Rename for consistency

lib/tbot/cli/start_workload_identity_api.go

@@ -87,15 +87,15 @@ func (c *WorkloadIdentityAPICommand) ApplyConfig(cfg *config.BotConfig, l *slog.
 	case c.NameSelector != "" && c.LabelSelector != "":
 		return trace.BadParameter("workload-identity-name and workload-identity-labels flags are mutually exclusive")
 	case c.NameSelector != "":
-		svc.WorkloadIdentity.Name = c.NameSelector
+		svc.Selector.Name = c.NameSelector
 	case c.LabelSelector != "":
 		labels, err := client.ParseLabelSpec(c.LabelSelector)
 		if err != nil {
 			return trace.Wrap(err, "parsing --workload-identity-labels")
 		}
-		svc.WorkloadIdentity.Labels = map[string][]string{}
+		svc.Selector.Labels = map[string][]string{}
 		for k, v := range labels {
-			svc.WorkloadIdentity.Labels[k] = []string{v}
+			svc.Selector.Labels[k] = []string{v}
 		}
 	default:
 		return trace.BadParameter("workload-identity-name or workload-identity-labels must be specified")

lib/tbot/cli/start_workload_identity_api_test.go

@@ -47,7 +47,7 @@ func TestNewWorkloadIdentityAPICommand(t *testing.T) {
 				require.Equal(t, map[string][]string{
 					"*":   {"*"},
 					"foo": {"bar"},
-				}, wis.WorkloadIdentity.Labels)
+				}, wis.Selector.Labels)
 			},
 		},
 		{
@@ -68,7 +68,7 @@ func TestNewWorkloadIdentityAPICommand(t *testing.T) {
 				wis, ok := svc.(*config.WorkloadIdentityAPIService)
 				require.True(t, ok)
 				require.Equal(t, "unix:///opt/workload.sock", wis.Listen)
-				require.Equal(t, "jim", wis.WorkloadIdentity.Name)
+				require.Equal(t, "jim", wis.Selector.Name)
 			},
 		},
 	})

lib/tbot/config/config_test.go

@@ -274,7 +274,7 @@ func TestBotConfig_YAML(t *testing.T) {
 					},
 					&WorkloadIdentityAPIService{
 						Listen: "tcp://127.0.0.1:123",
-						WorkloadIdentity: WorkloadIdentitySelector{
+						Selector: WorkloadIdentitySelector{
 							Name: "my-workload-identity",
 						},
 					},

lib/tbot/config/service_workload_identity_api.go

@@ -37,9 +37,9 @@ type WorkloadIdentityAPIService struct {
 	Listen string `yaml:"listen"`
 	// Attestors is the configuration for the workload attestation process.
 	Attestors workloadattest.Config `yaml:"attestors"`
-	// WorkloadIdentity is the selector for the WorkloadIdentity resource that
+	// Selector is the selector for the WorkloadIdentity resource that
 	// will be used to issue WICs.
-	WorkloadIdentity WorkloadIdentitySelector `yaml:"workload_identity"`
+	Selector WorkloadIdentitySelector `yaml:"selector"`
 }
 
 // CheckAndSetDefaults checks the SPIFFESVIDOutput values and sets any defaults.
@@ -50,8 +50,8 @@ func (o *WorkloadIdentityAPIService) CheckAndSetDefaults() error {
 	if err := o.Attestors.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err, "validating attestor")
 	}
-	if err := o.WorkloadIdentity.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err, "validating workload_identity")
+	if err := o.Selector.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating selector")
 	}
 	return nil
 }

lib/tbot/config/service_workload_identity_api_test.go

@@ -42,7 +42,7 @@ func TestWorkloadIdentityAPIService_YAML(t *testing.T) {
 						},
 					},
 				},
-				WorkloadIdentity: WorkloadIdentitySelector{
+				Selector: WorkloadIdentitySelector{
 					Name: "my-workload-identity",
 				},
 			},
@@ -51,7 +51,7 @@ func TestWorkloadIdentityAPIService_YAML(t *testing.T) {
 			name: "minimal",
 			in: WorkloadIdentityAPIService{
 				Listen: "tcp://0.0.0.0:4040",
-				WorkloadIdentity: WorkloadIdentitySelector{
+				Selector: WorkloadIdentitySelector{
 					Name: "my-workload-identity",
 				},
 			},
@@ -68,7 +68,7 @@ func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
 			name: "valid",
 			in: func() *WorkloadIdentityAPIService {
 				return &WorkloadIdentityAPIService{
-					WorkloadIdentity: WorkloadIdentitySelector{
+					Selector: WorkloadIdentitySelector{
 						Name: "my-workload-identity",
 					},
 					Listen: "tcp://0.0.0.0:4040",
@@ -79,7 +79,7 @@ func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
 			name: "valid with labels",
 			in: func() *WorkloadIdentityAPIService {
 				return &WorkloadIdentityAPIService{
-					WorkloadIdentity: WorkloadIdentitySelector{
+					Selector: WorkloadIdentitySelector{
 						Labels: map[string][]string{
 							"key": {"value"},
 						},
@@ -92,8 +92,8 @@ func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
 			name: "missing selectors",
 			in: func() *WorkloadIdentityAPIService {
 				return &WorkloadIdentityAPIService{
-					WorkloadIdentity: WorkloadIdentitySelector{},
-					Listen:           "tcp://0.0.0.0:4040",
+					Selector: WorkloadIdentitySelector{},
+					Listen:   "tcp://0.0.0.0:4040",
 				}
 			},
 			wantErr: "one of ['name', 'labels'] must be set",
@@ -102,7 +102,7 @@ func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
 			name: "too many selectors",
 			in: func() *WorkloadIdentityAPIService {
 				return &WorkloadIdentityAPIService{
-					WorkloadIdentity: WorkloadIdentitySelector{
+					Selector: WorkloadIdentitySelector{
 						Name: "my-workload-identity",
 						Labels: map[string][]string{
 							"key": {"value"},
@@ -117,7 +117,7 @@ func TestWorkloadIdentityAPIService_CheckAndSetDefaults(t *testing.T) {
 			name: "missing listen",
 			in: func() *WorkloadIdentityAPIService {
 				return &WorkloadIdentityAPIService{
-					WorkloadIdentity: WorkloadIdentitySelector{
+					Selector: WorkloadIdentitySelector{
 						Name: "my-workload-identity",
 					},
 				}

lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden

@@ -66,7 +66,7 @@ services:
     attestors:
       kubernetes:
         enabled: false
-    workload_identity:
+    selector:
       name: my-workload-identity
 debug: true
 auth_server: example.teleport.sh:443

lib/tbot/config/testdata/TestWorkloadIdentityAPIService_YAML/full.golden

@@ -9,5 +9,5 @@ attestors:
       ca_path: /path/to/ca.pem
       skip_verify: true
       anonymous: true
-workload_identity:
+selector:
   name: my-workload-identity

lib/tbot/config/testdata/TestWorkloadIdentityAPIService_YAML/minimal.golden

@@ -3,5 +3,5 @@ listen: tcp://0.0.0.0:4040
 attestors:
   kubernetes:
     enabled: false
-workload_identity:
+selector:
   name: my-workload-identity

lib/tbot/service_workload_identity_api.go

@@ -407,7 +407,7 @@ func (s *WorkloadIdentityAPIService) fetchX509SVIDs(
 		ctx,
 		log,
 		s.client,
-		s.cfg.WorkloadIdentity,
+		s.cfg.Selector,
 		s.botCfg.CertificateTTL,
 		attest,
 	)
@@ -488,7 +488,7 @@ func (s *WorkloadIdentityAPIService) FetchJWTSVID(
 		ctx,
 		log,
 		s.client,
-		s.cfg.WorkloadIdentity,
+		s.cfg.Selector,
 		req.Audience,
 		s.botCfg.CertificateTTL,
 		attr,

lib/tbot/service_workload_identity_api_test.go

@@ -94,7 +94,7 @@ func TestBotWorkloadIdentityAPI(t *testing.T) {
 	onboarding, _ := makeBot(t, rootClient, "api", role.GetName())
 	botConfig := defaultBotConfig(t, process, onboarding, config.ServiceConfigs{
 		&config.WorkloadIdentityAPIService{
-			WorkloadIdentity: config.WorkloadIdentitySelector{
+			Selector: config.WorkloadIdentitySelector{
 				Name: workloadIdentity.GetMetadata().GetName(),
 			},
 			Listen: listenAddr.String(),