diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go
index de266dc95a5..96ad2b2b343 100644
--- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go
+++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go
@@ -6,7 +6,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.28.1
-// 	protoc        v3.15.8
+// 	protoc        v3.19.6
 // source: credentialsfetcher/credentialsfetcher.proto
 
 package credentialsfetcher
@@ -26,6 +26,336 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type HealthCheckRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
+}
+
+func (x *HealthCheckRequest) Reset() {
+	*x = HealthCheckRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthCheckRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthCheckRequest) ProtoMessage() {}
+
+func (x *HealthCheckRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthCheckRequest.ProtoReflect.Descriptor instead.
+func (*HealthCheckRequest) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HealthCheckRequest) GetService() string {
+	if x != nil {
+		return x.Service
+	}
+	return ""
+}
+
+type HealthCheckResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+}
+
+func (x *HealthCheckResponse) Reset() {
+	*x = HealthCheckResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthCheckResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthCheckResponse) ProtoMessage() {}
+
+func (x *HealthCheckResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthCheckResponse.ProtoReflect.Descriptor instead.
+func (*HealthCheckResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *HealthCheckResponse) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+type KerberosArnLeaseRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CredspecArns    []string `protobuf:"bytes,1,rep,name=credspec_arns,json=credspecArns,proto3" json:"credspec_arns,omitempty"`
+	AccessKeyId     string   `protobuf:"bytes,2,opt,name=access_key_id,json=accessKeyId,proto3" json:"access_key_id,omitempty"`
+	SecretAccessKey string   `protobuf:"bytes,3,opt,name=secret_access_key,json=secretAccessKey,proto3" json:"secret_access_key,omitempty"`
+	SessionToken    string   `protobuf:"bytes,4,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"`
+	Region          string   `protobuf:"bytes,5,opt,name=region,proto3" json:"region,omitempty"`
+}
+
+func (x *KerberosArnLeaseRequest) Reset() {
+	*x = KerberosArnLeaseRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KerberosArnLeaseRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KerberosArnLeaseRequest) ProtoMessage() {}
+
+func (x *KerberosArnLeaseRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KerberosArnLeaseRequest.ProtoReflect.Descriptor instead.
+func (*KerberosArnLeaseRequest) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *KerberosArnLeaseRequest) GetCredspecArns() []string {
+	if x != nil {
+		return x.CredspecArns
+	}
+	return nil
+}
+
+func (x *KerberosArnLeaseRequest) GetAccessKeyId() string {
+	if x != nil {
+		return x.AccessKeyId
+	}
+	return ""
+}
+
+func (x *KerberosArnLeaseRequest) GetSecretAccessKey() string {
+	if x != nil {
+		return x.SecretAccessKey
+	}
+	return ""
+}
+
+func (x *KerberosArnLeaseRequest) GetSessionToken() string {
+	if x != nil {
+		return x.SessionToken
+	}
+	return ""
+}
+
+func (x *KerberosArnLeaseRequest) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+type CreateKerberosArnLeaseResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	LeaseId              string                       `protobuf:"bytes,1,opt,name=lease_id,json=leaseId,proto3" json:"lease_id,omitempty"`
+	KrbTicketResponseMap []*KerberosTicketArnResponse `protobuf:"bytes,2,rep,name=krb_ticket_response_map,json=krbTicketResponseMap,proto3" json:"krb_ticket_response_map,omitempty"`
+}
+
+func (x *CreateKerberosArnLeaseResponse) Reset() {
+	*x = CreateKerberosArnLeaseResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateKerberosArnLeaseResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateKerberosArnLeaseResponse) ProtoMessage() {}
+
+func (x *CreateKerberosArnLeaseResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateKerberosArnLeaseResponse.ProtoReflect.Descriptor instead.
+func (*CreateKerberosArnLeaseResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CreateKerberosArnLeaseResponse) GetLeaseId() string {
+	if x != nil {
+		return x.LeaseId
+	}
+	return ""
+}
+
+func (x *CreateKerberosArnLeaseResponse) GetKrbTicketResponseMap() []*KerberosTicketArnResponse {
+	if x != nil {
+		return x.KrbTicketResponseMap
+	}
+	return nil
+}
+
+type RenewKerberosArnLeaseResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+}
+
+func (x *RenewKerberosArnLeaseResponse) Reset() {
+	*x = RenewKerberosArnLeaseResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RenewKerberosArnLeaseResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RenewKerberosArnLeaseResponse) ProtoMessage() {}
+
+func (x *RenewKerberosArnLeaseResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RenewKerberosArnLeaseResponse.ProtoReflect.Descriptor instead.
+func (*RenewKerberosArnLeaseResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *RenewKerberosArnLeaseResponse) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+type KerberosTicketArnResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CredspecArns             string `protobuf:"bytes,1,opt,name=credspec_arns,json=credspecArns,proto3" json:"credspec_arns,omitempty"`
+	CreatedKerberosFilePaths string `protobuf:"bytes,2,opt,name=created_kerberos_file_paths,json=createdKerberosFilePaths,proto3" json:"created_kerberos_file_paths,omitempty"`
+}
+
+func (x *KerberosTicketArnResponse) Reset() {
+	*x = KerberosTicketArnResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KerberosTicketArnResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KerberosTicketArnResponse) ProtoMessage() {}
+
+func (x *KerberosTicketArnResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KerberosTicketArnResponse.ProtoReflect.Descriptor instead.
+func (*KerberosTicketArnResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *KerberosTicketArnResponse) GetCredspecArns() string {
+	if x != nil {
+		return x.CredspecArns
+	}
+	return ""
+}
+
+func (x *KerberosTicketArnResponse) GetCreatedKerberosFilePaths() string {
+	if x != nil {
+		return x.CreatedKerberosFilePaths
+	}
+	return ""
+}
+
 type CreateKerberosLeaseRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -37,7 +367,7 @@ type CreateKerberosLeaseRequest struct {
 func (x *CreateKerberosLeaseRequest) Reset() {
 	*x = CreateKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[0]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -50,7 +380,7 @@ func (x *CreateKerberosLeaseRequest) String() string {
 func (*CreateKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *CreateKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[0]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -63,7 +393,7 @@ func (x *CreateKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*CreateKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{0}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *CreateKerberosLeaseRequest) GetCredspecContents() []string {
@@ -85,7 +415,7 @@ type CreateKerberosLeaseResponse struct {
 func (x *CreateKerberosLeaseResponse) Reset() {
 	*x = CreateKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[1]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -98,7 +428,7 @@ func (x *CreateKerberosLeaseResponse) String() string {
 func (*CreateKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *CreateKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[1]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -111,7 +441,7 @@ func (x *CreateKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*CreateKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{1}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *CreateKerberosLeaseResponse) GetLeaseId() string {
@@ -142,7 +472,7 @@ type CreateNonDomainJoinedKerberosLeaseRequest struct {
 func (x *CreateNonDomainJoinedKerberosLeaseRequest) Reset() {
 	*x = CreateNonDomainJoinedKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[2]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -155,7 +485,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseRequest) String() string {
 func (*CreateNonDomainJoinedKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *CreateNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[2]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -168,7 +498,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.
 
 // Deprecated: Use CreateNonDomainJoinedKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*CreateNonDomainJoinedKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{2}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *CreateNonDomainJoinedKerberosLeaseRequest) GetCredspecContents() []string {
@@ -211,7 +541,7 @@ type CreateNonDomainJoinedKerberosLeaseResponse struct {
 func (x *CreateNonDomainJoinedKerberosLeaseResponse) Reset() {
 	*x = CreateNonDomainJoinedKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[3]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -224,7 +554,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseResponse) String() string {
 func (*CreateNonDomainJoinedKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *CreateNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[3]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -237,7 +567,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect
 
 // Deprecated: Use CreateNonDomainJoinedKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*CreateNonDomainJoinedKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{3}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *CreateNonDomainJoinedKerberosLeaseResponse) GetLeaseId() string {
@@ -267,7 +597,7 @@ type RenewNonDomainJoinedKerberosLeaseRequest struct {
 func (x *RenewNonDomainJoinedKerberosLeaseRequest) Reset() {
 	*x = RenewNonDomainJoinedKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[4]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -280,7 +610,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseRequest) String() string {
 func (*RenewNonDomainJoinedKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *RenewNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[4]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -293,7 +623,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.M
 
 // Deprecated: Use RenewNonDomainJoinedKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*RenewNonDomainJoinedKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{4}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *RenewNonDomainJoinedKerberosLeaseRequest) GetUsername() string {
@@ -328,7 +658,7 @@ type RenewNonDomainJoinedKerberosLeaseResponse struct {
 func (x *RenewNonDomainJoinedKerberosLeaseResponse) Reset() {
 	*x = RenewNonDomainJoinedKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[5]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -341,7 +671,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseResponse) String() string {
 func (*RenewNonDomainJoinedKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *RenewNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[5]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -354,7 +684,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect.
 
 // Deprecated: Use RenewNonDomainJoinedKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*RenewNonDomainJoinedKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{5}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *RenewNonDomainJoinedKerberosLeaseResponse) GetRenewedKerberosFilePaths() []string {
@@ -375,7 +705,7 @@ type DeleteKerberosLeaseRequest struct {
 func (x *DeleteKerberosLeaseRequest) Reset() {
 	*x = DeleteKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[6]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -388,7 +718,7 @@ func (x *DeleteKerberosLeaseRequest) String() string {
 func (*DeleteKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *DeleteKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[6]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -401,7 +731,7 @@ func (x *DeleteKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*DeleteKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{6}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *DeleteKerberosLeaseRequest) GetLeaseId() string {
@@ -423,7 +753,7 @@ type DeleteKerberosLeaseResponse struct {
 func (x *DeleteKerberosLeaseResponse) Reset() {
 	*x = DeleteKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[7]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -436,7 +766,7 @@ func (x *DeleteKerberosLeaseResponse) String() string {
 func (*DeleteKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *DeleteKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[7]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -449,7 +779,7 @@ func (x *DeleteKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*DeleteKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{7}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *DeleteKerberosLeaseResponse) GetLeaseId() string {
@@ -466,158 +796,307 @@ func (x *DeleteKerberosLeaseResponse) GetDeletedKerberosFilePaths() []string {
 	return nil
 }
 
-var File_credentialsfetcher_credentialsfetcher_proto protoreflect.FileDescriptor
-
-var file_credentialsfetcher_credentialsfetcher_proto_rawDesc = []byte{
-	0x0a, 0x2b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74,
-	0x63, 0x68, 0x65, 0x72, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
-	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x63,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65,
-	0x72, 0x22, 0x49, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65,
-	0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x2b, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x74,
-	0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64,
-	0x73, 0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x77, 0x0a, 0x1b,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65,
-	0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c,
-	0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c,
-	0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x64, 0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f,
-	0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65,
-	0x50, 0x61, 0x74, 0x68, 0x73, 0x22, 0xa8, 0x01, 0x0a, 0x29, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b,
-	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f,
-	0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10,
-	0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73,
-	0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x22, 0x86, 0x01, 0x0a, 0x2a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
-	0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66,
-	0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x18, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
-	0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73, 0x22, 0x7a, 0x0a, 0x28, 0x52, 0x65, 0x6e,
-	0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65,
-	0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a,
-	0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x6a, 0x0a, 0x29, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f,
-	0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72,
-	0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x3d, 0x0a, 0x1b, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64, 0x5f, 0x6b, 0x65,
-	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64,
-	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68,
-	0x73, 0x22, 0x37, 0x0a, 0x1a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65,
-	0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x22, 0x77, 0x0a, 0x1b, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61,
-	0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65, 0x61,
-	0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f,
-	0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61,
-	0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x64, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61,
-	0x74, 0x68, 0x73, 0x32, 0xce, 0x04, 0x0a, 0x19, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x46, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x73, 0x0a, 0x10, 0x41, 0x64, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
-	0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x1f, 0x41, 0x64, 0x64, 0x4e, 0x6f,
-	0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72,
-	0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x3d, 0x2e, 0x63, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a,
-	0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61,
-	0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x63, 0x72, 0x65, 0x64,
+var File_protos_credentialsfetcher_proto protoreflect.FileDescriptor
+
+var file_protos_credentialsfetcher_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65,
+	0x74, 0x63, 0x68, 0x65, 0x72, 0x22, 0x2e, 0x0a, 0x12, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x2d, 0x0a, 0x13, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x22, 0xcb, 0x01, 0x0a, 0x17, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f,
+	0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x61, 0x72, 0x6e,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65,
+	0x63, 0x41, 0x72, 0x6e, 0x73, 0x12, 0x22, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f,
+	0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65,
+	0x67, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x67, 0x69,
+	0x6f, 0x6e, 0x22, 0xa1, 0x01, 0x0a, 0x1e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72,
+	0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64,
+	0x12, 0x64, 0x0a, 0x17, 0x6b, 0x72, 0x62, 0x5f, 0x74, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x72,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66,
+	0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x54,
+	0x69, 0x63, 0x6b, 0x65, 0x74, 0x41, 0x72, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x52, 0x14, 0x6b, 0x72, 0x62, 0x54, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x4d, 0x61, 0x70, 0x22, 0x37, 0x0a, 0x1d, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22,
+	0x7f, 0x0a, 0x19, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x54, 0x69, 0x63, 0x6b, 0x65,
+	0x74, 0x41, 0x72, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x0d,
+	0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x61, 0x72, 0x6e, 0x73, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x41, 0x72, 0x6e,
+	0x73, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72,
+	0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x18, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x4b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73,
+	0x22, 0x49, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b,
+	0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65,
+	0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64, 0x73,
+	0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x77, 0x0a, 0x1b, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61,
+	0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65,
+	0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65,
+	0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70,
+	0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50,
+	0x61, 0x74, 0x68, 0x73, 0x22, 0xa8, 0x01, 0x0a, 0x29, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e,
+	0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65,
+	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x63,
+	0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x12,
+	0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22,
+	0x86, 0x01, 0x0a, 0x2a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f,
+	0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19,
+	0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69,
+	0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18,
+	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46,
+	0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73, 0x22, 0x7a, 0x0a, 0x28, 0x52, 0x65, 0x6e, 0x65,
+	0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x22, 0x6a, 0x0a, 0x29, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62,
+	0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x3d, 0x0a, 0x1b, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72,
+	0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64, 0x4b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73,
+	0x22, 0x37, 0x0a, 0x1a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19,
+	0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x22, 0x77, 0x0a, 0x1b, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73,
+	0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74,
+	0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74,
+	0x68, 0x73, 0x32, 0x9f, 0x07, 0x0a, 0x19, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x46, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x73, 0x0a, 0x10, 0x41, 0x64, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c,
+	0x65, 0x61, 0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x1f, 0x41, 0x64, 0x64, 0x4e, 0x6f, 0x6e,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62,
+	0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x3d, 0x2e, 0x63, 0x72, 0x65, 0x64,
 	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43,
 	0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f,
 	0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x21, 0x52, 0x65,
-	0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e,
-	0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12,
-	0x3c, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74,
-	0x63, 0x68, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f,
-	0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e,
-	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68,
-	0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c,
-	0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x76, 0x0a, 0x13,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65,
-	0x61, 0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b,
-	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b,
-	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x1f, 0x5a, 0x1d, 0x67, 0x72, 0x70, 0x63, 0x63, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65,
-	0x74, 0x63, 0x68, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69,
+	0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x21, 0x52, 0x65, 0x6e,
+	0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65,
+	0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x3c,
+	0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63,
+	0x68, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
+	0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65,
+	0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65,
+	0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x76, 0x0a, 0x13, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61,
+	0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
+	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65,
+	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
+	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65,
+	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x5e, 0x0a, 0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x12, 0x26, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
+	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e,
+	0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x76, 0x0a, 0x13, 0x41, 0x64, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x2b, 0x2e, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65,
+	0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x77, 0x0a, 0x15, 0x52,
+	0x65, 0x6e, 0x65, 0x77, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c,
+	0x65, 0x61, 0x73, 0x65, 0x12, 0x2b, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x31, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66,
+	0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4b, 0x65, 0x72, 0x62,
+	0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x23, 0x5a, 0x21, 0x67, 0x6d, 0x73, 0x61, 0x63, 0x72, 0x65, 0x64,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
-	file_credentialsfetcher_credentialsfetcher_proto_rawDescOnce sync.Once
-	file_credentialsfetcher_credentialsfetcher_proto_rawDescData = file_credentialsfetcher_credentialsfetcher_proto_rawDesc
+	file_protos_credentialsfetcher_proto_rawDescOnce sync.Once
+	file_protos_credentialsfetcher_proto_rawDescData = file_protos_credentialsfetcher_proto_rawDesc
 )
 
-func file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP() []byte {
-	file_credentialsfetcher_credentialsfetcher_proto_rawDescOnce.Do(func() {
-		file_credentialsfetcher_credentialsfetcher_proto_rawDescData = protoimpl.X.CompressGZIP(file_credentialsfetcher_credentialsfetcher_proto_rawDescData)
+func file_protos_credentialsfetcher_proto_rawDescGZIP() []byte {
+	file_protos_credentialsfetcher_proto_rawDescOnce.Do(func() {
+		file_protos_credentialsfetcher_proto_rawDescData = protoimpl.X.CompressGZIP(file_protos_credentialsfetcher_proto_rawDescData)
 	})
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescData
-}
-
-var file_credentialsfetcher_credentialsfetcher_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_credentialsfetcher_credentialsfetcher_proto_goTypes = []interface{}{
-	(*CreateKerberosLeaseRequest)(nil),                 // 0: credentialsfetcher.CreateKerberosLeaseRequest
-	(*CreateKerberosLeaseResponse)(nil),                // 1: credentialsfetcher.CreateKerberosLeaseResponse
-	(*CreateNonDomainJoinedKerberosLeaseRequest)(nil),  // 2: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
-	(*CreateNonDomainJoinedKerberosLeaseResponse)(nil), // 3: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
-	(*RenewNonDomainJoinedKerberosLeaseRequest)(nil),   // 4: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
-	(*RenewNonDomainJoinedKerberosLeaseResponse)(nil),  // 5: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
-	(*DeleteKerberosLeaseRequest)(nil),                 // 6: credentialsfetcher.DeleteKerberosLeaseRequest
-	(*DeleteKerberosLeaseResponse)(nil),                // 7: credentialsfetcher.DeleteKerberosLeaseResponse
-}
-var file_credentialsfetcher_credentialsfetcher_proto_depIdxs = []int32{
-	0, // 0: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:input_type -> credentialsfetcher.CreateKerberosLeaseRequest
-	2, // 1: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
-	4, // 2: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
-	6, // 3: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:input_type -> credentialsfetcher.DeleteKerberosLeaseRequest
-	1, // 4: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:output_type -> credentialsfetcher.CreateKerberosLeaseResponse
-	3, // 5: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
-	5, // 6: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
-	7, // 7: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:output_type -> credentialsfetcher.DeleteKerberosLeaseResponse
-	4, // [4:8] is the sub-list for method output_type
-	0, // [0:4] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_credentialsfetcher_credentialsfetcher_proto_init() }
-func file_credentialsfetcher_credentialsfetcher_proto_init() {
-	if File_credentialsfetcher_credentialsfetcher_proto != nil {
+	return file_protos_credentialsfetcher_proto_rawDescData
+}
+
+var file_protos_credentialsfetcher_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
+var file_protos_credentialsfetcher_proto_goTypes = []interface{}{
+	(*HealthCheckRequest)(nil),                         // 0: credentialsfetcher.HealthCheckRequest
+	(*HealthCheckResponse)(nil),                        // 1: credentialsfetcher.HealthCheckResponse
+	(*KerberosArnLeaseRequest)(nil),                    // 2: credentialsfetcher.KerberosArnLeaseRequest
+	(*CreateKerberosArnLeaseResponse)(nil),             // 3: credentialsfetcher.CreateKerberosArnLeaseResponse
+	(*RenewKerberosArnLeaseResponse)(nil),              // 4: credentialsfetcher.RenewKerberosArnLeaseResponse
+	(*KerberosTicketArnResponse)(nil),                  // 5: credentialsfetcher.KerberosTicketArnResponse
+	(*CreateKerberosLeaseRequest)(nil),                 // 6: credentialsfetcher.CreateKerberosLeaseRequest
+	(*CreateKerberosLeaseResponse)(nil),                // 7: credentialsfetcher.CreateKerberosLeaseResponse
+	(*CreateNonDomainJoinedKerberosLeaseRequest)(nil),  // 8: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
+	(*CreateNonDomainJoinedKerberosLeaseResponse)(nil), // 9: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
+	(*RenewNonDomainJoinedKerberosLeaseRequest)(nil),   // 10: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
+	(*RenewNonDomainJoinedKerberosLeaseResponse)(nil),  // 11: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
+	(*DeleteKerberosLeaseRequest)(nil),                 // 12: credentialsfetcher.DeleteKerberosLeaseRequest
+	(*DeleteKerberosLeaseResponse)(nil),                // 13: credentialsfetcher.DeleteKerberosLeaseResponse
+}
+var file_protos_credentialsfetcher_proto_depIdxs = []int32{
+	5,  // 0: credentialsfetcher.CreateKerberosArnLeaseResponse.krb_ticket_response_map:type_name -> credentialsfetcher.KerberosTicketArnResponse
+	6,  // 1: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:input_type -> credentialsfetcher.CreateKerberosLeaseRequest
+	8,  // 2: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
+	10, // 3: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
+	12, // 4: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:input_type -> credentialsfetcher.DeleteKerberosLeaseRequest
+	0,  // 5: credentialsfetcher.CredentialsFetcherService.HealthCheck:input_type -> credentialsfetcher.HealthCheckRequest
+	2,  // 6: credentialsfetcher.CredentialsFetcherService.AddKerberosArnLease:input_type -> credentialsfetcher.KerberosArnLeaseRequest
+	2,  // 7: credentialsfetcher.CredentialsFetcherService.RenewKerberosArnLease:input_type -> credentialsfetcher.KerberosArnLeaseRequest
+	7,  // 8: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:output_type -> credentialsfetcher.CreateKerberosLeaseResponse
+	9,  // 9: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
+	11, // 10: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
+	13, // 11: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:output_type -> credentialsfetcher.DeleteKerberosLeaseResponse
+	1,  // 12: credentialsfetcher.CredentialsFetcherService.HealthCheck:output_type -> credentialsfetcher.HealthCheckResponse
+	3,  // 13: credentialsfetcher.CredentialsFetcherService.AddKerberosArnLease:output_type -> credentialsfetcher.CreateKerberosArnLeaseResponse
+	4,  // 14: credentialsfetcher.CredentialsFetcherService.RenewKerberosArnLease:output_type -> credentialsfetcher.RenewKerberosArnLeaseResponse
+	8,  // [8:15] is the sub-list for method output_type
+	1,  // [1:8] is the sub-list for method input_type
+	1,  // [1:1] is the sub-list for extension type_name
+	1,  // [1:1] is the sub-list for extension extendee
+	0,  // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_protos_credentialsfetcher_proto_init() }
+
+//gocyclo:ignore
+func file_protos_credentialsfetcher_proto_init() {
+	if File_protos_credentialsfetcher_proto != nil {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthCheckRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthCheckResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KerberosArnLeaseRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateKerberosArnLeaseResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RenewKerberosArnLeaseResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KerberosTicketArnResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -629,7 +1108,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -641,7 +1120,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateNonDomainJoinedKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -653,7 +1132,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateNonDomainJoinedKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -665,7 +1144,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RenewNonDomainJoinedKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -677,7 +1156,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RenewNonDomainJoinedKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -689,7 +1168,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DeleteKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -701,7 +1180,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DeleteKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -718,18 +1197,18 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_credentialsfetcher_credentialsfetcher_proto_rawDesc,
+			RawDescriptor: file_protos_credentialsfetcher_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   8,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_credentialsfetcher_credentialsfetcher_proto_goTypes,
-		DependencyIndexes: file_credentialsfetcher_credentialsfetcher_proto_depIdxs,
-		MessageInfos:      file_credentialsfetcher_credentialsfetcher_proto_msgTypes,
+		GoTypes:           file_protos_credentialsfetcher_proto_goTypes,
+		DependencyIndexes: file_protos_credentialsfetcher_proto_depIdxs,
+		MessageInfos:      file_protos_credentialsfetcher_proto_msgTypes,
 	}.Build()
-	File_credentialsfetcher_credentialsfetcher_proto = out.File
-	file_credentialsfetcher_credentialsfetcher_proto_rawDesc = nil
-	file_credentialsfetcher_credentialsfetcher_proto_goTypes = nil
-	file_credentialsfetcher_credentialsfetcher_proto_depIdxs = nil
+	File_protos_credentialsfetcher_proto = out.File
+	file_protos_credentialsfetcher_proto_rawDesc = nil
+	file_protos_credentialsfetcher_proto_goTypes = nil
+	file_protos_credentialsfetcher_proto_depIdxs = nil
 }
diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto
index 5393650b16f..9070c16bf43 100644
--- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto
+++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto
@@ -15,6 +15,39 @@ service CredentialsFetcherService {
   rpc RenewNonDomainJoinedKerberosLease
       (RenewNonDomainJoinedKerberosLeaseRequest) returns (RenewNonDomainJoinedKerberosLeaseResponse);
   rpc DeleteKerberosLease (DeleteKerberosLeaseRequest) returns (DeleteKerberosLeaseResponse);
+  rpc HealthCheck(HealthCheckRequest) returns (HealthCheckResponse);
+  rpc AddKerberosArnLease (KerberosArnLeaseRequest) returns (CreateKerberosArnLeaseResponse);
+  rpc RenewKerberosArnLease (KerberosArnLeaseRequest) returns (RenewKerberosArnLeaseResponse);
+}
+
+message HealthCheckRequest {
+  string service = 1;
+}
+
+message HealthCheckResponse {
+  string status = 1;
+}
+
+message KerberosArnLeaseRequest {
+  repeated string credspec_arns = 1;
+  string access_key_id = 2;
+  string secret_access_key = 3;
+  string session_token = 4;
+  string region = 5;
+}
+
+message CreateKerberosArnLeaseResponse {
+  string lease_id = 1;
+  repeated KerberosTicketArnResponse krb_ticket_response_map = 2;
+}
+
+message RenewKerberosArnLeaseResponse {
+  string status = 1;
+}
+
+message KerberosTicketArnResponse {
+  string credspec_arns = 1;
+  string created_kerberos_file_paths = 2;
 }
 
 message CreateKerberosLeaseRequest {
@@ -48,6 +81,7 @@ message RenewNonDomainJoinedKerberosLeaseResponse{
   repeated string renewed_kerberos_file_paths = 1;
 }
 
+
 message DeleteKerberosLeaseRequest {
   string lease_id = 1;
 }
diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go
index 071fa0a7edb..9ddfd4fc055 100644
--- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go
+++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.15.8
+// - protoc             v3.19.6
 // source: credentialsfetcher/credentialsfetcher.proto
 
 package credentialsfetcher
@@ -27,6 +27,9 @@ type CredentialsFetcherServiceClient interface {
 	AddNonDomainJoinedKerberosLease(ctx context.Context, in *CreateNonDomainJoinedKerberosLeaseRequest, opts ...grpc.CallOption) (*CreateNonDomainJoinedKerberosLeaseResponse, error)
 	RenewNonDomainJoinedKerberosLease(ctx context.Context, in *RenewNonDomainJoinedKerberosLeaseRequest, opts ...grpc.CallOption) (*RenewNonDomainJoinedKerberosLeaseResponse, error)
 	DeleteKerberosLease(ctx context.Context, in *DeleteKerberosLeaseRequest, opts ...grpc.CallOption) (*DeleteKerberosLeaseResponse, error)
+	HealthCheck(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error)
+	AddKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*CreateKerberosArnLeaseResponse, error)
+	RenewKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*RenewKerberosArnLeaseResponse, error)
 }
 
 type credentialsFetcherServiceClient struct {
@@ -73,6 +76,33 @@ func (c *credentialsFetcherServiceClient) DeleteKerberosLease(ctx context.Contex
 	return out, nil
 }
 
+func (c *credentialsFetcherServiceClient) HealthCheck(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error) {
+	out := new(HealthCheckResponse)
+	err := c.cc.Invoke(ctx, "/credentialsfetcher.CredentialsFetcherService/HealthCheck", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *credentialsFetcherServiceClient) AddKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*CreateKerberosArnLeaseResponse, error) {
+	out := new(CreateKerberosArnLeaseResponse)
+	err := c.cc.Invoke(ctx, "/credentialsfetcher.CredentialsFetcherService/AddKerberosArnLease", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *credentialsFetcherServiceClient) RenewKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*RenewKerberosArnLeaseResponse, error) {
+	out := new(RenewKerberosArnLeaseResponse)
+	err := c.cc.Invoke(ctx, "/credentialsfetcher.CredentialsFetcherService/RenewKerberosArnLease", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // CredentialsFetcherServiceServer is the server API for CredentialsFetcherService service.
 // All implementations must embed UnimplementedCredentialsFetcherServiceServer
 // for forward compatibility
@@ -81,6 +111,9 @@ type CredentialsFetcherServiceServer interface {
 	AddNonDomainJoinedKerberosLease(context.Context, *CreateNonDomainJoinedKerberosLeaseRequest) (*CreateNonDomainJoinedKerberosLeaseResponse, error)
 	RenewNonDomainJoinedKerberosLease(context.Context, *RenewNonDomainJoinedKerberosLeaseRequest) (*RenewNonDomainJoinedKerberosLeaseResponse, error)
 	DeleteKerberosLease(context.Context, *DeleteKerberosLeaseRequest) (*DeleteKerberosLeaseResponse, error)
+	HealthCheck(context.Context, *HealthCheckRequest) (*HealthCheckResponse, error)
+	AddKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*CreateKerberosArnLeaseResponse, error)
+	RenewKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*RenewKerberosArnLeaseResponse, error)
 	mustEmbedUnimplementedCredentialsFetcherServiceServer()
 }
 
@@ -100,6 +133,15 @@ func (UnimplementedCredentialsFetcherServiceServer) RenewNonDomainJoinedKerberos
 func (UnimplementedCredentialsFetcherServiceServer) DeleteKerberosLease(context.Context, *DeleteKerberosLeaseRequest) (*DeleteKerberosLeaseResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteKerberosLease not implemented")
 }
+func (UnimplementedCredentialsFetcherServiceServer) HealthCheck(context.Context, *HealthCheckRequest) (*HealthCheckResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method HealthCheck not implemented")
+}
+func (UnimplementedCredentialsFetcherServiceServer) AddKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*CreateKerberosArnLeaseResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddKerberosArnLease not implemented")
+}
+func (UnimplementedCredentialsFetcherServiceServer) RenewKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*RenewKerberosArnLeaseResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RenewKerberosArnLease not implemented")
+}
 func (UnimplementedCredentialsFetcherServiceServer) mustEmbedUnimplementedCredentialsFetcherServiceServer() {
 }
 
@@ -186,6 +228,60 @@ func _CredentialsFetcherService_DeleteKerberosLease_Handler(srv interface{}, ctx
 	return interceptor(ctx, in, info, handler)
 }
 
+func _CredentialsFetcherService_HealthCheck_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(HealthCheckRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CredentialsFetcherServiceServer).HealthCheck(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/credentialsfetcher.CredentialsFetcherService/HealthCheck",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CredentialsFetcherServiceServer).HealthCheck(ctx, req.(*HealthCheckRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CredentialsFetcherService_AddKerberosArnLease_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KerberosArnLeaseRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CredentialsFetcherServiceServer).AddKerberosArnLease(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/credentialsfetcher.CredentialsFetcherService/AddKerberosArnLease",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CredentialsFetcherServiceServer).AddKerberosArnLease(ctx, req.(*KerberosArnLeaseRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CredentialsFetcherService_RenewKerberosArnLease_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KerberosArnLeaseRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CredentialsFetcherServiceServer).RenewKerberosArnLease(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/credentialsfetcher.CredentialsFetcherService/RenewKerberosArnLease",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CredentialsFetcherServiceServer).RenewKerberosArnLease(ctx, req.(*KerberosArnLeaseRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // CredentialsFetcherService_ServiceDesc is the grpc.ServiceDesc for CredentialsFetcherService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -209,6 +305,18 @@ var CredentialsFetcherService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteKerberosLease",
 			Handler:    _CredentialsFetcherService_DeleteKerberosLease_Handler,
 		},
+		{
+			MethodName: "HealthCheck",
+			Handler:    _CredentialsFetcherService_HealthCheck_Handler,
+		},
+		{
+			MethodName: "AddKerberosArnLease",
+			Handler:    _CredentialsFetcherService_AddKerberosArnLease_Handler,
+		},
+		{
+			MethodName: "RenewKerberosArnLease",
+			Handler:    _CredentialsFetcherService_RenewKerberosArnLease_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "credentialsfetcher/credentialsfetcher.proto",
diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcherclient.go b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcherclient.go
index 7ef2f54d155..080b0459a51 100644
--- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcherclient.go
+++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcherclient.go
@@ -5,13 +5,12 @@ import (
 	"os"
 	"time"
 
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
 	pb "github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher"
 	"github.com/cihub/seelog"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
 )
 
 type CredentialsFetcherClient struct {
@@ -62,6 +61,114 @@ type CredentialsFetcherResponse struct {
 	KerberosTicketPaths []string
 }
 
+// Credentials fetcher is a daemon running on the host which supports gMSA on linux
+type CredentialsFetcherArnResponse struct {
+	//lease id is a unique identifier associated with the kerberos tickets created for a container
+	LeaseID string
+	//path to the kerberos tickets created for the service accounts
+	KerberosTicketsMap map[string]string
+}
+
+// HealthCheck() invokes credentials fetcher daemon running on the host
+// to check the health status of daemon
+func (c CredentialsFetcherClient) HealthCheck(ctx context.Context, serviceName string) (string, error) {
+	if len(serviceName) == 0 {
+		return "", status.Errorf(codes.InvalidArgument, "service name should not be empty")
+	}
+	defer c.conn.Close()
+	client := pb.NewCredentialsFetcherServiceClient(c.conn)
+
+	request := &pb.HealthCheckRequest{Service: serviceName}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	response, err := client.HealthCheck(ctx, request)
+	if err != nil {
+		seelog.Errorf("credentials-fetcher daemon status is unhealthy during health check: %v", err)
+		return "", err
+	}
+	seelog.Debugf("credentials-fetcher daemon is running")
+
+	return response.GetStatus(), nil
+}
+
+// AddKerberosArnLease() invokes credentials fetcher daemon running on the host
+// to create kerberos tickets associated with gMSA accounts
+func (c CredentialsFetcherClient) AddKerberosArnLease(ctx context.Context, credentialspecsArns []string, accessKeyId string, secretKey string, sessionToken string, region string) (CredentialsFetcherArnResponse, error) {
+	if len(credentialspecsArns) == 0 {
+		return CredentialsFetcherArnResponse{}, status.Errorf(codes.InvalidArgument, "credentialspecArns should not be empty")
+	}
+
+	if len(accessKeyId) == 0 || len(secretKey) == 0 || len(sessionToken) == 0 || len(region) == 0 {
+		return CredentialsFetcherArnResponse{}, status.Errorf(codes.InvalidArgument, "accessid, secretkey, sessiontoken or region should not be empty")
+	}
+
+	defer c.conn.Close()
+	client := pb.NewCredentialsFetcherServiceClient(c.conn)
+
+	request := &pb.KerberosArnLeaseRequest{CredspecArns: credentialspecsArns, AccessKeyId: accessKeyId, SecretAccessKey: secretKey, SessionToken: sessionToken, Region: region}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	response, err := client.AddKerberosArnLease(ctx, request)
+	if err != nil {
+		seelog.Errorf("could not create kerberos tickets: %v", err)
+		return CredentialsFetcherArnResponse{}, err
+	}
+	seelog.Infof("created kerberos tickets and associated with LeaseID: %s", response.GetLeaseId())
+
+	credentialsFetcherResponse := CredentialsFetcherArnResponse{
+		LeaseID:            response.GetLeaseId(),
+		KerberosTicketsMap: make(map[string]string),
+	}
+
+	for _, value := range response.GetKrbTicketResponseMap() {
+		credSpecArns := value.GetCredspecArns()
+		_, ok := credentialsFetcherResponse.KerberosTicketsMap[credSpecArns]
+		if !ok {
+			credentialsFetcherResponse.KerberosTicketsMap[credSpecArns] = value.GetCreatedKerberosFilePaths()
+		}
+	}
+
+	return credentialsFetcherResponse, nil
+}
+
+// RenewKerberosArnLease() invokes credentials fetcher daemon running on the host
+// to renew kerberos tickets associated with gMSA accounts
+func (c CredentialsFetcherClient) RenewKerberosArnLease(ctx context.Context, credentialspecsArns []string, accessKeyId string, secretKey string, sessionToken string, region string) (string, error) {
+	if len(credentialspecsArns) == 0 {
+		return codes.InvalidArgument.String(), status.Errorf(codes.InvalidArgument, "credentialspecArns should not be empty")
+	}
+
+	if len(accessKeyId) == 0 || len(secretKey) == 0 || len(sessionToken) == 0 || len(region) == 0 {
+		return codes.InvalidArgument.String(), status.Errorf(codes.InvalidArgument, "accessid, secretkey, sessiontoken or region should not be empty")
+	}
+
+	defer c.conn.Close()
+	client := pb.NewCredentialsFetcherServiceClient(c.conn)
+
+	request := &pb.KerberosArnLeaseRequest{CredspecArns: credentialspecsArns, AccessKeyId: accessKeyId, SecretAccessKey: secretKey, SessionToken: sessionToken, Region: region}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	response, err := client.RenewKerberosArnLease(ctx, request)
+	if err != nil {
+		seelog.Errorf("could not renew kerberos tickets: %v", err)
+		return codes.Internal.String(), err
+	}
+
+	if response.GetStatus() == "failed" {
+		return codes.Internal.String(), status.Errorf(codes.Internal, "renewal of kerberos tickets failed")
+	}
+
+	seelog.Infof("renewal of kerberos tickets are successful")
+
+	return codes.OK.String(), nil
+}
+
 // AddKerberosLease() invokes credentials fetcher daemon running on the host
 // to create kerberos tickets associated with gMSA accounts
 func (c CredentialsFetcherClient) AddKerberosLease(ctx context.Context, credentialspecs []string) (CredentialsFetcherResponse, error) {
@@ -74,7 +181,7 @@ func (c CredentialsFetcherClient) AddKerberosLease(ctx context.Context, credenti
 
 	request := &pb.CreateKerberosLeaseRequest{CredspecContents: credentialspecs}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.AddKerberosLease(ctx, request)
@@ -110,7 +217,7 @@ func (c CredentialsFetcherClient) AddNonDomainJoinedKerberosLease(ctx context.Co
 
 	request := &pb.CreateNonDomainJoinedKerberosLeaseRequest{CredspecContents: credentialspecs, Username: username, Password: password, Domain: domain}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.AddNonDomainJoinedKerberosLease(ctx, request)
@@ -141,7 +248,7 @@ func (c CredentialsFetcherClient) RenewNonDomainJoinedKerberosLease(ctx context.
 
 	request := &pb.RenewNonDomainJoinedKerberosLeaseRequest{Username: username, Password: password, Domain: domain}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.RenewNonDomainJoinedKerberosLease(ctx, request)
@@ -170,7 +277,7 @@ func (c CredentialsFetcherClient) DeleteKerberosLease(ctx context.Context, lease
 
 	request := &pb.DeleteKerberosLeaseRequest{LeaseId: leaseid}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.DeleteKerberosLease(ctx, request)
diff --git a/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go b/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go
index de266dc95a5..96ad2b2b343 100644
--- a/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go
+++ b/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.pb.go
@@ -6,7 +6,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.28.1
-// 	protoc        v3.15.8
+// 	protoc        v3.19.6
 // source: credentialsfetcher/credentialsfetcher.proto
 
 package credentialsfetcher
@@ -26,6 +26,336 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type HealthCheckRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
+}
+
+func (x *HealthCheckRequest) Reset() {
+	*x = HealthCheckRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthCheckRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthCheckRequest) ProtoMessage() {}
+
+func (x *HealthCheckRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthCheckRequest.ProtoReflect.Descriptor instead.
+func (*HealthCheckRequest) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HealthCheckRequest) GetService() string {
+	if x != nil {
+		return x.Service
+	}
+	return ""
+}
+
+type HealthCheckResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+}
+
+func (x *HealthCheckResponse) Reset() {
+	*x = HealthCheckResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthCheckResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthCheckResponse) ProtoMessage() {}
+
+func (x *HealthCheckResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthCheckResponse.ProtoReflect.Descriptor instead.
+func (*HealthCheckResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *HealthCheckResponse) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+type KerberosArnLeaseRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CredspecArns    []string `protobuf:"bytes,1,rep,name=credspec_arns,json=credspecArns,proto3" json:"credspec_arns,omitempty"`
+	AccessKeyId     string   `protobuf:"bytes,2,opt,name=access_key_id,json=accessKeyId,proto3" json:"access_key_id,omitempty"`
+	SecretAccessKey string   `protobuf:"bytes,3,opt,name=secret_access_key,json=secretAccessKey,proto3" json:"secret_access_key,omitempty"`
+	SessionToken    string   `protobuf:"bytes,4,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"`
+	Region          string   `protobuf:"bytes,5,opt,name=region,proto3" json:"region,omitempty"`
+}
+
+func (x *KerberosArnLeaseRequest) Reset() {
+	*x = KerberosArnLeaseRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KerberosArnLeaseRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KerberosArnLeaseRequest) ProtoMessage() {}
+
+func (x *KerberosArnLeaseRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KerberosArnLeaseRequest.ProtoReflect.Descriptor instead.
+func (*KerberosArnLeaseRequest) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *KerberosArnLeaseRequest) GetCredspecArns() []string {
+	if x != nil {
+		return x.CredspecArns
+	}
+	return nil
+}
+
+func (x *KerberosArnLeaseRequest) GetAccessKeyId() string {
+	if x != nil {
+		return x.AccessKeyId
+	}
+	return ""
+}
+
+func (x *KerberosArnLeaseRequest) GetSecretAccessKey() string {
+	if x != nil {
+		return x.SecretAccessKey
+	}
+	return ""
+}
+
+func (x *KerberosArnLeaseRequest) GetSessionToken() string {
+	if x != nil {
+		return x.SessionToken
+	}
+	return ""
+}
+
+func (x *KerberosArnLeaseRequest) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+type CreateKerberosArnLeaseResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	LeaseId              string                       `protobuf:"bytes,1,opt,name=lease_id,json=leaseId,proto3" json:"lease_id,omitempty"`
+	KrbTicketResponseMap []*KerberosTicketArnResponse `protobuf:"bytes,2,rep,name=krb_ticket_response_map,json=krbTicketResponseMap,proto3" json:"krb_ticket_response_map,omitempty"`
+}
+
+func (x *CreateKerberosArnLeaseResponse) Reset() {
+	*x = CreateKerberosArnLeaseResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateKerberosArnLeaseResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateKerberosArnLeaseResponse) ProtoMessage() {}
+
+func (x *CreateKerberosArnLeaseResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateKerberosArnLeaseResponse.ProtoReflect.Descriptor instead.
+func (*CreateKerberosArnLeaseResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CreateKerberosArnLeaseResponse) GetLeaseId() string {
+	if x != nil {
+		return x.LeaseId
+	}
+	return ""
+}
+
+func (x *CreateKerberosArnLeaseResponse) GetKrbTicketResponseMap() []*KerberosTicketArnResponse {
+	if x != nil {
+		return x.KrbTicketResponseMap
+	}
+	return nil
+}
+
+type RenewKerberosArnLeaseResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+}
+
+func (x *RenewKerberosArnLeaseResponse) Reset() {
+	*x = RenewKerberosArnLeaseResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RenewKerberosArnLeaseResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RenewKerberosArnLeaseResponse) ProtoMessage() {}
+
+func (x *RenewKerberosArnLeaseResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RenewKerberosArnLeaseResponse.ProtoReflect.Descriptor instead.
+func (*RenewKerberosArnLeaseResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *RenewKerberosArnLeaseResponse) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+type KerberosTicketArnResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CredspecArns             string `protobuf:"bytes,1,opt,name=credspec_arns,json=credspecArns,proto3" json:"credspec_arns,omitempty"`
+	CreatedKerberosFilePaths string `protobuf:"bytes,2,opt,name=created_kerberos_file_paths,json=createdKerberosFilePaths,proto3" json:"created_kerberos_file_paths,omitempty"`
+}
+
+func (x *KerberosTicketArnResponse) Reset() {
+	*x = KerberosTicketArnResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KerberosTicketArnResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KerberosTicketArnResponse) ProtoMessage() {}
+
+func (x *KerberosTicketArnResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KerberosTicketArnResponse.ProtoReflect.Descriptor instead.
+func (*KerberosTicketArnResponse) Descriptor() ([]byte, []int) {
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *KerberosTicketArnResponse) GetCredspecArns() string {
+	if x != nil {
+		return x.CredspecArns
+	}
+	return ""
+}
+
+func (x *KerberosTicketArnResponse) GetCreatedKerberosFilePaths() string {
+	if x != nil {
+		return x.CreatedKerberosFilePaths
+	}
+	return ""
+}
+
 type CreateKerberosLeaseRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -37,7 +367,7 @@ type CreateKerberosLeaseRequest struct {
 func (x *CreateKerberosLeaseRequest) Reset() {
 	*x = CreateKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[0]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -50,7 +380,7 @@ func (x *CreateKerberosLeaseRequest) String() string {
 func (*CreateKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *CreateKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[0]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -63,7 +393,7 @@ func (x *CreateKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*CreateKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{0}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *CreateKerberosLeaseRequest) GetCredspecContents() []string {
@@ -85,7 +415,7 @@ type CreateKerberosLeaseResponse struct {
 func (x *CreateKerberosLeaseResponse) Reset() {
 	*x = CreateKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[1]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -98,7 +428,7 @@ func (x *CreateKerberosLeaseResponse) String() string {
 func (*CreateKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *CreateKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[1]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -111,7 +441,7 @@ func (x *CreateKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*CreateKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{1}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *CreateKerberosLeaseResponse) GetLeaseId() string {
@@ -142,7 +472,7 @@ type CreateNonDomainJoinedKerberosLeaseRequest struct {
 func (x *CreateNonDomainJoinedKerberosLeaseRequest) Reset() {
 	*x = CreateNonDomainJoinedKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[2]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -155,7 +485,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseRequest) String() string {
 func (*CreateNonDomainJoinedKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *CreateNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[2]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -168,7 +498,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.
 
 // Deprecated: Use CreateNonDomainJoinedKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*CreateNonDomainJoinedKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{2}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *CreateNonDomainJoinedKerberosLeaseRequest) GetCredspecContents() []string {
@@ -211,7 +541,7 @@ type CreateNonDomainJoinedKerberosLeaseResponse struct {
 func (x *CreateNonDomainJoinedKerberosLeaseResponse) Reset() {
 	*x = CreateNonDomainJoinedKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[3]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -224,7 +554,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseResponse) String() string {
 func (*CreateNonDomainJoinedKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *CreateNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[3]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -237,7 +567,7 @@ func (x *CreateNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect
 
 // Deprecated: Use CreateNonDomainJoinedKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*CreateNonDomainJoinedKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{3}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *CreateNonDomainJoinedKerberosLeaseResponse) GetLeaseId() string {
@@ -267,7 +597,7 @@ type RenewNonDomainJoinedKerberosLeaseRequest struct {
 func (x *RenewNonDomainJoinedKerberosLeaseRequest) Reset() {
 	*x = RenewNonDomainJoinedKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[4]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -280,7 +610,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseRequest) String() string {
 func (*RenewNonDomainJoinedKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *RenewNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[4]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -293,7 +623,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseRequest) ProtoReflect() protoreflect.M
 
 // Deprecated: Use RenewNonDomainJoinedKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*RenewNonDomainJoinedKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{4}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *RenewNonDomainJoinedKerberosLeaseRequest) GetUsername() string {
@@ -328,7 +658,7 @@ type RenewNonDomainJoinedKerberosLeaseResponse struct {
 func (x *RenewNonDomainJoinedKerberosLeaseResponse) Reset() {
 	*x = RenewNonDomainJoinedKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[5]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -341,7 +671,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseResponse) String() string {
 func (*RenewNonDomainJoinedKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *RenewNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[5]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -354,7 +684,7 @@ func (x *RenewNonDomainJoinedKerberosLeaseResponse) ProtoReflect() protoreflect.
 
 // Deprecated: Use RenewNonDomainJoinedKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*RenewNonDomainJoinedKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{5}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *RenewNonDomainJoinedKerberosLeaseResponse) GetRenewedKerberosFilePaths() []string {
@@ -375,7 +705,7 @@ type DeleteKerberosLeaseRequest struct {
 func (x *DeleteKerberosLeaseRequest) Reset() {
 	*x = DeleteKerberosLeaseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[6]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -388,7 +718,7 @@ func (x *DeleteKerberosLeaseRequest) String() string {
 func (*DeleteKerberosLeaseRequest) ProtoMessage() {}
 
 func (x *DeleteKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[6]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -401,7 +731,7 @@ func (x *DeleteKerberosLeaseRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteKerberosLeaseRequest.ProtoReflect.Descriptor instead.
 func (*DeleteKerberosLeaseRequest) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{6}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *DeleteKerberosLeaseRequest) GetLeaseId() string {
@@ -423,7 +753,7 @@ type DeleteKerberosLeaseResponse struct {
 func (x *DeleteKerberosLeaseResponse) Reset() {
 	*x = DeleteKerberosLeaseResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[7]
+		mi := &file_protos_credentialsfetcher_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -436,7 +766,7 @@ func (x *DeleteKerberosLeaseResponse) String() string {
 func (*DeleteKerberosLeaseResponse) ProtoMessage() {}
 
 func (x *DeleteKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_credentialsfetcher_credentialsfetcher_proto_msgTypes[7]
+	mi := &file_protos_credentialsfetcher_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -449,7 +779,7 @@ func (x *DeleteKerberosLeaseResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteKerberosLeaseResponse.ProtoReflect.Descriptor instead.
 func (*DeleteKerberosLeaseResponse) Descriptor() ([]byte, []int) {
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP(), []int{7}
+	return file_protos_credentialsfetcher_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *DeleteKerberosLeaseResponse) GetLeaseId() string {
@@ -466,158 +796,307 @@ func (x *DeleteKerberosLeaseResponse) GetDeletedKerberosFilePaths() []string {
 	return nil
 }
 
-var File_credentialsfetcher_credentialsfetcher_proto protoreflect.FileDescriptor
-
-var file_credentialsfetcher_credentialsfetcher_proto_rawDesc = []byte{
-	0x0a, 0x2b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74,
-	0x63, 0x68, 0x65, 0x72, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
-	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x63,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65,
-	0x72, 0x22, 0x49, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65,
-	0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x2b, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x74,
-	0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64,
-	0x73, 0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x77, 0x0a, 0x1b,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65,
-	0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c,
-	0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c,
-	0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x64, 0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f,
-	0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65,
-	0x50, 0x61, 0x74, 0x68, 0x73, 0x22, 0xa8, 0x01, 0x0a, 0x29, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b,
-	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f,
-	0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10,
-	0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73,
-	0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x22, 0x86, 0x01, 0x0a, 0x2a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
-	0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66,
-	0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x18, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
-	0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73, 0x22, 0x7a, 0x0a, 0x28, 0x52, 0x65, 0x6e,
-	0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65,
-	0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a,
-	0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x6a, 0x0a, 0x29, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f,
-	0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72,
-	0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x3d, 0x0a, 0x1b, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64, 0x5f, 0x6b, 0x65,
-	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64,
-	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68,
-	0x73, 0x22, 0x37, 0x0a, 0x1a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65,
-	0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x22, 0x77, 0x0a, 0x1b, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61,
-	0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65, 0x61,
-	0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f,
-	0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61,
-	0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x64, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61,
-	0x74, 0x68, 0x73, 0x32, 0xce, 0x04, 0x0a, 0x19, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x46, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x73, 0x0a, 0x10, 0x41, 0x64, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
-	0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x1f, 0x41, 0x64, 0x64, 0x4e, 0x6f,
-	0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72,
-	0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x3d, 0x2e, 0x63, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a,
-	0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61,
-	0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x63, 0x72, 0x65, 0x64,
+var File_protos_credentialsfetcher_proto protoreflect.FileDescriptor
+
+var file_protos_credentialsfetcher_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65,
+	0x74, 0x63, 0x68, 0x65, 0x72, 0x22, 0x2e, 0x0a, 0x12, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x2d, 0x0a, 0x13, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x22, 0xcb, 0x01, 0x0a, 0x17, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f,
+	0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x61, 0x72, 0x6e,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65,
+	0x63, 0x41, 0x72, 0x6e, 0x73, 0x12, 0x22, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f,
+	0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65,
+	0x67, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x67, 0x69,
+	0x6f, 0x6e, 0x22, 0xa1, 0x01, 0x0a, 0x1e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72,
+	0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64,
+	0x12, 0x64, 0x0a, 0x17, 0x6b, 0x72, 0x62, 0x5f, 0x74, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x72,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66,
+	0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x54,
+	0x69, 0x63, 0x6b, 0x65, 0x74, 0x41, 0x72, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x52, 0x14, 0x6b, 0x72, 0x62, 0x54, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x4d, 0x61, 0x70, 0x22, 0x37, 0x0a, 0x1d, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22,
+	0x7f, 0x0a, 0x19, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x54, 0x69, 0x63, 0x6b, 0x65,
+	0x74, 0x41, 0x72, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x0d,
+	0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x61, 0x72, 0x6e, 0x73, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x41, 0x72, 0x6e,
+	0x73, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72,
+	0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x18, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x4b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73,
+	0x22, 0x49, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b,
+	0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65,
+	0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64, 0x73,
+	0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x77, 0x0a, 0x1b, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61,
+	0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65,
+	0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65,
+	0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70,
+	0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50,
+	0x61, 0x74, 0x68, 0x73, 0x22, 0xa8, 0x01, 0x0a, 0x29, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e,
+	0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65,
+	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x5f, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x63,
+	0x72, 0x65, 0x64, 0x73, 0x70, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x12,
+	0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22,
+	0x86, 0x01, 0x0a, 0x2a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f,
+	0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19,
+	0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69,
+	0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18,
+	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46,
+	0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73, 0x22, 0x7a, 0x0a, 0x28, 0x52, 0x65, 0x6e, 0x65,
+	0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x22, 0x6a, 0x0a, 0x29, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62,
+	0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x3d, 0x0a, 0x1b, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x72,
+	0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x65, 0x64, 0x4b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73,
+	0x22, 0x37, 0x0a, 0x1a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19,
+	0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x49, 0x64, 0x22, 0x77, 0x0a, 0x1b, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x65, 0x61, 0x73,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x65, 0x61, 0x73,
+	0x65, 0x49, 0x64, 0x12, 0x3d, 0x0a, 0x1b, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6b,
+	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74,
+	0x68, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x18, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x61, 0x74,
+	0x68, 0x73, 0x32, 0x9f, 0x07, 0x0a, 0x19, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x46, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x73, 0x0a, 0x10, 0x41, 0x64, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c,
+	0x65, 0x61, 0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x1f, 0x41, 0x64, 0x64, 0x4e, 0x6f, 0x6e,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62,
+	0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x3d, 0x2e, 0x63, 0x72, 0x65, 0x64,
 	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43,
 	0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f,
 	0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x21, 0x52, 0x65,
-	0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e,
-	0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12,
-	0x3c, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74,
-	0x63, 0x68, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f,
-	0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e,
-	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68,
-	0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c,
-	0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x76, 0x0a, 0x13,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65,
-	0x61, 0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b,
-	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b,
-	0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x1f, 0x5a, 0x1d, 0x67, 0x72, 0x70, 0x63, 0x63, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65,
-	0x74, 0x63, 0x68, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69,
+	0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa0, 0x01, 0x0a, 0x21, 0x52, 0x65, 0x6e,
+	0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65,
+	0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x3c,
+	0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63,
+	0x68, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
+	0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65,
+	0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4e, 0x6f, 0x6e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x4a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65,
+	0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x76, 0x0a, 0x13, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61,
+	0x73, 0x65, 0x12, 0x2e, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
+	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65,
+	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
+	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65,
+	0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x5e, 0x0a, 0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x12, 0x26, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
+	0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e,
+	0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x76, 0x0a, 0x13, 0x41, 0x64, 0x64, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x2b, 0x2e, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e,
+	0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65,
+	0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x77, 0x0a, 0x15, 0x52,
+	0x65, 0x6e, 0x65, 0x77, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c,
+	0x65, 0x61, 0x73, 0x65, 0x12, 0x2b, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x4b, 0x65, 0x72, 0x62, 0x65, 0x72,
+	0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x31, 0x2e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x66,
+	0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x4b, 0x65, 0x72, 0x62,
+	0x65, 0x72, 0x6f, 0x73, 0x41, 0x72, 0x6e, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x23, 0x5a, 0x21, 0x67, 0x6d, 0x73, 0x61, 0x63, 0x72, 0x65, 0x64,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x66, 0x65, 0x74, 0x63, 0x68, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
-	file_credentialsfetcher_credentialsfetcher_proto_rawDescOnce sync.Once
-	file_credentialsfetcher_credentialsfetcher_proto_rawDescData = file_credentialsfetcher_credentialsfetcher_proto_rawDesc
+	file_protos_credentialsfetcher_proto_rawDescOnce sync.Once
+	file_protos_credentialsfetcher_proto_rawDescData = file_protos_credentialsfetcher_proto_rawDesc
 )
 
-func file_credentialsfetcher_credentialsfetcher_proto_rawDescGZIP() []byte {
-	file_credentialsfetcher_credentialsfetcher_proto_rawDescOnce.Do(func() {
-		file_credentialsfetcher_credentialsfetcher_proto_rawDescData = protoimpl.X.CompressGZIP(file_credentialsfetcher_credentialsfetcher_proto_rawDescData)
+func file_protos_credentialsfetcher_proto_rawDescGZIP() []byte {
+	file_protos_credentialsfetcher_proto_rawDescOnce.Do(func() {
+		file_protos_credentialsfetcher_proto_rawDescData = protoimpl.X.CompressGZIP(file_protos_credentialsfetcher_proto_rawDescData)
 	})
-	return file_credentialsfetcher_credentialsfetcher_proto_rawDescData
-}
-
-var file_credentialsfetcher_credentialsfetcher_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_credentialsfetcher_credentialsfetcher_proto_goTypes = []interface{}{
-	(*CreateKerberosLeaseRequest)(nil),                 // 0: credentialsfetcher.CreateKerberosLeaseRequest
-	(*CreateKerberosLeaseResponse)(nil),                // 1: credentialsfetcher.CreateKerberosLeaseResponse
-	(*CreateNonDomainJoinedKerberosLeaseRequest)(nil),  // 2: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
-	(*CreateNonDomainJoinedKerberosLeaseResponse)(nil), // 3: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
-	(*RenewNonDomainJoinedKerberosLeaseRequest)(nil),   // 4: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
-	(*RenewNonDomainJoinedKerberosLeaseResponse)(nil),  // 5: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
-	(*DeleteKerberosLeaseRequest)(nil),                 // 6: credentialsfetcher.DeleteKerberosLeaseRequest
-	(*DeleteKerberosLeaseResponse)(nil),                // 7: credentialsfetcher.DeleteKerberosLeaseResponse
-}
-var file_credentialsfetcher_credentialsfetcher_proto_depIdxs = []int32{
-	0, // 0: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:input_type -> credentialsfetcher.CreateKerberosLeaseRequest
-	2, // 1: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
-	4, // 2: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
-	6, // 3: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:input_type -> credentialsfetcher.DeleteKerberosLeaseRequest
-	1, // 4: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:output_type -> credentialsfetcher.CreateKerberosLeaseResponse
-	3, // 5: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
-	5, // 6: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
-	7, // 7: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:output_type -> credentialsfetcher.DeleteKerberosLeaseResponse
-	4, // [4:8] is the sub-list for method output_type
-	0, // [0:4] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_credentialsfetcher_credentialsfetcher_proto_init() }
-func file_credentialsfetcher_credentialsfetcher_proto_init() {
-	if File_credentialsfetcher_credentialsfetcher_proto != nil {
+	return file_protos_credentialsfetcher_proto_rawDescData
+}
+
+var file_protos_credentialsfetcher_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
+var file_protos_credentialsfetcher_proto_goTypes = []interface{}{
+	(*HealthCheckRequest)(nil),                         // 0: credentialsfetcher.HealthCheckRequest
+	(*HealthCheckResponse)(nil),                        // 1: credentialsfetcher.HealthCheckResponse
+	(*KerberosArnLeaseRequest)(nil),                    // 2: credentialsfetcher.KerberosArnLeaseRequest
+	(*CreateKerberosArnLeaseResponse)(nil),             // 3: credentialsfetcher.CreateKerberosArnLeaseResponse
+	(*RenewKerberosArnLeaseResponse)(nil),              // 4: credentialsfetcher.RenewKerberosArnLeaseResponse
+	(*KerberosTicketArnResponse)(nil),                  // 5: credentialsfetcher.KerberosTicketArnResponse
+	(*CreateKerberosLeaseRequest)(nil),                 // 6: credentialsfetcher.CreateKerberosLeaseRequest
+	(*CreateKerberosLeaseResponse)(nil),                // 7: credentialsfetcher.CreateKerberosLeaseResponse
+	(*CreateNonDomainJoinedKerberosLeaseRequest)(nil),  // 8: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
+	(*CreateNonDomainJoinedKerberosLeaseResponse)(nil), // 9: credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
+	(*RenewNonDomainJoinedKerberosLeaseRequest)(nil),   // 10: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
+	(*RenewNonDomainJoinedKerberosLeaseResponse)(nil),  // 11: credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
+	(*DeleteKerberosLeaseRequest)(nil),                 // 12: credentialsfetcher.DeleteKerberosLeaseRequest
+	(*DeleteKerberosLeaseResponse)(nil),                // 13: credentialsfetcher.DeleteKerberosLeaseResponse
+}
+var file_protos_credentialsfetcher_proto_depIdxs = []int32{
+	5,  // 0: credentialsfetcher.CreateKerberosArnLeaseResponse.krb_ticket_response_map:type_name -> credentialsfetcher.KerberosTicketArnResponse
+	6,  // 1: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:input_type -> credentialsfetcher.CreateKerberosLeaseRequest
+	8,  // 2: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseRequest
+	10, // 3: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:input_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseRequest
+	12, // 4: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:input_type -> credentialsfetcher.DeleteKerberosLeaseRequest
+	0,  // 5: credentialsfetcher.CredentialsFetcherService.HealthCheck:input_type -> credentialsfetcher.HealthCheckRequest
+	2,  // 6: credentialsfetcher.CredentialsFetcherService.AddKerberosArnLease:input_type -> credentialsfetcher.KerberosArnLeaseRequest
+	2,  // 7: credentialsfetcher.CredentialsFetcherService.RenewKerberosArnLease:input_type -> credentialsfetcher.KerberosArnLeaseRequest
+	7,  // 8: credentialsfetcher.CredentialsFetcherService.AddKerberosLease:output_type -> credentialsfetcher.CreateKerberosLeaseResponse
+	9,  // 9: credentialsfetcher.CredentialsFetcherService.AddNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.CreateNonDomainJoinedKerberosLeaseResponse
+	11, // 10: credentialsfetcher.CredentialsFetcherService.RenewNonDomainJoinedKerberosLease:output_type -> credentialsfetcher.RenewNonDomainJoinedKerberosLeaseResponse
+	13, // 11: credentialsfetcher.CredentialsFetcherService.DeleteKerberosLease:output_type -> credentialsfetcher.DeleteKerberosLeaseResponse
+	1,  // 12: credentialsfetcher.CredentialsFetcherService.HealthCheck:output_type -> credentialsfetcher.HealthCheckResponse
+	3,  // 13: credentialsfetcher.CredentialsFetcherService.AddKerberosArnLease:output_type -> credentialsfetcher.CreateKerberosArnLeaseResponse
+	4,  // 14: credentialsfetcher.CredentialsFetcherService.RenewKerberosArnLease:output_type -> credentialsfetcher.RenewKerberosArnLeaseResponse
+	8,  // [8:15] is the sub-list for method output_type
+	1,  // [1:8] is the sub-list for method input_type
+	1,  // [1:1] is the sub-list for extension type_name
+	1,  // [1:1] is the sub-list for extension extendee
+	0,  // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_protos_credentialsfetcher_proto_init() }
+
+//gocyclo:ignore
+func file_protos_credentialsfetcher_proto_init() {
+	if File_protos_credentialsfetcher_proto != nil {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthCheckRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthCheckResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KerberosArnLeaseRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateKerberosArnLeaseResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RenewKerberosArnLeaseResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KerberosTicketArnResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_protos_credentialsfetcher_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -629,7 +1108,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -641,7 +1120,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateNonDomainJoinedKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -653,7 +1132,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CreateNonDomainJoinedKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -665,7 +1144,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RenewNonDomainJoinedKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -677,7 +1156,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RenewNonDomainJoinedKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -689,7 +1168,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DeleteKerberosLeaseRequest); i {
 			case 0:
 				return &v.state
@@ -701,7 +1180,7 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 				return nil
 			}
 		}
-		file_credentialsfetcher_credentialsfetcher_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+		file_protos_credentialsfetcher_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DeleteKerberosLeaseResponse); i {
 			case 0:
 				return &v.state
@@ -718,18 +1197,18 @@ func file_credentialsfetcher_credentialsfetcher_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_credentialsfetcher_credentialsfetcher_proto_rawDesc,
+			RawDescriptor: file_protos_credentialsfetcher_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   8,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_credentialsfetcher_credentialsfetcher_proto_goTypes,
-		DependencyIndexes: file_credentialsfetcher_credentialsfetcher_proto_depIdxs,
-		MessageInfos:      file_credentialsfetcher_credentialsfetcher_proto_msgTypes,
+		GoTypes:           file_protos_credentialsfetcher_proto_goTypes,
+		DependencyIndexes: file_protos_credentialsfetcher_proto_depIdxs,
+		MessageInfos:      file_protos_credentialsfetcher_proto_msgTypes,
 	}.Build()
-	File_credentialsfetcher_credentialsfetcher_proto = out.File
-	file_credentialsfetcher_credentialsfetcher_proto_rawDesc = nil
-	file_credentialsfetcher_credentialsfetcher_proto_goTypes = nil
-	file_credentialsfetcher_credentialsfetcher_proto_depIdxs = nil
+	File_protos_credentialsfetcher_proto = out.File
+	file_protos_credentialsfetcher_proto_rawDesc = nil
+	file_protos_credentialsfetcher_proto_goTypes = nil
+	file_protos_credentialsfetcher_proto_depIdxs = nil
 }
diff --git a/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto b/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto
index 5393650b16f..9070c16bf43 100644
--- a/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto
+++ b/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher.proto
@@ -15,6 +15,39 @@ service CredentialsFetcherService {
   rpc RenewNonDomainJoinedKerberosLease
       (RenewNonDomainJoinedKerberosLeaseRequest) returns (RenewNonDomainJoinedKerberosLeaseResponse);
   rpc DeleteKerberosLease (DeleteKerberosLeaseRequest) returns (DeleteKerberosLeaseResponse);
+  rpc HealthCheck(HealthCheckRequest) returns (HealthCheckResponse);
+  rpc AddKerberosArnLease (KerberosArnLeaseRequest) returns (CreateKerberosArnLeaseResponse);
+  rpc RenewKerberosArnLease (KerberosArnLeaseRequest) returns (RenewKerberosArnLeaseResponse);
+}
+
+message HealthCheckRequest {
+  string service = 1;
+}
+
+message HealthCheckResponse {
+  string status = 1;
+}
+
+message KerberosArnLeaseRequest {
+  repeated string credspec_arns = 1;
+  string access_key_id = 2;
+  string secret_access_key = 3;
+  string session_token = 4;
+  string region = 5;
+}
+
+message CreateKerberosArnLeaseResponse {
+  string lease_id = 1;
+  repeated KerberosTicketArnResponse krb_ticket_response_map = 2;
+}
+
+message RenewKerberosArnLeaseResponse {
+  string status = 1;
+}
+
+message KerberosTicketArnResponse {
+  string credspec_arns = 1;
+  string created_kerberos_file_paths = 2;
 }
 
 message CreateKerberosLeaseRequest {
@@ -48,6 +81,7 @@ message RenewNonDomainJoinedKerberosLeaseResponse{
   repeated string renewed_kerberos_file_paths = 1;
 }
 
+
 message DeleteKerberosLeaseRequest {
   string lease_id = 1;
 }
diff --git a/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go b/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go
index 071fa0a7edb..9ddfd4fc055 100644
--- a/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go
+++ b/ecs-agent/gmsacredclient/credentialsfetcher/credentialsfetcher_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.15.8
+// - protoc             v3.19.6
 // source: credentialsfetcher/credentialsfetcher.proto
 
 package credentialsfetcher
@@ -27,6 +27,9 @@ type CredentialsFetcherServiceClient interface {
 	AddNonDomainJoinedKerberosLease(ctx context.Context, in *CreateNonDomainJoinedKerberosLeaseRequest, opts ...grpc.CallOption) (*CreateNonDomainJoinedKerberosLeaseResponse, error)
 	RenewNonDomainJoinedKerberosLease(ctx context.Context, in *RenewNonDomainJoinedKerberosLeaseRequest, opts ...grpc.CallOption) (*RenewNonDomainJoinedKerberosLeaseResponse, error)
 	DeleteKerberosLease(ctx context.Context, in *DeleteKerberosLeaseRequest, opts ...grpc.CallOption) (*DeleteKerberosLeaseResponse, error)
+	HealthCheck(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error)
+	AddKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*CreateKerberosArnLeaseResponse, error)
+	RenewKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*RenewKerberosArnLeaseResponse, error)
 }
 
 type credentialsFetcherServiceClient struct {
@@ -73,6 +76,33 @@ func (c *credentialsFetcherServiceClient) DeleteKerberosLease(ctx context.Contex
 	return out, nil
 }
 
+func (c *credentialsFetcherServiceClient) HealthCheck(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error) {
+	out := new(HealthCheckResponse)
+	err := c.cc.Invoke(ctx, "/credentialsfetcher.CredentialsFetcherService/HealthCheck", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *credentialsFetcherServiceClient) AddKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*CreateKerberosArnLeaseResponse, error) {
+	out := new(CreateKerberosArnLeaseResponse)
+	err := c.cc.Invoke(ctx, "/credentialsfetcher.CredentialsFetcherService/AddKerberosArnLease", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *credentialsFetcherServiceClient) RenewKerberosArnLease(ctx context.Context, in *KerberosArnLeaseRequest, opts ...grpc.CallOption) (*RenewKerberosArnLeaseResponse, error) {
+	out := new(RenewKerberosArnLeaseResponse)
+	err := c.cc.Invoke(ctx, "/credentialsfetcher.CredentialsFetcherService/RenewKerberosArnLease", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // CredentialsFetcherServiceServer is the server API for CredentialsFetcherService service.
 // All implementations must embed UnimplementedCredentialsFetcherServiceServer
 // for forward compatibility
@@ -81,6 +111,9 @@ type CredentialsFetcherServiceServer interface {
 	AddNonDomainJoinedKerberosLease(context.Context, *CreateNonDomainJoinedKerberosLeaseRequest) (*CreateNonDomainJoinedKerberosLeaseResponse, error)
 	RenewNonDomainJoinedKerberosLease(context.Context, *RenewNonDomainJoinedKerberosLeaseRequest) (*RenewNonDomainJoinedKerberosLeaseResponse, error)
 	DeleteKerberosLease(context.Context, *DeleteKerberosLeaseRequest) (*DeleteKerberosLeaseResponse, error)
+	HealthCheck(context.Context, *HealthCheckRequest) (*HealthCheckResponse, error)
+	AddKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*CreateKerberosArnLeaseResponse, error)
+	RenewKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*RenewKerberosArnLeaseResponse, error)
 	mustEmbedUnimplementedCredentialsFetcherServiceServer()
 }
 
@@ -100,6 +133,15 @@ func (UnimplementedCredentialsFetcherServiceServer) RenewNonDomainJoinedKerberos
 func (UnimplementedCredentialsFetcherServiceServer) DeleteKerberosLease(context.Context, *DeleteKerberosLeaseRequest) (*DeleteKerberosLeaseResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteKerberosLease not implemented")
 }
+func (UnimplementedCredentialsFetcherServiceServer) HealthCheck(context.Context, *HealthCheckRequest) (*HealthCheckResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method HealthCheck not implemented")
+}
+func (UnimplementedCredentialsFetcherServiceServer) AddKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*CreateKerberosArnLeaseResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddKerberosArnLease not implemented")
+}
+func (UnimplementedCredentialsFetcherServiceServer) RenewKerberosArnLease(context.Context, *KerberosArnLeaseRequest) (*RenewKerberosArnLeaseResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RenewKerberosArnLease not implemented")
+}
 func (UnimplementedCredentialsFetcherServiceServer) mustEmbedUnimplementedCredentialsFetcherServiceServer() {
 }
 
@@ -186,6 +228,60 @@ func _CredentialsFetcherService_DeleteKerberosLease_Handler(srv interface{}, ctx
 	return interceptor(ctx, in, info, handler)
 }
 
+func _CredentialsFetcherService_HealthCheck_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(HealthCheckRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CredentialsFetcherServiceServer).HealthCheck(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/credentialsfetcher.CredentialsFetcherService/HealthCheck",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CredentialsFetcherServiceServer).HealthCheck(ctx, req.(*HealthCheckRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CredentialsFetcherService_AddKerberosArnLease_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KerberosArnLeaseRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CredentialsFetcherServiceServer).AddKerberosArnLease(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/credentialsfetcher.CredentialsFetcherService/AddKerberosArnLease",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CredentialsFetcherServiceServer).AddKerberosArnLease(ctx, req.(*KerberosArnLeaseRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CredentialsFetcherService_RenewKerberosArnLease_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KerberosArnLeaseRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CredentialsFetcherServiceServer).RenewKerberosArnLease(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/credentialsfetcher.CredentialsFetcherService/RenewKerberosArnLease",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CredentialsFetcherServiceServer).RenewKerberosArnLease(ctx, req.(*KerberosArnLeaseRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // CredentialsFetcherService_ServiceDesc is the grpc.ServiceDesc for CredentialsFetcherService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -209,6 +305,18 @@ var CredentialsFetcherService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteKerberosLease",
 			Handler:    _CredentialsFetcherService_DeleteKerberosLease_Handler,
 		},
+		{
+			MethodName: "HealthCheck",
+			Handler:    _CredentialsFetcherService_HealthCheck_Handler,
+		},
+		{
+			MethodName: "AddKerberosArnLease",
+			Handler:    _CredentialsFetcherService_AddKerberosArnLease_Handler,
+		},
+		{
+			MethodName: "RenewKerberosArnLease",
+			Handler:    _CredentialsFetcherService_RenewKerberosArnLease_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "credentialsfetcher/credentialsfetcher.proto",
diff --git a/ecs-agent/gmsacredclient/credentialsfetcherclient.go b/ecs-agent/gmsacredclient/credentialsfetcherclient.go
index 7ef2f54d155..080b0459a51 100644
--- a/ecs-agent/gmsacredclient/credentialsfetcherclient.go
+++ b/ecs-agent/gmsacredclient/credentialsfetcherclient.go
@@ -5,13 +5,12 @@ import (
 	"os"
 	"time"
 
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
 	pb "github.com/aws/amazon-ecs-agent/ecs-agent/gmsacredclient/credentialsfetcher"
 	"github.com/cihub/seelog"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
 )
 
 type CredentialsFetcherClient struct {
@@ -62,6 +61,114 @@ type CredentialsFetcherResponse struct {
 	KerberosTicketPaths []string
 }
 
+// Credentials fetcher is a daemon running on the host which supports gMSA on linux
+type CredentialsFetcherArnResponse struct {
+	//lease id is a unique identifier associated with the kerberos tickets created for a container
+	LeaseID string
+	//path to the kerberos tickets created for the service accounts
+	KerberosTicketsMap map[string]string
+}
+
+// HealthCheck() invokes credentials fetcher daemon running on the host
+// to check the health status of daemon
+func (c CredentialsFetcherClient) HealthCheck(ctx context.Context, serviceName string) (string, error) {
+	if len(serviceName) == 0 {
+		return "", status.Errorf(codes.InvalidArgument, "service name should not be empty")
+	}
+	defer c.conn.Close()
+	client := pb.NewCredentialsFetcherServiceClient(c.conn)
+
+	request := &pb.HealthCheckRequest{Service: serviceName}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	response, err := client.HealthCheck(ctx, request)
+	if err != nil {
+		seelog.Errorf("credentials-fetcher daemon status is unhealthy during health check: %v", err)
+		return "", err
+	}
+	seelog.Debugf("credentials-fetcher daemon is running")
+
+	return response.GetStatus(), nil
+}
+
+// AddKerberosArnLease() invokes credentials fetcher daemon running on the host
+// to create kerberos tickets associated with gMSA accounts
+func (c CredentialsFetcherClient) AddKerberosArnLease(ctx context.Context, credentialspecsArns []string, accessKeyId string, secretKey string, sessionToken string, region string) (CredentialsFetcherArnResponse, error) {
+	if len(credentialspecsArns) == 0 {
+		return CredentialsFetcherArnResponse{}, status.Errorf(codes.InvalidArgument, "credentialspecArns should not be empty")
+	}
+
+	if len(accessKeyId) == 0 || len(secretKey) == 0 || len(sessionToken) == 0 || len(region) == 0 {
+		return CredentialsFetcherArnResponse{}, status.Errorf(codes.InvalidArgument, "accessid, secretkey, sessiontoken or region should not be empty")
+	}
+
+	defer c.conn.Close()
+	client := pb.NewCredentialsFetcherServiceClient(c.conn)
+
+	request := &pb.KerberosArnLeaseRequest{CredspecArns: credentialspecsArns, AccessKeyId: accessKeyId, SecretAccessKey: secretKey, SessionToken: sessionToken, Region: region}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	response, err := client.AddKerberosArnLease(ctx, request)
+	if err != nil {
+		seelog.Errorf("could not create kerberos tickets: %v", err)
+		return CredentialsFetcherArnResponse{}, err
+	}
+	seelog.Infof("created kerberos tickets and associated with LeaseID: %s", response.GetLeaseId())
+
+	credentialsFetcherResponse := CredentialsFetcherArnResponse{
+		LeaseID:            response.GetLeaseId(),
+		KerberosTicketsMap: make(map[string]string),
+	}
+
+	for _, value := range response.GetKrbTicketResponseMap() {
+		credSpecArns := value.GetCredspecArns()
+		_, ok := credentialsFetcherResponse.KerberosTicketsMap[credSpecArns]
+		if !ok {
+			credentialsFetcherResponse.KerberosTicketsMap[credSpecArns] = value.GetCreatedKerberosFilePaths()
+		}
+	}
+
+	return credentialsFetcherResponse, nil
+}
+
+// RenewKerberosArnLease() invokes credentials fetcher daemon running on the host
+// to renew kerberos tickets associated with gMSA accounts
+func (c CredentialsFetcherClient) RenewKerberosArnLease(ctx context.Context, credentialspecsArns []string, accessKeyId string, secretKey string, sessionToken string, region string) (string, error) {
+	if len(credentialspecsArns) == 0 {
+		return codes.InvalidArgument.String(), status.Errorf(codes.InvalidArgument, "credentialspecArns should not be empty")
+	}
+
+	if len(accessKeyId) == 0 || len(secretKey) == 0 || len(sessionToken) == 0 || len(region) == 0 {
+		return codes.InvalidArgument.String(), status.Errorf(codes.InvalidArgument, "accessid, secretkey, sessiontoken or region should not be empty")
+	}
+
+	defer c.conn.Close()
+	client := pb.NewCredentialsFetcherServiceClient(c.conn)
+
+	request := &pb.KerberosArnLeaseRequest{CredspecArns: credentialspecsArns, AccessKeyId: accessKeyId, SecretAccessKey: secretKey, SessionToken: sessionToken, Region: region}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	response, err := client.RenewKerberosArnLease(ctx, request)
+	if err != nil {
+		seelog.Errorf("could not renew kerberos tickets: %v", err)
+		return codes.Internal.String(), err
+	}
+
+	if response.GetStatus() == "failed" {
+		return codes.Internal.String(), status.Errorf(codes.Internal, "renewal of kerberos tickets failed")
+	}
+
+	seelog.Infof("renewal of kerberos tickets are successful")
+
+	return codes.OK.String(), nil
+}
+
 // AddKerberosLease() invokes credentials fetcher daemon running on the host
 // to create kerberos tickets associated with gMSA accounts
 func (c CredentialsFetcherClient) AddKerberosLease(ctx context.Context, credentialspecs []string) (CredentialsFetcherResponse, error) {
@@ -74,7 +181,7 @@ func (c CredentialsFetcherClient) AddKerberosLease(ctx context.Context, credenti
 
 	request := &pb.CreateKerberosLeaseRequest{CredspecContents: credentialspecs}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.AddKerberosLease(ctx, request)
@@ -110,7 +217,7 @@ func (c CredentialsFetcherClient) AddNonDomainJoinedKerberosLease(ctx context.Co
 
 	request := &pb.CreateNonDomainJoinedKerberosLeaseRequest{CredspecContents: credentialspecs, Username: username, Password: password, Domain: domain}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.AddNonDomainJoinedKerberosLease(ctx, request)
@@ -141,7 +248,7 @@ func (c CredentialsFetcherClient) RenewNonDomainJoinedKerberosLease(ctx context.
 
 	request := &pb.RenewNonDomainJoinedKerberosLeaseRequest{Username: username, Password: password, Domain: domain}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.RenewNonDomainJoinedKerberosLease(ctx, request)
@@ -170,7 +277,7 @@ func (c CredentialsFetcherClient) DeleteKerberosLease(ctx context.Context, lease
 
 	request := &pb.DeleteKerberosLeaseRequest{LeaseId: leaseid}
 
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(c.timeout))
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	response, err := client.DeleteKerberosLease(ctx, request)
diff --git a/ecs-agent/gmsacredclient/credentialsfetcherclient_test.go b/ecs-agent/gmsacredclient/credentialsfetcherclient_test.go
index 684a41cde69..6d496800a0f 100644
--- a/ecs-agent/gmsacredclient/credentialsfetcherclient_test.go
+++ b/ecs-agent/gmsacredclient/credentialsfetcherclient_test.go
@@ -40,6 +40,14 @@ type mockCredentialsFetcherServer struct {
 	pb.UnimplementedCredentialsFetcherServiceServer
 }
 
+func (*mockCredentialsFetcherServer) HealthCheck(ctx context.Context, req *pb.HealthCheckRequest) (*pb.HealthCheckResponse, error) {
+	if len(req.GetService()) == 0 {
+		return &pb.HealthCheckResponse{Status: "Failed"}, status.Errorf(codes.InvalidArgument, "service name should not be empty")
+	}
+
+	return &pb.HealthCheckResponse{Status: "OK"}, nil
+}
+
 func (*mockCredentialsFetcherServer) AddKerberosLease(ctx context.Context, req *pb.CreateKerberosLeaseRequest) (*pb.CreateKerberosLeaseResponse, error) {
 	if len(req.GetCredspecContents()) == 0 {
 		return &pb.CreateKerberosLeaseResponse{}, status.Errorf(codes.InvalidArgument, "credentialspecs request should not be empty")
@@ -48,6 +56,32 @@ func (*mockCredentialsFetcherServer) AddKerberosLease(ctx context.Context, req *
 	return &pb.CreateKerberosLeaseResponse{LeaseId: leaseid, CreatedKerberosFilePaths: []string{"/var/credentials-fetcher/krbdir/123456/webapp01", "/var/credentials-fetcher/krbdir/123456/webapp02"}}, nil
 }
 
+func (*mockCredentialsFetcherServer) AddKerberosArnLease(ctx context.Context, req *pb.KerberosArnLeaseRequest) (*pb.CreateKerberosArnLeaseResponse, error) {
+	if len(req.GetCredspecArns()) == 0 {
+		return &pb.CreateKerberosArnLeaseResponse{}, status.Errorf(codes.InvalidArgument, "credentialspecsarns request should not be empty")
+	}
+
+	if len(req.GetAccessKeyId()) == 0 || len(req.GetSecretAccessKey()) == 0 || len(req.GetSessionToken()) == 0 || len(req.GetRegion()) == 0 {
+		return &pb.CreateKerberosArnLeaseResponse{}, status.Errorf(codes.InvalidArgument, "accessid, secretkey, sessiontoken or region should not be empty")
+	}
+
+	var responseMap = &pb.KerberosTicketArnResponse{CredspecArns: "arn:aws:s3:::gmsacredspec/gmsa-cred-spec.json", CreatedKerberosFilePaths: "/var/credentials-fetcher/krbdir/123456/webapp01"}
+
+	return &pb.CreateKerberosArnLeaseResponse{LeaseId: leaseid, KrbTicketResponseMap: []*pb.KerberosTicketArnResponse{responseMap}}, nil
+}
+
+func (*mockCredentialsFetcherServer) RenewKerberosArnLease(ctx context.Context, req *pb.KerberosArnLeaseRequest) (*pb.RenewKerberosArnLeaseResponse, error) {
+	if len(req.GetCredspecArns()) == 0 {
+		return &pb.RenewKerberosArnLeaseResponse{Status: "failed"}, status.Errorf(codes.InvalidArgument, "credentialspecsarns request should not be empty")
+	}
+
+	if len(req.GetAccessKeyId()) == 0 || len(req.GetSecretAccessKey()) == 0 || len(req.GetSessionToken()) == 0 || len(req.GetRegion()) == 0 {
+		return &pb.RenewKerberosArnLeaseResponse{Status: "failed"}, status.Errorf(codes.InvalidArgument, "accessid, secretkey, sessiontoken or region should not be empty")
+	}
+
+	return &pb.RenewKerberosArnLeaseResponse{Status: "OK"}, nil
+}
+
 func (*mockCredentialsFetcherServer) AddNonDomainJoinedKerberosLease(ctx context.Context, req *pb.CreateNonDomainJoinedKerberosLeaseRequest) (*pb.CreateNonDomainJoinedKerberosLeaseResponse, error) {
 	if len(req.GetCredspecContents()) == 0 {
 		return &pb.CreateNonDomainJoinedKerberosLeaseResponse{}, status.Errorf(codes.InvalidArgument, "credentialspecs request should not be empty")
@@ -94,6 +128,45 @@ func dialer() func(context.Context, string) (net.Conn, error) {
 	}
 }
 
+func TestCredentialsFetcherClient_Health(t *testing.T) {
+	tests := []struct {
+		name          string
+		serviceName   string
+		response      string
+		expectedError string
+	}{
+		{
+			"inactive credentials-fetcher daemon",
+			"",
+			"Failed",
+			"rpc error: code = InvalidArgument desc = service name should not be empty",
+		},
+		{
+			"active credentials-fetcher daemon",
+			"testservice",
+			"OK",
+			"",
+		},
+	}
+
+	ctx := context.Background()
+
+	conn, err := grpc.DialContext(ctx, "", grpc.WithInsecure(), grpc.WithContextDialer(dialer()))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response, err := NewCredentialsFetcherClient(conn, time.Minute).HealthCheck(context.Background(), tt.serviceName)
+			if tt.expectedError != "" {
+				assert.EqualError(t, err, tt.expectedError)
+			} else {
+				assert.Equal(t, tt.response, response)
+			}
+		})
+	}
+}
+
 func TestCredentialsFetcherClient_AddKerberosLease(t *testing.T) {
 	tests := []struct {
 		name             string
@@ -133,6 +206,128 @@ func TestCredentialsFetcherClient_AddKerberosLease(t *testing.T) {
 	}
 }
 
+func TestCredentialsFetcherClient_AddNonDomainJoinedKerberosArnLease(t *testing.T) {
+	tests := []struct {
+		name          string
+		credspecArn   []string
+		accessId      string
+		secretKey     string
+		sessionToken  string
+		region        string
+		response      CredentialsFetcherArnResponse
+		expectedError string
+	}{
+		{
+			"invalid request empty credspecArn contents",
+			[]string{},
+			"testusername",
+			"testpassword",
+			"testdomain",
+			"testregion",
+			CredentialsFetcherArnResponse{},
+			"rpc error: code = InvalidArgument desc = credentialspecArns should not be empty",
+		},
+		{
+			"invalid request username, password or domain should not be empty",
+			[]string{credspec_webapp01},
+			"",
+			"",
+			"",
+			"",
+			CredentialsFetcherArnResponse{},
+			"rpc error: code = InvalidArgument desc = accessid, secretkey, sessiontoken or region should not be empty",
+		},
+		{
+			"valid request credspecs associated to gMSA account",
+			[]string{credspec_webapp01},
+			"testusername",
+			"testpassword",
+			"testdomain",
+			"testregion",
+			CredentialsFetcherArnResponse{LeaseID: "123456", KerberosTicketsMap: map[string]string{"arn:aws:s3:::gmsacredspec/gmsa-cred-spec.json": "/var/credentials-fetcher/krbdir/123456/webapp01"}},
+			"",
+		},
+	}
+
+	ctx := context.Background()
+
+	conn, err := grpc.DialContext(ctx, "", grpc.WithInsecure(), grpc.WithContextDialer(dialer()))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response, err := NewCredentialsFetcherClient(conn, time.Minute).AddKerberosArnLease(context.Background(), tt.credspecArn, tt.accessId, tt.secretKey, tt.sessionToken, tt.region)
+			if tt.expectedError != "" {
+				assert.EqualError(t, err, tt.expectedError)
+			} else {
+				assert.Equal(t, tt.response, response)
+			}
+		})
+	}
+}
+
+func TestCredentialsFetcherClient_RenewNonDomainJoinedKerberosArnLease(t *testing.T) {
+	tests := []struct {
+		name          string
+		credspecArn   []string
+		accessId      string
+		secretKey     string
+		sessionToken  string
+		region        string
+		response      string
+		expectedError string
+	}{
+		{
+			"invalid request empty credspecArn contents",
+			[]string{},
+			"testusername",
+			"testpassword",
+			"testdomain",
+			"testregion",
+			"",
+			"rpc error: code = InvalidArgument desc = credentialspecArns should not be empty",
+		},
+		{
+			"invalid request username, password or domain should not be empty",
+			[]string{credspec_webapp01},
+			"",
+			"",
+			"",
+			"",
+			"",
+			"rpc error: code = InvalidArgument desc = accessid, secretkey, sessiontoken or region should not be empty",
+		},
+		{
+			"valid request credspecs associated to gMSA account",
+			[]string{credspec_webapp01},
+			"testusername",
+			"testpassword",
+			"testdomain",
+			"testregion",
+			"OK",
+			"",
+		},
+	}
+
+	ctx := context.Background()
+
+	conn, err := grpc.DialContext(ctx, "", grpc.WithInsecure(), grpc.WithContextDialer(dialer()))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response, err := NewCredentialsFetcherClient(conn, time.Minute).RenewKerberosArnLease(context.Background(), tt.credspecArn, tt.accessId, tt.secretKey, tt.sessionToken, tt.region)
+			if tt.expectedError != "" {
+				assert.EqualError(t, err, tt.expectedError)
+			} else {
+				assert.Equal(t, tt.response, response)
+			}
+		})
+	}
+}
+
 func TestCredentialsFetcherClient_AddNonDomainJoinedKerberosLease(t *testing.T) {
 	tests := []struct {
 		name             string