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x04\xd8\xf3\x18\x03\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -72,9 +72,9 @@
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['expires']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['expires']._serialized_options = b'\272H\017\252\001\014\032\005\010\201\347\204\0172\003\010\330\004'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['project_roles']._loaded_options = None
-  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['project_roles']._serialized_options = b'\272H\021\232\001\016\"\005r\003\260\001\001*\005\202\001\002\020\001'
+  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['project_roles']._serialized_options = b'\272H\027\232\001\024\"\005r\003\260\001\001*\005\202\001\002\020\001\300\225\270\261\002\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['tenant_roles']._loaded_options = None
-  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['tenant_roles']._serialized_options = b'\272H\023\232\001\020\"\007r\005\020\003\030\200\001*\005\202\001\002\020\001'
+  _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['tenant_roles']._serialized_options = b'\272H\031\232\001\026\"\007r\005\020\003\030\200\001*\005\202\001\002\020\001\300\225\270\261\002\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['admin_role']._loaded_options = None
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['admin_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICECREATEREQUEST'].fields_by_name['infra_role']._loaded_options = None
@@ -100,9 +100,9 @@
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['description']._loaded_options = None
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['project_roles']._loaded_options = None
-  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['project_roles']._serialized_options = b'\272H\021\232\001\016\"\005r\003\260\001\001*\005\202\001\002\020\001'
+  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['project_roles']._serialized_options = b'\272H\027\232\001\024\"\005r\003\260\001\001*\005\202\001\002\020\001\300\225\270\261\002\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['tenant_roles']._loaded_options = None
-  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['tenant_roles']._serialized_options = b'\272H\023\232\001\020\"\007r\005\020\003\030\200\001*\005\202\001\002\020\001'
+  _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['tenant_roles']._serialized_options = b'\272H\031\232\001\026\"\007r\005\020\003\030\200\001*\005\202\001\002\020\001\300\225\270\261\002\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['admin_role']._loaded_options = None
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['admin_role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TOKENSERVICEUPDATEREQUEST'].fields_by_name['infra_role']._loaded_options = None
@@ -123,8 +123,8 @@
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\330\363\030\003'
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._serialized_options = b'\330\363\030\003'
-  _globals['_TOKENTYPE']._serialized_start=4942
-  _globals['_TOKENTYPE']._serialized_end=5022
+  _globals['_TOKENTYPE']._serialized_start=4966
+  _globals['_TOKENTYPE']._serialized_end=5046
   _globals['_TOKEN']._serialized_start=221
   _globals['_TOKEN']._serialized_end=1519
   _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=1040
@@ -134,43 +134,43 @@
   _globals['_TOKEN_MACHINEROLESENTRY']._serialized_start=1232
   _globals['_TOKEN_MACHINEROLESENTRY']._serialized_end=1327
   _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1522
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2841
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2853
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
   _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
   _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_METHODPERMISSION']._serialized_start=2843
-  _globals['_METHODPERMISSION']._serialized_end=2934
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2936
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=3036
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=3038
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=3063
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=3065
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=3141
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=3143
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3200
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3202
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3230
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3233
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4598
+  _globals['_METHODPERMISSION']._serialized_start=2855
+  _globals['_METHODPERMISSION']._serialized_end=2946
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2948
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=3048
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=3050
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=3075
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=3077
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=3153
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=3155
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3212
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3214
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3242
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3245
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4622
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=1040
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1135
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1137
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1230
   _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_start=1232
   _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_end=1327
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4600
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4676
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4678
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4732
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4734
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4807
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4809
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4837
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4839
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4940
-  _globals['_TOKENSERVICE']._serialized_start=5025
-  _globals['_TOKENSERVICE']._serialized_end=5681
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4624
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4700
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4702
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4756
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4758
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4831
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4833
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4861
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4863
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4964
+  _globals['_TOKENSERVICE']._serialized_start=5049
+  _globals['_TOKENSERVICE']._serialized_end=5705
 # @@protoc_insertion_point(module_scope)