From b30857ceb62f91f8daa4abfe99cfcd34c06e465b Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Wed, 24 Jun 2026 13:48:36 +0200
Subject: [PATCH 1/2] Add admin tenant add-member

---
 doc/index.html                                |  60 +++++++
 .../admin/v2/adminv2connect/tenant.connect.go |  38 +++-
 go/metalstack/admin/v2/tenant.pb.go           | 163 +++++++++++++++---
 go/permissions/servicepermissions.go          |   4 +
 .../v2/adminv2connect/TenantServiceClient.go  |  68 ++++++++
 .../v2/adminv2connect/TenantServiceHandler.go |  68 ++++++++
 js/buf/validate/validate_pb.ts                |   2 +-
 js/metalstack/admin/v2/audit_pb.js            |   2 +-
 js/metalstack/admin/v2/audit_pb.ts            |   2 +-
 js/metalstack/admin/v2/component_pb.js        |   2 +-
 js/metalstack/admin/v2/component_pb.ts        |   2 +-
 js/metalstack/admin/v2/filesystem_pb.js       |   2 +-
 js/metalstack/admin/v2/filesystem_pb.ts       |   2 +-
 js/metalstack/admin/v2/image_pb.js            |   2 +-
 js/metalstack/admin/v2/image_pb.ts            |   2 +-
 js/metalstack/admin/v2/ip_pb.js               |   2 +-
 js/metalstack/admin/v2/ip_pb.ts               |   2 +-
 js/metalstack/admin/v2/machine_pb.js          |   2 +-
 js/metalstack/admin/v2/machine_pb.ts          |   2 +-
 js/metalstack/admin/v2/network_pb.js          |   2 +-
 js/metalstack/admin/v2/network_pb.ts          |   2 +-
 js/metalstack/admin/v2/partition_pb.js        |   2 +-
 js/metalstack/admin/v2/partition_pb.ts        |   2 +-
 js/metalstack/admin/v2/project_pb.js          |   2 +-
 js/metalstack/admin/v2/project_pb.ts          |   2 +-
 .../admin/v2/size_imageconstraint_pb.js       |   2 +-
 .../admin/v2/size_imageconstraint_pb.ts       |   2 +-
 js/metalstack/admin/v2/size_pb.js             |   2 +-
 js/metalstack/admin/v2/size_pb.ts             |   2 +-
 js/metalstack/admin/v2/size_reservation_pb.js |   2 +-
 js/metalstack/admin/v2/size_reservation_pb.ts |   2 +-
 js/metalstack/admin/v2/switch_pb.js           |   2 +-
 js/metalstack/admin/v2/switch_pb.ts           |   2 +-
 js/metalstack/admin/v2/task_pb.js             |   2 +-
 js/metalstack/admin/v2/task_pb.ts             |   2 +-
 js/metalstack/admin/v2/tenant_pb.d.ts         |  53 +++++-
 js/metalstack/admin/v2/tenant_pb.js           |  14 +-
 js/metalstack/admin/v2/tenant_pb.ts           |  66 ++++++-
 js/metalstack/admin/v2/token_pb.js            |   2 +-
 js/metalstack/admin/v2/token_pb.ts            |   2 +-
 js/metalstack/admin/v2/vpn_pb.js              |   2 +-
 js/metalstack/admin/v2/vpn_pb.ts              |   2 +-
 js/metalstack/api/v2/audit_pb.js              |   2 +-
 js/metalstack/api/v2/audit_pb.ts              |   2 +-
 js/metalstack/api/v2/common_pb.js             |   2 +-
 js/metalstack/api/v2/common_pb.ts             |   2 +-
 js/metalstack/api/v2/component_pb.js          |   2 +-
 js/metalstack/api/v2/component_pb.ts          |   2 +-
 js/metalstack/api/v2/filesystem_pb.js         |   2 +-
 js/metalstack/api/v2/filesystem_pb.ts         |   2 +-
 js/metalstack/api/v2/health_pb.js             |   2 +-
 js/metalstack/api/v2/health_pb.ts             |   2 +-
 js/metalstack/api/v2/image_pb.js              |   2 +-
 js/metalstack/api/v2/image_pb.ts              |   2 +-
 js/metalstack/api/v2/ip_pb.js                 |   2 +-
 js/metalstack/api/v2/ip_pb.ts                 |   2 +-
 js/metalstack/api/v2/machine_pb.js            |   2 +-
 js/metalstack/api/v2/machine_pb.ts            |   2 +-
 js/metalstack/api/v2/method_pb.js             |   2 +-
 js/metalstack/api/v2/method_pb.ts             |   2 +-
 js/metalstack/api/v2/network_pb.js            |   2 +-
 js/metalstack/api/v2/network_pb.ts            |   2 +-
 js/metalstack/api/v2/partition_pb.js          |   2 +-
 js/metalstack/api/v2/partition_pb.ts          |   2 +-
 js/metalstack/api/v2/predefined_rules_pb.js   |   2 +-
 js/metalstack/api/v2/predefined_rules_pb.ts   |   2 +-
 js/metalstack/api/v2/project_pb.js            |   2 +-
 js/metalstack/api/v2/project_pb.ts            |   2 +-
 .../api/v2/size_imageconstraint_pb.js         |   2 +-
 .../api/v2/size_imageconstraint_pb.ts         |   2 +-
 js/metalstack/api/v2/size_pb.js               |   2 +-
 js/metalstack/api/v2/size_pb.ts               |   2 +-
 js/metalstack/api/v2/size_reservation_pb.js   |   2 +-
 js/metalstack/api/v2/size_reservation_pb.ts   |   2 +-
 js/metalstack/api/v2/switch_pb.js             |   2 +-
 js/metalstack/api/v2/switch_pb.ts             |   2 +-
 js/metalstack/api/v2/tenant_pb.js             |   2 +-
 js/metalstack/api/v2/tenant_pb.ts             |   2 +-
 js/metalstack/api/v2/token_pb.js              |   2 +-
 js/metalstack/api/v2/token_pb.ts              |   2 +-
 js/metalstack/api/v2/user_pb.js               |   2 +-
 js/metalstack/api/v2/user_pb.ts               |   2 +-
 js/metalstack/api/v2/version_pb.js            |   2 +-
 js/metalstack/api/v2/version_pb.ts            |   2 +-
 js/metalstack/api/v2/vpn_pb.js                |   2 +-
 js/metalstack/api/v2/vpn_pb.ts                |   2 +-
 js/metalstack/infra/v2/bmc_pb.js              |   2 +-
 js/metalstack/infra/v2/bmc_pb.ts              |   2 +-
 js/metalstack/infra/v2/boot_pb.js             |   2 +-
 js/metalstack/infra/v2/boot_pb.ts             |   2 +-
 js/metalstack/infra/v2/component_pb.js        |   2 +-
 js/metalstack/infra/v2/component_pb.ts        |   2 +-
 js/metalstack/infra/v2/event_pb.js            |   2 +-
 js/metalstack/infra/v2/event_pb.ts            |   2 +-
 js/metalstack/infra/v2/switch_pb.js           |   2 +-
 js/metalstack/infra/v2/switch_pb.ts           |   2 +-
 proto/buf.gen.yaml                            |   2 +-
 proto/metalstack/admin/v2/tenant.proto        |  20 ++-
 python/metalstack/admin/v2/tenant_connect.py  |  65 +++++++
 python/metalstack/admin/v2/tenant_pb2.py      |  20 ++-
 python/metalstack/admin/v2/tenant_pb2.pyi     |  14 ++
 101 files changed, 703 insertions(+), 126 deletions(-)

diff --git a/doc/index.html b/doc/index.html
index 21a980e9..e14c9330 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -2298,6 +2298,14 @@ <h2>Table of Contents</h2>
             <a href="#metalstack%2fadmin%2fv2%2ftenant.proto">metalstack/admin/v2/tenant.proto</a>
             <ul>
               
+                <li>
+                  <a href="#metalstack.admin.v2.TenantServiceAddMemberRequest"><span class="badge">M</span>TenantServiceAddMemberRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.TenantServiceAddMemberResponse"><span class="badge">M</span>TenantServiceAddMemberResponse</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.admin.v2.TenantServiceCreateRequest"><span class="badge">M</span>TenantServiceCreateRequest</a>
                 </li>
@@ -19042,6 +19050,51 @@ <h2 id="metalstack/admin/v2/tenant.proto">metalstack/admin/v2/tenant.proto</h2><
       <p></p>
 
       
+        <h3 id="metalstack.admin.v2.TenantServiceAddMemberRequest">TenantServiceAddMemberRequest</h3>
+        <p>TenantServiceAddMemberRequest is the request payload for adding a member to a tenant</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the tenant to which the member will be added </p></td>
+                </tr>
+              
+                <tr>
+                  <td>member</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the member to add </p></td>
+                </tr>
+              
+                <tr>
+                  <td>role</td>
+                  <td><a href="#metalstack.api.v2.TenantRole">metalstack.api.v2.TenantRole</a></td>
+                  <td></td>
+                  <td><p>Role to assign to the new member </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.TenantServiceAddMemberResponse">TenantServiceAddMemberResponse</h3>
+        <p>TenantServiceAddMemberResponse is the response payload for the add member request</p>
+
+        
+
+        
+      
         <h3 id="metalstack.admin.v2.TenantServiceCreateRequest">TenantServiceCreateRequest</h3>
         <p>TenantServiceCreateRequest is the request payload for creating a tenant.</p>
 
@@ -19201,6 +19254,13 @@ <h3 id="metalstack.admin.v2.TenantService">TenantService</h3>
                 <td><p>Returns the list of all tenants.</p></td>
               </tr>
             
+              <tr>
+                <td>AddMember</td>
+                <td><a href="#metalstack.admin.v2.TenantServiceAddMemberRequest">TenantServiceAddMemberRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TenantServiceAddMemberResponse">TenantServiceAddMemberResponse</a></td>
+                <td><p>Add a member to a tenant</p></td>
+              </tr>
+            
           </tbody>
         </table>
 
diff --git a/go/metalstack/admin/v2/adminv2connect/tenant.connect.go b/go/metalstack/admin/v2/adminv2connect/tenant.connect.go
index cfdbeb06..cdc22bbb 100644
--- a/go/metalstack/admin/v2/adminv2connect/tenant.connect.go
+++ b/go/metalstack/admin/v2/adminv2connect/tenant.connect.go
@@ -37,6 +37,8 @@ const (
 	TenantServiceCreateProcedure = "/metalstack.admin.v2.TenantService/Create"
 	// TenantServiceListProcedure is the fully-qualified name of the TenantService's List RPC.
 	TenantServiceListProcedure = "/metalstack.admin.v2.TenantService/List"
+	// TenantServiceAddMemberProcedure is the fully-qualified name of the TenantService's AddMember RPC.
+	TenantServiceAddMemberProcedure = "/metalstack.admin.v2.TenantService/AddMember"
 )
 
 // TenantServiceClient is a client for the metalstack.admin.v2.TenantService service.
@@ -45,6 +47,8 @@ type TenantServiceClient interface {
 	Create(context.Context, *v2.TenantServiceCreateRequest) (*v2.TenantServiceCreateResponse, error)
 	// Returns the list of all tenants.
 	List(context.Context, *v2.TenantServiceListRequest) (*v2.TenantServiceListResponse, error)
+	// Add a member to a tenant
+	AddMember(context.Context, *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error)
 }
 
 // NewTenantServiceClient constructs a client for the metalstack.admin.v2.TenantService service. By
@@ -70,13 +74,20 @@ func NewTenantServiceClient(httpClient connect.HTTPClient, baseURL string, opts
 			connect.WithSchema(tenantServiceMethods.ByName("List")),
 			connect.WithClientOptions(opts...),
 		),
+		addMember: connect.NewClient[v2.TenantServiceAddMemberRequest, v2.TenantServiceAddMemberResponse](
+			httpClient,
+			baseURL+TenantServiceAddMemberProcedure,
+			connect.WithSchema(tenantServiceMethods.ByName("AddMember")),
+			connect.WithClientOptions(opts...),
+		),
 	}
 }
 
 // tenantServiceClient implements TenantServiceClient.
 type tenantServiceClient struct {
-	create *connect.Client[v2.TenantServiceCreateRequest, v2.TenantServiceCreateResponse]
-	list   *connect.Client[v2.TenantServiceListRequest, v2.TenantServiceListResponse]
+	create    *connect.Client[v2.TenantServiceCreateRequest, v2.TenantServiceCreateResponse]
+	list      *connect.Client[v2.TenantServiceListRequest, v2.TenantServiceListResponse]
+	addMember *connect.Client[v2.TenantServiceAddMemberRequest, v2.TenantServiceAddMemberResponse]
 }
 
 // Create calls metalstack.admin.v2.TenantService.Create.
@@ -97,12 +108,23 @@ func (c *tenantServiceClient) List(ctx context.Context, req *v2.TenantServiceLis
 	return nil, err
 }
 
+// AddMember calls metalstack.admin.v2.TenantService.AddMember.
+func (c *tenantServiceClient) AddMember(ctx context.Context, req *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error) {
+	response, err := c.addMember.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
 // TenantServiceHandler is an implementation of the metalstack.admin.v2.TenantService service.
 type TenantServiceHandler interface {
 	// Creates a new tenant.
 	Create(context.Context, *v2.TenantServiceCreateRequest) (*v2.TenantServiceCreateResponse, error)
 	// Returns the list of all tenants.
 	List(context.Context, *v2.TenantServiceListRequest) (*v2.TenantServiceListResponse, error)
+	// Add a member to a tenant
+	AddMember(context.Context, *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error)
 }
 
 // NewTenantServiceHandler builds an HTTP handler from the service implementation. It returns the
@@ -124,12 +146,20 @@ func NewTenantServiceHandler(svc TenantServiceHandler, opts ...connect.HandlerOp
 		connect.WithSchema(tenantServiceMethods.ByName("List")),
 		connect.WithHandlerOptions(opts...),
 	)
+	tenantServiceAddMemberHandler := connect.NewUnaryHandlerSimple(
+		TenantServiceAddMemberProcedure,
+		svc.AddMember,
+		connect.WithSchema(tenantServiceMethods.ByName("AddMember")),
+		connect.WithHandlerOptions(opts...),
+	)
 	return "/metalstack.admin.v2.TenantService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case TenantServiceCreateProcedure:
 			tenantServiceCreateHandler.ServeHTTP(w, r)
 		case TenantServiceListProcedure:
 			tenantServiceListHandler.ServeHTTP(w, r)
+		case TenantServiceAddMemberProcedure:
+			tenantServiceAddMemberHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -146,3 +176,7 @@ func (UnimplementedTenantServiceHandler) Create(context.Context, *v2.TenantServi
 func (UnimplementedTenantServiceHandler) List(context.Context, *v2.TenantServiceListRequest) (*v2.TenantServiceListResponse, error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.TenantService.List is not implemented"))
 }
+
+func (UnimplementedTenantServiceHandler) AddMember(context.Context, *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.TenantService.AddMember is not implemented"))
+}
diff --git a/go/metalstack/admin/v2/tenant.pb.go b/go/metalstack/admin/v2/tenant.pb.go
index dd590fbe..06e62d45 100644
--- a/go/metalstack/admin/v2/tenant.pb.go
+++ b/go/metalstack/admin/v2/tenant.pb.go
@@ -252,13 +252,114 @@ func (x *TenantServiceListResponse) GetNextPage() uint64 {
 	return 0
 }
 
+// TenantServiceAddMemberRequest is the request payload for adding a member to a tenant
+type TenantServiceAddMemberRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Login of the tenant to which the member will be added
+	Tenant string `protobuf:"bytes,1,opt,name=tenant,proto3" json:"tenant,omitempty"`
+	// Login of the member to add
+	Member string `protobuf:"bytes,2,opt,name=member,proto3" json:"member,omitempty"`
+	// Role to assign to the new member
+	Role          v2.TenantRole `protobuf:"varint,3,opt,name=role,proto3,enum=metalstack.api.v2.TenantRole" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TenantServiceAddMemberRequest) Reset() {
+	*x = TenantServiceAddMemberRequest{}
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantServiceAddMemberRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantServiceAddMemberRequest) ProtoMessage() {}
+
+func (x *TenantServiceAddMemberRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TenantServiceAddMemberRequest.ProtoReflect.Descriptor instead.
+func (*TenantServiceAddMemberRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_tenant_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *TenantServiceAddMemberRequest) GetTenant() string {
+	if x != nil {
+		return x.Tenant
+	}
+	return ""
+}
+
+func (x *TenantServiceAddMemberRequest) GetMember() string {
+	if x != nil {
+		return x.Member
+	}
+	return ""
+}
+
+func (x *TenantServiceAddMemberRequest) GetRole() v2.TenantRole {
+	if x != nil {
+		return x.Role
+	}
+	return v2.TenantRole(0)
+}
+
+// TenantServiceAddMemberResponse is the response payload for the add member request
+type TenantServiceAddMemberResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TenantServiceAddMemberResponse) Reset() {
+	*x = TenantServiceAddMemberResponse{}
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantServiceAddMemberResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantServiceAddMemberResponse) ProtoMessage() {}
+
+func (x *TenantServiceAddMemberResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TenantServiceAddMemberResponse.ProtoReflect.Descriptor instead.
+func (*TenantServiceAddMemberResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_tenant_proto_rawDescGZIP(), []int{5}
+}
+
 var File_metalstack_admin_v2_tenant_proto protoreflect.FileDescriptor
 
 const file_metalstack_admin_v2_tenant_proto_rawDesc = "" +
 	"\n" +
 	" metalstack/admin/v2/tenant.proto\x12\x13metalstack.admin.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1emetalstack/api/v2/tenant.proto\"\xa2\x02\n" +
 	"\x1aTenantServiceCreateRequest\x12\x1f\n" +
-	"\x04name\x18\x01 \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x122\n" +
+	"\x04name\x18\x01 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x04name\x122\n" +
 	"\vdescription\x18\x02 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\vdescription\x88\x01\x01\x12\"\n" +
 	"\x05email\x18\x03 \x01(\tB\a\xbaH\x04r\x02`\x01H\x01R\x05email\x88\x01\x01\x12/\n" +
 	"\n" +
@@ -275,11 +376,17 @@ const file_metalstack_admin_v2_tenant_proto_rawDesc = "" +
 	"\atenants\x18\x01 \x03(\v2\x19.metalstack.api.v2.TenantR\atenants\x12 \n" +
 	"\tnext_page\x18\x02 \x01(\x04H\x00R\bnextPage\x88\x01\x01B\f\n" +
 	"\n" +
-	"_next_page2\xfa\x01\n" +
+	"_next_page\"\xa6\x01\n" +
+	"\x1dTenantServiceAddMemberRequest\x12#\n" +
+	"\x06tenant\x18\x01 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n" +
+	"\x06member\x18\x02 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x06member\x12;\n" +
+	"\x04role\x18\x03 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleB\b\xbaH\x05\x82\x01\x02\x10\x01R\x04role\" \n" +
+	"\x1eTenantServiceAddMemberResponse2\xfb\x02\n" +
 	"\rTenantService\x12v\n" +
 	"\x06Create\x12/.metalstack.admin.v2.TenantServiceCreateRequest\x1a0.metalstack.admin.v2.TenantServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12q\n" +
 	"\x04List\x12-.metalstack.admin.v2.TenantServiceListRequest\x1a..metalstack.admin.v2.TenantServiceListResponse\"\n" +
-	"\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01B\xcf\x01\n" +
+	"\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12\x7f\n" +
+	"\tAddMember\x122.metalstack.admin.v2.TenantServiceAddMemberRequest\x1a3.metalstack.admin.v2.TenantServiceAddMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01B\xcf\x01\n" +
 	"\x17com.metalstack.admin.v2B\vTenantProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3"
 
 var (
@@ -294,30 +401,36 @@ func file_metalstack_admin_v2_tenant_proto_rawDescGZIP() []byte {
 	return file_metalstack_admin_v2_tenant_proto_rawDescData
 }
 
-var file_metalstack_admin_v2_tenant_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_metalstack_admin_v2_tenant_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_metalstack_admin_v2_tenant_proto_goTypes = []any{
-	(*TenantServiceCreateRequest)(nil),  // 0: metalstack.admin.v2.TenantServiceCreateRequest
-	(*TenantServiceCreateResponse)(nil), // 1: metalstack.admin.v2.TenantServiceCreateResponse
-	(*TenantServiceListRequest)(nil),    // 2: metalstack.admin.v2.TenantServiceListRequest
-	(*TenantServiceListResponse)(nil),   // 3: metalstack.admin.v2.TenantServiceListResponse
-	(*v2.Labels)(nil),                   // 4: metalstack.api.v2.Labels
-	(*v2.Tenant)(nil),                   // 5: metalstack.api.v2.Tenant
-	(*v2.TenantQuery)(nil),              // 6: metalstack.api.v2.TenantQuery
+	(*TenantServiceCreateRequest)(nil),     // 0: metalstack.admin.v2.TenantServiceCreateRequest
+	(*TenantServiceCreateResponse)(nil),    // 1: metalstack.admin.v2.TenantServiceCreateResponse
+	(*TenantServiceListRequest)(nil),       // 2: metalstack.admin.v2.TenantServiceListRequest
+	(*TenantServiceListResponse)(nil),      // 3: metalstack.admin.v2.TenantServiceListResponse
+	(*TenantServiceAddMemberRequest)(nil),  // 4: metalstack.admin.v2.TenantServiceAddMemberRequest
+	(*TenantServiceAddMemberResponse)(nil), // 5: metalstack.admin.v2.TenantServiceAddMemberResponse
+	(*v2.Labels)(nil),                      // 6: metalstack.api.v2.Labels
+	(*v2.Tenant)(nil),                      // 7: metalstack.api.v2.Tenant
+	(*v2.TenantQuery)(nil),                 // 8: metalstack.api.v2.TenantQuery
+	(v2.TenantRole)(0),                     // 9: metalstack.api.v2.TenantRole
 }
 var file_metalstack_admin_v2_tenant_proto_depIdxs = []int32{
-	4, // 0: metalstack.admin.v2.TenantServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
-	5, // 1: metalstack.admin.v2.TenantServiceCreateResponse.tenant:type_name -> metalstack.api.v2.Tenant
-	6, // 2: metalstack.admin.v2.TenantServiceListRequest.query:type_name -> metalstack.api.v2.TenantQuery
-	5, // 3: metalstack.admin.v2.TenantServiceListResponse.tenants:type_name -> metalstack.api.v2.Tenant
-	0, // 4: metalstack.admin.v2.TenantService.Create:input_type -> metalstack.admin.v2.TenantServiceCreateRequest
-	2, // 5: metalstack.admin.v2.TenantService.List:input_type -> metalstack.admin.v2.TenantServiceListRequest
-	1, // 6: metalstack.admin.v2.TenantService.Create:output_type -> metalstack.admin.v2.TenantServiceCreateResponse
-	3, // 7: metalstack.admin.v2.TenantService.List:output_type -> metalstack.admin.v2.TenantServiceListResponse
-	6, // [6:8] is the sub-list for method output_type
-	4, // [4:6] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	6, // 0: metalstack.admin.v2.TenantServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	7, // 1: metalstack.admin.v2.TenantServiceCreateResponse.tenant:type_name -> metalstack.api.v2.Tenant
+	8, // 2: metalstack.admin.v2.TenantServiceListRequest.query:type_name -> metalstack.api.v2.TenantQuery
+	7, // 3: metalstack.admin.v2.TenantServiceListResponse.tenants:type_name -> metalstack.api.v2.Tenant
+	9, // 4: metalstack.admin.v2.TenantServiceAddMemberRequest.role:type_name -> metalstack.api.v2.TenantRole
+	0, // 5: metalstack.admin.v2.TenantService.Create:input_type -> metalstack.admin.v2.TenantServiceCreateRequest
+	2, // 6: metalstack.admin.v2.TenantService.List:input_type -> metalstack.admin.v2.TenantServiceListRequest
+	4, // 7: metalstack.admin.v2.TenantService.AddMember:input_type -> metalstack.admin.v2.TenantServiceAddMemberRequest
+	1, // 8: metalstack.admin.v2.TenantService.Create:output_type -> metalstack.admin.v2.TenantServiceCreateResponse
+	3, // 9: metalstack.admin.v2.TenantService.List:output_type -> metalstack.admin.v2.TenantServiceListResponse
+	5, // 10: metalstack.admin.v2.TenantService.AddMember:output_type -> metalstack.admin.v2.TenantServiceAddMemberResponse
+	8, // [8:11] is the sub-list for method output_type
+	5, // [5:8] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_admin_v2_tenant_proto_init() }
@@ -333,7 +446,7 @@ func file_metalstack_admin_v2_tenant_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_tenant_proto_rawDesc), len(file_metalstack_admin_v2_tenant_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   4,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/permissions/servicepermissions.go b/go/permissions/servicepermissions.go
index 32de85b5..466442ab 100755
--- a/go/permissions/servicepermissions.go
+++ b/go/permissions/servicepermissions.go
@@ -111,6 +111,7 @@ func GetServicePermissions() *ServicePermissions {
 					"/metalstack.admin.v2.TaskService/List",
 					"/metalstack.admin.v2.TenantService/Create",
 					"/metalstack.admin.v2.TenantService/List",
+					"/metalstack.admin.v2.TenantService/AddMember",
 					"/metalstack.admin.v2.TokenService/List",
 					"/metalstack.admin.v2.TokenService/Revoke",
 					"/metalstack.admin.v2.TokenService/Create",
@@ -329,6 +330,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.TaskService/Get":                           true,
 			"/metalstack.admin.v2.TaskService/List":                          true,
 			"/metalstack.admin.v2.TaskService/Queues":                        true,
+			"/metalstack.admin.v2.TenantService/AddMember":                   true,
 			"/metalstack.admin.v2.TenantService/Create":                      true,
 			"/metalstack.admin.v2.TenantService/List":                        true,
 			"/metalstack.admin.v2.TokenService/Create":                       true,
@@ -511,6 +513,7 @@ func GetServicePermissions() *ServicePermissions {
 				"/metalstack.admin.v2.TaskService/Get":                   true,
 				"/metalstack.admin.v2.TaskService/List":                  true,
 				"/metalstack.admin.v2.TaskService/Queues":                true,
+				"/metalstack.admin.v2.TenantService/AddMember":           true,
 				"/metalstack.admin.v2.TenantService/Create":              true,
 				"/metalstack.admin.v2.TenantService/List":                true,
 				"/metalstack.admin.v2.TokenService/Create":               true,
@@ -639,6 +642,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.TaskService/Get":                   true,
 			"/metalstack.admin.v2.TaskService/List":                  true,
 			"/metalstack.admin.v2.TaskService/Queues":                true,
+			"/metalstack.admin.v2.TenantService/AddMember":           true,
 			"/metalstack.admin.v2.TenantService/Create":              true,
 			"/metalstack.admin.v2.TenantService/List":                true,
 			"/metalstack.admin.v2.TokenService/Create":               true,
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go
index e8946128..dc23be63 100644
--- a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go
@@ -38,6 +38,74 @@ func (_m *TenantServiceClient) EXPECT() *TenantServiceClient_Expecter {
 	return &TenantServiceClient_Expecter{mock: &_m.Mock}
 }
 
+// AddMember provides a mock function for the type TenantServiceClient
+func (_mock *TenantServiceClient) AddMember(context1 context.Context, tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest) (*adminv2.TenantServiceAddMemberResponse, error) {
+	ret := _mock.Called(context1, tenantServiceAddMemberRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for AddMember")
+	}
+
+	var r0 *adminv2.TenantServiceAddMemberResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceAddMemberRequest) (*adminv2.TenantServiceAddMemberResponse, error)); ok {
+		return returnFunc(context1, tenantServiceAddMemberRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceAddMemberRequest) *adminv2.TenantServiceAddMemberResponse); ok {
+		r0 = returnFunc(context1, tenantServiceAddMemberRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.TenantServiceAddMemberResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.TenantServiceAddMemberRequest) error); ok {
+		r1 = returnFunc(context1, tenantServiceAddMemberRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// TenantServiceClient_AddMember_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AddMember'
+type TenantServiceClient_AddMember_Call struct {
+	*mock.Call
+}
+
+// AddMember is a helper method to define mock.On call
+//   - context1 context.Context
+//   - tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest
+func (_e *TenantServiceClient_Expecter) AddMember(context1 any, tenantServiceAddMemberRequest any) *TenantServiceClient_AddMember_Call {
+	return &TenantServiceClient_AddMember_Call{Call: _e.mock.On("AddMember", context1, tenantServiceAddMemberRequest)}
+}
+
+func (_c *TenantServiceClient_AddMember_Call) Run(run func(context1 context.Context, tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest)) *TenantServiceClient_AddMember_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.TenantServiceAddMemberRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.TenantServiceAddMemberRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *TenantServiceClient_AddMember_Call) Return(tenantServiceAddMemberResponse *adminv2.TenantServiceAddMemberResponse, err error) *TenantServiceClient_AddMember_Call {
+	_c.Call.Return(tenantServiceAddMemberResponse, err)
+	return _c
+}
+
+func (_c *TenantServiceClient_AddMember_Call) RunAndReturn(run func(context1 context.Context, tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest) (*adminv2.TenantServiceAddMemberResponse, error)) *TenantServiceClient_AddMember_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Create provides a mock function for the type TenantServiceClient
 func (_mock *TenantServiceClient) Create(context1 context.Context, tenantServiceCreateRequest *adminv2.TenantServiceCreateRequest) (*adminv2.TenantServiceCreateResponse, error) {
 	ret := _mock.Called(context1, tenantServiceCreateRequest)
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go
index dcc17cf4..e4f83394 100644
--- a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go
@@ -38,6 +38,74 @@ func (_m *TenantServiceHandler) EXPECT() *TenantServiceHandler_Expecter {
 	return &TenantServiceHandler_Expecter{mock: &_m.Mock}
 }
 
+// AddMember provides a mock function for the type TenantServiceHandler
+func (_mock *TenantServiceHandler) AddMember(context1 context.Context, tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest) (*adminv2.TenantServiceAddMemberResponse, error) {
+	ret := _mock.Called(context1, tenantServiceAddMemberRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for AddMember")
+	}
+
+	var r0 *adminv2.TenantServiceAddMemberResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceAddMemberRequest) (*adminv2.TenantServiceAddMemberResponse, error)); ok {
+		return returnFunc(context1, tenantServiceAddMemberRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceAddMemberRequest) *adminv2.TenantServiceAddMemberResponse); ok {
+		r0 = returnFunc(context1, tenantServiceAddMemberRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.TenantServiceAddMemberResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.TenantServiceAddMemberRequest) error); ok {
+		r1 = returnFunc(context1, tenantServiceAddMemberRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// TenantServiceHandler_AddMember_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AddMember'
+type TenantServiceHandler_AddMember_Call struct {
+	*mock.Call
+}
+
+// AddMember is a helper method to define mock.On call
+//   - context1 context.Context
+//   - tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest
+func (_e *TenantServiceHandler_Expecter) AddMember(context1 any, tenantServiceAddMemberRequest any) *TenantServiceHandler_AddMember_Call {
+	return &TenantServiceHandler_AddMember_Call{Call: _e.mock.On("AddMember", context1, tenantServiceAddMemberRequest)}
+}
+
+func (_c *TenantServiceHandler_AddMember_Call) Run(run func(context1 context.Context, tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest)) *TenantServiceHandler_AddMember_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.TenantServiceAddMemberRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.TenantServiceAddMemberRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *TenantServiceHandler_AddMember_Call) Return(tenantServiceAddMemberResponse *adminv2.TenantServiceAddMemberResponse, err error) *TenantServiceHandler_AddMember_Call {
+	_c.Call.Return(tenantServiceAddMemberResponse, err)
+	return _c
+}
+
+func (_c *TenantServiceHandler_AddMember_Call) RunAndReturn(run func(context1 context.Context, tenantServiceAddMemberRequest *adminv2.TenantServiceAddMemberRequest) (*adminv2.TenantServiceAddMemberResponse, error)) *TenantServiceHandler_AddMember_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Create provides a mock function for the type TenantServiceHandler
 func (_mock *TenantServiceHandler) Create(context1 context.Context, tenantServiceCreateRequest *adminv2.TenantServiceCreateRequest) (*adminv2.TenantServiceCreateResponse, error) {
 	ret := _mock.Called(context1, tenantServiceCreateRequest)
diff --git a/js/buf/validate/validate_pb.ts b/js/buf/validate/validate_pb.ts
index b37b18ae..5dbd31db 100644
--- a/js/buf/validate/validate_pb.ts
+++ b/js/buf/validate/validate_pb.ts
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file buf/validate/validate.proto (package buf.validate, syntax proto2)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/audit_pb.js b/js/metalstack/admin/v2/audit_pb.js
index df32b7c6..f076f6db 100644
--- a/js/metalstack/admin/v2/audit_pb.js
+++ b/js/metalstack/admin/v2/audit_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/audit.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/audit_pb.ts b/js/metalstack/admin/v2/audit_pb.ts
index b76d02f1..f80e957b 100644
--- a/js/metalstack/admin/v2/audit_pb.ts
+++ b/js/metalstack/admin/v2/audit_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/audit.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/component_pb.js b/js/metalstack/admin/v2/component_pb.js
index 296824b6..aec8f4aa 100644
--- a/js/metalstack/admin/v2/component_pb.js
+++ b/js/metalstack/admin/v2/component_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/component.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/component_pb.ts b/js/metalstack/admin/v2/component_pb.ts
index e16b6484..26cf39d3 100644
--- a/js/metalstack/admin/v2/component_pb.ts
+++ b/js/metalstack/admin/v2/component_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/component.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/filesystem_pb.js b/js/metalstack/admin/v2/filesystem_pb.js
index 36ed9d1c..e30e00ad 100644
--- a/js/metalstack/admin/v2/filesystem_pb.js
+++ b/js/metalstack/admin/v2/filesystem_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/filesystem.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/filesystem_pb.ts b/js/metalstack/admin/v2/filesystem_pb.ts
index dafaa808..8b9eacad 100644
--- a/js/metalstack/admin/v2/filesystem_pb.ts
+++ b/js/metalstack/admin/v2/filesystem_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/filesystem.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/image_pb.js b/js/metalstack/admin/v2/image_pb.js
index a775f936..8c5c87ff 100644
--- a/js/metalstack/admin/v2/image_pb.js
+++ b/js/metalstack/admin/v2/image_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/image.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/image_pb.ts b/js/metalstack/admin/v2/image_pb.ts
index 8df0f118..b7c4c339 100644
--- a/js/metalstack/admin/v2/image_pb.ts
+++ b/js/metalstack/admin/v2/image_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/image.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/ip_pb.js b/js/metalstack/admin/v2/ip_pb.js
index 9ec74503..d14bb572 100644
--- a/js/metalstack/admin/v2/ip_pb.js
+++ b/js/metalstack/admin/v2/ip_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/ip.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/ip_pb.ts b/js/metalstack/admin/v2/ip_pb.ts
index dd5ed755..9054977f 100644
--- a/js/metalstack/admin/v2/ip_pb.ts
+++ b/js/metalstack/admin/v2/ip_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/ip.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/machine_pb.js b/js/metalstack/admin/v2/machine_pb.js
index b708ecb5..6edbd16c 100644
--- a/js/metalstack/admin/v2/machine_pb.js
+++ b/js/metalstack/admin/v2/machine_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/machine.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/machine_pb.ts b/js/metalstack/admin/v2/machine_pb.ts
index b8dd3ef7..1b1859be 100644
--- a/js/metalstack/admin/v2/machine_pb.ts
+++ b/js/metalstack/admin/v2/machine_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/machine.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/network_pb.js b/js/metalstack/admin/v2/network_pb.js
index b189bc89..b1b116c1 100644
--- a/js/metalstack/admin/v2/network_pb.js
+++ b/js/metalstack/admin/v2/network_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/network.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/network_pb.ts b/js/metalstack/admin/v2/network_pb.ts
index 6555f2c8..27333bf1 100644
--- a/js/metalstack/admin/v2/network_pb.ts
+++ b/js/metalstack/admin/v2/network_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/network.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/partition_pb.js b/js/metalstack/admin/v2/partition_pb.js
index 3853df2c..38ecd002 100644
--- a/js/metalstack/admin/v2/partition_pb.js
+++ b/js/metalstack/admin/v2/partition_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/partition.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/partition_pb.ts b/js/metalstack/admin/v2/partition_pb.ts
index 0cdb6dfa..fcee9c0b 100644
--- a/js/metalstack/admin/v2/partition_pb.ts
+++ b/js/metalstack/admin/v2/partition_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/partition.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/project_pb.js b/js/metalstack/admin/v2/project_pb.js
index 5d0e6319..7fe2e074 100644
--- a/js/metalstack/admin/v2/project_pb.js
+++ b/js/metalstack/admin/v2/project_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/project.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/project_pb.ts b/js/metalstack/admin/v2/project_pb.ts
index 8d02779d..49d206b9 100644
--- a/js/metalstack/admin/v2/project_pb.ts
+++ b/js/metalstack/admin/v2/project_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/project.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/size_imageconstraint_pb.js b/js/metalstack/admin/v2/size_imageconstraint_pb.js
index e15849e4..439f76fd 100644
--- a/js/metalstack/admin/v2/size_imageconstraint_pb.js
+++ b/js/metalstack/admin/v2/size_imageconstraint_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/size_imageconstraint.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/size_imageconstraint_pb.ts b/js/metalstack/admin/v2/size_imageconstraint_pb.ts
index 8594eb1f..fd9f24ee 100644
--- a/js/metalstack/admin/v2/size_imageconstraint_pb.ts
+++ b/js/metalstack/admin/v2/size_imageconstraint_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/size_imageconstraint.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/size_pb.js b/js/metalstack/admin/v2/size_pb.js
index 2acb16e2..33c56b0f 100644
--- a/js/metalstack/admin/v2/size_pb.js
+++ b/js/metalstack/admin/v2/size_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/size.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/size_pb.ts b/js/metalstack/admin/v2/size_pb.ts
index f81f7eda..2268b8d6 100644
--- a/js/metalstack/admin/v2/size_pb.ts
+++ b/js/metalstack/admin/v2/size_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/size.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/size_reservation_pb.js b/js/metalstack/admin/v2/size_reservation_pb.js
index e1fbcd43..908dabd8 100644
--- a/js/metalstack/admin/v2/size_reservation_pb.js
+++ b/js/metalstack/admin/v2/size_reservation_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/size_reservation.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/size_reservation_pb.ts b/js/metalstack/admin/v2/size_reservation_pb.ts
index 6ac22173..f9615fd8 100644
--- a/js/metalstack/admin/v2/size_reservation_pb.ts
+++ b/js/metalstack/admin/v2/size_reservation_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/size_reservation.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/switch_pb.js b/js/metalstack/admin/v2/switch_pb.js
index e4114c42..21c30318 100644
--- a/js/metalstack/admin/v2/switch_pb.js
+++ b/js/metalstack/admin/v2/switch_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/switch.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/switch_pb.ts b/js/metalstack/admin/v2/switch_pb.ts
index 292e7685..e8b97b16 100644
--- a/js/metalstack/admin/v2/switch_pb.ts
+++ b/js/metalstack/admin/v2/switch_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/switch.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/task_pb.js b/js/metalstack/admin/v2/task_pb.js
index 74473f8d..43662e6e 100644
--- a/js/metalstack/admin/v2/task_pb.js
+++ b/js/metalstack/admin/v2/task_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/task.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/task_pb.ts b/js/metalstack/admin/v2/task_pb.ts
index 6acef8f4..52339ba4 100644
--- a/js/metalstack/admin/v2/task_pb.ts
+++ b/js/metalstack/admin/v2/task_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/task.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/tenant_pb.d.ts b/js/metalstack/admin/v2/tenant_pb.d.ts
index 40b3e36a..83b8bde8 100644
--- a/js/metalstack/admin/v2/tenant_pb.d.ts
+++ b/js/metalstack/admin/v2/tenant_pb.d.ts
@@ -1,5 +1,5 @@
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { Labels } from "../../api/v2/common_pb";
+import type { Labels, TenantRole } from "../../api/v2/common_pb";
 import type { Tenant, TenantQuery } from "../../api/v2/tenant_pb";
 import type { Message } from "@bufbuild/protobuf";
 /**
@@ -108,6 +108,47 @@ export type TenantServiceListResponse = Message<"metalstack.admin.v2.TenantServi
  * Use `create(TenantServiceListResponseSchema)` to create a new message.
  */
 export declare const TenantServiceListResponseSchema: GenMessage<TenantServiceListResponse>;
+/**
+ * TenantServiceAddMemberRequest is the request payload for adding a member to a tenant
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceAddMemberRequest
+ */
+export type TenantServiceAddMemberRequest = Message<"metalstack.admin.v2.TenantServiceAddMemberRequest"> & {
+    /**
+     * Login of the tenant to which the member will be added
+     *
+     * @generated from field: string tenant = 1;
+     */
+    tenant: string;
+    /**
+     * Login of the member to add
+     *
+     * @generated from field: string member = 2;
+     */
+    member: string;
+    /**
+     * Role to assign to the new member
+     *
+     * @generated from field: metalstack.api.v2.TenantRole role = 3;
+     */
+    role: TenantRole;
+};
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceAddMemberRequest.
+ * Use `create(TenantServiceAddMemberRequestSchema)` to create a new message.
+ */
+export declare const TenantServiceAddMemberRequestSchema: GenMessage<TenantServiceAddMemberRequest>;
+/**
+ * TenantServiceAddMemberResponse is the response payload for the add member request
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceAddMemberResponse
+ */
+export type TenantServiceAddMemberResponse = Message<"metalstack.admin.v2.TenantServiceAddMemberResponse"> & {};
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceAddMemberResponse.
+ * Use `create(TenantServiceAddMemberResponseSchema)` to create a new message.
+ */
+export declare const TenantServiceAddMemberResponseSchema: GenMessage<TenantServiceAddMemberResponse>;
 /**
  * TenantService provides tenant management operations.
  *
@@ -134,4 +175,14 @@ export declare const TenantService: GenService<{
         input: typeof TenantServiceListRequestSchema;
         output: typeof TenantServiceListResponseSchema;
     };
+    /**
+     * Add a member to a tenant
+     *
+     * @generated from rpc metalstack.admin.v2.TenantService.AddMember
+     */
+    addMember: {
+        methodKind: "unary";
+        input: typeof TenantServiceAddMemberRequestSchema;
+        output: typeof TenantServiceAddMemberResponseSchema;
+    };
 }>;
diff --git a/js/metalstack/admin/v2/tenant_pb.js b/js/metalstack/admin/v2/tenant_pb.js
index dacb25a2..1c7c8ade 100644
--- a/js/metalstack/admin/v2/tenant_pb.js
+++ b/js/metalstack/admin/v2/tenant_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/tenant.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
@@ -9,7 +9,7 @@ import { file_metalstack_api_v2_tenant } from "../../api/v2/tenant_pb";
 /**
  * Describes the file metalstack/admin/v2/tenant.proto.
  */
-export const file_metalstack_admin_v2_tenant = /*@__PURE__*/ fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgbAs66xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2Uy+gEKDVRlbmFudFNlcnZpY2USdgoGQ3JlYXRlEi8ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQ3JlYXRlUmVxdWVzdBowLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlc3BvbnNlIgnS8xgBAeDzGAEScQoETGlzdBItLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgBQs8BChdjb20ubWV0YWxzdGFjay5hZG1pbi52MkILVGVuYW50UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
+export const file_metalstack_admin_v2_tenant = /*@__PURE__*/ fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgaQtK6xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2UikAEKHVRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECARI1CgRyb2xlGAMgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZUIIukgFggECEAEiIAoeVGVuYW50U2VydmljZUFkZE1lbWJlclJlc3BvbnNlMvsCCg1UZW5hbnRTZXJ2aWNlEnYKBkNyZWF0ZRIvLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QaMC5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZSIJ0vMYAQHg8xgBEnEKBExpc3QSLS5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VMaXN0UmVxdWVzdBouLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXNwb25zZSIK0vMYAgEC4PMYARJ/CglBZGRNZW1iZXISMi5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0GjMubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQWRkTWVtYmVyUmVzcG9uc2UiCdLzGAEB4PMYAULPAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCC1RlbmFudFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
 /**
  * Describes the message metalstack.admin.v2.TenantServiceCreateRequest.
  * Use `create(TenantServiceCreateRequestSchema)` to create a new message.
@@ -30,6 +30,16 @@ export const TenantServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_met
  * Use `create(TenantServiceListResponseSchema)` to create a new message.
  */
 export const TenantServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_tenant, 3);
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceAddMemberRequest.
+ * Use `create(TenantServiceAddMemberRequestSchema)` to create a new message.
+ */
+export const TenantServiceAddMemberRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_tenant, 4);
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceAddMemberResponse.
+ * Use `create(TenantServiceAddMemberResponseSchema)` to create a new message.
+ */
+export const TenantServiceAddMemberResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_tenant, 5);
 /**
  * TenantService provides tenant management operations.
  *
diff --git a/js/metalstack/admin/v2/tenant_pb.ts b/js/metalstack/admin/v2/tenant_pb.ts
index daf9d669..bd7f6386 100644
--- a/js/metalstack/admin/v2/tenant_pb.ts
+++ b/js/metalstack/admin/v2/tenant_pb.ts
@@ -1,11 +1,11 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/tenant.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
-import type { Labels } from "../../api/v2/common_pb";
+import type { Labels, TenantRole } from "../../api/v2/common_pb";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
 import { file_metalstack_api_v2_predefined_rules } from "../../api/v2/predefined_rules_pb";
 import type { Tenant, TenantQuery } from "../../api/v2/tenant_pb";
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/admin/v2/tenant.proto.
  */
 export const file_metalstack_admin_v2_tenant: GenFile = /*@__PURE__*/
-  fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgbAs66xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2Uy+gEKDVRlbmFudFNlcnZpY2USdgoGQ3JlYXRlEi8ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQ3JlYXRlUmVxdWVzdBowLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlc3BvbnNlIgnS8xgBAeDzGAEScQoETGlzdBItLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgBQs8BChdjb20ubWV0YWxzdGFjay5hZG1pbi52MkILVGVuYW50UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
+  fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgaQtK6xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2UikAEKHVRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECARI1CgRyb2xlGAMgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZUIIukgFggECEAEiIAoeVGVuYW50U2VydmljZUFkZE1lbWJlclJlc3BvbnNlMvsCCg1UZW5hbnRTZXJ2aWNlEnYKBkNyZWF0ZRIvLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QaMC5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZSIJ0vMYAQHg8xgBEnEKBExpc3QSLS5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VMaXN0UmVxdWVzdBouLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXNwb25zZSIK0vMYAgEC4PMYARJ/CglBZGRNZW1iZXISMi5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0GjMubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQWRkTWVtYmVyUmVzcG9uc2UiCdLzGAEB4PMYAULPAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCC1RlbmFudFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
 
 /**
  * TenantServiceCreateRequest is the request payload for creating a tenant.
@@ -137,6 +137,56 @@ export type TenantServiceListResponse = Message<"metalstack.admin.v2.TenantServi
 export const TenantServiceListResponseSchema: GenMessage<TenantServiceListResponse> = /*@__PURE__*/
   messageDesc(file_metalstack_admin_v2_tenant, 3);
 
+/**
+ * TenantServiceAddMemberRequest is the request payload for adding a member to a tenant
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceAddMemberRequest
+ */
+export type TenantServiceAddMemberRequest = Message<"metalstack.admin.v2.TenantServiceAddMemberRequest"> & {
+  /**
+   * Login of the tenant to which the member will be added
+   *
+   * @generated from field: string tenant = 1;
+   */
+  tenant: string;
+
+  /**
+   * Login of the member to add
+   *
+   * @generated from field: string member = 2;
+   */
+  member: string;
+
+  /**
+   * Role to assign to the new member
+   *
+   * @generated from field: metalstack.api.v2.TenantRole role = 3;
+   */
+  role: TenantRole;
+};
+
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceAddMemberRequest.
+ * Use `create(TenantServiceAddMemberRequestSchema)` to create a new message.
+ */
+export const TenantServiceAddMemberRequestSchema: GenMessage<TenantServiceAddMemberRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_tenant, 4);
+
+/**
+ * TenantServiceAddMemberResponse is the response payload for the add member request
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceAddMemberResponse
+ */
+export type TenantServiceAddMemberResponse = Message<"metalstack.admin.v2.TenantServiceAddMemberResponse"> & {
+};
+
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceAddMemberResponse.
+ * Use `create(TenantServiceAddMemberResponseSchema)` to create a new message.
+ */
+export const TenantServiceAddMemberResponseSchema: GenMessage<TenantServiceAddMemberResponse> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_tenant, 5);
+
 /**
  * TenantService provides tenant management operations.
  *
@@ -163,6 +213,16 @@ export const TenantService: GenService<{
     input: typeof TenantServiceListRequestSchema;
     output: typeof TenantServiceListResponseSchema;
   },
+  /**
+   * Add a member to a tenant
+   *
+   * @generated from rpc metalstack.admin.v2.TenantService.AddMember
+   */
+  addMember: {
+    methodKind: "unary";
+    input: typeof TenantServiceAddMemberRequestSchema;
+    output: typeof TenantServiceAddMemberResponseSchema;
+  },
 }> = /*@__PURE__*/
   serviceDesc(file_metalstack_admin_v2_tenant, 0);
 
diff --git a/js/metalstack/admin/v2/token_pb.js b/js/metalstack/admin/v2/token_pb.js
index 6c33a770..12cb9474 100644
--- a/js/metalstack/admin/v2/token_pb.js
+++ b/js/metalstack/admin/v2/token_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/token.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/token_pb.ts b/js/metalstack/admin/v2/token_pb.ts
index 3e7d2910..137263b7 100644
--- a/js/metalstack/admin/v2/token_pb.ts
+++ b/js/metalstack/admin/v2/token_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/token.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/admin/v2/vpn_pb.js b/js/metalstack/admin/v2/vpn_pb.js
index 62a84809..9487da4c 100644
--- a/js/metalstack/admin/v2/vpn_pb.js
+++ b/js/metalstack/admin/v2/vpn_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/vpn.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/admin/v2/vpn_pb.ts b/js/metalstack/admin/v2/vpn_pb.ts
index 67a9fa18..ae8d8c53 100644
--- a/js/metalstack/admin/v2/vpn_pb.ts
+++ b/js/metalstack/admin/v2/vpn_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/admin/v2/vpn.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/audit_pb.js b/js/metalstack/api/v2/audit_pb.js
index c33cd4aa..54488fd0 100644
--- a/js/metalstack/api/v2/audit_pb.js
+++ b/js/metalstack/api/v2/audit_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/audit.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/audit_pb.ts b/js/metalstack/api/v2/audit_pb.ts
index abb6aac7..f667d305 100644
--- a/js/metalstack/api/v2/audit_pb.ts
+++ b/js/metalstack/api/v2/audit_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/audit.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/common_pb.js b/js/metalstack/api/v2/common_pb.js
index 8e2d8fd7..272c62b9 100644
--- a/js/metalstack/api/v2/common_pb.js
+++ b/js/metalstack/api/v2/common_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/common.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, extDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/common_pb.ts b/js/metalstack/api/v2/common_pb.ts
index d271f8ba..e68ea337 100644
--- a/js/metalstack/api/v2/common_pb.ts
+++ b/js/metalstack/api/v2/common_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/common.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/component_pb.js b/js/metalstack/api/v2/component_pb.js
index 42d22ea4..fa13b3fa 100644
--- a/js/metalstack/api/v2/component_pb.js
+++ b/js/metalstack/api/v2/component_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/component.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/component_pb.ts b/js/metalstack/api/v2/component_pb.ts
index f90977ec..dd3b775c 100644
--- a/js/metalstack/api/v2/component_pb.ts
+++ b/js/metalstack/api/v2/component_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/component.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/filesystem_pb.js b/js/metalstack/api/v2/filesystem_pb.js
index 6af7efdc..73a3d0af 100644
--- a/js/metalstack/api/v2/filesystem_pb.js
+++ b/js/metalstack/api/v2/filesystem_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/filesystem.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/filesystem_pb.ts b/js/metalstack/api/v2/filesystem_pb.ts
index 1b350f3d..50b987e6 100644
--- a/js/metalstack/api/v2/filesystem_pb.ts
+++ b/js/metalstack/api/v2/filesystem_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/filesystem.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/health_pb.js b/js/metalstack/api/v2/health_pb.js
index 45e2426a..7d6d85fd 100644
--- a/js/metalstack/api/v2/health_pb.js
+++ b/js/metalstack/api/v2/health_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/health.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/health_pb.ts b/js/metalstack/api/v2/health_pb.ts
index 79aaf555..2a07602b 100644
--- a/js/metalstack/api/v2/health_pb.ts
+++ b/js/metalstack/api/v2/health_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/health.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/image_pb.js b/js/metalstack/api/v2/image_pb.js
index e7edd8d5..fbacb8e4 100644
--- a/js/metalstack/api/v2/image_pb.js
+++ b/js/metalstack/api/v2/image_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/image.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/image_pb.ts b/js/metalstack/api/v2/image_pb.ts
index e93b7f7b..fc64a908 100644
--- a/js/metalstack/api/v2/image_pb.ts
+++ b/js/metalstack/api/v2/image_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/image.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/ip_pb.js b/js/metalstack/api/v2/ip_pb.js
index ad53b14e..e8e43991 100644
--- a/js/metalstack/api/v2/ip_pb.js
+++ b/js/metalstack/api/v2/ip_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/ip.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/ip_pb.ts b/js/metalstack/api/v2/ip_pb.ts
index 128faa69..4d9a4591 100644
--- a/js/metalstack/api/v2/ip_pb.ts
+++ b/js/metalstack/api/v2/ip_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/ip.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/machine_pb.js b/js/metalstack/api/v2/machine_pb.js
index 358160c2..e82df6c4 100644
--- a/js/metalstack/api/v2/machine_pb.js
+++ b/js/metalstack/api/v2/machine_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/machine.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/machine_pb.ts b/js/metalstack/api/v2/machine_pb.ts
index 110a0e9c..646202fe 100644
--- a/js/metalstack/api/v2/machine_pb.ts
+++ b/js/metalstack/api/v2/machine_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/machine.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/method_pb.js b/js/metalstack/api/v2/method_pb.js
index 2171e717..69c3001b 100644
--- a/js/metalstack/api/v2/method_pb.js
+++ b/js/metalstack/api/v2/method_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/method.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/method_pb.ts b/js/metalstack/api/v2/method_pb.ts
index 0d373aa8..aeb0a243 100644
--- a/js/metalstack/api/v2/method_pb.ts
+++ b/js/metalstack/api/v2/method_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/method.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/network_pb.js b/js/metalstack/api/v2/network_pb.js
index 06d26796..d9b9a775 100644
--- a/js/metalstack/api/v2/network_pb.js
+++ b/js/metalstack/api/v2/network_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/network.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/network_pb.ts b/js/metalstack/api/v2/network_pb.ts
index 046ea8ee..d2f9aae7 100644
--- a/js/metalstack/api/v2/network_pb.ts
+++ b/js/metalstack/api/v2/network_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/network.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/partition_pb.js b/js/metalstack/api/v2/partition_pb.js
index 639b7d37..b4963920 100644
--- a/js/metalstack/api/v2/partition_pb.js
+++ b/js/metalstack/api/v2/partition_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/partition.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/partition_pb.ts b/js/metalstack/api/v2/partition_pb.ts
index f24e414c..7c0fcf2e 100644
--- a/js/metalstack/api/v2/partition_pb.ts
+++ b/js/metalstack/api/v2/partition_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/partition.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/predefined_rules_pb.js b/js/metalstack/api/v2/predefined_rules_pb.js
index a81e76ee..7aac13fd 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.js
+++ b/js/metalstack/api/v2/predefined_rules_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/predefined_rules.proto (package metalstack.api.v2, syntax proto2)
 /* eslint-disable */
 import { extDesc, fileDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/predefined_rules_pb.ts b/js/metalstack/api/v2/predefined_rules_pb.ts
index ac2f1e1c..69305d52 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/predefined_rules.proto (package metalstack.api.v2, syntax proto2)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/project_pb.js b/js/metalstack/api/v2/project_pb.js
index 3fcb120b..bfdc91b5 100644
--- a/js/metalstack/api/v2/project_pb.js
+++ b/js/metalstack/api/v2/project_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/project.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/project_pb.ts b/js/metalstack/api/v2/project_pb.ts
index ff83328b..6d5f4223 100644
--- a/js/metalstack/api/v2/project_pb.ts
+++ b/js/metalstack/api/v2/project_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/project.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/size_imageconstraint_pb.js b/js/metalstack/api/v2/size_imageconstraint_pb.js
index c400208c..518bf58c 100644
--- a/js/metalstack/api/v2/size_imageconstraint_pb.js
+++ b/js/metalstack/api/v2/size_imageconstraint_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/size_imageconstraint.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/size_imageconstraint_pb.ts b/js/metalstack/api/v2/size_imageconstraint_pb.ts
index f622e90f..ab0e630e 100644
--- a/js/metalstack/api/v2/size_imageconstraint_pb.ts
+++ b/js/metalstack/api/v2/size_imageconstraint_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/size_imageconstraint.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/size_pb.js b/js/metalstack/api/v2/size_pb.js
index 80586e34..78689136 100644
--- a/js/metalstack/api/v2/size_pb.js
+++ b/js/metalstack/api/v2/size_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/size.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/size_pb.ts b/js/metalstack/api/v2/size_pb.ts
index a6fd2780..d36db600 100644
--- a/js/metalstack/api/v2/size_pb.ts
+++ b/js/metalstack/api/v2/size_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/size.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/size_reservation_pb.js b/js/metalstack/api/v2/size_reservation_pb.js
index d4818b3b..ca3d3b92 100644
--- a/js/metalstack/api/v2/size_reservation_pb.js
+++ b/js/metalstack/api/v2/size_reservation_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/size_reservation.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/size_reservation_pb.ts b/js/metalstack/api/v2/size_reservation_pb.ts
index 110e923d..01c4c878 100644
--- a/js/metalstack/api/v2/size_reservation_pb.ts
+++ b/js/metalstack/api/v2/size_reservation_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/size_reservation.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/switch_pb.js b/js/metalstack/api/v2/switch_pb.js
index db9e2a0e..6be7cd81 100644
--- a/js/metalstack/api/v2/switch_pb.js
+++ b/js/metalstack/api/v2/switch_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/switch.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/switch_pb.ts b/js/metalstack/api/v2/switch_pb.ts
index b459cda0..227746c1 100644
--- a/js/metalstack/api/v2/switch_pb.ts
+++ b/js/metalstack/api/v2/switch_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/switch.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/tenant_pb.js b/js/metalstack/api/v2/tenant_pb.js
index c5aeeb45..2b3b525b 100644
--- a/js/metalstack/api/v2/tenant_pb.js
+++ b/js/metalstack/api/v2/tenant_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/tenant.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/tenant_pb.ts b/js/metalstack/api/v2/tenant_pb.ts
index 9be61b0a..d24dc54c 100644
--- a/js/metalstack/api/v2/tenant_pb.ts
+++ b/js/metalstack/api/v2/tenant_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/tenant.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/token_pb.js b/js/metalstack/api/v2/token_pb.js
index d87aba32..23ed5eba 100644
--- a/js/metalstack/api/v2/token_pb.js
+++ b/js/metalstack/api/v2/token_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/token.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/token_pb.ts b/js/metalstack/api/v2/token_pb.ts
index 879dddea..8fc729f8 100644
--- a/js/metalstack/api/v2/token_pb.ts
+++ b/js/metalstack/api/v2/token_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/token.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/user_pb.js b/js/metalstack/api/v2/user_pb.js
index 5c906132..1342930f 100644
--- a/js/metalstack/api/v2/user_pb.js
+++ b/js/metalstack/api/v2/user_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/user.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/user_pb.ts b/js/metalstack/api/v2/user_pb.ts
index 6b7fb6f8..3301536a 100644
--- a/js/metalstack/api/v2/user_pb.ts
+++ b/js/metalstack/api/v2/user_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/user.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/version_pb.js b/js/metalstack/api/v2/version_pb.js
index 702cdc8a..78fe01ae 100644
--- a/js/metalstack/api/v2/version_pb.js
+++ b/js/metalstack/api/v2/version_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/version.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/version_pb.ts b/js/metalstack/api/v2/version_pb.ts
index fcc7deeb..ae9622f1 100644
--- a/js/metalstack/api/v2/version_pb.ts
+++ b/js/metalstack/api/v2/version_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/version.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/api/v2/vpn_pb.js b/js/metalstack/api/v2/vpn_pb.js
index 10841da1..ced4aa40 100644
--- a/js/metalstack/api/v2/vpn_pb.js
+++ b/js/metalstack/api/v2/vpn_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/vpn.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/api/v2/vpn_pb.ts b/js/metalstack/api/v2/vpn_pb.ts
index dc0a9f2d..1a4b387e 100644
--- a/js/metalstack/api/v2/vpn_pb.ts
+++ b/js/metalstack/api/v2/vpn_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/api/v2/vpn.proto (package metalstack.api.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/infra/v2/bmc_pb.js b/js/metalstack/infra/v2/bmc_pb.js
index ad7b4501..63de16ec 100644
--- a/js/metalstack/infra/v2/bmc_pb.js
+++ b/js/metalstack/infra/v2/bmc_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/bmc.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/infra/v2/bmc_pb.ts b/js/metalstack/infra/v2/bmc_pb.ts
index c35b4d47..b98f6498 100644
--- a/js/metalstack/infra/v2/bmc_pb.ts
+++ b/js/metalstack/infra/v2/bmc_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/bmc.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/infra/v2/boot_pb.js b/js/metalstack/infra/v2/boot_pb.js
index 4ad091b1..e3896211 100644
--- a/js/metalstack/infra/v2/boot_pb.js
+++ b/js/metalstack/infra/v2/boot_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/boot.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/infra/v2/boot_pb.ts b/js/metalstack/infra/v2/boot_pb.ts
index b001dbab..3f19449b 100644
--- a/js/metalstack/infra/v2/boot_pb.ts
+++ b/js/metalstack/infra/v2/boot_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/boot.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/infra/v2/component_pb.js b/js/metalstack/infra/v2/component_pb.js
index 1bfabb84..4a41ea02 100644
--- a/js/metalstack/infra/v2/component_pb.js
+++ b/js/metalstack/infra/v2/component_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/component.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/infra/v2/component_pb.ts b/js/metalstack/infra/v2/component_pb.ts
index a05308ca..8053e764 100644
--- a/js/metalstack/infra/v2/component_pb.ts
+++ b/js/metalstack/infra/v2/component_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/component.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/infra/v2/event_pb.js b/js/metalstack/infra/v2/event_pb.js
index 3e25896b..121891d6 100644
--- a/js/metalstack/infra/v2/event_pb.js
+++ b/js/metalstack/infra/v2/event_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/event.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/infra/v2/event_pb.ts b/js/metalstack/infra/v2/event_pb.ts
index f8e98df8..6685c224 100644
--- a/js/metalstack/infra/v2/event_pb.ts
+++ b/js/metalstack/infra/v2/event_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/event.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/js/metalstack/infra/v2/switch_pb.js b/js/metalstack/infra/v2/switch_pb.js
index 914219f4..0fb535e0 100644
--- a/js/metalstack/infra/v2/switch_pb.js
+++ b/js/metalstack/infra/v2/switch_pb.js
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/switch.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
diff --git a/js/metalstack/infra/v2/switch_pb.ts b/js/metalstack/infra/v2/switch_pb.ts
index 0708a565..e6f27237 100644
--- a/js/metalstack/infra/v2/switch_pb.ts
+++ b/js/metalstack/infra/v2/switch_pb.ts
@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts"
 // @generated from file metalstack/infra/v2/switch.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 
diff --git a/proto/buf.gen.yaml b/proto/buf.gen.yaml
index 8954d002..cea84a5a 100644
--- a/proto/buf.gen.yaml
+++ b/proto/buf.gen.yaml
@@ -27,7 +27,7 @@ plugins:
   - remote: buf.build/connectrpc/python:v0.10.1
     out: ../python
   # js
-  - remote: buf.build/bufbuild/es:v2.12.0
+  - remote: buf.build/bufbuild/es:v2.12.1
     include_imports: true
     out: ../js
     opt: target=ts
diff --git a/proto/metalstack/admin/v2/tenant.proto b/proto/metalstack/admin/v2/tenant.proto
index c4b35539..28c388a1 100644
--- a/proto/metalstack/admin/v2/tenant.proto
+++ b/proto/metalstack/admin/v2/tenant.proto
@@ -20,12 +20,17 @@ service TenantService {
     option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_VIEWER;
     option (metalstack.api.v2.auditing) = AUDITING_INCLUDED;
   }
+  // Add a member to a tenant
+  rpc AddMember(TenantServiceAddMemberRequest) returns (TenantServiceAddMemberResponse) {
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_INCLUDED;
+  }
 }
 
 // TenantServiceCreateRequest is the request payload for creating a tenant.
 message TenantServiceCreateRequest {
   // Name of the tenant
-  string name = 1 [(buf.validate.field).string.(metalstack.api.v2.is_name) = true];
+  string name = 1 [(buf.validate.field).string.(metalstack.api.v2.is_tenant_login) = true];
   // Description of the tenant
   optional string description = 2 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
   // Email of the tenant, if not set will be inherited from the creator
@@ -55,3 +60,16 @@ message TenantServiceListResponse {
   // NextPage is used for pagination, returns the next page to be fetched and must then be provided in the list request
   optional uint64 next_page = 2;
 }
+
+// TenantServiceAddMemberRequest is the request payload for adding a member to a tenant
+message TenantServiceAddMemberRequest {
+  // Login of the tenant to which the member will be added
+  string tenant = 1 [(buf.validate.field).string.(metalstack.api.v2.is_tenant_login) = true];
+  // Login of the member to add
+  string member = 2 [(buf.validate.field).string.(metalstack.api.v2.is_tenant_login) = true];
+  // Role to assign to the new member
+  metalstack.api.v2.TenantRole role = 3 [(buf.validate.field).enum.defined_only = true];
+}
+
+// TenantServiceAddMemberResponse is the response payload for the add member request
+message TenantServiceAddMemberResponse {}
diff --git a/python/metalstack/admin/v2/tenant_connect.py b/python/metalstack/admin/v2/tenant_connect.py
index 437b5e66..76843172 100644
--- a/python/metalstack/admin/v2/tenant_connect.py
+++ b/python/metalstack/admin/v2/tenant_connect.py
@@ -24,6 +24,9 @@ async def create(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.Tena
     async def list(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceListRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceListResponse:
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
 
+    async def add_member(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
 
 class TenantServiceASGIApplication(ConnectASGIApplication[TenantService]):
     def __init__(self, service: TenantService | AsyncGenerator[TenantService], *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None, compressions: Iterable[Compression] | None = None, codecs: Iterable[Codec] | None = None) -> None:
@@ -50,6 +53,16 @@ def __init__(self, service: TenantService | AsyncGenerator[TenantService], *, in
                     ),
                     function=svc.list,
                 ),
+                "/metalstack.admin.v2.TenantService/AddMember": Endpoint.unary(
+                    method=MethodInfo(
+                        name="AddMember",
+                        service_name="metalstack.admin.v2.TenantService",
+                        input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.add_member,
+                ),
             },
             interceptors=interceptors,
             read_max_bytes=read_max_bytes,
@@ -104,6 +117,26 @@ async def list(
             timeout_ms=timeout_ms,
         )
 
+    async def add_member(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="AddMember",
+                service_name="metalstack.admin.v2.TenantService",
+                input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest,
+                output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
 
 
 
@@ -113,6 +146,8 @@ def create(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServ
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
     def list(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceListRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceListResponse:
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def add_member(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
 
 
 class TenantServiceWSGIApplication(ConnectWSGIApplication):
@@ -139,6 +174,16 @@ def __init__(self, service: TenantServiceSync, interceptors: Iterable[Intercepto
                     ),
                     function=service.list,
                 ),
+                "/metalstack.admin.v2.TenantService/AddMember": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="AddMember",
+                        service_name="metalstack.admin.v2.TenantService",
+                        input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.add_member,
+                ),
             },
             interceptors=interceptors,
             read_max_bytes=read_max_bytes,
@@ -193,4 +238,24 @@ def list(
             timeout_ms=timeout_ms,
         )
 
+    def add_member(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="AddMember",
+                service_name="metalstack.admin.v2.TenantService",
+                input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest,
+                output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
 
diff --git a/python/metalstack/admin/v2/tenant_pb2.py b/python/metalstack/admin/v2/tenant_pb2.py
index b8a8147c..b2a8c010 100644
--- a/python/metalstack/admin/v2/tenant_pb2.py
+++ b/python/metalstack/admin/v2/tenant_pb2.py
@@ -28,7 +28,7 @@
 from metalstack.api.v2 import tenant_pb2 as metalstack_dot_api_dot_v2_dot_tenant__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n metalstack/admin/v2/tenant.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1emetalstack/api/v2/tenant.proto\"\xa2\x02\n\x1aTenantServiceCreateRequest\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\"\n\x05\x65mail\x18\x03 \x01(\tB\x07\xbaH\x04r\x02`\x01H\x01R\x05\x65mail\x88\x01\x01\x12/\n\navatar_url\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01H\x02R\tavatarUrl\x88\x01\x01\x12\x31\n\x06labels\x18\x05 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labelsB\x0e\n\x0c_descriptionB\x08\n\x06_emailB\r\n\x0b_avatar_url\"P\n\x1bTenantServiceCreateResponse\x12\x31\n\x06tenant\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.TenantR\x06tenant\"P\n\x18TenantServiceListRequest\x12\x34\n\x05query\x18\x01 \x01(\x0b\x32\x1e.metalstack.api.v2.TenantQueryR\x05query\"\x80\x01\n\x19TenantServiceListResponse\x12\x33\n\x07tenants\x18\x01 \x03(\x0b\x32\x19.metalstack.api.v2.TenantR\x07tenants\x12 \n\tnext_page\x18\x02 \x01(\x04H\x00R\x08nextPage\x88\x01\x01\x42\x0c\n\n_next_page2\xfa\x01\n\rTenantService\x12v\n\x06\x43reate\x12/.metalstack.admin.v2.TenantServiceCreateRequest\x1a\x30.metalstack.admin.v2.TenantServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12q\n\x04List\x12-.metalstack.admin.v2.TenantServiceListRequest\x1a..metalstack.admin.v2.TenantServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x42\xcf\x01\n\x17\x63om.metalstack.admin.v2B\x0bTenantProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n metalstack/admin/v2/tenant.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1emetalstack/api/v2/tenant.proto\"\xa2\x02\n\x1aTenantServiceCreateRequest\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\"\n\x05\x65mail\x18\x03 \x01(\tB\x07\xbaH\x04r\x02`\x01H\x01R\x05\x65mail\x88\x01\x01\x12/\n\navatar_url\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01H\x02R\tavatarUrl\x88\x01\x01\x12\x31\n\x06labels\x18\x05 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labelsB\x0e\n\x0c_descriptionB\x08\n\x06_emailB\r\n\x0b_avatar_url\"P\n\x1bTenantServiceCreateResponse\x12\x31\n\x06tenant\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.TenantR\x06tenant\"P\n\x18TenantServiceListRequest\x12\x34\n\x05query\x18\x01 \x01(\x0b\x32\x1e.metalstack.api.v2.TenantQueryR\x05query\"\x80\x01\n\x19TenantServiceListResponse\x12\x33\n\x07tenants\x18\x01 \x03(\x0b\x32\x19.metalstack.api.v2.TenantR\x07tenants\x12 \n\tnext_page\x18\x02 \x01(\x04H\x00R\x08nextPage\x88\x01\x01\x42\x0c\n\n_next_page\"\xa6\x01\n\x1dTenantServiceAddMemberRequest\x12#\n\x06tenant\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n\x06member\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06member\x12;\n\x04role\x18\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04role\" \n\x1eTenantServiceAddMemberResponse2\xfb\x02\n\rTenantService\x12v\n\x06\x43reate\x12/.metalstack.admin.v2.TenantServiceCreateRequest\x1a\x30.metalstack.admin.v2.TenantServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12q\n\x04List\x12-.metalstack.admin.v2.TenantServiceListRequest\x1a..metalstack.admin.v2.TenantServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12\x7f\n\tAddMember\x12\x32.metalstack.admin.v2.TenantServiceAddMemberRequest\x1a\x33.metalstack.admin.v2.TenantServiceAddMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xcf\x01\n\x17\x63om.metalstack.admin.v2B\x0bTenantProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -37,17 +37,25 @@
   _globals['DESCRIPTOR']._loaded_options = None
   _globals['DESCRIPTOR']._serialized_options = b'\n\027com.metalstack.admin.v2B\013TenantProtoP\001Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\242\002\003MAX\252\002\023Metalstack.Admin.V2\312\002\023Metalstack\\Admin\\V2\342\002\037Metalstack\\Admin\\V2\\GPBMetadata\352\002\025Metalstack::Admin::V2'
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['name']._loaded_options = None
-  _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['name']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
+  _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['name']._serialized_options = b'\272H\010r\006\220\264\256\261\002\001'
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['description']._loaded_options = None
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['description']._serialized_options = b'\272H\010r\006\310\263\256\261\002\001'
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['email']._loaded_options = None
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['email']._serialized_options = b'\272H\004r\002`\001'
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['avatar_url']._loaded_options = None
   _globals['_TENANTSERVICECREATEREQUEST'].fields_by_name['avatar_url']._serialized_options = b'\272H\010r\006\340\263\256\261\002\001'
+  _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['tenant']._loaded_options = None
+  _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['tenant']._serialized_options = b'\272H\010r\006\220\264\256\261\002\001'
+  _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['member']._loaded_options = None
+  _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['member']._serialized_options = b'\272H\010r\006\220\264\256\261\002\001'
+  _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['role']._loaded_options = None
+  _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['role']._serialized_options = b'\272H\005\202\001\002\020\001'
   _globals['_TENANTSERVICE'].methods_by_name['Create']._loaded_options = None
   _globals['_TENANTSERVICE'].methods_by_name['Create']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
   _globals['_TENANTSERVICE'].methods_by_name['List']._loaded_options = None
   _globals['_TENANTSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002\340\363\030\001'
+  _globals['_TENANTSERVICE'].methods_by_name['AddMember']._loaded_options = None
+  _globals['_TENANTSERVICE'].methods_by_name['AddMember']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
   _globals['_TENANTSERVICECREATEREQUEST']._serialized_start=193
   _globals['_TENANTSERVICECREATEREQUEST']._serialized_end=483
   _globals['_TENANTSERVICECREATERESPONSE']._serialized_start=485
@@ -56,6 +64,10 @@
   _globals['_TENANTSERVICELISTREQUEST']._serialized_end=647
   _globals['_TENANTSERVICELISTRESPONSE']._serialized_start=650
   _globals['_TENANTSERVICELISTRESPONSE']._serialized_end=778
-  _globals['_TENANTSERVICE']._serialized_start=781
-  _globals['_TENANTSERVICE']._serialized_end=1031
+  _globals['_TENANTSERVICEADDMEMBERREQUEST']._serialized_start=781
+  _globals['_TENANTSERVICEADDMEMBERREQUEST']._serialized_end=947
+  _globals['_TENANTSERVICEADDMEMBERRESPONSE']._serialized_start=949
+  _globals['_TENANTSERVICEADDMEMBERRESPONSE']._serialized_end=981
+  _globals['_TENANTSERVICE']._serialized_start=984
+  _globals['_TENANTSERVICE']._serialized_end=1363
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/tenant_pb2.pyi b/python/metalstack/admin/v2/tenant_pb2.pyi
index d6b61ef6..1518b7c0 100644
--- a/python/metalstack/admin/v2/tenant_pb2.pyi
+++ b/python/metalstack/admin/v2/tenant_pb2.pyi
@@ -43,3 +43,17 @@ class TenantServiceListResponse(_message.Message):
     tenants: _containers.RepeatedCompositeFieldContainer[_tenant_pb2.Tenant]
     next_page: int
     def __init__(self, tenants: _Optional[_Iterable[_Union[_tenant_pb2.Tenant, _Mapping]]] = ..., next_page: _Optional[int] = ...) -> None: ...
+
+class TenantServiceAddMemberRequest(_message.Message):
+    __slots__ = ("tenant", "member", "role")
+    TENANT_FIELD_NUMBER: _ClassVar[int]
+    MEMBER_FIELD_NUMBER: _ClassVar[int]
+    ROLE_FIELD_NUMBER: _ClassVar[int]
+    tenant: str
+    member: str
+    role: _common_pb2.TenantRole
+    def __init__(self, tenant: _Optional[str] = ..., member: _Optional[str] = ..., role: _Optional[_Union[_common_pb2.TenantRole, str]] = ...) -> None: ...
+
+class TenantServiceAddMemberResponse(_message.Message):
+    __slots__ = ()
+    def __init__(self) -> None: ...

From 1c81852c62b783bd6f94c92c4d5ea024f05a283c Mon Sep 17 00:00:00 2001
From: Stefan Majer <stefan.majer@f-i-ts.de>
Date: Thu, 25 Jun 2026 07:39:28 +0200
Subject: [PATCH 2/2] Remove Member

---
 doc/index.html                                |  53 ++++++
 .../admin/v2/adminv2connect/tenant.connect.go |  41 ++++-
 go/metalstack/admin/v2/tenant.pb.go           | 161 ++++++++++++++----
 go/permissions/servicepermissions.go          |   4 +
 .../v2/adminv2connect/TenantServiceClient.go  |  68 ++++++++
 .../v2/adminv2connect/TenantServiceHandler.go |  68 ++++++++
 js/metalstack/admin/v2/tenant_pb.d.ts         |  45 +++++
 js/metalstack/admin/v2/tenant_pb.js           |  12 +-
 js/metalstack/admin/v2/tenant_pb.ts           |  55 +++++-
 proto/metalstack/admin/v2/tenant.proto        |  16 ++
 python/metalstack/admin/v2/tenant_connect.py  |  65 +++++++
 python/metalstack/admin/v2/tenant_pb2.py      |  16 +-
 python/metalstack/admin/v2/tenant_pb2.pyi     |  12 ++
 13 files changed, 578 insertions(+), 38 deletions(-)

diff --git a/doc/index.html b/doc/index.html
index e14c9330..33c6109b 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -2322,6 +2322,14 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack.admin.v2.TenantServiceListResponse"><span class="badge">M</span>TenantServiceListResponse</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.admin.v2.TenantServiceRemoveMemberRequest"><span class="badge">M</span>TenantServiceRemoveMemberRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.TenantServiceRemoveMemberResponse"><span class="badge">M</span>TenantServiceRemoveMemberResponse</a>
+                </li>
+              
               
               
               
@@ -19226,6 +19234,44 @@ <h3 id="metalstack.admin.v2.TenantServiceListResponse">TenantServiceListResponse
 
         
       
+        <h3 id="metalstack.admin.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveMemberRequest</h3>
+        <p>TenantServiceRemoveMemberRequest is the request payload for removing a member from a tenant</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the tenant from which the member will be removed </p></td>
+                </tr>
+              
+                <tr>
+                  <td>member</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the member to remove </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.TenantServiceRemoveMemberResponse">TenantServiceRemoveMemberResponse</h3>
+        <p>TenantServiceRemoveMemberResponse is the response payload for the remove member request</p>
+
+        
+
+        
+      
 
       
 
@@ -19261,6 +19307,13 @@ <h3 id="metalstack.admin.v2.TenantService">TenantService</h3>
                 <td><p>Add a member to a tenant</p></td>
               </tr>
             
+              <tr>
+                <td>RemoveMember</td>
+                <td><a href="#metalstack.admin.v2.TenantServiceRemoveMemberRequest">TenantServiceRemoveMemberRequest</a></td>
+                <td><a href="#metalstack.admin.v2.TenantServiceRemoveMemberResponse">TenantServiceRemoveMemberResponse</a></td>
+                <td><p>RemoveMember remove a member of a tenant</p></td>
+              </tr>
+            
           </tbody>
         </table>
 
diff --git a/go/metalstack/admin/v2/adminv2connect/tenant.connect.go b/go/metalstack/admin/v2/adminv2connect/tenant.connect.go
index cdc22bbb..3f48b270 100644
--- a/go/metalstack/admin/v2/adminv2connect/tenant.connect.go
+++ b/go/metalstack/admin/v2/adminv2connect/tenant.connect.go
@@ -39,6 +39,9 @@ const (
 	TenantServiceListProcedure = "/metalstack.admin.v2.TenantService/List"
 	// TenantServiceAddMemberProcedure is the fully-qualified name of the TenantService's AddMember RPC.
 	TenantServiceAddMemberProcedure = "/metalstack.admin.v2.TenantService/AddMember"
+	// TenantServiceRemoveMemberProcedure is the fully-qualified name of the TenantService's
+	// RemoveMember RPC.
+	TenantServiceRemoveMemberProcedure = "/metalstack.admin.v2.TenantService/RemoveMember"
 )
 
 // TenantServiceClient is a client for the metalstack.admin.v2.TenantService service.
@@ -49,6 +52,8 @@ type TenantServiceClient interface {
 	List(context.Context, *v2.TenantServiceListRequest) (*v2.TenantServiceListResponse, error)
 	// Add a member to a tenant
 	AddMember(context.Context, *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error)
+	// RemoveMember remove a member of a tenant
+	RemoveMember(context.Context, *v2.TenantServiceRemoveMemberRequest) (*v2.TenantServiceRemoveMemberResponse, error)
 }
 
 // NewTenantServiceClient constructs a client for the metalstack.admin.v2.TenantService service. By
@@ -80,14 +85,21 @@ func NewTenantServiceClient(httpClient connect.HTTPClient, baseURL string, opts
 			connect.WithSchema(tenantServiceMethods.ByName("AddMember")),
 			connect.WithClientOptions(opts...),
 		),
+		removeMember: connect.NewClient[v2.TenantServiceRemoveMemberRequest, v2.TenantServiceRemoveMemberResponse](
+			httpClient,
+			baseURL+TenantServiceRemoveMemberProcedure,
+			connect.WithSchema(tenantServiceMethods.ByName("RemoveMember")),
+			connect.WithClientOptions(opts...),
+		),
 	}
 }
 
 // tenantServiceClient implements TenantServiceClient.
 type tenantServiceClient struct {
-	create    *connect.Client[v2.TenantServiceCreateRequest, v2.TenantServiceCreateResponse]
-	list      *connect.Client[v2.TenantServiceListRequest, v2.TenantServiceListResponse]
-	addMember *connect.Client[v2.TenantServiceAddMemberRequest, v2.TenantServiceAddMemberResponse]
+	create       *connect.Client[v2.TenantServiceCreateRequest, v2.TenantServiceCreateResponse]
+	list         *connect.Client[v2.TenantServiceListRequest, v2.TenantServiceListResponse]
+	addMember    *connect.Client[v2.TenantServiceAddMemberRequest, v2.TenantServiceAddMemberResponse]
+	removeMember *connect.Client[v2.TenantServiceRemoveMemberRequest, v2.TenantServiceRemoveMemberResponse]
 }
 
 // Create calls metalstack.admin.v2.TenantService.Create.
@@ -117,6 +129,15 @@ func (c *tenantServiceClient) AddMember(ctx context.Context, req *v2.TenantServi
 	return nil, err
 }
 
+// RemoveMember calls metalstack.admin.v2.TenantService.RemoveMember.
+func (c *tenantServiceClient) RemoveMember(ctx context.Context, req *v2.TenantServiceRemoveMemberRequest) (*v2.TenantServiceRemoveMemberResponse, error) {
+	response, err := c.removeMember.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
 // TenantServiceHandler is an implementation of the metalstack.admin.v2.TenantService service.
 type TenantServiceHandler interface {
 	// Creates a new tenant.
@@ -125,6 +146,8 @@ type TenantServiceHandler interface {
 	List(context.Context, *v2.TenantServiceListRequest) (*v2.TenantServiceListResponse, error)
 	// Add a member to a tenant
 	AddMember(context.Context, *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error)
+	// RemoveMember remove a member of a tenant
+	RemoveMember(context.Context, *v2.TenantServiceRemoveMemberRequest) (*v2.TenantServiceRemoveMemberResponse, error)
 }
 
 // NewTenantServiceHandler builds an HTTP handler from the service implementation. It returns the
@@ -152,6 +175,12 @@ func NewTenantServiceHandler(svc TenantServiceHandler, opts ...connect.HandlerOp
 		connect.WithSchema(tenantServiceMethods.ByName("AddMember")),
 		connect.WithHandlerOptions(opts...),
 	)
+	tenantServiceRemoveMemberHandler := connect.NewUnaryHandlerSimple(
+		TenantServiceRemoveMemberProcedure,
+		svc.RemoveMember,
+		connect.WithSchema(tenantServiceMethods.ByName("RemoveMember")),
+		connect.WithHandlerOptions(opts...),
+	)
 	return "/metalstack.admin.v2.TenantService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case TenantServiceCreateProcedure:
@@ -160,6 +189,8 @@ func NewTenantServiceHandler(svc TenantServiceHandler, opts ...connect.HandlerOp
 			tenantServiceListHandler.ServeHTTP(w, r)
 		case TenantServiceAddMemberProcedure:
 			tenantServiceAddMemberHandler.ServeHTTP(w, r)
+		case TenantServiceRemoveMemberProcedure:
+			tenantServiceRemoveMemberHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -180,3 +211,7 @@ func (UnimplementedTenantServiceHandler) List(context.Context, *v2.TenantService
 func (UnimplementedTenantServiceHandler) AddMember(context.Context, *v2.TenantServiceAddMemberRequest) (*v2.TenantServiceAddMemberResponse, error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.TenantService.AddMember is not implemented"))
 }
+
+func (UnimplementedTenantServiceHandler) RemoveMember(context.Context, *v2.TenantServiceRemoveMemberRequest) (*v2.TenantServiceRemoveMemberResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.TenantService.RemoveMember is not implemented"))
+}
diff --git a/go/metalstack/admin/v2/tenant.pb.go b/go/metalstack/admin/v2/tenant.pb.go
index 06e62d45..3937e5f2 100644
--- a/go/metalstack/admin/v2/tenant.pb.go
+++ b/go/metalstack/admin/v2/tenant.pb.go
@@ -353,6 +353,98 @@ func (*TenantServiceAddMemberResponse) Descriptor() ([]byte, []int) {
 	return file_metalstack_admin_v2_tenant_proto_rawDescGZIP(), []int{5}
 }
 
+// TenantServiceRemoveMemberRequest is the request payload for removing a member from a tenant
+type TenantServiceRemoveMemberRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Login of the tenant from which the member will be removed
+	Tenant string `protobuf:"bytes,1,opt,name=tenant,proto3" json:"tenant,omitempty"`
+	// Login of the member to remove
+	Member        string `protobuf:"bytes,2,opt,name=member,proto3" json:"member,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TenantServiceRemoveMemberRequest) Reset() {
+	*x = TenantServiceRemoveMemberRequest{}
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantServiceRemoveMemberRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantServiceRemoveMemberRequest) ProtoMessage() {}
+
+func (x *TenantServiceRemoveMemberRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TenantServiceRemoveMemberRequest.ProtoReflect.Descriptor instead.
+func (*TenantServiceRemoveMemberRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_tenant_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *TenantServiceRemoveMemberRequest) GetTenant() string {
+	if x != nil {
+		return x.Tenant
+	}
+	return ""
+}
+
+func (x *TenantServiceRemoveMemberRequest) GetMember() string {
+	if x != nil {
+		return x.Member
+	}
+	return ""
+}
+
+// TenantServiceRemoveMemberResponse is the response payload for the remove member request
+type TenantServiceRemoveMemberResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TenantServiceRemoveMemberResponse) Reset() {
+	*x = TenantServiceRemoveMemberResponse{}
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantServiceRemoveMemberResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantServiceRemoveMemberResponse) ProtoMessage() {}
+
+func (x *TenantServiceRemoveMemberResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_tenant_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TenantServiceRemoveMemberResponse.ProtoReflect.Descriptor instead.
+func (*TenantServiceRemoveMemberResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_tenant_proto_rawDescGZIP(), []int{7}
+}
+
 var File_metalstack_admin_v2_tenant_proto protoreflect.FileDescriptor
 
 const file_metalstack_admin_v2_tenant_proto_rawDesc = "" +
@@ -381,12 +473,17 @@ const file_metalstack_admin_v2_tenant_proto_rawDesc = "" +
 	"\x06tenant\x18\x01 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n" +
 	"\x06member\x18\x02 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x06member\x12;\n" +
 	"\x04role\x18\x03 \x01(\x0e2\x1d.metalstack.api.v2.TenantRoleB\b\xbaH\x05\x82\x01\x02\x10\x01R\x04role\" \n" +
-	"\x1eTenantServiceAddMemberResponse2\xfb\x02\n" +
+	"\x1eTenantServiceAddMemberResponse\"l\n" +
+	" TenantServiceRemoveMemberRequest\x12#\n" +
+	"\x06tenant\x18\x01 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n" +
+	"\x06member\x18\x02 \x01(\tB\v\xbaH\br\x06\x90\xb4\xae\xb1\x02\x01R\x06member\"#\n" +
+	"!TenantServiceRemoveMemberResponse2\x86\x04\n" +
 	"\rTenantService\x12v\n" +
 	"\x06Create\x12/.metalstack.admin.v2.TenantServiceCreateRequest\x1a0.metalstack.admin.v2.TenantServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12q\n" +
 	"\x04List\x12-.metalstack.admin.v2.TenantServiceListRequest\x1a..metalstack.admin.v2.TenantServiceListResponse\"\n" +
 	"\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12\x7f\n" +
-	"\tAddMember\x122.metalstack.admin.v2.TenantServiceAddMemberRequest\x1a3.metalstack.admin.v2.TenantServiceAddMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01B\xcf\x01\n" +
+	"\tAddMember\x122.metalstack.admin.v2.TenantServiceAddMemberRequest\x1a3.metalstack.admin.v2.TenantServiceAddMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12\x88\x01\n" +
+	"\fRemoveMember\x125.metalstack.admin.v2.TenantServiceRemoveMemberRequest\x1a6.metalstack.admin.v2.TenantServiceRemoveMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01B\xcf\x01\n" +
 	"\x17com.metalstack.admin.v2B\vTenantProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3"
 
 var (
@@ -401,36 +498,40 @@ func file_metalstack_admin_v2_tenant_proto_rawDescGZIP() []byte {
 	return file_metalstack_admin_v2_tenant_proto_rawDescData
 }
 
-var file_metalstack_admin_v2_tenant_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_metalstack_admin_v2_tenant_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_metalstack_admin_v2_tenant_proto_goTypes = []any{
-	(*TenantServiceCreateRequest)(nil),     // 0: metalstack.admin.v2.TenantServiceCreateRequest
-	(*TenantServiceCreateResponse)(nil),    // 1: metalstack.admin.v2.TenantServiceCreateResponse
-	(*TenantServiceListRequest)(nil),       // 2: metalstack.admin.v2.TenantServiceListRequest
-	(*TenantServiceListResponse)(nil),      // 3: metalstack.admin.v2.TenantServiceListResponse
-	(*TenantServiceAddMemberRequest)(nil),  // 4: metalstack.admin.v2.TenantServiceAddMemberRequest
-	(*TenantServiceAddMemberResponse)(nil), // 5: metalstack.admin.v2.TenantServiceAddMemberResponse
-	(*v2.Labels)(nil),                      // 6: metalstack.api.v2.Labels
-	(*v2.Tenant)(nil),                      // 7: metalstack.api.v2.Tenant
-	(*v2.TenantQuery)(nil),                 // 8: metalstack.api.v2.TenantQuery
-	(v2.TenantRole)(0),                     // 9: metalstack.api.v2.TenantRole
+	(*TenantServiceCreateRequest)(nil),        // 0: metalstack.admin.v2.TenantServiceCreateRequest
+	(*TenantServiceCreateResponse)(nil),       // 1: metalstack.admin.v2.TenantServiceCreateResponse
+	(*TenantServiceListRequest)(nil),          // 2: metalstack.admin.v2.TenantServiceListRequest
+	(*TenantServiceListResponse)(nil),         // 3: metalstack.admin.v2.TenantServiceListResponse
+	(*TenantServiceAddMemberRequest)(nil),     // 4: metalstack.admin.v2.TenantServiceAddMemberRequest
+	(*TenantServiceAddMemberResponse)(nil),    // 5: metalstack.admin.v2.TenantServiceAddMemberResponse
+	(*TenantServiceRemoveMemberRequest)(nil),  // 6: metalstack.admin.v2.TenantServiceRemoveMemberRequest
+	(*TenantServiceRemoveMemberResponse)(nil), // 7: metalstack.admin.v2.TenantServiceRemoveMemberResponse
+	(*v2.Labels)(nil),                         // 8: metalstack.api.v2.Labels
+	(*v2.Tenant)(nil),                         // 9: metalstack.api.v2.Tenant
+	(*v2.TenantQuery)(nil),                    // 10: metalstack.api.v2.TenantQuery
+	(v2.TenantRole)(0),                        // 11: metalstack.api.v2.TenantRole
 }
 var file_metalstack_admin_v2_tenant_proto_depIdxs = []int32{
-	6, // 0: metalstack.admin.v2.TenantServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
-	7, // 1: metalstack.admin.v2.TenantServiceCreateResponse.tenant:type_name -> metalstack.api.v2.Tenant
-	8, // 2: metalstack.admin.v2.TenantServiceListRequest.query:type_name -> metalstack.api.v2.TenantQuery
-	7, // 3: metalstack.admin.v2.TenantServiceListResponse.tenants:type_name -> metalstack.api.v2.Tenant
-	9, // 4: metalstack.admin.v2.TenantServiceAddMemberRequest.role:type_name -> metalstack.api.v2.TenantRole
-	0, // 5: metalstack.admin.v2.TenantService.Create:input_type -> metalstack.admin.v2.TenantServiceCreateRequest
-	2, // 6: metalstack.admin.v2.TenantService.List:input_type -> metalstack.admin.v2.TenantServiceListRequest
-	4, // 7: metalstack.admin.v2.TenantService.AddMember:input_type -> metalstack.admin.v2.TenantServiceAddMemberRequest
-	1, // 8: metalstack.admin.v2.TenantService.Create:output_type -> metalstack.admin.v2.TenantServiceCreateResponse
-	3, // 9: metalstack.admin.v2.TenantService.List:output_type -> metalstack.admin.v2.TenantServiceListResponse
-	5, // 10: metalstack.admin.v2.TenantService.AddMember:output_type -> metalstack.admin.v2.TenantServiceAddMemberResponse
-	8, // [8:11] is the sub-list for method output_type
-	5, // [5:8] is the sub-list for method input_type
-	5, // [5:5] is the sub-list for extension type_name
-	5, // [5:5] is the sub-list for extension extendee
-	0, // [0:5] is the sub-list for field type_name
+	8,  // 0: metalstack.admin.v2.TenantServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	9,  // 1: metalstack.admin.v2.TenantServiceCreateResponse.tenant:type_name -> metalstack.api.v2.Tenant
+	10, // 2: metalstack.admin.v2.TenantServiceListRequest.query:type_name -> metalstack.api.v2.TenantQuery
+	9,  // 3: metalstack.admin.v2.TenantServiceListResponse.tenants:type_name -> metalstack.api.v2.Tenant
+	11, // 4: metalstack.admin.v2.TenantServiceAddMemberRequest.role:type_name -> metalstack.api.v2.TenantRole
+	0,  // 5: metalstack.admin.v2.TenantService.Create:input_type -> metalstack.admin.v2.TenantServiceCreateRequest
+	2,  // 6: metalstack.admin.v2.TenantService.List:input_type -> metalstack.admin.v2.TenantServiceListRequest
+	4,  // 7: metalstack.admin.v2.TenantService.AddMember:input_type -> metalstack.admin.v2.TenantServiceAddMemberRequest
+	6,  // 8: metalstack.admin.v2.TenantService.RemoveMember:input_type -> metalstack.admin.v2.TenantServiceRemoveMemberRequest
+	1,  // 9: metalstack.admin.v2.TenantService.Create:output_type -> metalstack.admin.v2.TenantServiceCreateResponse
+	3,  // 10: metalstack.admin.v2.TenantService.List:output_type -> metalstack.admin.v2.TenantServiceListResponse
+	5,  // 11: metalstack.admin.v2.TenantService.AddMember:output_type -> metalstack.admin.v2.TenantServiceAddMemberResponse
+	7,  // 12: metalstack.admin.v2.TenantService.RemoveMember:output_type -> metalstack.admin.v2.TenantServiceRemoveMemberResponse
+	9,  // [9:13] is the sub-list for method output_type
+	5,  // [5:9] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_admin_v2_tenant_proto_init() }
@@ -446,7 +547,7 @@ func file_metalstack_admin_v2_tenant_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_tenant_proto_rawDesc), len(file_metalstack_admin_v2_tenant_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/permissions/servicepermissions.go b/go/permissions/servicepermissions.go
index 466442ab..309c48df 100755
--- a/go/permissions/servicepermissions.go
+++ b/go/permissions/servicepermissions.go
@@ -112,6 +112,7 @@ func GetServicePermissions() *ServicePermissions {
 					"/metalstack.admin.v2.TenantService/Create",
 					"/metalstack.admin.v2.TenantService/List",
 					"/metalstack.admin.v2.TenantService/AddMember",
+					"/metalstack.admin.v2.TenantService/RemoveMember",
 					"/metalstack.admin.v2.TokenService/List",
 					"/metalstack.admin.v2.TokenService/Revoke",
 					"/metalstack.admin.v2.TokenService/Create",
@@ -333,6 +334,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.TenantService/AddMember":                   true,
 			"/metalstack.admin.v2.TenantService/Create":                      true,
 			"/metalstack.admin.v2.TenantService/List":                        true,
+			"/metalstack.admin.v2.TenantService/RemoveMember":                true,
 			"/metalstack.admin.v2.TokenService/Create":                       true,
 			"/metalstack.admin.v2.TokenService/List":                         true,
 			"/metalstack.admin.v2.TokenService/Revoke":                       true,
@@ -516,6 +518,7 @@ func GetServicePermissions() *ServicePermissions {
 				"/metalstack.admin.v2.TenantService/AddMember":           true,
 				"/metalstack.admin.v2.TenantService/Create":              true,
 				"/metalstack.admin.v2.TenantService/List":                true,
+				"/metalstack.admin.v2.TenantService/RemoveMember":        true,
 				"/metalstack.admin.v2.TokenService/Create":               true,
 				"/metalstack.admin.v2.TokenService/List":                 true,
 				"/metalstack.admin.v2.TokenService/Revoke":               true,
@@ -645,6 +648,7 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.TenantService/AddMember":           true,
 			"/metalstack.admin.v2.TenantService/Create":              true,
 			"/metalstack.admin.v2.TenantService/List":                true,
+			"/metalstack.admin.v2.TenantService/RemoveMember":        true,
 			"/metalstack.admin.v2.TokenService/Create":               true,
 			"/metalstack.admin.v2.TokenService/List":                 true,
 			"/metalstack.admin.v2.TokenService/Revoke":               true,
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go
index dc23be63..32469c12 100644
--- a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceClient.go
@@ -241,3 +241,71 @@ func (_c *TenantServiceClient_List_Call) RunAndReturn(run func(context1 context.
 	_c.Call.Return(run)
 	return _c
 }
+
+// RemoveMember provides a mock function for the type TenantServiceClient
+func (_mock *TenantServiceClient) RemoveMember(context1 context.Context, tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest) (*adminv2.TenantServiceRemoveMemberResponse, error) {
+	ret := _mock.Called(context1, tenantServiceRemoveMemberRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RemoveMember")
+	}
+
+	var r0 *adminv2.TenantServiceRemoveMemberResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceRemoveMemberRequest) (*adminv2.TenantServiceRemoveMemberResponse, error)); ok {
+		return returnFunc(context1, tenantServiceRemoveMemberRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceRemoveMemberRequest) *adminv2.TenantServiceRemoveMemberResponse); ok {
+		r0 = returnFunc(context1, tenantServiceRemoveMemberRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.TenantServiceRemoveMemberResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.TenantServiceRemoveMemberRequest) error); ok {
+		r1 = returnFunc(context1, tenantServiceRemoveMemberRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// TenantServiceClient_RemoveMember_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RemoveMember'
+type TenantServiceClient_RemoveMember_Call struct {
+	*mock.Call
+}
+
+// RemoveMember is a helper method to define mock.On call
+//   - context1 context.Context
+//   - tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest
+func (_e *TenantServiceClient_Expecter) RemoveMember(context1 any, tenantServiceRemoveMemberRequest any) *TenantServiceClient_RemoveMember_Call {
+	return &TenantServiceClient_RemoveMember_Call{Call: _e.mock.On("RemoveMember", context1, tenantServiceRemoveMemberRequest)}
+}
+
+func (_c *TenantServiceClient_RemoveMember_Call) Run(run func(context1 context.Context, tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest)) *TenantServiceClient_RemoveMember_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.TenantServiceRemoveMemberRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.TenantServiceRemoveMemberRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *TenantServiceClient_RemoveMember_Call) Return(tenantServiceRemoveMemberResponse *adminv2.TenantServiceRemoveMemberResponse, err error) *TenantServiceClient_RemoveMember_Call {
+	_c.Call.Return(tenantServiceRemoveMemberResponse, err)
+	return _c
+}
+
+func (_c *TenantServiceClient_RemoveMember_Call) RunAndReturn(run func(context1 context.Context, tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest) (*adminv2.TenantServiceRemoveMemberResponse, error)) *TenantServiceClient_RemoveMember_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go
index e4f83394..dc6251d4 100644
--- a/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/TenantServiceHandler.go
@@ -241,3 +241,71 @@ func (_c *TenantServiceHandler_List_Call) RunAndReturn(run func(context1 context
 	_c.Call.Return(run)
 	return _c
 }
+
+// RemoveMember provides a mock function for the type TenantServiceHandler
+func (_mock *TenantServiceHandler) RemoveMember(context1 context.Context, tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest) (*adminv2.TenantServiceRemoveMemberResponse, error) {
+	ret := _mock.Called(context1, tenantServiceRemoveMemberRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RemoveMember")
+	}
+
+	var r0 *adminv2.TenantServiceRemoveMemberResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceRemoveMemberRequest) (*adminv2.TenantServiceRemoveMemberResponse, error)); ok {
+		return returnFunc(context1, tenantServiceRemoveMemberRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.TenantServiceRemoveMemberRequest) *adminv2.TenantServiceRemoveMemberResponse); ok {
+		r0 = returnFunc(context1, tenantServiceRemoveMemberRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.TenantServiceRemoveMemberResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.TenantServiceRemoveMemberRequest) error); ok {
+		r1 = returnFunc(context1, tenantServiceRemoveMemberRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// TenantServiceHandler_RemoveMember_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RemoveMember'
+type TenantServiceHandler_RemoveMember_Call struct {
+	*mock.Call
+}
+
+// RemoveMember is a helper method to define mock.On call
+//   - context1 context.Context
+//   - tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest
+func (_e *TenantServiceHandler_Expecter) RemoveMember(context1 any, tenantServiceRemoveMemberRequest any) *TenantServiceHandler_RemoveMember_Call {
+	return &TenantServiceHandler_RemoveMember_Call{Call: _e.mock.On("RemoveMember", context1, tenantServiceRemoveMemberRequest)}
+}
+
+func (_c *TenantServiceHandler_RemoveMember_Call) Run(run func(context1 context.Context, tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest)) *TenantServiceHandler_RemoveMember_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.TenantServiceRemoveMemberRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.TenantServiceRemoveMemberRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *TenantServiceHandler_RemoveMember_Call) Return(tenantServiceRemoveMemberResponse *adminv2.TenantServiceRemoveMemberResponse, err error) *TenantServiceHandler_RemoveMember_Call {
+	_c.Call.Return(tenantServiceRemoveMemberResponse, err)
+	return _c
+}
+
+func (_c *TenantServiceHandler_RemoveMember_Call) RunAndReturn(run func(context1 context.Context, tenantServiceRemoveMemberRequest *adminv2.TenantServiceRemoveMemberRequest) (*adminv2.TenantServiceRemoveMemberResponse, error)) *TenantServiceHandler_RemoveMember_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/js/metalstack/admin/v2/tenant_pb.d.ts b/js/metalstack/admin/v2/tenant_pb.d.ts
index 83b8bde8..2fc66760 100644
--- a/js/metalstack/admin/v2/tenant_pb.d.ts
+++ b/js/metalstack/admin/v2/tenant_pb.d.ts
@@ -149,6 +149,41 @@ export type TenantServiceAddMemberResponse = Message<"metalstack.admin.v2.Tenant
  * Use `create(TenantServiceAddMemberResponseSchema)` to create a new message.
  */
 export declare const TenantServiceAddMemberResponseSchema: GenMessage<TenantServiceAddMemberResponse>;
+/**
+ * TenantServiceRemoveMemberRequest is the request payload for removing a member from a tenant
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceRemoveMemberRequest
+ */
+export type TenantServiceRemoveMemberRequest = Message<"metalstack.admin.v2.TenantServiceRemoveMemberRequest"> & {
+    /**
+     * Login of the tenant from which the member will be removed
+     *
+     * @generated from field: string tenant = 1;
+     */
+    tenant: string;
+    /**
+     * Login of the member to remove
+     *
+     * @generated from field: string member = 2;
+     */
+    member: string;
+};
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceRemoveMemberRequest.
+ * Use `create(TenantServiceRemoveMemberRequestSchema)` to create a new message.
+ */
+export declare const TenantServiceRemoveMemberRequestSchema: GenMessage<TenantServiceRemoveMemberRequest>;
+/**
+ * TenantServiceRemoveMemberResponse is the response payload for the remove member request
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceRemoveMemberResponse
+ */
+export type TenantServiceRemoveMemberResponse = Message<"metalstack.admin.v2.TenantServiceRemoveMemberResponse"> & {};
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceRemoveMemberResponse.
+ * Use `create(TenantServiceRemoveMemberResponseSchema)` to create a new message.
+ */
+export declare const TenantServiceRemoveMemberResponseSchema: GenMessage<TenantServiceRemoveMemberResponse>;
 /**
  * TenantService provides tenant management operations.
  *
@@ -185,4 +220,14 @@ export declare const TenantService: GenService<{
         input: typeof TenantServiceAddMemberRequestSchema;
         output: typeof TenantServiceAddMemberResponseSchema;
     };
+    /**
+     * RemoveMember remove a member of a tenant
+     *
+     * @generated from rpc metalstack.admin.v2.TenantService.RemoveMember
+     */
+    removeMember: {
+        methodKind: "unary";
+        input: typeof TenantServiceRemoveMemberRequestSchema;
+        output: typeof TenantServiceRemoveMemberResponseSchema;
+    };
 }>;
diff --git a/js/metalstack/admin/v2/tenant_pb.js b/js/metalstack/admin/v2/tenant_pb.js
index 1c7c8ade..0f8ad4f0 100644
--- a/js/metalstack/admin/v2/tenant_pb.js
+++ b/js/metalstack/admin/v2/tenant_pb.js
@@ -9,7 +9,7 @@ import { file_metalstack_api_v2_tenant } from "../../api/v2/tenant_pb";
 /**
  * Describes the file metalstack/admin/v2/tenant.proto.
  */
-export const file_metalstack_admin_v2_tenant = /*@__PURE__*/ fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgaQtK6xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2UikAEKHVRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECARI1CgRyb2xlGAMgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZUIIukgFggECEAEiIAoeVGVuYW50U2VydmljZUFkZE1lbWJlclJlc3BvbnNlMvsCCg1UZW5hbnRTZXJ2aWNlEnYKBkNyZWF0ZRIvLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QaMC5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZSIJ0vMYAQHg8xgBEnEKBExpc3QSLS5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VMaXN0UmVxdWVzdBouLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXNwb25zZSIK0vMYAgEC4PMYARJ/CglBZGRNZW1iZXISMi5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0GjMubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQWRkTWVtYmVyUmVzcG9uc2UiCdLzGAEB4PMYAULPAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCC1RlbmFudFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
+export const file_metalstack_admin_v2_tenant = /*@__PURE__*/ fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgaQtK6xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2UikAEKHVRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECARI1CgRyb2xlGAMgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZUIIukgFggECEAEiIAoeVGVuYW50U2VydmljZUFkZE1lbWJlclJlc3BvbnNlIlwKIFRlbmFudFNlcnZpY2VSZW1vdmVNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECASIjCiFUZW5hbnRTZXJ2aWNlUmVtb3ZlTWVtYmVyUmVzcG9uc2UyhgQKDVRlbmFudFNlcnZpY2USdgoGQ3JlYXRlEi8ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQ3JlYXRlUmVxdWVzdBowLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlc3BvbnNlIgnS8xgBAeDzGAEScQoETGlzdBItLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgBEn8KCUFkZE1lbWJlchIyLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUFkZE1lbWJlclJlcXVlc3QaMy5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXNwb25zZSIJ0vMYAQHg8xgBEogBCgxSZW1vdmVNZW1iZXISNS5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VSZW1vdmVNZW1iZXJSZXF1ZXN0GjYubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlUmVtb3ZlTWVtYmVyUmVzcG9uc2UiCdLzGAEB4PMYAULPAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCC1RlbmFudFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
 /**
  * Describes the message metalstack.admin.v2.TenantServiceCreateRequest.
  * Use `create(TenantServiceCreateRequestSchema)` to create a new message.
@@ -40,6 +40,16 @@ export const TenantServiceAddMemberRequestSchema = /*@__PURE__*/ messageDesc(fil
  * Use `create(TenantServiceAddMemberResponseSchema)` to create a new message.
  */
 export const TenantServiceAddMemberResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_tenant, 5);
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceRemoveMemberRequest.
+ * Use `create(TenantServiceRemoveMemberRequestSchema)` to create a new message.
+ */
+export const TenantServiceRemoveMemberRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_tenant, 6);
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceRemoveMemberResponse.
+ * Use `create(TenantServiceRemoveMemberResponseSchema)` to create a new message.
+ */
+export const TenantServiceRemoveMemberResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_tenant, 7);
 /**
  * TenantService provides tenant management operations.
  *
diff --git a/js/metalstack/admin/v2/tenant_pb.ts b/js/metalstack/admin/v2/tenant_pb.ts
index bd7f6386..f4e22a1c 100644
--- a/js/metalstack/admin/v2/tenant_pb.ts
+++ b/js/metalstack/admin/v2/tenant_pb.ts
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/admin/v2/tenant.proto.
  */
 export const file_metalstack_admin_v2_tenant: GenFile = /*@__PURE__*/
-  fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgaQtK6xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2UikAEKHVRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECARI1CgRyb2xlGAMgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZUIIukgFggECEAEiIAoeVGVuYW50U2VydmljZUFkZE1lbWJlclJlc3BvbnNlMvsCCg1UZW5hbnRTZXJ2aWNlEnYKBkNyZWF0ZRIvLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QaMC5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZSIJ0vMYAQHg8xgBEnEKBExpc3QSLS5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VMaXN0UmVxdWVzdBouLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXNwb25zZSIK0vMYAgEC4PMYARJ/CglBZGRNZW1iZXISMi5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0GjMubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQWRkTWVtYmVyUmVzcG9uc2UiCdLzGAEB4PMYAULPAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCC1RlbmFudFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
+  fileDesc("CiBtZXRhbHN0YWNrL2FkbWluL3YyL3RlbmFudC5wcm90bxITbWV0YWxzdGFjay5hZG1pbi52MiL1AQoaVGVuYW50U2VydmljZUNyZWF0ZVJlcXVlc3QSGQoEbmFtZRgBIAEoCUILukgIcgaQtK6xAgESJQoLZGVzY3JpcHRpb24YAiABKAlCC7pICHIGyLOusQIBSACIAQESGwoFZW1haWwYAyABKAlCB7pIBHICYAFIAYgBARIkCgphdmF0YXJfdXJsGAQgASgJQgu6SAhyBuCzrrECAUgCiAEBEikKBmxhYmVscxgFIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVsc0IOCgxfZGVzY3JpcHRpb25CCAoGX2VtYWlsQg0KC19hdmF0YXJfdXJsIkgKG1RlbmFudFNlcnZpY2VDcmVhdGVSZXNwb25zZRIpCgZ0ZW5hbnQYASABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnQiSQoYVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Ei0KBXF1ZXJ5GAEgASgLMh4ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UXVlcnkibQoZVGVuYW50U2VydmljZUxpc3RSZXNwb25zZRIqCgd0ZW5hbnRzGAEgAygLMhkubWV0YWxzdGFjay5hcGkudjIuVGVuYW50EhYKCW5leHRfcGFnZRgCIAEoBEgAiAEBQgwKCl9uZXh0X3BhZ2UikAEKHVRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECARI1CgRyb2xlGAMgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZUIIukgFggECEAEiIAoeVGVuYW50U2VydmljZUFkZE1lbWJlclJlc3BvbnNlIlwKIFRlbmFudFNlcnZpY2VSZW1vdmVNZW1iZXJSZXF1ZXN0EhsKBnRlbmFudBgBIAEoCUILukgIcgaQtK6xAgESGwoGbWVtYmVyGAIgASgJQgu6SAhyBpC0rrECASIjCiFUZW5hbnRTZXJ2aWNlUmVtb3ZlTWVtYmVyUmVzcG9uc2UyhgQKDVRlbmFudFNlcnZpY2USdgoGQ3JlYXRlEi8ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlQ3JlYXRlUmVxdWVzdBowLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUNyZWF0ZVJlc3BvbnNlIgnS8xgBAeDzGAEScQoETGlzdBItLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUxpc3RSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgBEn8KCUFkZE1lbWJlchIyLm1ldGFsc3RhY2suYWRtaW4udjIuVGVuYW50U2VydmljZUFkZE1lbWJlclJlcXVlc3QaMy5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VBZGRNZW1iZXJSZXNwb25zZSIJ0vMYAQHg8xgBEogBCgxSZW1vdmVNZW1iZXISNS5tZXRhbHN0YWNrLmFkbWluLnYyLlRlbmFudFNlcnZpY2VSZW1vdmVNZW1iZXJSZXF1ZXN0GjYubWV0YWxzdGFjay5hZG1pbi52Mi5UZW5hbnRTZXJ2aWNlUmVtb3ZlTWVtYmVyUmVzcG9uc2UiCdLzGAEB4PMYAULPAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCC1RlbmFudFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_tenant]);
 
 /**
  * TenantServiceCreateRequest is the request payload for creating a tenant.
@@ -187,6 +187,49 @@ export type TenantServiceAddMemberResponse = Message<"metalstack.admin.v2.Tenant
 export const TenantServiceAddMemberResponseSchema: GenMessage<TenantServiceAddMemberResponse> = /*@__PURE__*/
   messageDesc(file_metalstack_admin_v2_tenant, 5);
 
+/**
+ * TenantServiceRemoveMemberRequest is the request payload for removing a member from a tenant
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceRemoveMemberRequest
+ */
+export type TenantServiceRemoveMemberRequest = Message<"metalstack.admin.v2.TenantServiceRemoveMemberRequest"> & {
+  /**
+   * Login of the tenant from which the member will be removed
+   *
+   * @generated from field: string tenant = 1;
+   */
+  tenant: string;
+
+  /**
+   * Login of the member to remove
+   *
+   * @generated from field: string member = 2;
+   */
+  member: string;
+};
+
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceRemoveMemberRequest.
+ * Use `create(TenantServiceRemoveMemberRequestSchema)` to create a new message.
+ */
+export const TenantServiceRemoveMemberRequestSchema: GenMessage<TenantServiceRemoveMemberRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_tenant, 6);
+
+/**
+ * TenantServiceRemoveMemberResponse is the response payload for the remove member request
+ *
+ * @generated from message metalstack.admin.v2.TenantServiceRemoveMemberResponse
+ */
+export type TenantServiceRemoveMemberResponse = Message<"metalstack.admin.v2.TenantServiceRemoveMemberResponse"> & {
+};
+
+/**
+ * Describes the message metalstack.admin.v2.TenantServiceRemoveMemberResponse.
+ * Use `create(TenantServiceRemoveMemberResponseSchema)` to create a new message.
+ */
+export const TenantServiceRemoveMemberResponseSchema: GenMessage<TenantServiceRemoveMemberResponse> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_tenant, 7);
+
 /**
  * TenantService provides tenant management operations.
  *
@@ -223,6 +266,16 @@ export const TenantService: GenService<{
     input: typeof TenantServiceAddMemberRequestSchema;
     output: typeof TenantServiceAddMemberResponseSchema;
   },
+  /**
+   * RemoveMember remove a member of a tenant
+   *
+   * @generated from rpc metalstack.admin.v2.TenantService.RemoveMember
+   */
+  removeMember: {
+    methodKind: "unary";
+    input: typeof TenantServiceRemoveMemberRequestSchema;
+    output: typeof TenantServiceRemoveMemberResponseSchema;
+  },
 }> = /*@__PURE__*/
   serviceDesc(file_metalstack_admin_v2_tenant, 0);
 
diff --git a/proto/metalstack/admin/v2/tenant.proto b/proto/metalstack/admin/v2/tenant.proto
index 28c388a1..4a2e3ffd 100644
--- a/proto/metalstack/admin/v2/tenant.proto
+++ b/proto/metalstack/admin/v2/tenant.proto
@@ -25,6 +25,11 @@ service TenantService {
     option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_EDITOR;
     option (metalstack.api.v2.auditing) = AUDITING_INCLUDED;
   }
+  // RemoveMember remove a member of a tenant
+  rpc RemoveMember(TenantServiceRemoveMemberRequest) returns (TenantServiceRemoveMemberResponse) {
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_EDITOR;
+    option (metalstack.api.v2.auditing) = AUDITING_INCLUDED;
+  }
 }
 
 // TenantServiceCreateRequest is the request payload for creating a tenant.
@@ -73,3 +78,14 @@ message TenantServiceAddMemberRequest {
 
 // TenantServiceAddMemberResponse is the response payload for the add member request
 message TenantServiceAddMemberResponse {}
+
+// TenantServiceRemoveMemberRequest is the request payload for removing a member from a tenant
+message TenantServiceRemoveMemberRequest {
+  // Login of the tenant from which the member will be removed
+  string tenant = 1 [(buf.validate.field).string.(metalstack.api.v2.is_tenant_login) = true];
+  // Login of the member to remove
+  string member = 2 [(buf.validate.field).string.(metalstack.api.v2.is_tenant_login) = true];
+}
+
+// TenantServiceRemoveMemberResponse is the response payload for the remove member request
+message TenantServiceRemoveMemberResponse {}
diff --git a/python/metalstack/admin/v2/tenant_connect.py b/python/metalstack/admin/v2/tenant_connect.py
index 76843172..d54a06eb 100644
--- a/python/metalstack/admin/v2/tenant_connect.py
+++ b/python/metalstack/admin/v2/tenant_connect.py
@@ -27,6 +27,9 @@ async def list(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.Tenant
     async def add_member(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse:
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
 
+    async def remove_member(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
 
 class TenantServiceASGIApplication(ConnectASGIApplication[TenantService]):
     def __init__(self, service: TenantService | AsyncGenerator[TenantService], *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None, compressions: Iterable[Compression] | None = None, codecs: Iterable[Codec] | None = None) -> None:
@@ -63,6 +66,16 @@ def __init__(self, service: TenantService | AsyncGenerator[TenantService], *, in
                     ),
                     function=svc.add_member,
                 ),
+                "/metalstack.admin.v2.TenantService/RemoveMember": Endpoint.unary(
+                    method=MethodInfo(
+                        name="RemoveMember",
+                        service_name="metalstack.admin.v2.TenantService",
+                        input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.remove_member,
+                ),
             },
             interceptors=interceptors,
             read_max_bytes=read_max_bytes,
@@ -137,6 +150,26 @@ async def add_member(
             timeout_ms=timeout_ms,
         )
 
+    async def remove_member(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="RemoveMember",
+                service_name="metalstack.admin.v2.TenantService",
+                input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest,
+                output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
 
 
 
@@ -148,6 +181,8 @@ def list(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServic
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
     def add_member(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceAddMemberResponse:
         raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def remove_member(self, request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
 
 
 class TenantServiceWSGIApplication(ConnectWSGIApplication):
@@ -184,6 +219,16 @@ def __init__(self, service: TenantServiceSync, interceptors: Iterable[Intercepto
                     ),
                     function=service.add_member,
                 ),
+                "/metalstack.admin.v2.TenantService/RemoveMember": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="RemoveMember",
+                        service_name="metalstack.admin.v2.TenantService",
+                        input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.remove_member,
+                ),
             },
             interceptors=interceptors,
             read_max_bytes=read_max_bytes,
@@ -258,4 +303,24 @@ def add_member(
             timeout_ms=timeout_ms,
         )
 
+    def remove_member(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="RemoveMember",
+                service_name="metalstack.admin.v2.TenantService",
+                input=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberRequest,
+                output=metalstack_dot_admin_dot_v2_dot_tenant__pb2.TenantServiceRemoveMemberResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
 
diff --git a/python/metalstack/admin/v2/tenant_pb2.py b/python/metalstack/admin/v2/tenant_pb2.py
index b2a8c010..1202e8b9 100644
--- a/python/metalstack/admin/v2/tenant_pb2.py
+++ b/python/metalstack/admin/v2/tenant_pb2.py
@@ -28,7 +28,7 @@
 from metalstack.api.v2 import tenant_pb2 as metalstack_dot_api_dot_v2_dot_tenant__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n metalstack/admin/v2/tenant.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1emetalstack/api/v2/tenant.proto\"\xa2\x02\n\x1aTenantServiceCreateRequest\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\"\n\x05\x65mail\x18\x03 \x01(\tB\x07\xbaH\x04r\x02`\x01H\x01R\x05\x65mail\x88\x01\x01\x12/\n\navatar_url\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01H\x02R\tavatarUrl\x88\x01\x01\x12\x31\n\x06labels\x18\x05 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labelsB\x0e\n\x0c_descriptionB\x08\n\x06_emailB\r\n\x0b_avatar_url\"P\n\x1bTenantServiceCreateResponse\x12\x31\n\x06tenant\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.TenantR\x06tenant\"P\n\x18TenantServiceListRequest\x12\x34\n\x05query\x18\x01 \x01(\x0b\x32\x1e.metalstack.api.v2.TenantQueryR\x05query\"\x80\x01\n\x19TenantServiceListResponse\x12\x33\n\x07tenants\x18\x01 \x03(\x0b\x32\x19.metalstack.api.v2.TenantR\x07tenants\x12 \n\tnext_page\x18\x02 \x01(\x04H\x00R\x08nextPage\x88\x01\x01\x42\x0c\n\n_next_page\"\xa6\x01\n\x1dTenantServiceAddMemberRequest\x12#\n\x06tenant\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n\x06member\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06member\x12;\n\x04role\x18\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04role\" \n\x1eTenantServiceAddMemberResponse2\xfb\x02\n\rTenantService\x12v\n\x06\x43reate\x12/.metalstack.admin.v2.TenantServiceCreateRequest\x1a\x30.metalstack.admin.v2.TenantServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12q\n\x04List\x12-.metalstack.admin.v2.TenantServiceListRequest\x1a..metalstack.admin.v2.TenantServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12\x7f\n\tAddMember\x12\x32.metalstack.admin.v2.TenantServiceAddMemberRequest\x1a\x33.metalstack.admin.v2.TenantServiceAddMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xcf\x01\n\x17\x63om.metalstack.admin.v2B\x0bTenantProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n metalstack/admin/v2/tenant.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1emetalstack/api/v2/tenant.proto\"\xa2\x02\n\x1aTenantServiceCreateRequest\x12\x1f\n\x04name\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x04name\x12\x32\n\x0b\x64\x65scription\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\"\n\x05\x65mail\x18\x03 \x01(\tB\x07\xbaH\x04r\x02`\x01H\x01R\x05\x65mail\x88\x01\x01\x12/\n\navatar_url\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xe0\xb3\xae\xb1\x02\x01H\x02R\tavatarUrl\x88\x01\x01\x12\x31\n\x06labels\x18\x05 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labelsB\x0e\n\x0c_descriptionB\x08\n\x06_emailB\r\n\x0b_avatar_url\"P\n\x1bTenantServiceCreateResponse\x12\x31\n\x06tenant\x18\x01 \x01(\x0b\x32\x19.metalstack.api.v2.TenantR\x06tenant\"P\n\x18TenantServiceListRequest\x12\x34\n\x05query\x18\x01 \x01(\x0b\x32\x1e.metalstack.api.v2.TenantQueryR\x05query\"\x80\x01\n\x19TenantServiceListResponse\x12\x33\n\x07tenants\x18\x01 \x03(\x0b\x32\x19.metalstack.api.v2.TenantR\x07tenants\x12 \n\tnext_page\x18\x02 \x01(\x04H\x00R\x08nextPage\x88\x01\x01\x42\x0c\n\n_next_page\"\xa6\x01\n\x1dTenantServiceAddMemberRequest\x12#\n\x06tenant\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n\x06member\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06member\x12;\n\x04role\x18\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04role\" \n\x1eTenantServiceAddMemberResponse\"l\n TenantServiceRemoveMemberRequest\x12#\n\x06tenant\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06tenant\x12#\n\x06member\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\x90\xb4\xae\xb1\x02\x01R\x06member\"#\n!TenantServiceRemoveMemberResponse2\x86\x04\n\rTenantService\x12v\n\x06\x43reate\x12/.metalstack.admin.v2.TenantServiceCreateRequest\x1a\x30.metalstack.admin.v2.TenantServiceCreateResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12q\n\x04List\x12-.metalstack.admin.v2.TenantServiceListRequest\x1a..metalstack.admin.v2.TenantServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x01\x12\x7f\n\tAddMember\x12\x32.metalstack.admin.v2.TenantServiceAddMemberRequest\x1a\x33.metalstack.admin.v2.TenantServiceAddMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x12\x88\x01\n\x0cRemoveMember\x12\x35.metalstack.admin.v2.TenantServiceRemoveMemberRequest\x1a\x36.metalstack.admin.v2.TenantServiceRemoveMemberResponse\"\t\xd2\xf3\x18\x01\x01\xe0\xf3\x18\x01\x42\xcf\x01\n\x17\x63om.metalstack.admin.v2B\x0bTenantProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -50,12 +50,18 @@
   _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['member']._serialized_options = b'\272H\010r\006\220\264\256\261\002\001'
   _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['role']._loaded_options = None
   _globals['_TENANTSERVICEADDMEMBERREQUEST'].fields_by_name['role']._serialized_options = b'\272H\005\202\001\002\020\001'
+  _globals['_TENANTSERVICEREMOVEMEMBERREQUEST'].fields_by_name['tenant']._loaded_options = None
+  _globals['_TENANTSERVICEREMOVEMEMBERREQUEST'].fields_by_name['tenant']._serialized_options = b'\272H\010r\006\220\264\256\261\002\001'
+  _globals['_TENANTSERVICEREMOVEMEMBERREQUEST'].fields_by_name['member']._loaded_options = None
+  _globals['_TENANTSERVICEREMOVEMEMBERREQUEST'].fields_by_name['member']._serialized_options = b'\272H\010r\006\220\264\256\261\002\001'
   _globals['_TENANTSERVICE'].methods_by_name['Create']._loaded_options = None
   _globals['_TENANTSERVICE'].methods_by_name['Create']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
   _globals['_TENANTSERVICE'].methods_by_name['List']._loaded_options = None
   _globals['_TENANTSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002\340\363\030\001'
   _globals['_TENANTSERVICE'].methods_by_name['AddMember']._loaded_options = None
   _globals['_TENANTSERVICE'].methods_by_name['AddMember']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
+  _globals['_TENANTSERVICE'].methods_by_name['RemoveMember']._loaded_options = None
+  _globals['_TENANTSERVICE'].methods_by_name['RemoveMember']._serialized_options = b'\322\363\030\001\001\340\363\030\001'
   _globals['_TENANTSERVICECREATEREQUEST']._serialized_start=193
   _globals['_TENANTSERVICECREATEREQUEST']._serialized_end=483
   _globals['_TENANTSERVICECREATERESPONSE']._serialized_start=485
@@ -68,6 +74,10 @@
   _globals['_TENANTSERVICEADDMEMBERREQUEST']._serialized_end=947
   _globals['_TENANTSERVICEADDMEMBERRESPONSE']._serialized_start=949
   _globals['_TENANTSERVICEADDMEMBERRESPONSE']._serialized_end=981
-  _globals['_TENANTSERVICE']._serialized_start=984
-  _globals['_TENANTSERVICE']._serialized_end=1363
+  _globals['_TENANTSERVICEREMOVEMEMBERREQUEST']._serialized_start=983
+  _globals['_TENANTSERVICEREMOVEMEMBERREQUEST']._serialized_end=1091
+  _globals['_TENANTSERVICEREMOVEMEMBERRESPONSE']._serialized_start=1093
+  _globals['_TENANTSERVICEREMOVEMEMBERRESPONSE']._serialized_end=1128
+  _globals['_TENANTSERVICE']._serialized_start=1131
+  _globals['_TENANTSERVICE']._serialized_end=1649
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/tenant_pb2.pyi b/python/metalstack/admin/v2/tenant_pb2.pyi
index 1518b7c0..79b559c7 100644
--- a/python/metalstack/admin/v2/tenant_pb2.pyi
+++ b/python/metalstack/admin/v2/tenant_pb2.pyi
@@ -57,3 +57,15 @@ class TenantServiceAddMemberRequest(_message.Message):
 class TenantServiceAddMemberResponse(_message.Message):
     __slots__ = ()
     def __init__(self) -> None: ...
+
+class TenantServiceRemoveMemberRequest(_message.Message):
+    __slots__ = ("tenant", "member")
+    TENANT_FIELD_NUMBER: _ClassVar[int]
+    MEMBER_FIELD_NUMBER: _ClassVar[int]
+    tenant: str
+    member: str
+    def __init__(self, tenant: _Optional[str] = ..., member: _Optional[str] = ...) -> None: ...
+
+class TenantServiceRemoveMemberResponse(_message.Message):
+    __slots__ = ()
+    def __init__(self) -> None: ...