diff --git a/vendor/github.com/hashicorp/consul-template/CHANGELOG.md b/vendor/github.com/hashicorp/consul-template/CHANGELOG.md
index c7f092876abe..04c0fa1e1f79 100644
--- a/vendor/github.com/hashicorp/consul-template/CHANGELOG.md
+++ b/vendor/github.com/hashicorp/consul-template/CHANGELOG.md
@@ -1,4 +1,14 @@
-## UNRELEASED
+## v0.20.1 (July 30, 2019)
+
+BUG FIXES:
+
+* Fixed issue with exec running before template rendering when wait is set [[GH-1229](https://github.com/hashicorp/consul-template/issues/1229), [GH-1209](https://github.com/hashicorp/consul-template/issues/1209)]
+* Fixed issue with templates not rendering with `-once` [[GH-1227](https://github.com/hashicorp/consul-template/pull/1227), [GH-1196](https://github.com/hashicorp/consul-template/issues/1196), [GH-1207](https://github.com/hashicorp/consul-template/issues/1207)]
+* Fixed regression with ~/.vault-token and with vault_agent_token_file not respecting renew_token [[GH-1228](https://github.com/hashicorp/consul-template/issues/1228), [GH-1189](https://github.com/hashicorp/consul-template/issues/1189)]
+* CA certificates missing from docker 'light' image [[GH-1200](https://github.com/hashicorp/consul-template/issues/1200)]
+* Fixed issue with dedup data garbage in Consul KV [[GH-1158](https://github.com/hashicorp/consul-template/issues/1158), [[GH-1168](https://github.com/hashicorp/consul-template/issues/1168)]
+* Fixed bad case in import path [[GH-1139](https://github.com/hashicorp/consul-template/issues/1139)]
+* Documented limits on using "." in service names [[GH-1205](https://github.com/hashicorp/consul-template/issues/1205)]
 
 ## v0.20.0 (February 19, 2019)
 
diff --git a/vendor/github.com/hashicorp/consul-template/Gopkg.lock b/vendor/github.com/hashicorp/consul-template/Gopkg.lock
index 114d6ff4b4a8..1e0c5c21060d 100644
--- a/vendor/github.com/hashicorp/consul-template/Gopkg.lock
+++ b/vendor/github.com/hashicorp/consul-template/Gopkg.lock
@@ -56,7 +56,7 @@
 
 [[projects]]
   digest = "1:289dd4d7abfb3ad2b5f728fbe9b1d5c1bf7d265a3eb9ef92869af1f7baba4c7a"
-  name = "github.com/burntsushi/toml"
+  name = "github.com/BurntSushi/toml"
   packages = ["."]
   pruneopts = ""
   revision = "b26d9c308763d68093482582cea63d69be07a0f0"
diff --git a/vendor/github.com/hashicorp/consul-template/Gopkg.toml b/vendor/github.com/hashicorp/consul-template/Gopkg.toml
index 8ebdd4f5bd93..9173f680c9c2 100644
--- a/vendor/github.com/hashicorp/consul-template/Gopkg.toml
+++ b/vendor/github.com/hashicorp/consul-template/Gopkg.toml
@@ -1,6 +1,6 @@
 
 [[constraint]]
-  name = "github.com/burntsushi/toml"
+  name = "github.com/BurntSushi/toml"
   version = "0.3.0"
 
 [[constraint]]
diff --git a/vendor/github.com/hashicorp/consul-template/Makefile b/vendor/github.com/hashicorp/consul-template/Makefile
index 76b06b57eac3..5aff89f89ffd 100644
--- a/vendor/github.com/hashicorp/consul-template/Makefile
+++ b/vendor/github.com/hashicorp/consul-template/Makefile
@@ -14,7 +14,7 @@ GOTAGS ?=
 GOMAXPROCS ?= 4
 
 # Get the project metadata
-GOVERSION := 1.12.5
+GO_DOCKER_VERSION ?= 1.12
 PROJECT := $(CURRENT_DIR:$(GOPATH)/src/%=%)
 OWNER := $(notdir $(patsubst %/,%,$(dir $(PROJECT))))
 NAME := $(notdir $(PROJECT))
@@ -45,9 +45,6 @@ LD_FLAGS ?= \
 # List of Docker targets to build
 DOCKER_TARGETS ?= alpine light scratch
 
-# List of tests to run
-TEST ?= ./...
-
 # Create a cross-compile target for every os-arch pairing. This will generate
 # a make target for each os/arch like "make linux/amd64" as well as generate a
 # meta target (build) for compiling everything.
@@ -86,7 +83,7 @@ pristine:
 		--dns="8.8.8.8" \
 		--volume="${CURRENT_DIR}:/go/src/${PROJECT}" \
 		--workdir="/go/src/${PROJECT}" \
-		"golang:${GOVERSION}" env GOCACHE=/tmp make -j4 build
+		"golang:${GO_DOCKER_VERSION}" env GOCACHE=/tmp make -j4 build
 
 # bootstrap installs the necessary go tools for development or build.
 bootstrap:
@@ -149,6 +146,7 @@ define make-docker-target
 			--file="docker/${1}/Dockerfile" \
 			--build-arg="LD_FLAGS=${LD_FLAGS}" \
 			--build-arg="GOTAGS=${GOTAGS}" \
+			--build-arg="GOVERSION=${GO_DOCKER_VERSION}" \
 			$(if $(filter $1,scratch),--tag="${OWNER}/${NAME}",) \
 			--tag="${OWNER}/${NAME}:${1}" \
 			--tag="${OWNER}/${NAME}:${VERSION}-${1}" \
@@ -173,7 +171,7 @@ $(foreach target,$(DOCKER_TARGETS),$(eval $(call make-docker-target,$(target))))
 # test runs the test suite.
 test:
 	@echo "==> Testing ${NAME}"
-	@go test -timeout=30s -parallel=20 -failfast -tags="${GOTAGS}" ./... ${TESTARGS}
+	@go test -count=1 -timeout=30s -parallel=20 -failfast -tags="${GOTAGS}" ./... ${TESTARGS}
 .PHONY: test
 
 # test-race runs the test suite.
diff --git a/vendor/github.com/hashicorp/consul-template/README.md b/vendor/github.com/hashicorp/consul-template/README.md
index 8b6919d422c8..1312773b9b5c 100644
--- a/vendor/github.com/hashicorp/consul-template/README.md
+++ b/vendor/github.com/hashicorp/consul-template/README.md
@@ -302,7 +302,8 @@ vault {
 
   # This tells Consul Template to load the Vault token from the contents of a file.
   # If this field is specified:
-  # - Consul Template will not try to renew the Vault token.
+  # - by default Consul Template will not try to renew the Vault token, if you want it
+  # to renew you will nee dto specify renew_token = true as below.
   # - Consul Template will periodically stat the file and update the token if it has
   # changed.
   # vault_agent_token_file = "/tmp/vault/agent/token"
@@ -494,6 +495,10 @@ template {
   left_delimiter  = "{{"
   right_delimiter = "}}"
 
+  # These are functions that are not permitted in the template. If a template
+  # includes one of these functions, it will exit with an error.
+  function_blacklist = []
+
   # This is the `minimum(:maximum)` to wait before rendering a new template to
   # disk and triggering a command, separated by a colon (`:`). If the optional
   # maximum value is omitted, it is assumed to be 4x the required minimum value.
@@ -825,7 +830,7 @@ To access a versioned secret value (for the K/V version 2 backend):
 
 When omitting the `?version` parameter, the latest version of the secret will be
 fetched. Note the nested `.Data.data` syntax when referencing the secret value.
-For more information about using the K/V v2 backend, see the 
+For more information about using the K/V v2 backend, see the
 [Vault Documentation](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html).
 
 When using Vault versions 0.10.0/0.10.1, the secret path will have to be prefixed
@@ -1494,8 +1499,8 @@ plugin.
 {{ plugin "my-plugin" }}
 ```
 
-The plugin can take an arbitrary number of string arguments, and can be the 
-target of a pipeline that produces strings as well. This is most commonly 
+The plugin can take an arbitrary number of string arguments, and can be the
+target of a pipeline that produces strings as well. This is most commonly
 combined with a JSON filter for customization:
 
 ```liquid
@@ -1798,7 +1803,7 @@ $ NAME [INPUT...]
   that is found on the `PATH`.
 
 - `INPUT` - input from the template. There will be one INPUT for every argument passed
-  to the `plugin` function. If the arguments contain whitespace, that whitespace 
+  to the `plugin` function. If the arguments contain whitespace, that whitespace
   will be passed as if the argument were quoted by the shell.
 
 #### Important Notes
@@ -2227,7 +2232,7 @@ following to generate all binaries:
 $ make build
 ```
 
-If you want to run the tests, first [install consul locally](https://www.consul.io/docs/install/index.html), then:
+If you want to run the tests, first install [consul](https://www.consul.io/docs/install/index.html) and [vault](https://www.vaultproject.io/docs/install/) locally, then:
 
 ```shell
 $ make test
diff --git a/vendor/github.com/hashicorp/consul-template/config/template.go b/vendor/github.com/hashicorp/consul-template/config/template.go
index 63eb99c5f7d1..5fad0b29926a 100644
--- a/vendor/github.com/hashicorp/consul-template/config/template.go
+++ b/vendor/github.com/hashicorp/consul-template/config/template.go
@@ -75,6 +75,10 @@ type TemplateConfig struct {
 	// delimiter is utilized when parsing the template.
 	LeftDelim  *string `mapstructure:"left_delimiter"`
 	RightDelim *string `mapstructure:"right_delimiter"`
+
+	// FunctionBlacklist is a list of functions that this template is not
+	// permitted to run.
+	FunctionBlacklist []string `mapstructure:"function_blacklist"`
 }
 
 // DefaultTemplateConfig returns a configuration that is populated with the
@@ -123,6 +127,10 @@ func (c *TemplateConfig) Copy() *TemplateConfig {
 	o.LeftDelim = c.LeftDelim
 	o.RightDelim = c.RightDelim
 
+	for _, fun := range c.FunctionBlacklist {
+		o.FunctionBlacklist = append(o.FunctionBlacklist, fun)
+	}
+
 	return &o
 }
 
@@ -196,6 +204,10 @@ func (c *TemplateConfig) Merge(o *TemplateConfig) *TemplateConfig {
 		r.RightDelim = o.RightDelim
 	}
 
+	for _, fun := range o.FunctionBlacklist {
+		r.FunctionBlacklist = append(r.FunctionBlacklist, fun)
+	}
+
 	return r
 }
 
@@ -285,6 +297,7 @@ func (c *TemplateConfig) GoString() string {
 		"Wait:%#v, "+
 		"LeftDelim:%s, "+
 		"RightDelim:%s"+
+		"FunctionBlacklist:%s"+
 		"}",
 		BoolGoString(c.Backup),
 		StringGoString(c.Command),
@@ -299,6 +312,7 @@ func (c *TemplateConfig) GoString() string {
 		c.Wait,
 		StringGoString(c.LeftDelim),
 		StringGoString(c.RightDelim),
+		c.FunctionBlacklist,
 	)
 }
 
diff --git a/vendor/github.com/hashicorp/consul-template/config/vault.go b/vendor/github.com/hashicorp/consul-template/config/vault.go
index e25e776154e3..0ba4cce73a65 100644
--- a/vendor/github.com/hashicorp/consul-template/config/vault.go
+++ b/vendor/github.com/hashicorp/consul-template/config/vault.go
@@ -8,6 +8,10 @@ import (
 )
 
 const (
+	// XXX Change use to api.EnvVaultSkipVerify once we've updated vendored
+	// vault to version 1.1.0 or newer.
+	EnvVaultSkipVerify = "VAULT_SKIP_VERIFY"
+
 	// DefaultVaultGrace is the default grace period before which to read a new
 	// secret from Vault. If a lease is due to expire in 15 seconds, Consul
 	// Template will read a new secret at that time minus this value.
@@ -209,9 +213,13 @@ func (c *VaultConfig) Finalize() {
 	}
 
 	if c.RenewToken == nil {
+		default_renew := DefaultVaultRenewToken
+		if c.VaultAgentTokenFile != nil {
+			default_renew = false
+		}
 		c.RenewToken = boolFromEnv([]string{
 			"VAULT_RENEW_TOKEN",
-		}, DefaultVaultRenewToken)
+		}, default_renew)
 	}
 
 	if c.Retry == nil {
@@ -242,7 +250,8 @@ func (c *VaultConfig) Finalize() {
 		c.SSL.ServerName = stringFromEnv([]string{api.EnvVaultTLSServerName}, "")
 	}
 	if c.SSL.Verify == nil {
-		c.SSL.Verify = antiboolFromEnv([]string{api.EnvVaultInsecure}, true)
+		c.SSL.Verify = antiboolFromEnv([]string{
+			EnvVaultSkipVerify, api.EnvVaultInsecure}, true)
 	}
 	c.SSL.Finalize()
 
@@ -256,9 +265,16 @@ func (c *VaultConfig) Finalize() {
 		}, "")
 	}
 
-	if c.VaultAgentTokenFile != nil {
+	if c.VaultAgentTokenFile == nil {
+		if StringVal(c.Token) == "" {
+			if homePath != "" {
+				c.Token = stringFromFile([]string{
+					homePath + "/.vault-token",
+				}, "")
+			}
+		}
+	} else {
 		c.Token = stringFromFile([]string{*c.VaultAgentTokenFile}, "")
-		c.RenewToken = Bool(false)
 	}
 
 	if c.Transport == nil {
diff --git a/vendor/github.com/hashicorp/consul-template/dependency/vault_write.go b/vendor/github.com/hashicorp/consul-template/dependency/vault_write.go
index 4970301d5cdd..22aad3aa2421 100644
--- a/vendor/github.com/hashicorp/consul-template/dependency/vault_write.go
+++ b/vendor/github.com/hashicorp/consul-template/dependency/vault_write.go
@@ -173,7 +173,9 @@ func (d *VaultWriteQuery) writeSecret(clients *ClientSet, opts *QueryOptions) (*
 		return nil, errors.Wrap(err, d.String())
 	}
 	if vaultSecret == nil {
-		return nil, fmt.Errorf("no secret exists at %s", d.path)
+		if _, isv2, _ := isKVv2(clients.Vault(), d.path); isv2 {
+			return nil, fmt.Errorf("no secret exists at %s", d.path)
+		}
 	}
 
 	return vaultSecret, nil
diff --git a/vendor/github.com/hashicorp/consul-template/manager/dedup.go b/vendor/github.com/hashicorp/consul-template/manager/dedup.go
index ae49e060e409..3f5f9a9503d0 100644
--- a/vendor/github.com/hashicorp/consul-template/manager/dedup.go
+++ b/vendor/github.com/hashicorp/consul-template/manager/dedup.go
@@ -36,9 +36,7 @@ var (
 )
 
 const (
-	// templateDataFlag is added as a flag to the shared data values
-	// so that we can use it as a sanity check
-	templateDataFlag = 0x22b9a127a2c03520
+	templateNoDataStr = "__NO_DATA__"
 )
 
 // templateData is GOB encoded share the dependency values
@@ -52,6 +50,10 @@ type templateData struct {
 	Data map[string]interface{}
 }
 
+func templateNoData() []byte {
+	return []byte(templateNoDataStr)
+}
+
 // DedupManager is used to de-duplicate which instance of Consul-Template
 // is handling each template. For each template, a lock path is determined
 // using the MD5 of the template. This path is used to elect a "leader"
@@ -154,9 +156,10 @@ START:
 	sessionCh := make(chan struct{})
 	ttl := fmt.Sprintf("%.6fs", float64(*d.config.TTL)/float64(time.Second))
 	se := &consulapi.SessionEntry{
-		Name:     "Consul-Template de-duplication",
-		Behavior: "delete",
-		TTL:      ttl,
+		Name:      "Consul-Template de-duplication",
+		Behavior:  "delete",
+		TTL:       ttl,
+		LockDelay: 1 * time.Millisecond,
 	}
 	id, _, err := session.Create(se, nil)
 	if err != nil {
@@ -257,7 +260,7 @@ func (d *DedupManager) UpdateDeps(t *template.Template, deps []dep.Dependency) e
 	kvPair := consulapi.KVPair{
 		Key:   dataPath,
 		Value: buf.Bytes(),
-		Flags: templateDataFlag,
+		Flags: consulapi.LockFlagValue,
 	}
 	client := d.clients.Consul()
 	if _, err := client.KV().Put(&kvPair, nil); err != nil {
@@ -409,7 +412,7 @@ START:
 	}
 
 	// Parse the data file
-	if pair != nil && pair.Flags == templateDataFlag {
+	if pair != nil && pair.Flags == consulapi.LockFlagValue && !bytes.Equal(pair.Value, templateNoData()) {
 		d.parseData(pair.Key, pair.Value)
 	}
 	goto START
@@ -456,7 +459,8 @@ func (d *DedupManager) attemptLock(client *consulapi.Client, session string, ses
 		log.Printf("[INFO] (dedup) attempting lock for template hash %s", t.ID())
 		basePath := path.Join(*d.config.Prefix, t.ID())
 		lopts := &consulapi.LockOptions{
-			Key:              path.Join(basePath, "lock"),
+			Key:              path.Join(basePath, "data"),
+			Value:            templateNoData(),
 			Session:          session,
 			MonitorRetries:   3,
 			MonitorRetryTime: 3 * time.Second,
@@ -491,11 +495,17 @@ func (d *DedupManager) attemptLock(client *consulapi.Client, session string, ses
 		case <-sessionCh:
 			log.Printf("[INFO] (dedup) releasing session '%s'", lopts.Key)
 			d.setLeader(t, nil)
-			lock.Unlock()
+			_, err = client.Session().Destroy(session, nil)
+			if err != nil {
+				log.Printf("[ERROR] (dedup) failed destroying session '%s', %s", session, err)
+			}
 			return
 		case <-d.stopCh:
 			log.Printf("[INFO] (dedup) releasing lock '%s'", lopts.Key)
-			lock.Unlock()
+			_, err = client.Session().Destroy(session, nil)
+			if err != nil {
+				log.Printf("[ERROR] (dedup) failed destroying session '%s', %s", session, err)
+			}
 			return
 		}
 	}
diff --git a/vendor/github.com/hashicorp/consul-template/manager/runner.go b/vendor/github.com/hashicorp/consul-template/manager/runner.go
index 0efb711610b9..773a6dd6b45f 100644
--- a/vendor/github.com/hashicorp/consul-template/manager/runner.go
+++ b/vendor/github.com/hashicorp/consul-template/manager/runner.go
@@ -221,31 +221,6 @@ func (r *Runner) Start() {
 	}
 
 	for {
-		// Enable quiescence for all templates if we have specified wait
-		// intervals.
-	NEXT_Q:
-		for _, t := range r.templates {
-			if _, ok := r.quiescenceMap[t.ID()]; ok {
-				continue NEXT_Q
-			}
-
-			for _, c := range r.templateConfigsFor(t) {
-				if *c.Wait.Enabled {
-					log.Printf("[DEBUG] (runner) enabling template-specific quiescence for %q", t.ID())
-					r.quiescenceMap[t.ID()] = newQuiescence(
-						r.quiescenceCh, *c.Wait.Min, *c.Wait.Max, t)
-					continue NEXT_Q
-				}
-			}
-
-			if *r.config.Wait.Enabled {
-				log.Printf("[DEBUG] (runner) enabling global quiescence for %q", t.ID())
-				r.quiescenceMap[t.ID()] = newQuiescence(
-					r.quiescenceCh, *r.config.Wait.Min, *r.config.Wait.Max, t)
-				continue NEXT_Q
-			}
-		}
-
 		// Warn the user if they are watching too many dependencies.
 		if r.watcher.Size() > saneViewLimit {
 			log.Printf("[WARN] (runner) watching %d dependencies - watching this "+
@@ -256,6 +231,32 @@ func (r *Runner) Start() {
 
 		if r.allTemplatesRendered() {
 			log.Printf("[DEBUG] (runner) all templates rendered")
+			// Enable quiescence for all templates if we have specified wait
+			// intervals.
+		NEXT_Q:
+			for _, t := range r.templates {
+				if _, ok := r.quiescenceMap[t.ID()]; ok {
+					continue NEXT_Q
+				}
+
+				for _, c := range r.templateConfigsFor(t) {
+					if *c.Wait.Enabled {
+						log.Printf("[DEBUG] (runner) enabling template-specific "+
+							"quiescence for %q", t.ID())
+						r.quiescenceMap[t.ID()] = newQuiescence(
+							r.quiescenceCh, *c.Wait.Min, *c.Wait.Max, t)
+						continue NEXT_Q
+					}
+				}
+
+				if *r.config.Wait.Enabled {
+					log.Printf("[DEBUG] (runner) enabling global quiescence for %q",
+						t.ID())
+					r.quiescenceMap[t.ID()] = newQuiescence(
+						r.quiescenceCh, *r.config.Wait.Min, *r.config.Wait.Max, t)
+					continue NEXT_Q
+				}
+			}
 
 			// If an exec command was given and a command is not currently running,
 			// spawn the child process for supervision.
@@ -850,11 +851,12 @@ func (r *Runner) init() error {
 	// destinations.
 	for _, ctmpl := range *r.config.Templates {
 		tmpl, err := template.NewTemplate(&template.NewTemplateInput{
-			Source:        config.StringVal(ctmpl.Source),
-			Contents:      config.StringVal(ctmpl.Contents),
-			ErrMissingKey: config.BoolVal(ctmpl.ErrMissingKey),
-			LeftDelim:     config.StringVal(ctmpl.LeftDelim),
-			RightDelim:    config.StringVal(ctmpl.RightDelim),
+			Source:            config.StringVal(ctmpl.Source),
+			Contents:          config.StringVal(ctmpl.Contents),
+			ErrMissingKey:     config.BoolVal(ctmpl.ErrMissingKey),
+			LeftDelim:         config.StringVal(ctmpl.LeftDelim),
+			RightDelim:        config.StringVal(ctmpl.RightDelim),
+			FunctionBlacklist: ctmpl.FunctionBlacklist,
 		})
 		if err != nil {
 			return err
@@ -938,14 +940,16 @@ func (r *Runner) templateConfigsFor(tmpl *template.Template) []*config.TemplateC
 
 // TemplateConfigMapping returns a mapping between the template ID and the set
 // of TemplateConfig represented by the template ID
-func (r *Runner) TemplateConfigMapping() map[string][]config.TemplateConfig {
-	m := make(map[string][]config.TemplateConfig, len(r.ctemplatesMap))
+func (r *Runner) TemplateConfigMapping() map[string][]*config.TemplateConfig {
+	// this method is primarily used to support embedding consul-template
+	// in other applications (ex. Nomad)
+	m := make(map[string][]*config.TemplateConfig, len(r.ctemplatesMap))
 
 	for id, set := range r.ctemplatesMap {
-		ctmpls := make([]config.TemplateConfig, len(set))
+		ctmpls := make([]*config.TemplateConfig, len(set))
 		m[id] = ctmpls
 		for i, ctmpl := range set {
-			ctmpls[i] = *ctmpl
+			ctmpls[i] = ctmpl
 		}
 	}
 
diff --git a/vendor/github.com/hashicorp/consul-template/template/funcs.go b/vendor/github.com/hashicorp/consul-template/template/funcs.go
index c0048df016c3..caf03b1b37e3 100644
--- a/vendor/github.com/hashicorp/consul-template/template/funcs.go
+++ b/vendor/github.com/hashicorp/consul-template/template/funcs.go
@@ -15,7 +15,7 @@ import (
 	"text/template"
 	"time"
 
-	"github.com/burntsushi/toml"
+	"github.com/BurntSushi/toml"
 	dep "github.com/hashicorp/consul-template/dependency"
 	"github.com/pkg/errors"
 	yaml "gopkg.in/yaml.v2"
@@ -1156,3 +1156,8 @@ func modulo(b, a interface{}) (interface{}, error) {
 		return nil, fmt.Errorf("modulo: unknown type for %q (%T)", av, a)
 	}
 }
+
+// blacklisted always returns an error, to be used in place of blacklisted template functions
+func blacklisted(...string) (string, error) {
+	return "", errors.New("function is disabled")
+}
diff --git a/vendor/github.com/hashicorp/consul-template/template/template.go b/vendor/github.com/hashicorp/consul-template/template/template.go
index 88150d46c45f..3c9552bb5648 100644
--- a/vendor/github.com/hashicorp/consul-template/template/template.go
+++ b/vendor/github.com/hashicorp/consul-template/template/template.go
@@ -45,6 +45,10 @@ type Template struct {
 	// errMissingKey causes the template processing to exit immediately if a map
 	// is indexed with a key that does not exist.
 	errMissingKey bool
+
+	// functionBlacklist are functions not permitted to be executed
+	// when we render this template
+	functionBlacklist []string
 }
 
 // NewTemplateInput is used as input when creating the template.
@@ -62,6 +66,10 @@ type NewTemplateInput struct {
 	// LeftDelim and RightDelim are the template delimiters.
 	LeftDelim  string
 	RightDelim string
+
+	// FunctionBlacklist are functions not permitted to be executed
+	// when we render this template
+	FunctionBlacklist []string
 }
 
 // NewTemplate creates and parses a new Consul Template template at the given
@@ -86,6 +94,7 @@ func NewTemplate(i *NewTemplateInput) (*Template, error) {
 	t.leftDelim = i.LeftDelim
 	t.rightDelim = i.RightDelim
 	t.errMissingKey = i.ErrMissingKey
+	t.functionBlacklist = i.FunctionBlacklist
 
 	if i.Source != "" {
 		contents, err := ioutil.ReadFile(i.Source)
@@ -129,6 +138,10 @@ type ExecuteInput struct {
 	// Values specified here will take precedence over any values in the
 	// environment when using the `env` function.
 	Env []string
+
+	// BlacklistedFunctions is a set of functions to be disabled
+	// when executing the template
+	BlacklistedFunctions []string
 }
 
 // ExecuteResult is the result of the template execution.
@@ -153,12 +166,14 @@ func (t *Template) Execute(i *ExecuteInput) (*ExecuteResult, error) {
 
 	tmpl := template.New("")
 	tmpl.Delims(t.leftDelim, t.rightDelim)
+
 	tmpl.Funcs(funcMap(&funcMapInput{
-		t:       tmpl,
-		brain:   i.Brain,
-		env:     i.Env,
-		used:    &used,
-		missing: &missing,
+		t:                 tmpl,
+		brain:             i.Brain,
+		env:               i.Env,
+		used:              &used,
+		missing:           &missing,
+		functionBlacklist: t.functionBlacklist,
 	}))
 
 	if t.errMissingKey {
@@ -187,18 +202,19 @@ func (t *Template) Execute(i *ExecuteInput) (*ExecuteResult, error) {
 
 // funcMapInput is input to the funcMap, which builds the template functions.
 type funcMapInput struct {
-	t       *template.Template
-	brain   *Brain
-	env     []string
-	used    *dep.Set
-	missing *dep.Set
+	t                 *template.Template
+	brain             *Brain
+	env               []string
+	functionBlacklist []string
+	used              *dep.Set
+	missing           *dep.Set
 }
 
 // funcMap is the map of template functions to their respective functions.
 func funcMap(i *funcMapInput) template.FuncMap {
 	var scratch Scratch
 
-	return template.FuncMap{
+	r := template.FuncMap{
 		// API functions
 		"datacenters":  datacentersFunc(i.brain, i.used, i.missing),
 		"file":         fileFunc(i.brain, i.used, i.missing),
@@ -263,4 +279,12 @@ func funcMap(i *funcMapInput) template.FuncMap {
 		"divide":   divide,
 		"modulo":   modulo,
 	}
+
+	for _, bf := range i.functionBlacklist {
+		if _, ok := r[bf]; ok {
+			r[bf] = blacklisted
+		}
+	}
+
+	return r
 }
diff --git a/vendor/github.com/hashicorp/consul-template/version/version.go b/vendor/github.com/hashicorp/consul-template/version/version.go
index 29721f5f366e..5bed92ee8f04 100644
--- a/vendor/github.com/hashicorp/consul-template/version/version.go
+++ b/vendor/github.com/hashicorp/consul-template/version/version.go
@@ -2,7 +2,7 @@ package version
 
 import "fmt"
 
-const Version = "0.20.1-dev"
+const Version = "0.20.1"
 
 var (
 	Name      string
diff --git a/vendor/vendor.json b/vendor/vendor.json
index 8e1c0a5bd0e3..e2c8164225e1 100644
--- a/vendor/vendor.json
+++ b/vendor/vendor.json
@@ -163,17 +163,17 @@
 		{"path":"github.com/gorilla/context","checksumSHA1":"g/V4qrXjUGG9B+e3hB+4NAYJ5Gs=","revision":"08b5f424b9271eedf6f9f0ce86cb9396ed337a42","revisionTime":"2016-08-17T18:46:32Z"},
 		{"path":"github.com/gorilla/mux","checksumSHA1":"STQSdSj2FcpCf0NLfdsKhNutQT0=","revision":"e48e440e4c92e3251d812f8ce7858944dfa3331c","revisionTime":"2018-08-07T07:52:56Z"},
 		{"path":"github.com/gorilla/websocket","checksumSHA1":"gr0edNJuVv4+olNNZl5ZmwLgscA=","revision":"0ec3d1bd7fe50c503d6df98ee649d81f4857c564","revisionTime":"2019-03-06T00:42:57Z"},
-		{"path":"github.com/hashicorp/consul-template","checksumSHA1":"k5zZ8xCgta0EJ2sZWPEs1kAM5Vw=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/child","checksumSHA1":"AhDPiKa7wzh3SE6Gx0WrsDYwBHg=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/config","checksumSHA1":"BIIejfVMt8xA1bGtJswPpT+wwMA=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/dependency","checksumSHA1":"kMdbOWSNfm8Imce6y6cweX+EVNg=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/logging","checksumSHA1":"o5N7SV389Ej+3b1iRNmz1dx5e1M=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/manager","checksumSHA1":"9lrVI3BnWtC5Z2l/LXdK0e2yJjI=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/renderer","checksumSHA1":"DUHtghMoLyrgPhv4lexVniBuWYk=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/signals","checksumSHA1":"YSEUV/9/k85XciRKu0cngxdjZLE=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/template","checksumSHA1":"Y0Ws3O64np8sFDE/3vAx8lFUHxc=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/version","checksumSHA1":"85qK+LAbb/oAjvdDqVOLi4tMxZk=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
-		{"path":"github.com/hashicorp/consul-template/watch","checksumSHA1":"cJxopvJKg7DBBb8tnDsfmBp5Q8I=","revision":"4058b146979c4feb0551d39b8795a31409b3e6bf","revisionTime":"2019-07-17T18:51:08Z"},
+		{"path":"github.com/hashicorp/consul-template","checksumSHA1":"4Grd+Faw3dbVtCpxHwo3zF78YbQ=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/child","checksumSHA1":"AhDPiKa7wzh3SE6Gx0WrsDYwBHg=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/config","checksumSHA1":"f6zmAm/RmQ7qosEmrzM4KBfcYJk=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/dependency","checksumSHA1":"zNqwxk8tXQPpBq6m7vPMNGVq12Q=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/logging","checksumSHA1":"o5N7SV389Ej+3b1iRNmz1dx5e1M=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/manager","checksumSHA1":"R04OvwF7CdYyrIyQ06qb7wcrDnI=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/renderer","checksumSHA1":"DUHtghMoLyrgPhv4lexVniBuWYk=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/signals","checksumSHA1":"YSEUV/9/k85XciRKu0cngxdjZLE=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/template","checksumSHA1":"/5mXm9rYsPuq6IEJVKr6OW/bLzY=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/version","checksumSHA1":"xGlGDk2O21uV5d7dJp1wTEQyoZI=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
+		{"path":"github.com/hashicorp/consul-template/watch","checksumSHA1":"cJxopvJKg7DBBb8tnDsfmBp5Q8I=","revision":"b5fe848c3dcc381342eacfdf27be0a86958b5349","revisionTime":"2019-08-05T19:58:20Z"},
 		{"path":"github.com/hashicorp/consul/agent/consul/autopilot","checksumSHA1":"+I7fgoQlrnTUGW5krqNLadWwtjg=","revision":"fb848fc48818f58690db09d14640513aa6bf3c02","revisionTime":"2018-04-13T17:05:42Z"},
 		{"path":"github.com/hashicorp/consul/api","checksumSHA1":"7JPBtnIgLkdcJ0ldXMTEnVjNEjA=","revision":"40cec98468b829e5cdaacb0629b3e23a028db688","revisionTime":"2019-05-22T20:19:12Z"},
 		{"path":"github.com/hashicorp/consul/command/flags","checksumSHA1":"soNN4xaHTbeXFgNkZ7cX0gbFXQk=","revision":"fb848fc48818f58690db09d14640513aa6bf3c02","revisionTime":"2018-04-13T17:05:42Z"},