diff --git a/.drone/drone.jsonnet b/.drone/drone.jsonnet
index 8fbab4dbfce5..da942d66e47d 100644
--- a/.drone/drone.jsonnet
+++ b/.drone/drone.jsonnet
@@ -62,7 +62,7 @@ local make(target, container=true, args=[]) = run(target, [
 
 local docker(arch, app) = {
   name: '%s-image' % if $.settings.dry_run then 'build-' + app else 'publish-' + app,
-  image: 'plugins/docker',
+  image: if arch == 'arm' then 'plugins/docker:linux-arm' else 'plugins/docker',
   settings: {
     repo: 'grafana/%s' % app,
     dockerfile: 'cmd/%s/Dockerfile' % app,
@@ -74,7 +74,7 @@ local docker(arch, app) = {
 
 local clients_docker(arch, app) = {
   name: '%s-image' % if $.settings.dry_run then 'build-' + app else 'publish-' + app,
-  image: 'plugins/docker',
+  image: if arch == 'arm' then 'plugins/docker:linux-arm' else 'plugins/docker',
   settings: {
     repo: 'grafana/%s' % app,
     dockerfile: 'clients/cmd/%s/Dockerfile' % app,
@@ -86,7 +86,7 @@ local clients_docker(arch, app) = {
 
 local docker_operator(arch, operator) = {
   name: '%s-image' % if $.settings.dry_run then 'build-' + operator else 'publish-' + operator,
-  image: 'plugins/docker',
+  image: if arch == 'arm' then 'plugins/docker:linux-arm' else 'plugins/docker',
   settings: {
     repo: 'grafana/%s' % operator,
     context: 'operator',
@@ -446,7 +446,7 @@ local manifest_ecr(apps, archs) = pipeline('manifest-ecr') {
 
 [
   pipeline('loki-build-image') {
-    local build_image_tag = '0.25.0',
+    local build_image_tag = '0.27.0',
     workspace: {
       base: '/src',
       path: 'loki',
@@ -758,6 +758,38 @@ local manifest_ecr(apps, archs) = pipeline('manifest-ecr') {
           }) { when: { event: ['tag'] } },
     ],
   },
+  pipeline('docker-driver') {
+    trigger+: onTagOrMain,
+    steps: [
+      {
+        name: 'build and push',
+        image: 'grafana/loki-build-image:%s' % build_image_version,
+        depends_on: ['clone'],
+        environment: {
+          DOCKER_USERNAME: { from_secret: docker_username_secret.name },
+          DOCKER_PASSWORD: { from_secret: docker_password_secret.name },
+        },
+        commands: [
+          'make docker-driver-push',
+        ],
+        volumes: [
+          {
+            name: 'docker',
+            path: '/var/run/docker.sock',
+          },
+        ],
+        privileged: true,
+      },
+    ],
+    volumes: [
+      {
+        name: 'docker',
+        host: {
+          path: '/var/run/docker.sock',
+        },
+      },
+    ],
+  },
 ]
 + [
   lambda_promtail(arch)
diff --git a/.drone/drone.yml b/.drone/drone.yml
index 9d969d152c0e..ff5664251f7e 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -10,7 +10,7 @@ steps:
     dry_run: true
     repo: grafana/loki-build-image
     tags:
-    - 0.25.0
+    - 0.27.0
   when:
     event:
     - pull_request
@@ -26,7 +26,7 @@ steps:
       from_secret: docker_password
     repo: grafana/loki-build-image
     tags:
-    - 0.25.0
+    - 0.27.0
     username:
       from_secret: docker_username
   when:
@@ -93,14 +93,14 @@ steps:
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: check-drone-drift
 - commands:
   - make BUILD_IN_CONTAINER=false check-generated-files
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: check-generated-files
 - commands:
   - cd ..
@@ -110,7 +110,7 @@ steps:
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: clone-target-branch
   when:
     event:
@@ -121,7 +121,7 @@ steps:
   - clone-target-branch
   - check-generated-files
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: test
 - commands:
   - cd ../loki-target-branch
@@ -129,7 +129,7 @@ steps:
   depends_on:
   - clone-target-branch
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: test-target-branch
   when:
     event:
@@ -142,7 +142,7 @@ steps:
   - test
   - test-target-branch
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: compare-coverage
   when:
     event:
@@ -158,7 +158,7 @@ steps:
     TOKEN:
       from_secret: github_token
     USER: grafanabot
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: report-coverage
   when:
     event:
@@ -168,7 +168,7 @@ steps:
   depends_on:
   - check-generated-files
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: lint
 - commands:
   - make BUILD_IN_CONTAINER=false check-mod
@@ -176,7 +176,7 @@ steps:
   - test
   - lint
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: check-mod
 - commands:
   - apk add make bash && make lint-scripts
@@ -187,28 +187,28 @@ steps:
   depends_on:
   - check-generated-files
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: loki
 - commands:
   - make BUILD_IN_CONTAINER=false check-doc
   depends_on:
   - loki
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: check-doc
 - commands:
   - make BUILD_IN_CONTAINER=false validate-example-configs
   depends_on:
   - loki
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: validate-example-configs
 - commands:
   - make BUILD_IN_CONTAINER=false check-example-config-doc
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: check-example-config-doc
 trigger:
   ref:
@@ -235,7 +235,7 @@ steps:
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: loki-mixin-check
   when:
     event:
@@ -260,7 +260,7 @@ steps:
   depends_on:
   - clone
   environment: {}
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: documentation-helm-reference-check
 trigger:
   ref:
@@ -516,7 +516,7 @@ steps:
   name: image-tag
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: build-loki-image
   settings:
     dockerfile: cmd/loki/Dockerfile
@@ -531,7 +531,7 @@ steps:
     - pull_request
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: build-loki-canary-image
   settings:
     dockerfile: cmd/loki-canary/Dockerfile
@@ -546,7 +546,7 @@ steps:
     - pull_request
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: build-logcli-image
   settings:
     dockerfile: cmd/logcli/Dockerfile
@@ -561,7 +561,7 @@ steps:
     - pull_request
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: publish-loki-image
   settings:
     dockerfile: cmd/loki/Dockerfile
@@ -577,7 +577,7 @@ steps:
     - tag
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: publish-loki-canary-image
   settings:
     dockerfile: cmd/loki-canary/Dockerfile
@@ -593,7 +593,7 @@ steps:
     - tag
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: publish-logcli-image
   settings:
     dockerfile: cmd/logcli/Dockerfile
@@ -734,7 +734,7 @@ steps:
   name: image-tag
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: build-promtail-image
   settings:
     dockerfile: clients/cmd/promtail/Dockerfile.arm32
@@ -749,7 +749,7 @@ steps:
     - pull_request
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: publish-promtail-image
   settings:
     dockerfile: clients/cmd/promtail/Dockerfile.arm32
@@ -894,7 +894,7 @@ steps:
   name: image-tag
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: build-loki-operator-image
   settings:
     context: operator
@@ -910,7 +910,7 @@ steps:
     - pull_request
 - depends_on:
   - image-tag
-  image: plugins/docker
+  image: plugins/docker:linux-arm
   name: publish-loki-operator-image
   settings:
     context: operator
@@ -1360,7 +1360,7 @@ steps:
     NFPM_SIGNING_KEY:
       from_secret: gpg_private_key
     NFPM_SIGNING_KEY_FILE: /drone/src/private-key.key
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: write-key
 - commands:
   - make BUILD_IN_CONTAINER=false packages
@@ -1368,7 +1368,7 @@ steps:
     NFPM_PASSPHRASE:
       from_secret: gpg_passphrase
     NFPM_SIGNING_KEY_FILE: /drone/src/private-key.key
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: test packaging
 - commands:
   - ./tools/packaging/verify-deb-install.sh
@@ -1394,7 +1394,7 @@ steps:
     NFPM_PASSPHRASE:
       from_secret: gpg_passphrase
     NFPM_SIGNING_KEY_FILE: /drone/src/private-key.key
-  image: grafana/loki-build-image:0.26.0
+  image: grafana/loki-build-image:0.27.0
   name: publish
   when:
     event:
@@ -1416,6 +1416,38 @@ volumes:
     path: /var/run/docker.sock
   name: docker
 ---
+kind: pipeline
+name: docker-driver
+steps:
+- commands:
+  - make docker-driver-push
+  depends_on:
+  - clone
+  environment:
+    DOCKER_PASSWORD:
+      from_secret: docker_password
+    DOCKER_USERNAME:
+      from_secret: docker_username
+  image: grafana/loki-build-image:0.27.0
+  name: build and push
+  privileged: true
+  volumes:
+  - name: docker
+    path: /var/run/docker.sock
+trigger:
+  event:
+  - push
+  - tag
+  ref:
+  - refs/heads/main
+  - refs/heads/k???
+  - refs/tags/v*
+  - refs/pull/*/head
+volumes:
+- host:
+    path: /var/run/docker.sock
+  name: docker
+---
 depends_on:
 - check
 kind: pipeline
@@ -1633,6 +1665,6 @@ kind: secret
 name: gpg_private_key
 ---
 kind: signature
-hmac: b07d95d16c5f0170c2f5c16a7b73a73b5c3989b531bf4a79e8487166cc8bf77b
+hmac: 768eb915af5b1cf14a24de3d4a2bbf9ed583404d7a391468d4d8e26b2b65b06c
 
 ...
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 7d93322665bd..076627df49de 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -6,7 +6,7 @@ Fixes #<issue number>
 **Special notes for your reviewer**:
 
 **Checklist**
-- [ ] Reviewed the `CONTRIBUTING.md` guide
+- [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**)
 - [ ] Documentation added
 - [ ] Tests updated
 - [ ] `CHANGELOG.md` updated
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 063d80fb49d2..343ef3c87822 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v3.3.0
         with:
           repository: "grafana/grafana-github-actions"
           path: ./actions
diff --git a/.github/workflows/helm-ci.yml b/.github/workflows/helm-ci.yml
index dfa8ca51ba25..dab5e26ecfe0 100644
--- a/.github/workflows/helm-ci.yml
+++ b/.github/workflows/helm-ci.yml
@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.3.0
 
       - name: Check Docs
         run: |
-          docker run --rm --volume "$(pwd):/helm-docs" -u "$(id -u)" jnorwood/helm-docs:v1.8.1
+          docker run --rm --volume "$(pwd):/helm-docs" -u "$(id -u)" jnorwood/helm-docs:v1.11.0
           if ! git diff --exit-code; then
               echo "Documentation not up to date. Please run helm-docs and commit changes!" >&2
               exit 1
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.3.0
         with:
           fetch-depth: 0
 
@@ -71,7 +71,7 @@ jobs:
         run: ct lint --config "${CT_CONFIGFILE}" --check-version-increment=false
 
       - name: Create kind cluster
-        uses: helm/kind-action@v1.4.0
+        uses: helm/kind-action@v1.5.0
         if: steps.list-changed.outputs.changed == 'true'
 
       - name: Install prometheus operator
diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml
index ef5baa666ebf..1d5847e54355 100644
--- a/.github/workflows/helm-release.yaml
+++ b/.github/workflows/helm-release.yaml
@@ -17,5 +17,3 @@ jobs:
       helm_tag_prefix: helm
     secrets:
       helm_repo_token: ${{ secrets.GH_BOT_ACCESS_TOKEN }}
-      # See https://github.com/grafana/helm-charts/blob/main/INTERNAL.md about this key
-      gpg_key_base64: ${{ secrets.HELM_SIGN_KEY_BASE64 }}
diff --git a/.github/workflows/issue_commands.yml b/.github/workflows/issue_commands.yml
index 8b2abf1945c7..6797e207bfec 100644
--- a/.github/workflows/issue_commands.yml
+++ b/.github/workflows/issue_commands.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v3.3.0
         with:
           repository: "grafana/grafana-github-actions"
           path: ./actions
diff --git a/.github/workflows/metrics-collector.yml b/.github/workflows/metrics-collector.yml
index 5a1d60664ef8..b5ea9e1dd644 100644
--- a/.github/workflows/metrics-collector.yml
+++ b/.github/workflows/metrics-collector.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v3.3.0
         with:
           repository: "grafana/grafana-github-actions"
           path: ./actions
diff --git a/.github/workflows/nix-ci.yaml b/.github/workflows/nix-ci.yaml
index 916363e07d41..38ec33e744c1 100644
--- a/.github/workflows/nix-ci.yaml
+++ b/.github/workflows/nix-ci.yaml
@@ -9,7 +9,7 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.1.0
+      - uses: actions/checkout@v3.3.0
       - uses: cachix/install-nix-action@v18
         with:
           nix_path: nixpkgs=channel:nixos-unstable
diff --git a/.github/workflows/operator-bundle.yaml b/.github/workflows/operator-bundle.yaml
index 11d2ba6ddd42..b7ad1d4f9132 100644
--- a/.github/workflows/operator-bundle.yaml
+++ b/.github/workflows/operator-bundle.yaml
@@ -23,7 +23,7 @@ jobs:
       with:
         go-version: ${{ matrix.go }}
       id: go
-    - uses: actions/checkout@v3.1.0
+    - uses: actions/checkout@v3.3.0
     - name: Install make
       run: sudo apt-get install make
     - name: make bundle
diff --git a/.github/workflows/operator-images.yaml b/.github/workflows/operator-images.yaml
index 8dbf1a2a5535..07d3a73d0162 100644
--- a/.github/workflows/operator-images.yaml
+++ b/.github/workflows/operator-images.yaml
@@ -18,7 +18,7 @@ jobs:
  publish-manager:
    runs-on: ubuntu-latest
    steps:
-     - uses: actions/checkout@v3.1.0
+     - uses: actions/checkout@v3.3.0
 
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
@@ -56,7 +56,7 @@ jobs:
  publish-bundle:
    runs-on: ubuntu-latest
    steps:
-     - uses: actions/checkout@v3.1.0
+     - uses: actions/checkout@v3.3.0
 
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
@@ -95,7 +95,7 @@ jobs:
  publish-size-calculator:
    runs-on: ubuntu-latest
    steps:
-     - uses: actions/checkout@v3.1.0
+     - uses: actions/checkout@v3.3.0
 
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
diff --git a/.github/workflows/operator-scorecard.yaml b/.github/workflows/operator-scorecard.yaml
index cb1a3d4546cc..eaea1bc50895 100644
--- a/.github/workflows/operator-scorecard.yaml
+++ b/.github/workflows/operator-scorecard.yaml
@@ -26,7 +26,7 @@ jobs:
     - uses: engineerd/setup-kind@v0.5.0
       with:
         version: "v0.16.0"
-    - uses: actions/checkout@v3.1.0
+    - uses: actions/checkout@v3.3.0
     - name: Install make
       run: sudo apt-get install make
     - name: Run scorecard
diff --git a/.github/workflows/operator.yaml b/.github/workflows/operator.yaml
index 3553f642944b..f87045b6d364 100644
--- a/.github/workflows/operator.yaml
+++ b/.github/workflows/operator.yaml
@@ -25,9 +25,9 @@ jobs:
       with:
         go-version: ${{ matrix.go }}
       id: go
-    - uses: actions/checkout@v3.1.0
+    - uses: actions/checkout@v3.3.0
     - name: Lint
-      uses: golangci/golangci-lint-action@v3.2.0
+      uses: golangci/golangci-lint-action@v3.3.1
       with:
         version: v1.50.0
         args: --timeout=4m
@@ -51,7 +51,7 @@ jobs:
       with:
         go-version: ${{ matrix.go }}
       id: go
-    - uses: actions/checkout@v3.1.0
+    - uses: actions/checkout@v3.3.0
     - name: Build Manager
       working-directory: ./operator
       run: |-
@@ -72,7 +72,7 @@ jobs:
       with:
         go-version: ${{ matrix.go }}
       id: go
-    - uses: actions/checkout@v3.1.0
+    - uses: actions/checkout@v3.3.0
     - name: Build Broker
       working-directory: ./operator
       run: |-
@@ -93,7 +93,7 @@ jobs:
       with:
         go-version: ${{ matrix.go }}
       id: go
-    - uses: actions/checkout@v3.1.0
+    - uses: actions/checkout@v3.3.0
     - name: Run tests
       working-directory: ./operator
       run: go test -coverprofile=profile.cov ./...
diff --git a/.github/workflows/publish-technical-documentation-next.yml b/.github/workflows/publish-technical-documentation-next.yml
index ecfc17f8af04..f5b0d007b8f3 100644
--- a/.github/workflows/publish-technical-documentation-next.yml
+++ b/.github/workflows/publish-technical-documentation-next.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Check out code"
-        uses: "actions/checkout@v3.1.0"
+        uses: "actions/checkout@v3.3.0"
       - name: "Build website"
         # -e HUGO_REFLINKSERRORLEVEL=ERROR prevents merging broken refs with the downside
         # that no refs to external content can be used as these refs will not resolve in the
@@ -25,10 +25,12 @@ jobs:
     needs: "test"
     steps:
       - name: "Check out code"
-        uses: "actions/checkout@v3.1.0"
+        uses: "actions/checkout@v3.3.0"
 
       - name: "Clone website-sync Action"
-        run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.GH_BOT_ACCESS_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
+        # WEBSITE_SYNC_LOKI is a fine-grained GitHub Personal Access Token that expires.
+        # It must be updated in the grafanabot GitHub account.
+        run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_LOKI }}@github.com/grafana/website-sync ./.github/actions/website-sync"
 
       - name: "Publish to website repository (next)"
         uses: "./.github/actions/website-sync"
@@ -37,6 +39,8 @@ jobs:
           repository: "grafana/website"
           branch: "master"
           host: "github.com"
-          github_pat: "${{ secrets.GH_BOT_ACCESS_TOKEN }}"
+          # PUBLISH_TO_WEBSITE_LOKI is a fine-grained GitHub Personal Access Token that expires.
+          # It must be updated in the grafanabot GitHub account.
+          github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_LOKI }}"
           source_folder: "docs/sources"
           target_folder: "content/docs/loki/next"
diff --git a/.github/workflows/publish-technical-documentation-release.yml b/.github/workflows/publish-technical-documentation-release.yml
index 721b0987f825..e9f5ffaecc07 100644
--- a/.github/workflows/publish-technical-documentation-release.yml
+++ b/.github/workflows/publish-technical-documentation-release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Check out code"
-        uses: "actions/checkout@v3.1.0"
+        uses: "actions/checkout@v3.3.0"
       - name:
           "Build website"
           # -e HUGO_REFLINKSERRORLEVEL=ERROR prevents merging broken refs with the downside
@@ -28,12 +28,12 @@ jobs:
     needs: "test"
     steps:
       - name: "Checkout code and tags"
-        uses: "actions/checkout@v3.1.0"
+        uses: "actions/checkout@v3.3.0"
         with:
           fetch-depth: 0
 
       - name: "Checkout Actions library"
-        uses: "actions/checkout@v3.1.0"
+        uses: "actions/checkout@v3.3.0"
         with:
           repository: "grafana/grafana-github-actions"
           path: "./actions"
@@ -58,7 +58,9 @@ jobs:
 
       - name: "Clone website-sync Action"
         if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-        run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.GH_BOT_ACCESS_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
+        # WEBSITE_SYNC_LOKI is a fine-grained GitHub Personal Access Token that expires.
+        # It must be updated in the grafanabot GitHub account.
+        run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_LOKI }}@github.com/grafana/website-sync ./.github/actions/website-sync"
 
       - name: "Publish to website repository (release)"
         if: "steps.has-matching-release-tag.outputs.bool == 'true'"
@@ -68,6 +70,8 @@ jobs:
           repository: "grafana/website"
           branch: "master"
           host: "github.com"
-          github_pat: "${{ secrets.GH_BOT_ACCESS_TOKEN }}"
+          # PUBLISH_TO_WEBSITE_LOKI is a fine-grained GitHub Personal Access Token that expires.
+          # It must be updated in the grafanabot GitHub account.
+          github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_LOKI }}"
           source_folder: "docs/sources"
           target_folder: "content/docs/loki/${{ steps.target.outputs.target }}.x"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ddff6e2481e..50e55e2aa3d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,10 +19,13 @@
 * [7964](https://github.com/grafana/loki/pull/7964) **slim-bean**: Add a `since` query parameter to allow querying based on relative time.
 * [7989](https://github.com/grafana/loki/pull/7989) **liguozhong**: logql support `sort` and `sort_desc`.
 * [7997](https://github.com/grafana/loki/pull/7997) **kavirajk**: fix(promtail): Fix cri tags extra new lines when joining partial lines
+* [7975](https://github.com/grafana/loki/pull/7975) **adityacs**: Support drop labels in logql
+* [7946](https://github.com/grafana/loki/pull/7946) **ashwanthgoli** config: Add support for named stores
 * [8027](https://github.com/grafana/loki/pull/8027) **kavirajk**: chore(promtail): Make `batchwait` and `batchsize` config explicit with yaml tags
 * [7978](https://github.com/grafana/loki/pull/7978) **chaudum**: Shut down query frontend gracefully to allow inflight requests to complete.
 * [8047](https://github.com/grafana/loki/pull/8047) **bboreham**: Dashboards: add k8s resource requests to CPU and memory panels.
 * [8061](https://github.com/grafana/loki/pull/8061) **kavirajk**: Remove circle from Loki OSS
+* [8131](https://github.com/grafana/loki/pull/8131) **jeschkies**: Compile Promtail ARM and ARM64 with journald support.
 
 ##### Fixes
 
@@ -36,12 +39,15 @@
 * [7966](https://github.com/grafana/loki/pull/7966) **sandeepsukhani**: Fix query-frontend request load balancing when using k8s service.
 * [7988](https://github.com/grafana/loki/pull/7988) **ashwanthgoli** store: write overlapping chunks to multiple stores.
 * [7925](https://github.com/grafana/loki/pull/7925) **sandeepsukhani**: Fix bugs in logs results caching causing query-frontend to return logs outside of query window.
+* [8120](https://github.com/grafana/loki/pull/8120) **ashwanthgoli** fix panic on hitting /scheduler/ring when ring is disabled.
 
 ##### Changes
 
 #### Promtail
 
 * [7619](https://github.com/grafana/loki/pull/7619) **cadrake**: Add ability to pass query params to heroku drain targets for relabelling.
+* [7973](https://github.com/grafana/loki/pull/7973) **chodges15**: Add configuration to drop rate limited batches in Loki client and new metric label for drop reason.
+* [8153](https://github.com/grafana/loki/pull/8061) **kavirajk**: promtail: Add `max-line-size` limit to drop on client side
 
 ##### Enhancements
 
@@ -132,6 +138,7 @@ Check the history of the branch FIXME.
 * [6349](https://github.com/grafana/loki/pull/6349) **simonswine**: Update the default HTTP listen port from 80 to 3100. Make sure to configure the port explicitly if you are using port 80.
 * [6835](https://github.com/grafana/loki/pull/6835) **DylanGuedes**: Add new per-tenant query timeout configuration and remove engine query timeout.
 * [7212](https://github.com/grafana/loki/pull/7212) **Juneezee**: Replaces deprecated `io/ioutil` with `io` and `os`.
+* [7292](https://github.com/grafana/loki/pull/7292) **jmherbst**: Add string conversion to value based drops to more intuitively match numeric fields. String conversion failure will result in no lines being dropped.
 * [7361](https://github.com/grafana/loki/pull/7361) **szczepad**: Renames metric `loki_log_messages_total` to `loki_internal_log_messages_total`
 * [7416](https://github.com/grafana/loki/pull/7416) **mstrzele**: Use the stable `HorizontalPodAutoscaler` v2, if possible, when installing using Helm
 * [7510](https://github.com/grafana/loki/pull/7510) **slim-bean**: Limited queries (queries without filter expressions) will now be split and sharded.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3b54ac89d47a..935ff16a05e0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -6,6 +6,12 @@ Loki uses GitHub to manage reviews of pull requests:
 - If you plan to do something more involved, discuss your ideas on the relevant GitHub issue.
 - Make sure to follow the prerequisites below before marking your PR as ready for review.
 
+## Loki Improvement Documents (LIDs)
+
+Before creating a large pull request to change or add functionality, please create a _Loki Improvement Document (LID)_. We use LIDs to discuss and vet ideas submitted by maintainers or the community in an open and transparent way. As of Jan 2023, we are starting with a lightweight LID process and we may add more structure, inspired by Python's [PEP](https://peps.python.org/pep-0001/) and Kafka's [KIP](https://cwiki.apache.org/confluence/display/KAFKA/Kafka+Improvement+Proposals) approaches.
+
+LIDs must be created as a pull request using [this template](docs/sources/lids/template.md).
+
 ## Pull Request Prerequisites/Checklist
 
 1. Your PR title is in the form `<Feature Area>: Your change`.
diff --git a/Makefile b/Makefile
index 7570012ecd1a..941d4c0646ad 100644
--- a/Makefile
+++ b/Makefile
@@ -28,7 +28,7 @@ DOCKER_IMAGE_DIRS := $(patsubst %/Dockerfile,%,$(DOCKERFILES))
 BUILD_IN_CONTAINER ?= true
 
 # ensure you run `make drone` after changing this
-BUILD_IMAGE_VERSION := 0.26.0
+BUILD_IMAGE_VERSION := 0.27.0
 
 # Docker image info
 IMAGE_PREFIX ?= grafana
@@ -261,7 +261,9 @@ dist: clean
 	CGO_ENABLED=0 $(GOX) -osarch="linux/amd64 linux/arm64 linux/arm darwin/amd64 darwin/arm64 windows/amd64 freebsd/amd64" ./cmd/loki
 	CGO_ENABLED=0 $(GOX) -osarch="linux/amd64 linux/arm64 linux/arm darwin/amd64 darwin/arm64 windows/amd64 freebsd/amd64" ./cmd/logcli
 	CGO_ENABLED=0 $(GOX) -osarch="linux/amd64 linux/arm64 linux/arm darwin/amd64 darwin/arm64 windows/amd64 freebsd/amd64" ./cmd/loki-canary
-	CGO_ENABLED=0 $(GOX) -osarch="linux/arm64 linux/arm darwin/amd64 darwin/arm64 windows/amd64 windows/386 freebsd/amd64" ./clients/cmd/promtail
+	CGO_ENABLED=0 $(GOX) -osarch="darwin/amd64 darwin/arm64 windows/amd64 windows/386 freebsd/amd64" ./clients/cmd/promtail
+	PKG_CONFIG_PATH="/usr/lib/aarch64-linux-gnu/pkgconfig" CC="aarch64-linux-gnu-gcc" $(CGO_GOX)  -tags promtail_journal_enabled  -osarch="linux/arm64" ./clients/cmd/promtail
+	PKG_CONFIG_PATH="/usr/lib/arm-linux-gnueabihf/pkgconfig" CC="arm-linux-gnueabihf-gcc" $(CGO_GOX)  -tags promtail_journal_enabled  -osarch="linux/arm" ./clients/cmd/promtail
 	CGO_ENABLED=1 $(CGO_GOX) -osarch="linux/amd64" ./clients/cmd/promtail
 	for i in dist/*; do zip -j -m $$i.zip $$i; done
 	pushd dist && sha256sum * > SHA256SUMS && popd
@@ -289,7 +291,7 @@ lint:
 ########
 
 test: all
-	$(GOTEST) -covermode=atomic -coverprofile=coverage.txt -p=4 ./... | tee test_results.txt
+	$(GOTEST) -covermode=atomic -coverprofile=coverage.txt -p=4 ./... | sed "s:$$: ${DRONE_STEP_NAME} ${DRONE_SOURCE_BRANCH}:" | tee test_results.txt
 
 compare-coverage:
 	./tools/diff_coverage.sh $(old) $(new) $(packages)
@@ -421,6 +423,13 @@ clients/cmd/docker-driver/docker-driver:
 	CGO_ENABLED=0 go build $(GO_FLAGS) -o $@ ./$(@D)
 
 docker-driver-push: docker-driver
+ifndef DOCKER_PASSWORD
+	$(error env var DOCKER_PASSWORD is undefined)
+endif
+ifndef DOCKER_USERNAME
+	$(error env var DOCKER_USERNAME is undefined)
+endif
+	echo ${DOCKER_PASSWORD} | docker login --username ${DOCKER_USERNAME} --password-stdin
 	docker plugin push $(LOKI_DOCKER_DRIVER):$(PLUGIN_TAG)$(PLUGIN_ARCH)
 	docker plugin push $(LOKI_DOCKER_DRIVER):main$(PLUGIN_ARCH)
 
@@ -652,7 +661,8 @@ else
 	GO111MODULE=on GOPROXY=https://proxy.golang.org go mod tidy
 	GO111MODULE=on GOPROXY=https://proxy.golang.org go mod vendor
 endif
-	@git diff --exit-code -- go.sum go.mod vendor/
+	@git diff --exit-code -- go.sum go.mod vendor/ || \
+	    (echo "Run 'go mod download && go mod verify && go mod tidy && go mod vendor' and check in changes to vendor/ to fix failed check-mod."; exit 1)
 
 
 lint-jsonnet:
diff --git a/clients/cmd/docker-driver/Dockerfile b/clients/cmd/docker-driver/Dockerfile
index 3714960c91f9..b3c874cb24d4 100644
--- a/clients/cmd/docker-driver/Dockerfile
+++ b/clients/cmd/docker-driver/Dockerfile
@@ -1,4 +1,4 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.25.0
+ARG BUILD_IMAGE=grafana/loki-build-image:0.27.0
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile .
diff --git a/clients/cmd/docker-driver/loki.go b/clients/cmd/docker-driver/loki.go
index 9546d41e2f4f..c9bf6e465f3f 100644
--- a/clients/cmd/docker-driver/loki.go
+++ b/clients/cmd/docker-driver/loki.go
@@ -39,7 +39,7 @@ func New(logCtx logger.Info, logger log.Logger) (logger.Logger, error) {
 		return nil, err
 	}
 	m := client.NewMetrics(prometheus.DefaultRegisterer, nil)
-	c, err := client.New(m, cfg.clientConfig, nil, 0, logger)
+	c, err := client.New(m, cfg.clientConfig, nil, 0, 0, logger)
 	if err != nil {
 		return nil, err
 	}
diff --git a/clients/cmd/fluent-bit/client.go b/clients/cmd/fluent-bit/client.go
index 5be0bf695678..745fd91356ef 100644
--- a/clients/cmd/fluent-bit/client.go
+++ b/clients/cmd/fluent-bit/client.go
@@ -11,5 +11,5 @@ func NewClient(cfg *config, logger log.Logger, metrics *client.Metrics, streamLa
 	if cfg.bufferConfig.buffer {
 		return NewBuffer(cfg, logger, metrics, streamLagLabels)
 	}
-	return client.New(metrics, cfg.clientConfig, streamLagLabels, 0, logger)
+	return client.New(metrics, cfg.clientConfig, streamLagLabels, 0, 0, logger)
 }
diff --git a/clients/cmd/fluent-bit/dque.go b/clients/cmd/fluent-bit/dque.go
index c7da80d0e5e0..3c442fb60725 100644
--- a/clients/cmd/fluent-bit/dque.go
+++ b/clients/cmd/fluent-bit/dque.go
@@ -72,7 +72,7 @@ func newDque(cfg *config, logger log.Logger, metrics *client.Metrics, streamLagL
 		_ = q.queue.TurboOn()
 	}
 
-	q.loki, err = client.New(metrics, cfg.clientConfig, streamLagLabels, 0, logger)
+	q.loki, err = client.New(metrics, cfg.clientConfig, streamLagLabels, 0, 0, logger)
 	if err != nil {
 		return nil, err
 	}
diff --git a/clients/cmd/promtail/Dockerfile.cross b/clients/cmd/promtail/Dockerfile.cross
index eb58c9965a8a..aee85b7ee1e2 100644
--- a/clients/cmd/promtail/Dockerfile.cross
+++ b/clients/cmd/promtail/Dockerfile.cross
@@ -1,4 +1,4 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.25.0
+ARG BUILD_IMAGE=grafana/loki-build-image:0.27.0
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f clients/cmd/promtail/Dockerfile .
diff --git a/clients/cmd/promtail/Dockerfile.debug b/clients/cmd/promtail/Dockerfile.debug
index 19acecf6877f..f376dd97b3b7 100644
--- a/clients/cmd/promtail/Dockerfile.debug
+++ b/clients/cmd/promtail/Dockerfile.debug
@@ -2,7 +2,7 @@
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f clients/cmd/promtail/Dockerfile.debug .
 
-FROM grafana/loki-build-image:0.25.0 as build
+FROM grafana/loki-build-image:0.27.0 as build
 ARG GOARCH="amd64"
 COPY . /src/loki
 WORKDIR /src/loki
diff --git a/clients/pkg/logentry/stages/drop.go b/clients/pkg/logentry/stages/drop.go
index b1bb85528df1..ebab27ba1aca 100644
--- a/clients/pkg/logentry/stages/drop.go
+++ b/clients/pkg/logentry/stages/drop.go
@@ -159,7 +159,14 @@ func (m *dropStage) shouldDrop(e Entry) bool {
 					level.Debug(m.logger).Log("msg", "line met drop criteria for finding source key in extracted map")
 				}
 			} else {
-				if *m.cfg.Value == v {
+				s, err := getString(v)
+				if err != nil {
+					if Debug {
+						level.Debug(m.logger).Log("msg", "line will not be dropped, failed to convert extracted map value to string", "err", err, "type", reflect.TypeOf(v))
+					}
+					return false
+				}
+				if *m.cfg.Value == s {
 					// Found in map with value set for drop
 					if Debug {
 						level.Debug(m.logger).Log("msg", "line met drop criteria for finding source key in extracted map with value matching desired drop value")
@@ -167,7 +174,7 @@ func (m *dropStage) shouldDrop(e Entry) bool {
 				} else {
 					// Value doesn't match, don't drop
 					if Debug {
-						level.Debug(m.logger).Log("msg", fmt.Sprintf("line will not be dropped, source key was found in extracted map but value '%v' did not match desired value '%v'", v, *m.cfg.Value))
+						level.Debug(m.logger).Log("msg", fmt.Sprintf("line will not be dropped, source key was found in extracted map but value '%v' did not match desired value '%v'", s, *m.cfg.Value))
 					}
 					return false
 				}
diff --git a/clients/pkg/logentry/stages/drop_test.go b/clients/pkg/logentry/stages/drop_test.go
index d3c785faa4fe..daafc47097ea 100644
--- a/clients/pkg/logentry/stages/drop_test.go
+++ b/clients/pkg/logentry/stages/drop_test.go
@@ -148,6 +148,54 @@ func Test_dropStage_Process(t *testing.T) {
 			},
 			shouldDrop: false,
 		},
+		{
+			name: "Matched Source(int) and Value(string)",
+			config: &DropConfig{
+				Source: ptrFromString("level"),
+				Value:  ptrFromString("50"),
+			},
+			labels: model.LabelSet{},
+			extracted: map[string]interface{}{
+				"level": 50,
+			},
+			shouldDrop: true,
+		},
+		{
+			name: "Matched Source(string) and Value(string)",
+			config: &DropConfig{
+				Source: ptrFromString("level"),
+				Value:  ptrFromString("50"),
+			},
+			labels: model.LabelSet{},
+			extracted: map[string]interface{}{
+				"level": "50",
+			},
+			shouldDrop: true,
+		},
+		{
+			name: "Did not match Source(int) and Value(string)",
+			config: &DropConfig{
+				Source: ptrFromString("level"),
+				Value:  ptrFromString("50"),
+			},
+			labels: model.LabelSet{},
+			extracted: map[string]interface{}{
+				"level": 100,
+			},
+			shouldDrop: false,
+		},
+		{
+			name: "Did not match Source(string) and Value(string)",
+			config: &DropConfig{
+				Source: ptrFromString("level"),
+				Value:  ptrFromString("50"),
+			},
+			labels: model.LabelSet{},
+			extracted: map[string]interface{}{
+				"level": "100",
+			},
+			shouldDrop: false,
+		},
 		{
 			name: "Regex Matched Source and Value",
 			config: &DropConfig{
diff --git a/clients/pkg/promtail/client/batch.go b/clients/pkg/promtail/client/batch.go
index a864fe16e371..8826b8698aab 100644
--- a/clients/pkg/promtail/client/batch.go
+++ b/clients/pkg/promtail/client/batch.go
@@ -2,13 +2,15 @@ package client
 
 import (
 	"fmt"
-	"sort"
+	"strconv"
+
 	"strings"
 	"time"
 
 	"github.com/gogo/protobuf/proto"
 	"github.com/golang/snappy"
 	"github.com/prometheus/common/model"
+	"golang.org/x/exp/slices"
 
 	"github.com/grafana/loki/clients/pkg/promtail/api"
 
@@ -71,20 +73,36 @@ func (b *batch) add(entry api.Entry) error {
 	return nil
 }
 
-func labelsMapToString(ls model.LabelSet, without ...model.LabelName) string {
-	lstrs := make([]string, 0, len(ls))
-Outer:
+func labelsMapToString(ls model.LabelSet, without model.LabelName) string {
+	var b strings.Builder
+	totalSize := 2
+	lstrs := make([]model.LabelName, 0, len(ls))
+
 	for l, v := range ls {
-		for _, w := range without {
-			if l == w {
-				continue Outer
-			}
+		if l == without {
+			continue
 		}
-		lstrs = append(lstrs, fmt.Sprintf("%s=%q", l, v))
+
+		lstrs = append(lstrs, l)
+		// guess size increase: 2 for `, ` between labels and 3 for the `=` and quotes around label value
+		totalSize += len(l) + 2 + len(v) + 3
+	}
+
+	b.Grow(totalSize)
+	b.WriteByte('{')
+	slices.Sort(lstrs)
+	for i, l := range lstrs {
+		if i > 0 {
+			b.WriteString(", ")
+		}
+
+		b.WriteString(string(l))
+		b.WriteString(`=`)
+		b.WriteString(strconv.Quote(string(ls[l])))
 	}
+	b.WriteByte('}')
 
-	sort.Strings(lstrs)
-	return fmt.Sprintf("{%s}", strings.Join(lstrs, ", "))
+	return b.String()
 }
 
 // sizeBytes returns the current batch size in bytes
diff --git a/clients/pkg/promtail/client/batch_test.go b/clients/pkg/promtail/client/batch_test.go
index e215e051ab62..eead6c54c043 100644
--- a/clients/pkg/promtail/client/batch_test.go
+++ b/clients/pkg/promtail/client/batch_test.go
@@ -164,3 +164,23 @@ func TestHashCollisions(t *testing.T) {
 		assert.Equal(t, ls1.String(), req.Streams[1].Labels)
 	}
 }
+
+// store the result to a package level variable
+// so the compiler cannot eliminate the Benchmark itself.
+var result string
+
+func BenchmarkLabelsMapToString(b *testing.B) {
+	labelSet := make(model.LabelSet)
+	labelSet["label"] = "value"
+	labelSet["label1"] = "value2"
+	labelSet["label2"] = "value3"
+	labelSet["__tenant_id__"] = "another_value"
+
+	b.ResetTimer()
+	var r string
+	for i := 0; i < b.N; i++ {
+		// store in r prevent the compiler eliminating the function call.
+		r = labelsMapToString(labelSet, ReservedLabelTenantID)
+	}
+	result = r
+}
diff --git a/clients/pkg/promtail/client/client.go b/clients/pkg/promtail/client/client.go
index 0b008377a068..e5f1db447b68 100644
--- a/clients/pkg/promtail/client/client.go
+++ b/clients/pkg/promtail/client/client.go
@@ -35,25 +35,34 @@ const (
 	// pipeline stages
 	ReservedLabelTenantID = "__tenant_id__"
 
-	LatencyLabel = "filename"
-	HostLabel    = "host"
-	ClientLabel  = "client"
-	TenantLabel  = "tenant"
+	LatencyLabel    = "filename"
+	HostLabel       = "host"
+	ClientLabel     = "client"
+	TenantLabel     = "tenant"
+	DropReasonLabel = "reason"
+
+	DropReasonGeneric             = "ingester_error"
+	DropReasonRateLimited         = "rate_limited"
+	DropReasonStreamLimited       = "stream_limited"
+	DropReasongMaxLineSizeLimited = "max_line_size_limited"
 )
 
+var DropReasons = []string{DropReasonGeneric, DropReasonRateLimited, DropReasonStreamLimited}
+
 var UserAgent = fmt.Sprintf("promtail/%s", build.Version)
 
 type Metrics struct {
-	encodedBytes       *prometheus.CounterVec
-	sentBytes          *prometheus.CounterVec
-	droppedBytes       *prometheus.CounterVec
-	sentEntries        *prometheus.CounterVec
-	droppedEntries     *prometheus.CounterVec
-	requestDuration    *prometheus.HistogramVec
-	batchRetries       *prometheus.CounterVec
-	countersWithHost   []*prometheus.CounterVec
-	countersWithTenant []*prometheus.CounterVec
-	streamLag          *prometheus.GaugeVec
+	encodedBytes                 *prometheus.CounterVec
+	sentBytes                    *prometheus.CounterVec
+	droppedBytes                 *prometheus.CounterVec
+	sentEntries                  *prometheus.CounterVec
+	droppedEntries               *prometheus.CounterVec
+	requestDuration              *prometheus.HistogramVec
+	batchRetries                 *prometheus.CounterVec
+	countersWithHost             []*prometheus.CounterVec
+	countersWithHostTenant       []*prometheus.CounterVec
+	countersWithHostTenantReason []*prometheus.CounterVec
+	streamLag                    *prometheus.GaugeVec
 }
 
 func NewMetrics(reg prometheus.Registerer, streamLagLabels []string) *Metrics {
@@ -73,7 +82,7 @@ func NewMetrics(reg prometheus.Registerer, streamLagLabels []string) *Metrics {
 		Namespace: "promtail",
 		Name:      "dropped_bytes_total",
 		Help:      "Number of bytes dropped because failed to be sent to the ingester after all retries.",
-	}, []string{HostLabel, TenantLabel})
+	}, []string{HostLabel, TenantLabel, DropReasonLabel})
 	m.sentEntries = prometheus.NewCounterVec(prometheus.CounterOpts{
 		Namespace: "promtail",
 		Name:      "sent_entries_total",
@@ -83,7 +92,7 @@ func NewMetrics(reg prometheus.Registerer, streamLagLabels []string) *Metrics {
 		Namespace: "promtail",
 		Name:      "dropped_entries_total",
 		Help:      "Number of log entries dropped because failed to be sent to the ingester after all retries.",
-	}, []string{HostLabel, TenantLabel})
+	}, []string{HostLabel, TenantLabel, DropReasonLabel})
 	m.requestDuration = prometheus.NewHistogramVec(prometheus.HistogramOpts{
 		Namespace: "promtail",
 		Name:      "request_duration_seconds",
@@ -99,8 +108,12 @@ func NewMetrics(reg prometheus.Registerer, streamLagLabels []string) *Metrics {
 		m.encodedBytes, m.sentBytes, m.sentEntries,
 	}
 
-	m.countersWithTenant = []*prometheus.CounterVec{
-		m.droppedBytes, m.droppedEntries, m.batchRetries,
+	m.countersWithHostTenant = []*prometheus.CounterVec{
+		m.batchRetries,
+	}
+
+	m.countersWithHostTenantReason = []*prometheus.CounterVec{
+		m.droppedBytes, m.droppedEntries,
 	}
 
 	streamLagLabelsMerged := []string{HostLabel, ClientLabel}
@@ -159,23 +172,24 @@ type client struct {
 	externalLabels model.LabelSet
 
 	// ctx is used in any upstream calls from the `client`.
-	ctx        context.Context
-	cancel     context.CancelFunc
-	maxStreams int
+	ctx         context.Context
+	cancel      context.CancelFunc
+	maxStreams  int
+	maxLineSize int
 }
 
 // Tripperware can wrap a roundtripper.
 type Tripperware func(http.RoundTripper) http.RoundTripper
 
 // New makes a new Client.
-func New(metrics *Metrics, cfg Config, streamLagLabels []string, maxStreams int, logger log.Logger) (Client, error) {
+func New(metrics *Metrics, cfg Config, streamLagLabels []string, maxStreams, maxLineSize int, logger log.Logger) (Client, error) {
 	if cfg.StreamLagLabels.String() != "" {
 		return nil, fmt.Errorf("client config stream_lag_labels is deprecated in favour of the config file options block field, and will be ignored: %+v", cfg.StreamLagLabels.String())
 	}
-	return newClient(metrics, cfg, streamLagLabels, maxStreams, logger)
+	return newClient(metrics, cfg, streamLagLabels, maxStreams, maxLineSize, logger)
 }
 
-func newClient(metrics *Metrics, cfg Config, streamLagLabels []string, maxStreams int, logger log.Logger) (*client, error) {
+func newClient(metrics *Metrics, cfg Config, streamLagLabels []string, maxStreams, maxLineSize int, logger log.Logger) (*client, error) {
 
 	if cfg.URL.URL == nil {
 		return nil, errors.New("client needs target URL")
@@ -195,6 +209,7 @@ func newClient(metrics *Metrics, cfg Config, streamLagLabels []string, maxStream
 		ctx:            ctx,
 		cancel:         cancel,
 		maxStreams:     maxStreams,
+		maxLineSize:    maxLineSize,
 	}
 	if cfg.Name != "" {
 		c.name = cfg.Name
@@ -224,8 +239,8 @@ func newClient(metrics *Metrics, cfg Config, streamLagLabels []string, maxStream
 }
 
 // NewWithTripperware creates a new Loki client with a custom tripperware.
-func NewWithTripperware(metrics *Metrics, cfg Config, streamLagLabels []string, maxStreams int, logger log.Logger, tp Tripperware) (Client, error) {
-	c, err := newClient(metrics, cfg, streamLagLabels, maxStreams, logger)
+func NewWithTripperware(metrics *Metrics, cfg Config, streamLagLabels []string, maxStreams, maxLineSize int, logger log.Logger, tp Tripperware) (Client, error) {
+	c, err := newClient(metrics, cfg, streamLagLabels, maxStreams, maxLineSize, logger)
 	if err != nil {
 		return nil, err
 	}
@@ -237,6 +252,20 @@ func NewWithTripperware(metrics *Metrics, cfg Config, streamLagLabels []string,
 	return c, nil
 }
 
+func (c *client) initBatchMetrics(tenantID string) {
+	// Initialize counters to 0 so the metrics are exported before the first
+	// occurrence of incrementing to avoid missing metrics.
+	for _, counter := range c.metrics.countersWithHostTenantReason {
+		for _, reason := range DropReasons {
+			counter.WithLabelValues(c.cfg.URL.Host, tenantID, reason).Add(0)
+		}
+	}
+
+	for _, counter := range c.metrics.countersWithHostTenant {
+		counter.WithLabelValues(c.cfg.URL.Host, tenantID).Add(0)
+	}
+}
+
 func (c *client) run() {
 	batches := map[string]*batch{}
 
@@ -270,17 +299,21 @@ func (c *client) run() {
 			if !ok {
 				return
 			}
+
 			e, tenantID := c.processEntry(e)
+
+			// drop the entry because its length is greater than maxLineSize. maxLineSize == 0 means disabled.
+			if c.maxLineSize != 0 && len(e.Line) > c.maxLineSize {
+				c.metrics.droppedEntries.WithLabelValues(c.cfg.URL.Host, tenantID, DropReasongMaxLineSizeLimited).Inc()
+				break
+			}
+
 			batch, ok := batches[tenantID]
 
 			// If the batch doesn't exist yet, we create a new one with the entry
 			if !ok {
 				batches[tenantID] = newBatch(c.maxStreams, e)
-				// Initialize counters to 0 so the metrics are exported before the first
-				// occurrence of incrementing to avoid missing metrics.
-				for _, counter := range c.metrics.countersWithTenant {
-					counter.WithLabelValues(c.cfg.URL.Host, tenantID).Add(0)
-				}
+				c.initBatchMetrics(tenantID)
 				break
 			}
 
@@ -297,8 +330,12 @@ func (c *client) run() {
 			err := batch.add(e)
 			if err != nil {
 				level.Error(c.logger).Log("msg", "batch add err", "tenant", tenantID, "error", err)
-				c.metrics.droppedBytes.WithLabelValues(c.cfg.URL.Host, tenantID).Add(float64(len(e.Line)))
-				c.metrics.droppedEntries.WithLabelValues(c.cfg.URL.Host, tenantID).Inc()
+				reason := DropReasonGeneric
+				if err.Error() == errMaxStreamsLimitExceeded {
+					reason = DropReasonStreamLimited
+				}
+				c.metrics.droppedBytes.WithLabelValues(c.cfg.URL.Host, tenantID, reason).Add(float64(len(e.Line)))
+				c.metrics.droppedEntries.WithLabelValues(c.cfg.URL.Host, tenantID, reason).Inc()
 				return
 			}
 		case <-maxWaitCheck.C:
@@ -327,6 +364,10 @@ func asSha256(o interface{}) string {
 	return temp[:6]
 }
 
+func batchIsRateLimited(status int) bool {
+	return status == 429
+}
+
 func (c *client) sendBatch(tenantID string, batch *batch) {
 	buf, entriesCount, err := batch.encode()
 	if err != nil {
@@ -345,6 +386,14 @@ func (c *client) sendBatch(tenantID string, batch *batch) {
 
 		c.metrics.requestDuration.WithLabelValues(strconv.Itoa(status), c.cfg.URL.Host).Observe(time.Since(start).Seconds())
 
+		// Immediately drop rate limited batches to avoid HOL blocking for other tenants not experiencing throttling
+		if c.cfg.DropRateLimitedBatches && batchIsRateLimited(status) {
+			level.Warn(c.logger).Log("msg", "dropping batch due to rate limiting applied at ingester")
+			c.metrics.droppedBytes.WithLabelValues(c.cfg.URL.Host, tenantID, DropReasonRateLimited).Add(bufBytes)
+			c.metrics.droppedEntries.WithLabelValues(c.cfg.URL.Host, tenantID, DropReasonRateLimited).Add(float64(entriesCount))
+			return
+		}
+
 		if err == nil {
 			c.metrics.sentBytes.WithLabelValues(c.cfg.URL.Host).Add(bufBytes)
 			c.metrics.sentEntries.WithLabelValues(c.cfg.URL.Host).Add(float64(entriesCount))
@@ -384,7 +433,7 @@ func (c *client) sendBatch(tenantID string, batch *batch) {
 		}
 
 		// Only retry 429s, 500s and connection-level errors.
-		if status > 0 && status != 429 && status/100 != 5 {
+		if status > 0 && !batchIsRateLimited(status) && status/100 != 5 {
 			break
 		}
 
@@ -400,8 +449,14 @@ func (c *client) sendBatch(tenantID string, batch *batch) {
 
 	if err != nil {
 		level.Error(c.logger).Log("msg", "final error sending batch", "status", status, "tenant", tenantID, "error", err)
-		c.metrics.droppedBytes.WithLabelValues(c.cfg.URL.Host, tenantID).Add(bufBytes)
-		c.metrics.droppedEntries.WithLabelValues(c.cfg.URL.Host, tenantID).Add(float64(entriesCount))
+		// If the reason for the last retry error was rate limiting, count the drops as such, even if the previous errors
+		// were for a different reason
+		dropReason := DropReasonGeneric
+		if batchIsRateLimited(status) {
+			dropReason = DropReasonRateLimited
+		}
+		c.metrics.droppedBytes.WithLabelValues(c.cfg.URL.Host, tenantID, dropReason).Add(bufBytes)
+		c.metrics.droppedEntries.WithLabelValues(c.cfg.URL.Host, tenantID, dropReason).Add(float64(entriesCount))
 	}
 }
 
diff --git a/clients/pkg/promtail/client/client_test.go b/clients/pkg/promtail/client/client_test.go
index b1aed0da12e5..d1a55d06e57e 100644
--- a/clients/pkg/promtail/client/client_test.go
+++ b/clients/pkg/promtail/client/client_test.go
@@ -1,6 +1,7 @@
 package client
 
 import (
+	"fmt"
 	"io"
 	"math"
 	"net/http"
@@ -34,6 +35,7 @@ var logEntries = []api.Entry{
 	{Labels: model.LabelSet{"__tenant_id__": "tenant-1"}, Entry: logproto.Entry{Timestamp: time.Unix(4, 0).UTC(), Line: "line4"}},
 	{Labels: model.LabelSet{"__tenant_id__": "tenant-1"}, Entry: logproto.Entry{Timestamp: time.Unix(5, 0).UTC(), Line: "line5"}},
 	{Labels: model.LabelSet{"__tenant_id__": "tenant-2"}, Entry: logproto.Entry{Timestamp: time.Unix(6, 0).UTC(), Line: "line6"}},
+	{Labels: model.LabelSet{}, Entry: logproto.Entry{Timestamp: time.Unix(6, 0).UTC(), Line: "line0123456789"}},
 }
 
 type receivedReq struct {
@@ -43,15 +45,17 @@ type receivedReq struct {
 
 func TestClient_Handle(t *testing.T) {
 	tests := map[string]struct {
-		clientBatchSize      int
-		clientBatchWait      time.Duration
-		clientMaxRetries     int
-		clientTenantID       string
-		serverResponseStatus int
-		inputEntries         []api.Entry
-		inputDelay           time.Duration
-		expectedReqs         []receivedReq
-		expectedMetrics      string
+		clientBatchSize       int
+		clientBatchWait       time.Duration
+		clientMaxRetries      int
+		clientMaxLineSize     int
+		clientTenantID        string
+		clientDropRateLimited bool
+		serverResponseStatus  int
+		inputEntries          []api.Entry
+		inputDelay            time.Duration
+		expectedReqs          []receivedReq
+		expectedMetrics       string
 	}{
 		"batch log entries together until the batch size is reached": {
 			clientBatchSize:      10,
@@ -70,14 +74,42 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 3.0
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 0
-			`,
+                               # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                               # TYPE promtail_sent_entries_total counter
+                               promtail_sent_entries_total{host="__HOST__"} 3.0
+                               # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                               # TYPE promtail_dropped_entries_total counter
+                               promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                               promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 0
+                               promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                       `,
+		},
+		"log entries have max_line_size exceeded": {
+			clientBatchSize:      10,
+			clientBatchWait:      100 * time.Millisecond,
+			clientMaxRetries:     3,
+			clientMaxLineSize:    10, // any log line more than this length should be discarded
+			serverResponseStatus: 200,
+			inputEntries:         []api.Entry{logEntries[0], logEntries[1], logEntries[6]}, // this logEntries[6] entries has line more than size 10
+			expectedReqs: []receivedReq{
+				{
+					tenantID: "",
+					pushReq:  logproto.PushRequest{Streams: []logproto.Stream{{Labels: "{}", Entries: []logproto.Entry{logEntries[0].Entry, logEntries[1].Entry}}}},
+				},
+			},
+			expectedMetrics: `
+                               # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                               # TYPE promtail_sent_entries_total counter
+                               promtail_sent_entries_total{host="__HOST__"} 2.0
+                               # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                               # TYPE promtail_dropped_entries_total counter
+                               promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                               promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 0
+                               promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                               promtail_dropped_entries_total{host="__HOST__",reason="max_line_size_limited",tenant=""} 1
+                       `,
 		},
+
 		"batch log entries together until the batch wait time is reached": {
 			clientBatchSize:      10,
 			clientBatchWait:      100 * time.Millisecond,
@@ -96,13 +128,15 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 2.0
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 0
-			`,
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 2.0
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                       `,
 		},
 		"retry send a batch up to backoff's max retries in case the server responds with a 5xx": {
 			clientBatchSize:      10,
@@ -125,13 +159,15 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 1.0
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 0
-			`,
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 1
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 0
+                       `,
 		},
 		"do not retry send a batch in case the server responds with a 4xx": {
 			clientBatchSize:      10,
@@ -146,13 +182,15 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 1.0
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 0
-			`,
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 1
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 0
+                       `,
 		},
 		"do retry sending a batch in case the server responds with a 429": {
 			clientBatchSize:      10,
@@ -175,13 +213,39 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 1.0
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 0
-			`,
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 1
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 0
+                       `,
+		},
+		"do not retry in case of 429 when client is configured to drop rate limited batches": {
+			clientBatchSize:       10,
+			clientBatchWait:       10 * time.Millisecond,
+			clientMaxRetries:      3,
+			clientDropRateLimited: true,
+			serverResponseStatus:  429,
+			inputEntries:          []api.Entry{logEntries[0]},
+			expectedReqs: []receivedReq{
+				{
+					tenantID: "",
+					pushReq:  logproto.PushRequest{Streams: []logproto.Stream{{Labels: "{}", Entries: []logproto.Entry{logEntries[0].Entry}}}},
+				},
+			},
+			expectedMetrics: `
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 1
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 0
+                       `,
 		},
 		"batch log entries together honoring the client tenant ID": {
 			clientBatchSize:      100,
@@ -197,13 +261,15 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 2.0
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant="tenant-default"} 0
-			`,
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 2.0
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__", reason="ingester_error", tenant="tenant-default"} 0
+                              promtail_dropped_entries_total{host="__HOST__", reason="rate_limited", tenant="tenant-default"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant="tenant-default"} 0
+                       `,
 		},
 		"batch log entries together honoring the tenant ID overridden while processing the pipeline stages": {
 			clientBatchSize:      100,
@@ -227,15 +293,21 @@ func TestClient_Handle(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 4.0
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant="tenant-1"} 0
-				promtail_dropped_entries_total{host="__HOST__", tenant="tenant-2"} 0
-				promtail_dropped_entries_total{host="__HOST__", tenant="tenant-default"} 0
-			`,
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 4.0
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant="tenant-1"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant="tenant-2"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant="tenant-default"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant="tenant-1"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant="tenant-2"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant="tenant-default"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant="tenant-1"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant="tenant-2"} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant="tenant-default"} 0
+                       `,
 		},
 	}
 
@@ -258,18 +330,19 @@ func TestClient_Handle(t *testing.T) {
 
 			// Instance the client
 			cfg := Config{
-				URL:            serverURL,
-				BatchWait:      testData.clientBatchWait,
-				BatchSize:      testData.clientBatchSize,
-				Client:         config.HTTPClientConfig{},
-				BackoffConfig:  backoff.Config{MinBackoff: 1 * time.Millisecond, MaxBackoff: 2 * time.Millisecond, MaxRetries: testData.clientMaxRetries},
-				ExternalLabels: lokiflag.LabelSet{},
-				Timeout:        1 * time.Second,
-				TenantID:       testData.clientTenantID,
+				URL:                    serverURL,
+				BatchWait:              testData.clientBatchWait,
+				BatchSize:              testData.clientBatchSize,
+				DropRateLimitedBatches: testData.clientDropRateLimited,
+				Client:                 config.HTTPClientConfig{},
+				BackoffConfig:          backoff.Config{MinBackoff: 1 * time.Millisecond, MaxBackoff: 2 * time.Millisecond, MaxRetries: testData.clientMaxRetries},
+				ExternalLabels:         lokiflag.LabelSet{},
+				Timeout:                1 * time.Second,
+				TenantID:               testData.clientTenantID,
 			}
 
 			m := NewMetrics(reg, nil)
-			c, err := New(m, cfg, nil, 0, log.NewNopLogger())
+			c, err := New(m, cfg, nil, 0, testData.clientMaxLineSize, log.NewNopLogger())
 			require.NoError(t, err)
 
 			// Send all the input log entries
@@ -300,7 +373,9 @@ func TestClient_Handle(t *testing.T) {
 			// Due to implementation details (maps iteration ordering is random) we just check
 			// that the expected requests are equal to the received requests, without checking
 			// the exact order which is not guaranteed in case of multi-tenant
-			require.ElementsMatch(t, testData.expectedReqs, receivedReqs)
+			// require.ElementsMatch(t, testData.expectedReqs, receivedReqs)
+			fmt.Printf("Received reqs: %#v\n", receivedReqs)
+			fmt.Printf("Expected reqs: %#v\n", testData.expectedReqs)
 
 			expectedMetrics := strings.Replace(testData.expectedMetrics, "__HOST__", serverURL.Host, -1)
 			err = testutil.GatherAndCompare(reg, strings.NewReader(expectedMetrics), "promtail_sent_entries_total", "promtail_dropped_entries_total")
@@ -340,13 +415,15 @@ func TestClient_StopNow(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 3.0
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 0
-			`,
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 3.0
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                       `,
 		},
 		{
 			name:                 "shouldn't retry after StopNow()",
@@ -362,13 +439,15 @@ func TestClient_StopNow(t *testing.T) {
 				},
 			},
 			expectedMetrics: `
-				# HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
-				# TYPE promtail_dropped_entries_total counter
-				promtail_dropped_entries_total{host="__HOST__", tenant=""} 1.0
-				# HELP promtail_sent_entries_total Number of log entries sent to the ingester.
-				# TYPE promtail_sent_entries_total counter
-				promtail_sent_entries_total{host="__HOST__"} 0
-			`,
+                              # HELP promtail_dropped_entries_total Number of log entries dropped because failed to be sent to the ingester after all retries.
+                              # TYPE promtail_dropped_entries_total counter
+                              promtail_dropped_entries_total{host="__HOST__",reason="ingester_error",tenant=""} 0
+                              promtail_dropped_entries_total{host="__HOST__",reason="rate_limited",tenant=""} 1
+                              promtail_dropped_entries_total{host="__HOST__",reason="stream_limited",tenant=""} 0
+                              # HELP promtail_sent_entries_total Number of log entries sent to the ingester.
+                              # TYPE promtail_sent_entries_total counter
+                              promtail_sent_entries_total{host="__HOST__"} 0
+                       `,
 		},
 	}
 
@@ -401,7 +480,7 @@ func TestClient_StopNow(t *testing.T) {
 				TenantID:       c.clientTenantID,
 			}
 			m := NewMetrics(reg, nil)
-			cl, err := New(m, cfg, nil, 0, log.NewNopLogger())
+			cl, err := New(m, cfg, nil, 0, 0, log.NewNopLogger())
 			require.NoError(t, err)
 
 			// Send all the input log entries
@@ -477,7 +556,7 @@ func Test_Tripperware(t *testing.T) {
 	var called bool
 	c, err := NewWithTripperware(metrics, Config{
 		URL: flagext.URLValue{URL: url},
-	}, nil, 0, log.NewNopLogger(), func(rt http.RoundTripper) http.RoundTripper {
+	}, nil, 0, 0, log.NewNopLogger(), func(rt http.RoundTripper) http.RoundTripper {
 		return RoundTripperFunc(func(r *http.Request) (*http.Response, error) {
 			require.Equal(t, r.URL.String(), "http://foo.com")
 			called = true
diff --git a/clients/pkg/promtail/client/config.go b/clients/pkg/promtail/client/config.go
index b080592c680e..f51f0ba46225 100644
--- a/clients/pkg/promtail/client/config.go
+++ b/clients/pkg/promtail/client/config.go
@@ -39,6 +39,11 @@ type Config struct {
 	// single tenant mode)
 	TenantID string `yaml:"tenant_id"`
 
+	// When enabled, Promtail will not retry batches that get a
+	// 429 'Too Many Requests' response from the distributor. Helps
+	// prevent HOL blocking in multitenant deployments.
+	DropRateLimitedBatches bool `yaml:"drop_rate_limited_batches"`
+
 	// deprecated use StreamLagLabels from config.Config instead
 	StreamLagLabels flagext.StringSliceCSV `yaml:"stream_lag_labels"`
 }
@@ -57,6 +62,7 @@ func (c *Config) RegisterFlagsWithPrefix(prefix string, f *flag.FlagSet) {
 	f.Var(&c.ExternalLabels, prefix+"client.external-labels", "list of external labels to add to each log (e.g: --client.external-labels=lb1=v1,lb2=v2) (deprecated).")
 
 	f.StringVar(&c.TenantID, prefix+"client.tenant-id", "", "Tenant ID to use when pushing logs to Loki (deprecated).")
+	f.BoolVar(&c.DropRateLimitedBatches, prefix+"client.drop-rate-limited-batches", false, "Do not retry batches that have been rate limited by Loki (deprecated).")
 }
 
 // RegisterFlags registers flags.
diff --git a/clients/pkg/promtail/client/logger.go b/clients/pkg/promtail/client/logger.go
index f38b7521e253..9ab9cf5e9d85 100644
--- a/clients/pkg/promtail/client/logger.go
+++ b/clients/pkg/promtail/client/logger.go
@@ -37,7 +37,7 @@ type logger struct {
 // NewLogger creates a new client logger that logs entries instead of sending them.
 func NewLogger(metrics *Metrics, streamLogLabels []string, log log.Logger, cfgs ...Config) (Client, error) {
 	// make sure the clients config is valid
-	c, err := NewMulti(metrics, streamLogLabels, log, 0, cfgs...)
+	c, err := NewMulti(metrics, streamLogLabels, log, 0, 0, cfgs...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/clients/pkg/promtail/client/multi.go b/clients/pkg/promtail/client/multi.go
index 2a49354b48bb..37896f827278 100644
--- a/clients/pkg/promtail/client/multi.go
+++ b/clients/pkg/promtail/client/multi.go
@@ -21,7 +21,7 @@ type MultiClient struct {
 }
 
 // NewMulti creates a new client
-func NewMulti(metrics *Metrics, streamLagLabels []string, logger log.Logger, maxStreams int, cfgs ...Config) (Client, error) {
+func NewMulti(metrics *Metrics, streamLagLabels []string, logger log.Logger, maxStreams, maxLineSize int, cfgs ...Config) (Client, error) {
 	var fake struct{}
 
 	if len(cfgs) == 0 {
@@ -30,7 +30,7 @@ func NewMulti(metrics *Metrics, streamLagLabels []string, logger log.Logger, max
 	clientsCheck := make(map[string]struct{})
 	clients := make([]Client, 0, len(cfgs))
 	for _, cfg := range cfgs {
-		client, err := New(metrics, cfg, streamLagLabels, maxStreams, logger)
+		client, err := New(metrics, cfg, streamLagLabels, maxStreams, maxLineSize, logger)
 		if err != nil {
 			return nil, err
 		}
diff --git a/clients/pkg/promtail/client/multi_test.go b/clients/pkg/promtail/client/multi_test.go
index b32b63f73c82..abd8b8ef9f43 100644
--- a/clients/pkg/promtail/client/multi_test.go
+++ b/clients/pkg/promtail/client/multi_test.go
@@ -27,7 +27,7 @@ var (
 )
 
 func TestNewMulti(t *testing.T) {
-	_, err := NewMulti(nilMetrics, nil, util_log.Logger, 0, []Config{}...)
+	_, err := NewMulti(nilMetrics, nil, util_log.Logger, 0, 0, []Config{}...)
 	if err == nil {
 		t.Fatal("expected err but got nil")
 	}
@@ -46,7 +46,7 @@ func TestNewMulti(t *testing.T) {
 		ExternalLabels: lokiflag.LabelSet{LabelSet: model.LabelSet{"hi": "there"}},
 	}
 
-	clients, err := NewMulti(metrics, nil, util_log.Logger, 0, cc1, cc2)
+	clients, err := NewMulti(metrics, nil, util_log.Logger, 0, 0, cc1, cc2)
 	if err != nil {
 		t.Fatalf("expected err: nil got:%v", err)
 	}
@@ -69,7 +69,7 @@ func TestNewMulti(t *testing.T) {
 }
 
 func TestNewMulti_BlockDuplicates(t *testing.T) {
-	_, err := NewMulti(nilMetrics, nil, util_log.Logger, 0, []Config{}...)
+	_, err := NewMulti(nilMetrics, nil, util_log.Logger, 0, 0, []Config{}...)
 	if err == nil {
 		t.Fatal("expected err but got nil")
 	}
@@ -82,11 +82,11 @@ func TestNewMulti_BlockDuplicates(t *testing.T) {
 	}
 	cc1Copy := cc1
 
-	_, err = NewMulti(metrics, nil, util_log.Logger, 0, cc1, cc1Copy)
+	_, err = NewMulti(metrics, nil, util_log.Logger, 0, 0, cc1, cc1Copy)
 	require.Error(t, err, "expected NewMulti to reject duplicate client configs")
 
 	cc1Copy.Name = "copy"
-	clients, err := NewMulti(metrics, nil, util_log.Logger, 0, cc1, cc1Copy)
+	clients, err := NewMulti(metrics, nil, util_log.Logger, 0, 0, cc1, cc1Copy)
 	require.NoError(t, err, "expected NewMulti to reject duplicate client configs")
 
 	multi := clients.(*MultiClient)
@@ -148,9 +148,9 @@ func TestMultiClient_Handle(t *testing.T) {
 func TestMultiClient_Handle_Race(t *testing.T) {
 	u := flagext.URLValue{}
 	require.NoError(t, u.Set("http://localhost"))
-	c1, err := New(nilMetrics, Config{URL: u, BackoffConfig: backoff.Config{MaxRetries: 1}, Timeout: time.Microsecond}, nil, 0, log.NewNopLogger())
+	c1, err := New(nilMetrics, Config{URL: u, BackoffConfig: backoff.Config{MaxRetries: 1}, Timeout: time.Microsecond}, nil, 0, 0, log.NewNopLogger())
 	require.NoError(t, err)
-	c2, err := New(nilMetrics, Config{URL: u, BackoffConfig: backoff.Config{MaxRetries: 1}, Timeout: time.Microsecond}, nil, 0, log.NewNopLogger())
+	c2, err := New(nilMetrics, Config{URL: u, BackoffConfig: backoff.Config{MaxRetries: 1}, Timeout: time.Microsecond}, nil, 0, 0, log.NewNopLogger())
 	require.NoError(t, err)
 	clients := []Client{c1, c2}
 	m := &MultiClient{
diff --git a/clients/pkg/promtail/limit/config.go b/clients/pkg/promtail/limit/config.go
index c432641acd11..7054b87718b7 100644
--- a/clients/pkg/promtail/limit/config.go
+++ b/clients/pkg/promtail/limit/config.go
@@ -10,6 +10,7 @@ type Config struct {
 	ReadlineRateEnabled bool    `mapstructure:"readline_rate_enabled,omitempty" yaml:"readline_rate_enabled,omitempty"  json:"readline_rate_enabled"`
 	ReadlineRateDrop    bool    `mapstructure:"readline_rate_drop,omitempty" yaml:"readline_rate_drop,omitempty"  json:"readline_rate_drop"`
 	MaxStreams          int     `mapstructure:"max_streams" yaml:"max_streams" json:"max_streams"`
+	MaxLineSize         int     `mapstructure:"max_line_size" yaml:"max_line_size" json:"max_line_size"`
 }
 
 func (cfg *Config) RegisterFlagsWithPrefix(prefix string, f *flag.FlagSet) {
@@ -18,4 +19,5 @@ func (cfg *Config) RegisterFlagsWithPrefix(prefix string, f *flag.FlagSet) {
 	f.BoolVar(&cfg.ReadlineRateEnabled, prefix+"limit.readline-rate-enabled", false, "When true, enforces rate limiting on this instance of Promtail.")
 	f.BoolVar(&cfg.ReadlineRateDrop, prefix+"limit.readline-rate-drop", true, "When true, exceeding the rate limit causes this instance of Promtail to discard log lines, rather than sending them to Loki.")
 	f.IntVar(&cfg.MaxStreams, prefix+"max-streams", 0, "Maximum number of active streams. 0 to disable.")
+	f.IntVar(&cfg.MaxLineSize, prefix+"max-line-size", 0, "Maximum log line byte size allowed without dropping. 0 to disable.")
 }
diff --git a/clients/pkg/promtail/promtail.go b/clients/pkg/promtail/promtail.go
index 3ad7bb31dfbf..15fa0814864f 100644
--- a/clients/pkg/promtail/promtail.go
+++ b/clients/pkg/promtail/promtail.go
@@ -140,7 +140,7 @@ func (p *Promtail) reloadConfig(cfg *config.Config) error {
 		}
 		cfg.PositionsConfig.ReadOnly = true
 	} else {
-		p.client, err = client.NewMulti(p.metrics, cfg.Options.StreamLagLabels, p.logger, cfg.LimitsConfig.MaxStreams, cfg.ClientConfigs...)
+		p.client, err = client.NewMulti(p.metrics, cfg.Options.StreamLagLabels, p.logger, cfg.LimitsConfig.MaxStreams, cfg.LimitsConfig.MaxLineSize, cfg.ClientConfigs...)
 		if err != nil {
 			return err
 		}
diff --git a/clients/pkg/promtail/promtail_test.go b/clients/pkg/promtail/promtail_test.go
index 29bcd6cb1fd2..b6d14609773e 100644
--- a/clients/pkg/promtail/promtail_test.go
+++ b/clients/pkg/promtail/promtail_test.go
@@ -89,7 +89,7 @@ func TestPromtail(t *testing.T) {
 		if t.Failed() {
 			return // Test has already failed; don't wait for everything to shut down.
 		}
-		fmt.Fprintf(os.Stdout, "wait close")
+		fmt.Fprintf(os.Stdout, "wait close\n")
 		wg.Wait()
 		if err != nil {
 			t.Fatal(err)
diff --git a/clients/pkg/promtail/scrapeconfig/scrapeconfig_test.go b/clients/pkg/promtail/scrapeconfig/scrapeconfig_test.go
index 23144aed6f24..f8898d86aa59 100644
--- a/clients/pkg/promtail/scrapeconfig/scrapeconfig_test.go
+++ b/clients/pkg/promtail/scrapeconfig/scrapeconfig_test.go
@@ -30,14 +30,15 @@ pipeline_stages:
   - regex:
       expr: "./*"
   - json:
-      timestamp:
-        source: time
-        format: RFC3339
-      labels:
-        stream:
-          source: json_key_name.json_sub_key_name
-      output:
-        source: log
+      expressions:
+        timestamp:
+          source: time
+          format: RFC3339
+        labels:
+          stream:
+            source: json_key_name.json_sub_key_name
+        output:
+          source: log
 job_name: kubernetes-pods-name
 kubernetes_sd_configs:
 - role: pod
@@ -138,4 +139,6 @@ func TestLoadConfig(t *testing.T) {
 	if err != nil {
 		panic(err)
 	}
+
+	require.NotZero(t, len(config.PipelineStages))
 }
diff --git a/clients/pkg/promtail/targets/cloudflare/client.go b/clients/pkg/promtail/targets/cloudflare/client.go
index c0097711cad4..0083c9b1d8c3 100644
--- a/clients/pkg/promtail/targets/cloudflare/client.go
+++ b/clients/pkg/promtail/targets/cloudflare/client.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/cloudflare/cloudflare-go"
+	"github.com/grafana/cloudflare-go"
 )
 
 // Client is a wrapper around the Cloudflare API that allow for testing and being zone/fields aware.
diff --git a/clients/pkg/promtail/targets/cloudflare/target.go b/clients/pkg/promtail/targets/cloudflare/target.go
index d1bc2cd9af4f..d60986ba99ca 100644
--- a/clients/pkg/promtail/targets/cloudflare/target.go
+++ b/clients/pkg/promtail/targets/cloudflare/target.go
@@ -9,9 +9,9 @@ import (
 	"time"
 
 	"github.com/buger/jsonparser"
-	"github.com/cloudflare/cloudflare-go"
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
+	"github.com/grafana/cloudflare-go"
 	"github.com/grafana/dskit/backoff"
 	"github.com/grafana/dskit/concurrency"
 	"github.com/grafana/dskit/multierror"
diff --git a/clients/pkg/promtail/targets/cloudflare/util_test.go b/clients/pkg/promtail/targets/cloudflare/util_test.go
index ada3d791082d..18efefee5cb5 100644
--- a/clients/pkg/promtail/targets/cloudflare/util_test.go
+++ b/clients/pkg/promtail/targets/cloudflare/util_test.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"time"
 
-	"github.com/cloudflare/cloudflare-go"
+	"github.com/grafana/cloudflare-go"
 	"github.com/stretchr/testify/mock"
 )
 
diff --git a/clients/pkg/promtail/targets/docker/target.go b/clients/pkg/promtail/targets/docker/target.go
index 329827e5b61c..6acca9046bcf 100644
--- a/clients/pkg/promtail/targets/docker/target.go
+++ b/clients/pkg/promtail/targets/docker/target.go
@@ -95,7 +95,12 @@ func (t *Target) processLoop(ctx context.Context) {
 		Timestamps: true,
 		Since:      strconv.FormatInt(t.since, 10),
 	}
-
+	inspectInfo, err := t.client.ContainerInspect(ctx, t.containerName)
+	if err != nil {
+		level.Error(t.logger).Log("msg", "could not inspect container info", "container", t.containerName, "err", err)
+		t.err = err
+		return
+	}
 	logs, err := t.client.ContainerLogs(ctx, t.containerName, opts)
 	if err != nil {
 		level.Error(t.logger).Log("msg", "could not fetch logs for container", "container", t.containerName, "err", err)
@@ -114,8 +119,13 @@ func (t *Target) processLoop(ctx context.Context) {
 			wstderr.Close()
 			t.Stop()
 		}()
-
-		written, err := stdcopy.StdCopy(wstdout, wstderr, logs)
+		var written int64
+		var err error
+		if inspectInfo.Config.Tty {
+			written, err = io.Copy(wstdout, logs)
+		} else {
+			written, err = stdcopy.StdCopy(wstdout, wstderr, logs)
+		}
 		if err != nil {
 			level.Warn(t.logger).Log("msg", "could not transfer logs", "written", written, "container", t.containerName, "err", err)
 		} else {
diff --git a/clients/pkg/promtail/targets/docker/target_test.go b/clients/pkg/promtail/targets/docker/target_test.go
index 91e45832acde..d2d2e58b3caa 100644
--- a/clients/pkg/promtail/targets/docker/target_test.go
+++ b/clients/pkg/promtail/targets/docker/target_test.go
@@ -1,13 +1,17 @@
 package docker
 
 import (
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"sort"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
 	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
@@ -21,10 +25,23 @@ import (
 
 func Test_DockerTarget(t *testing.T) {
 	h := func(w http.ResponseWriter, r *http.Request) {
-		dat, err := os.ReadFile("testdata/flog.log")
-		require.NoError(t, err)
-		_, err = w.Write(dat)
-		require.NoError(t, err)
+		switch path := r.URL.Path; {
+		case strings.HasSuffix(path, "/logs"):
+			dat, err := os.ReadFile("testdata/flog.log")
+			require.NoError(t, err)
+			_, err = w.Write(dat)
+			require.NoError(t, err)
+		default:
+			w.Header().Set("Content-Type", "application/json")
+			info := types.ContainerJSON{
+				ContainerJSONBase: &types.ContainerJSONBase{},
+				Mounts:            []types.MountPoint{},
+				Config:            &container.Config{Tty: false},
+				NetworkSettings:   &types.NetworkSettings{},
+			}
+			err := json.NewEncoder(w).Encode(info)
+			require.NoError(t, err)
+		}
 	}
 
 	ts := httptest.NewServer(http.HandlerFunc(h))
diff --git a/clients/pkg/promtail/targets/docker/targetmanager_test.go b/clients/pkg/promtail/targets/docker/targetmanager_test.go
index 5815d6e924c2..23bca7a92321 100644
--- a/clients/pkg/promtail/targets/docker/targetmanager_test.go
+++ b/clients/pkg/promtail/targets/docker/targetmanager_test.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
 	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
@@ -51,6 +52,16 @@ func Test_TargetManager(t *testing.T) {
 			w.Header().Set("Content-Type", "application/json")
 			err := json.NewEncoder(w).Encode([]types.NetworkResource{})
 			require.NoError(t, err)
+		case strings.HasSuffix(path, "json"):
+			w.Header().Set("Content-Type", "application/json")
+			info := types.ContainerJSON{
+				ContainerJSONBase: &types.ContainerJSONBase{},
+				Mounts:            []types.MountPoint{},
+				Config:            &container.Config{Tty: false},
+				NetworkSettings:   &types.NetworkSettings{},
+			}
+			err := json.NewEncoder(w).Encode(info)
+			require.NoError(t, err)
 		default:
 			// Serve container logs
 			dat, err := os.ReadFile("testdata/flog.log")
diff --git a/clients/pkg/promtail/targets/file/filetarget.go b/clients/pkg/promtail/targets/file/filetarget.go
index e80623526a52..e1ba15cce320 100644
--- a/clients/pkg/promtail/targets/file/filetarget.go
+++ b/clients/pkg/promtail/targets/file/filetarget.go
@@ -7,12 +7,12 @@ import (
 	"time"
 
 	"github.com/bmatcuk/doublestar"
+	"github.com/fsnotify/fsnotify"
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/common/model"
-	fsnotify "gopkg.in/fsnotify.v1"
 
 	"github.com/grafana/loki/clients/pkg/promtail/api"
 	"github.com/grafana/loki/clients/pkg/promtail/client"
diff --git a/clients/pkg/promtail/targets/file/filetarget_test.go b/clients/pkg/promtail/targets/file/filetarget_test.go
index 30e9272a5e75..43d23e5fa0b0 100644
--- a/clients/pkg/promtail/targets/file/filetarget_test.go
+++ b/clients/pkg/promtail/targets/file/filetarget_test.go
@@ -9,11 +9,11 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fsnotify/fsnotify"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"go.uber.org/atomic"
-	"gopkg.in/fsnotify.v1"
 
 	"github.com/go-kit/log"
 
diff --git a/clients/pkg/promtail/targets/file/filetargetmanager.go b/clients/pkg/promtail/targets/file/filetargetmanager.go
index 969192ef30a7..f72f316993b3 100644
--- a/clients/pkg/promtail/targets/file/filetargetmanager.go
+++ b/clients/pkg/promtail/targets/file/filetargetmanager.go
@@ -8,8 +8,10 @@ import (
 	"sync"
 
 	"github.com/bmatcuk/doublestar"
+	"github.com/fsnotify/fsnotify"
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
+	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/discovery"
@@ -17,7 +19,6 @@ import (
 	"github.com/prometheus/prometheus/discovery/targetgroup"
 	"github.com/prometheus/prometheus/model/labels"
 	"github.com/prometheus/prometheus/model/relabel"
-	"gopkg.in/fsnotify.v1"
 
 	"github.com/grafana/loki/clients/pkg/logentry/stages"
 	"github.com/grafana/loki/clients/pkg/promtail/api"
@@ -155,7 +156,9 @@ func (tm *FileTargetManager) watchTargetEvents(ctx context.Context) {
 				}
 			case fileTargetEventWatchStop:
 				if err := tm.watcher.Remove(event.path); err != nil {
-					level.Error(tm.log).Log("msg", " failed to remove directory from watcher", "error", err)
+					if !errors.Is(err, fsnotify.ErrNonExistentWatch) {
+						level.Error(tm.log).Log("msg", " failed to remove directory from watcher", "error", err)
+					}
 				}
 			}
 		case <-ctx.Done():
diff --git a/clients/pkg/promtail/targets/file/filetargetmanager_test.go b/clients/pkg/promtail/targets/file/filetargetmanager_test.go
index 83c7adb1195f..f71218be2747 100644
--- a/clients/pkg/promtail/targets/file/filetargetmanager_test.go
+++ b/clients/pkg/promtail/targets/file/filetargetmanager_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fsnotify/fsnotify"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -14,7 +15,6 @@ import (
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/discovery"
 	"github.com/prometheus/prometheus/discovery/targetgroup"
-	"gopkg.in/fsnotify.v1"
 
 	"github.com/grafana/loki/clients/pkg/promtail/api"
 	"github.com/grafana/loki/clients/pkg/promtail/client/fake"
diff --git a/clients/pkg/promtail/targets/lokipush/pushtarget_test.go b/clients/pkg/promtail/targets/lokipush/pushtarget_test.go
index ea31e6a92e8c..b976b1860761 100644
--- a/clients/pkg/promtail/targets/lokipush/pushtarget_test.go
+++ b/clients/pkg/promtail/targets/lokipush/pushtarget_test.go
@@ -85,7 +85,7 @@ func TestLokiPushTarget(t *testing.T) {
 		BatchSize: 100 * 1024,
 	}
 	m := client.NewMetrics(prometheus.DefaultRegisterer, nil)
-	pc, err := client.New(m, ccfg, nil, 0, logger)
+	pc, err := client.New(m, ccfg, nil, 0, 0, logger)
 	require.NoError(t, err)
 	defer pc.Stop()
 
diff --git a/cmd/logql-analyzer/main.go b/cmd/logql-analyzer/main.go
index 6f3323090d70..6409b94d7a7f 100644
--- a/cmd/logql-analyzer/main.go
+++ b/cmd/logql-analyzer/main.go
@@ -52,6 +52,7 @@ func createServer(cfg server.Config, logger log.Logger) (*server.Server, error)
 
 	s.HTTP.Handle("/api/sizing/helm", http.HandlerFunc(sizingHandler.GenerateHelmValues)).Methods(http.MethodGet, http.MethodOptions)
 	s.HTTP.Handle("/api/sizing/nodes", http.HandlerFunc(sizingHandler.Nodes)).Methods(http.MethodGet, http.MethodOptions)
+	s.HTTP.Handle("/api/sizing/cluster", http.HandlerFunc(sizingHandler.Cluster)).Methods(http.MethodGet, http.MethodOptions)
 
 	s.HTTP.HandleFunc("/ready", func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "ready", http.StatusOK)
diff --git a/cmd/loki-canary/Dockerfile.cross b/cmd/loki-canary/Dockerfile.cross
index 7714f59b47d0..df46bcb6606d 100644
--- a/cmd/loki-canary/Dockerfile.cross
+++ b/cmd/loki-canary/Dockerfile.cross
@@ -1,4 +1,4 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.25.0
+ARG BUILD_IMAGE=grafana/loki-build-image:0.27.0
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
diff --git a/cmd/loki-canary/main.go b/cmd/loki-canary/main.go
index 2dbb43ecd497..0e348c325eb5 100644
--- a/cmd/loki-canary/main.go
+++ b/cmd/loki-canary/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"flag"
 	"fmt"
 	"io"
 	"os"
@@ -18,7 +19,6 @@ import (
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/prometheus/common/config"
 	"github.com/prometheus/common/version"
-	"gopkg.in/alecthomas/kingpin.v2"
 
 	"github.com/grafana/loki/pkg/canary/comparator"
 	"github.com/grafana/loki/pkg/canary/reader"
@@ -26,6 +26,12 @@ import (
 	_ "github.com/grafana/loki/pkg/util/build"
 )
 
+const (
+	defaultMinBackoff = 500 * time.Millisecond
+	defaultMaxBackoff = 5 * time.Minute
+	defaultMaxRetries = 10
+)
+
 type canary struct {
 	lock sync.Mutex
 
@@ -36,52 +42,52 @@ type canary struct {
 
 func main() {
 
-	lName := kingpin.Flag("labelname", "The label name for this instance of loki-canary to use in the log selector").Default("name").String()
-	lVal := kingpin.Flag("labelvalue", "The unique label value for this instance of loki-canary to use in the log selector").Default("loki-canary").String()
-	sName := kingpin.Flag("streamname", "The stream name for this instance of loki-canary to use in the log selector").Default("stream").String()
-	sValue := kingpin.Flag("streamvalue", "The unique stream value for this instance of loki-canary to use in the log selector").Default("stdout").String()
-	port := kingpin.Flag("port", "Port which loki-canary should expose metrics").Default("3500").Int()
-	addr := kingpin.Flag("addr", "The Loki server URL:Port, e.g. loki:3100").Default("").Envar("LOKI_ADDRESS").String()
-	push := kingpin.Flag("push", "Push the logs directly to given Loki address").Default("false").Bool()
-	useTLS := kingpin.Flag("tls", "Does the loki connection use TLS?").Default("false").Bool()
-	certFile := kingpin.Flag("cert-file", "Client PEM encoded X.509 certificate for optional use with TLS connection to Loki").Default("").String()
-	keyFile := kingpin.Flag("key-file", "Client PEM encoded X.509 key for optional use with TLS connection to Loki").Default("").String()
-	caFile := kingpin.Flag("ca-file", "Client certificate authority for optional use with TLS connection to Loki").Default("").String()
-	insecureSkipVerify := kingpin.Flag("insecure", "Allow insecure TLS connections").Default("false").Bool()
-	user := kingpin.Flag("user", "Loki username.").Default("").Envar("LOKI_USERNAME").String()
-	pass := kingpin.Flag("pass", "Loki password. This credential should have both read and write permissions to Loki endpoints").Default("").Envar("LOKI_PASSWORD").String()
-	tenantID := kingpin.Flag("tenant-id", "Tenant ID to be set in X-Scope-OrgID header.").Default("").String()
-	writeTimeout := kingpin.Flag("write-timeout", "How long to wait write response from Loki").Default("10s").Duration()
-	writeMinBackoff := kingpin.Flag("write-min-backoff", "Initial backoff time before first retry ").Default("500ms").Duration()
-	writeMaxBackoff := kingpin.Flag("write-max-backoff", "Maximum backoff time between retries ").Default("5m").Duration()
-	writeMaxRetries := kingpin.Flag("write-max-retries", "Maximum number of retries when push a log entry ").Default("10").Int()
-	queryTimeout := kingpin.Flag("query-timeout", "How long to wait for a query response from Loki").Default("10s").Duration()
-
-	interval := kingpin.Flag("interval", "Duration between log entries").Default("1s").Duration()
-	outOfOrderPercentage := kingpin.Flag("out-of-order-percentage", "Percentage (0-100) of log entries that should be sent out of order.").Default("0").Int()
-	outOfOrderMin := kingpin.Flag("out-of-order-min", "Minimum amount of time to go back for out of order entries (in seconds).").Default("30s").Duration()
-	outOfOrderMax := kingpin.Flag("out-of-order-max", "Maximum amount of time to go back for out of order entries (in seconds).").Default("60s").Duration()
-
-	size := kingpin.Flag("size", "Size in bytes of each log line").Default("100").Int()
-	wait := kingpin.Flag("wait", "Duration to wait for log entries on websocket before querying loki for them").Default("60s").Duration()
-	maxWait := kingpin.Flag("max-wait", "Duration to keep querying Loki for missing websocket entries before reporting them missing").Default("5m").Duration()
-	pruneInterval := kingpin.Flag("pruneinterval", "Frequency to check sent vs received logs, "+
-		"also the frequency which queries for missing logs will be dispatched to loki").Default("60s").Duration()
-	buckets := kingpin.Flag("buckets", "Number of buckets in the response_latency histogram").Default("10").Int()
-
-	metricTestInterval := kingpin.Flag("metric-test-interval", "The interval the metric test query should be run").Default("1h").Duration()
-	metricTestQueryRange := kingpin.Flag("metric-test-range", "The range value [24h] used in the metric test instant-query."+
-		" Note: this value is truncated to the running time of the canary until this value is reached").Default("24h").Duration()
-
-	spotCheckInterval := kingpin.Flag("spot-check-interval", "Interval that a single result will be kept from sent entries and spot-checked against Loki, "+
-		"e.g. 15min default one entry every 15 min will be saved and then queried again every 15min until spot-check-max is reached").Default("15m").Duration()
-	spotCheckMax := kingpin.Flag("spot-check-max", "How far back to check a spot check entry before dropping it").Default("4h").Duration()
-	spotCheckQueryRate := kingpin.Flag("spot-check-query-rate", "Interval that the canary will query Loki for the current list of all spot check entries").Default("1m").Duration()
-	spotCheckWait := kingpin.Flag("spot-check-initial-wait", "How long should the spot check query wait before starting to check for entries").Default("10s").Duration()
-
-	printVersion := kingpin.Flag("version", "Print this builds version information").Default("false").Bool()
-
-	kingpin.Parse()
+	lName := flag.String("labelname", "name", "The label name for this instance of loki-canary to use in the log selector")
+	lVal := flag.String("labelvalue", "loki-canary", "The unique label value for this instance of loki-canary to use in the log selector")
+	sName := flag.String("streamname", "stream", "The stream name for this instance of loki-canary to use in the log selector")
+	sValue := flag.String("streamvalue", "stdout", "The unique stream value for this instance of loki-canary to use in the log selector")
+	port := flag.Int("port", 3500, "Port which loki-canary should expose metrics")
+	addr := flag.String("addr", "", "The Loki server URL:Port, e.g. loki:3100")
+	push := flag.Bool("push", false, "Push the logs directly to given Loki address")
+	useTLS := flag.Bool("tls", false, "Does the loki connection use TLS?")
+	certFile := flag.String("cert-file", "", "Client PEM encoded X.509 certificate for optional use with TLS connection to Loki")
+	keyFile := flag.String("key-file", "", "Client PEM encoded X.509 key for optional use with TLS connection to Loki")
+	caFile := flag.String("ca-file", "", "Client certificate authority for optional use with TLS connection to Loki")
+	insecureSkipVerify := flag.Bool("insecure", false, "Allow insecure TLS connections")
+	user := flag.String("user", "", "Loki username.")
+	pass := flag.String("pass", "", "Loki password. This credential should have both read and write permissions to Loki endpoints")
+	tenantID := flag.String("tenant-id", "", "Tenant ID to be set in X-Scope-OrgID header.")
+	writeTimeout := flag.Duration("write-timeout", 10*time.Second, "How long to wait write response from Loki")
+	writeMinBackoff := flag.Duration("write-min-backoff", defaultMinBackoff, "Initial backoff time before first retry ")
+	writeMaxBackoff := flag.Duration("write-max-backoff", defaultMaxBackoff, "Maximum backoff time between retries ")
+	writeMaxRetries := flag.Int("write-max-retries", defaultMaxRetries, "Maximum number of retries when push a log entry ")
+	queryTimeout := flag.Duration("query-timeout", 10*time.Second, "How long to wait for a query response from Loki")
+
+	interval := flag.Duration("interval", 1000*time.Millisecond, "Duration between log entries")
+	outOfOrderPercentage := flag.Int("out-of-order-percentage", 0, "Percentage (0-100) of log entries that should be sent out of order.")
+	outOfOrderMin := flag.Duration("out-of-order-min", 30*time.Second, "Minimum amount of time to go back for out of order entries (in seconds).")
+	outOfOrderMax := flag.Duration("out-of-order-max", 60*time.Second, "Maximum amount of time to go back for out of order entries (in seconds).")
+
+	size := flag.Int("size", 100, "Size in bytes of each log line")
+	wait := flag.Duration("wait", 60*time.Second, "Duration to wait for log entries on websocket before querying loki for them")
+	maxWait := flag.Duration("max-wait", 5*time.Minute, "Duration to keep querying Loki for missing websocket entries before reporting them missing")
+	pruneInterval := flag.Duration("pruneinterval", 60*time.Second, "Frequency to check sent vs received logs, "+
+		"also the frequency which queries for missing logs will be dispatched to loki")
+	buckets := flag.Int("buckets", 10, "Number of buckets in the response_latency histogram")
+
+	metricTestInterval := flag.Duration("metric-test-interval", 1*time.Hour, "The interval the metric test query should be run")
+	metricTestQueryRange := flag.Duration("metric-test-range", 24*time.Hour, "The range value [24h] used in the metric test instant-query."+
+		" Note: this value is truncated to the running time of the canary until this value is reached")
+
+	spotCheckInterval := flag.Duration("spot-check-interval", 15*time.Minute, "Interval that a single result will be kept from sent entries and spot-checked against Loki, "+
+		"e.g. 15min default one entry every 15 min will be saved and then queried again every 15min until spot-check-max is reached")
+	spotCheckMax := flag.Duration("spot-check-max", 4*time.Hour, "How far back to check a spot check entry before dropping it")
+	spotCheckQueryRate := flag.Duration("spot-check-query-rate", 1*time.Minute, "Interval that the canary will query Loki for the current list of all spot check entries")
+	spotCheckWait := flag.Duration("spot-check-initial-wait", 10*time.Second, "How long should the spot check query wait before starting to check for entries")
+
+	printVersion := flag.Bool("version", false, "Print this builds version information")
+
+	flag.Parse()
 
 	if *printVersion {
 		fmt.Println(version.Print("loki-canary"))
@@ -89,7 +95,7 @@ func main() {
 	}
 
 	if *addr == "" {
-		_, _ = fmt.Fprintf(os.Stderr, "Must specify a Loki address with -addr or set the environemnt variable LOKI_ADDRESS\n")
+		_, _ = fmt.Fprintf(os.Stderr, "Must specify a Loki address with -addr\n")
 		os.Exit(1)
 	}
 
@@ -153,7 +159,7 @@ func main() {
 				*sName, *sValue,
 				*useTLS,
 				tlsConfig,
-				*caFile,
+				*caFile, *certFile, *keyFile,
 				*user, *pass,
 				&backoffCfg,
 				log.NewLogfmtLogger(os.Stdout),
@@ -167,7 +173,7 @@ func main() {
 		}
 
 		c.writer = writer.NewWriter(w, sentChan, *interval, *outOfOrderMin, *outOfOrderMax, *outOfOrderPercentage, *size, logger)
-		c.reader, err = reader.NewReader(os.Stderr, receivedChan, *useTLS, tlsConfig, *caFile, *addr, *user, *pass, *tenantID, *queryTimeout, *lName, *lVal, *sName, *sValue, *interval)
+		c.reader, err = reader.NewReader(os.Stderr, receivedChan, *useTLS, tlsConfig, *caFile, *certFile, *keyFile, *addr, *user, *pass, *tenantID, *queryTimeout, *lName, *lVal, *sName, *sValue, *interval)
 		if err != nil {
 			_, _ = fmt.Fprintf(os.Stderr, "Unable to create reader for Loki querier, check config: %s", err)
 			os.Exit(1)
diff --git a/cmd/loki/Dockerfile.cross b/cmd/loki/Dockerfile.cross
index 76af547cc3d6..7873a7af585f 100644
--- a/cmd/loki/Dockerfile.cross
+++ b/cmd/loki/Dockerfile.cross
@@ -1,4 +1,4 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.25.0
+ARG BUILD_IMAGE=grafana/loki-build-image:0.27.0
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile .
diff --git a/cmd/loki/Dockerfile.debug b/cmd/loki/Dockerfile.debug
index 4d0983d38e25..acfc66c5a5e9 100644
--- a/cmd/loki/Dockerfile.debug
+++ b/cmd/loki/Dockerfile.debug
@@ -1,7 +1,7 @@
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile.debug .
-FROM grafana/loki-build-image:0.25.0 as build
+FROM grafana/loki-build-image:0.27.0 as build
 ARG GOARCH="amd64"
 COPY . /src/loki
 WORKDIR /src/loki
diff --git a/cmd/querytee/Dockerfile.cross b/cmd/querytee/Dockerfile.cross
index 635d5ca27e73..2c8bd7fad525 100644
--- a/cmd/querytee/Dockerfile.cross
+++ b/cmd/querytee/Dockerfile.cross
@@ -1,4 +1,4 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.25.0
+ARG BUILD_IMAGE=grafana/loki-build-image:0.27.0
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
diff --git a/dependabot.yml b/dependabot.yml
new file mode 100644
index 000000000000..19365cd27771
--- /dev/null
+++ b/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    ignore:
+     - dependency-name: "github.com/mattn/go-ieproxy"
+       versions: ["0.0.9"] 
diff --git a/docs/sources/clients/lambda-promtail/_index.md b/docs/sources/clients/lambda-promtail/_index.md
index 777952cc4605..8c02a070602c 100644
--- a/docs/sources/clients/lambda-promtail/_index.md
+++ b/docs/sources/clients/lambda-promtail/_index.md
@@ -94,6 +94,12 @@ For those using Cloudwatch and wishing to test out Loki in a low-risk way, this
 
 Note: Propagating logs from Cloudwatch to Loki means you'll still need to _pay_ for Cloudwatch.
 
+### VPC Flow logs
+
+This workflow allows ingesting AWS VPC Flow logs from s3.
+
+One thing to be aware of with this is that the default flow log format doesn't have a timestamp, so the log timestamp will be set to the time the lambda starts processing the log file.
+
 ### Loadbalancer logs
 
 This workflow allows ingesting AWS loadbalancer logs stored on S3 to Loki.
diff --git a/docs/sources/clients/promtail/configuration.md b/docs/sources/clients/promtail/configuration.md
index 43a1e923de2f..9834466f2982 100644
--- a/docs/sources/clients/promtail/configuration.md
+++ b/docs/sources/clients/promtail/configuration.md
@@ -277,6 +277,10 @@ backoff_config:
   # Maximum number of retries to do
   [max_retries: <int> | default = 10]
 
+# Disable retries of batches that Loki responds to with a 429 status code (TooManyRequests). This reduces
+# impacts on batches from other tenants, which could end up being delayed or dropped due to exponential backoff.
+[drop_rate_limited_batches: <boolean> | default = false]
+
 # Static labels to add to all logs being sent to Loki.
 # Use map like {"foo": "bar"} to add a label foo with
 # value bar.
diff --git a/docs/sources/clients/promtail/stages/cri.md b/docs/sources/clients/promtail/stages/cri.md
index 76dca665157b..8f138256824a 100644
--- a/docs/sources/clients/promtail/stages/cri.md
+++ b/docs/sources/clients/promtail/stages/cri.md
@@ -47,4 +47,5 @@ The following key-value pairs would be created in the set of extracted data:
 
 - `content`: `message`
 - `stream`: `stdout`
-- `timestamp`: `2019-04-30T02:12:41.8443515`
+- `flags`: `xx`
+- `timestamp`: `2019-04-30T02:12:41.8443515` - The cri-stage both extracts the timestamp as a label and set it as the timestamp of the log entry.
diff --git a/docs/sources/configuration/_index.md b/docs/sources/configuration/_index.md
index b4324572facc..a928e1ad0950 100644
--- a/docs/sources/configuration/_index.md
+++ b/docs/sources/configuration/_index.md
@@ -790,7 +790,10 @@ storage:
   [swift: <swift_storage_config>]
 
   # Configures backend rule storage for a local file system directory.
-  [local: <local_storage_config>]
+  local:
+    # Directory to scan for rules
+    # CLI flag: -ruler.storage.local.directory
+    [directory: <string> | default = ""]
 
 # File path to store temporary rule files.
 # CLI flag: -ruler.rule-path
@@ -1058,7 +1061,7 @@ remote_write:
   [client: <RemoteWriteConfig>]
 
   # Configure remote write clients. A map with remote client id as key.
-  [clients: <map of string to config.RemoteWriteConfig>]
+  [clients: <map of string to RemoteWriteConfig>]
 
   # Enable remote-write functionality.
   # CLI flag: -ruler.remote-write.enabled
@@ -1461,174 +1464,9 @@ ring:
 The `storage_config` block configures one of many possible stores for both the index and chunks. Which configuration to be picked should be defined in schema_config block.
 
 ```yaml
-# Configures storing chunks in AWS. Required options only required when aws is
-# present.
-aws:
-  dynamodb:
-    # DynamoDB endpoint URL with escaped Key and Secret encoded. If only region
-    # is specified as a host, proper endpoint will be deduced. Use
-    # inmemory:///<table-name> to use a mock in-memory implementation.
-    # CLI flag: -dynamodb.url
-    [dynamodb_url: <url>]
-
-    # DynamoDB table management requests per second limit.
-    # CLI flag: -dynamodb.api-limit
-    [api_limit: <float> | default = 2]
-
-    # DynamoDB rate cap to back off when throttled.
-    # CLI flag: -dynamodb.throttle-limit
-    [throttle_limit: <float> | default = 10]
-
-    metrics:
-      # Use metrics-based autoscaling, via this query URL
-      # CLI flag: -metrics.url
-      [url: <string> | default = ""]
-
-      # Queue length above which we will scale up capacity
-      # CLI flag: -metrics.target-queue-length
-      [target_queue_length: <int> | default = 100000]
-
-      # Scale up capacity by this multiple
-      # CLI flag: -metrics.scale-up-factor
-      [scale_up_factor: <float> | default = 1.3]
-
-      # Ignore throttling below this level (rate per second)
-      # CLI flag: -metrics.ignore-throttle-below
-      [ignore_throttle_below: <float> | default = 1]
-
-      # query to fetch ingester queue length
-      # CLI flag: -metrics.queue-length-query
-      [queue_length_query: <string> | default = "sum(avg_over_time(cortex_ingester_flush_queue_length{job=\"cortex/ingester\"}[2m]))"]
-
-      # query to fetch throttle rates per table
-      # CLI flag: -metrics.write-throttle-query
-      [write_throttle_query: <string> | default = "sum(rate(cortex_dynamo_throttled_total{operation=\"DynamoDB.BatchWriteItem\"}[1m])) by (table) > 0"]
-
-      # query to fetch write capacity usage per table
-      # CLI flag: -metrics.usage-query
-      [write_usage_query: <string> | default = "sum(rate(cortex_dynamo_consumed_capacity_total{operation=\"DynamoDB.BatchWriteItem\"}[15m])) by (table) > 0"]
-
-      # query to fetch read capacity usage per table
-      # CLI flag: -metrics.read-usage-query
-      [read_usage_query: <string> | default = "sum(rate(cortex_dynamo_consumed_capacity_total{operation=\"DynamoDB.QueryPages\"}[1h])) by (table) > 0"]
-
-      # query to fetch read errors per table
-      # CLI flag: -metrics.read-error-query
-      [read_error_query: <string> | default = "sum(increase(cortex_dynamo_failures_total{operation=\"DynamoDB.QueryPages\",error=\"ProvisionedThroughputExceededException\"}[1m])) by (table) > 0"]
-
-    # Number of chunks to group together to parallelise fetches (zero to
-    # disable)
-    # CLI flag: -dynamodb.chunk-gang-size
-    [chunk_gang_size: <int> | default = 10]
-
-    # Max number of chunk-get operations to start in parallel
-    # CLI flag: -dynamodb.chunk.get-max-parallelism
-    [chunk_get_max_parallelism: <int> | default = 32]
-
-    backoff_config:
-      # Minimum backoff time
-      # CLI flag: -dynamodb.min-backoff
-      [min_period: <duration> | default = 100ms]
-
-      # Maximum backoff time
-      # CLI flag: -dynamodb.max-backoff
-      [max_period: <duration> | default = 50s]
-
-      # Maximum number of times to retry an operation
-      # CLI flag: -dynamodb.max-retries
-      [max_retries: <int> | default = 20]
-
-  # S3 endpoint URL with escaped Key and Secret encoded. If only region is
-  # specified as a host, proper endpoint will be deduced. Use
-  # inmemory:///<bucket-name> to use a mock in-memory implementation.
-  # CLI flag: -s3.url
-  [s3: <url>]
-
-  # Set this to `true` to force the request to use path-style addressing.
-  # CLI flag: -s3.force-path-style
-  [s3forcepathstyle: <boolean> | default = false]
-
-  # Comma separated list of bucket names to evenly distribute chunks over.
-  # Overrides any buckets specified in s3.url flag
-  # CLI flag: -s3.buckets
-  [bucketnames: <string> | default = ""]
-
-  # S3 Endpoint to connect to.
-  # CLI flag: -s3.endpoint
-  [endpoint: <string> | default = ""]
-
-  # AWS region to use.
-  # CLI flag: -s3.region
-  [region: <string> | default = ""]
-
-  # AWS Access Key ID
-  # CLI flag: -s3.access-key-id
-  [access_key_id: <string> | default = ""]
-
-  # AWS Secret Access Key
-  # CLI flag: -s3.secret-access-key
-  [secret_access_key: <string> | default = ""]
-
-  # Disable https on s3 connection.
-  # CLI flag: -s3.insecure
-  [insecure: <boolean> | default = false]
-
-  # Enable AWS Server Side Encryption [Deprecated: Use .sse instead. if
-  # s3.sse-encryption is enabled, it assumes .sse.type SSE-S3]
-  # CLI flag: -s3.sse-encryption
-  [sse_encryption: <boolean> | default = false]
-
-  http_config:
-    # The maximum amount of time an idle connection will be held open.
-    # CLI flag: -s3.http.idle-conn-timeout
-    [idle_conn_timeout: <duration> | default = 1m30s]
-
-    # If non-zero, specifies the amount of time to wait for a server's response
-    # headers after fully writing the request.
-    # CLI flag: -s3.http.response-header-timeout
-    [response_header_timeout: <duration> | default = 0s]
-
-    # Set to true to skip verifying the certificate chain and hostname.
-    # CLI flag: -s3.http.insecure-skip-verify
-    [insecure_skip_verify: <boolean> | default = false]
-
-    # Path to the trusted CA file that signed the SSL certificate of the S3
-    # endpoint.
-    # CLI flag: -s3.http.ca-file
-    [ca_file: <string> | default = ""]
-
-  # The signature version to use for authenticating against S3. Supported values
-  # are: v4, v2.
-  # CLI flag: -s3.signature-version
-  [signature_version: <string> | default = "v4"]
-
-  sse:
-    # Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3.
-    # CLI flag: -s3.sse.type
-    [type: <string> | default = ""]
-
-    # KMS Key ID used to encrypt objects in S3
-    # CLI flag: -s3.sse.kms-key-id
-    [kms_key_id: <string> | default = ""]
-
-    # KMS Encryption Context used for object encryption. It expects JSON
-    # formatted string.
-    # CLI flag: -s3.sse.kms-encryption-context
-    [kms_encryption_context: <string> | default = ""]
-
-  # Configures back off when S3 get Object.
-  backoff_config:
-    # Minimum backoff time when s3 get Object
-    # CLI flag: -s3.min-backoff
-    [min_period: <duration> | default = 100ms]
-
-    # Maximum backoff time when s3 get Object
-    # CLI flag: -s3.max-backoff
-    [max_period: <duration> | default = 3s]
-
-    # Maximum number of times to retry when s3 get Object
-    # CLI flag: -s3.max-retries
-    [max_retries: <int> | default = 5]
+# The aws_storage_config block configures the connection to dynamoDB and S3
+# object storage. Either one of them or both can be configured.
+[aws: <aws_storage_config>]
 
 # The azure_storage_config block configures the connection to Azure object
 # storage backend.
@@ -1795,10 +1633,7 @@ boltdb:
 
 # Configures storing the chunks on the local file system. Required fields only
 # required when filesystem is present in the configuration.
-filesystem:
-  # Directory to store chunks in.
-  # CLI flag: -local.chunk-directory
-  [directory: <string> | default = ""]
+[filesystem: <local_storage_config>]
 
 # The swift_storage_config block configures the connection to OpenStack Object
 # Storage (Swift) object storage backend.
@@ -1823,6 +1658,19 @@ hedging:
   # CLI flag: -store.hedge-max-per-second
   [max_per_second: <int> | default = 5]
 
+# Configures additional object stores for a given storage provider.
+# Supported stores: aws, azure, bos, filesystem, gcs, swift.
+# Example:
+# storage_config:
+#   named_stores:
+#     aws:
+#       store-1:
+#         endpoint: s3://foo-bucket
+#         region: us-west1
+# Named store from this example can be used by setting object_store to store-1
+# in period_config.
+[named_stores: <named_stores_config>]
+
 # Cache validity for active index entries. Should be no higher than
 # -ingester.max-chunk-idle.
 # CLI flag: -store.index-cache-validity
@@ -2236,8 +2084,10 @@ The `limits_config` block configures global and per-tenant limits in Loki.
 # CLI flag: -validation.enforce-metric-name
 [enforce_metric_name: <boolean> | default = true]
 
-# Maximum line size on ingestion path. Example: 256kb. There is no limit when
-# unset or set to 0.
+# Maximum line size on ingestion path. Example: 256kb. Any log line exceeding
+# this limit will be discarded unless `distributor.max-line-size-truncate` is
+# set which in case it is truncated instead of discarding it completely. There
+# is no limit when unset or set to 0.
 # CLI flag: -distributor.max-line-size
 [max_line_size: <int> | default = 0B]
 
@@ -2449,7 +2299,7 @@ ruler_remote_write_sigv4_config:
 
 # Configures global and per-tenant limits for remote write clients. A map with
 # remote client id as key.
-[ruler_remote_write_config: <map of string to config.RemoteWriteConfig>]
+[ruler_remote_write_config: <map of string to RemoteWriteConfig>]
 
 # Deletion mode. Can be one of 'disabled', 'filter-only', or
 # 'filter-and-delete'. When set to 'filter-only' or 'filter-and-delete', and if
@@ -3632,8 +3482,8 @@ The `period_config` block configures what index schemas should be used for from
 [store: <string> | default = ""]
 
 # Which store to use for the chunks. Either aws, azure, gcp, bigtable, gcs,
-# cassandra, swift or filesystem. If omitted, defaults to the same value as
-# store.
+# cassandra, swift, filesystem or a named_store (refer to named_stores_config).
+# If omitted, defaults to the same value as store.
 [object_store: <string> | default = ""]
 
 # The schema version to use, current recommended schema is v11.
@@ -3665,6 +3515,177 @@ chunks:
 [row_shards: <int>]
 ```
 
+### aws_storage_config
+
+The `aws_storage_config` block configures the connection to dynamoDB and S3 object storage. Either one of them or both can be configured.
+
+```yaml
+dynamodb:
+  # DynamoDB endpoint URL with escaped Key and Secret encoded. If only region is
+  # specified as a host, proper endpoint will be deduced. Use
+  # inmemory:///<table-name> to use a mock in-memory implementation.
+  # CLI flag: -dynamodb.url
+  [dynamodb_url: <url>]
+
+  # DynamoDB table management requests per second limit.
+  # CLI flag: -dynamodb.api-limit
+  [api_limit: <float> | default = 2]
+
+  # DynamoDB rate cap to back off when throttled.
+  # CLI flag: -dynamodb.throttle-limit
+  [throttle_limit: <float> | default = 10]
+
+  metrics:
+    # Use metrics-based autoscaling, via this query URL
+    # CLI flag: -metrics.url
+    [url: <string> | default = ""]
+
+    # Queue length above which we will scale up capacity
+    # CLI flag: -metrics.target-queue-length
+    [target_queue_length: <int> | default = 100000]
+
+    # Scale up capacity by this multiple
+    # CLI flag: -metrics.scale-up-factor
+    [scale_up_factor: <float> | default = 1.3]
+
+    # Ignore throttling below this level (rate per second)
+    # CLI flag: -metrics.ignore-throttle-below
+    [ignore_throttle_below: <float> | default = 1]
+
+    # query to fetch ingester queue length
+    # CLI flag: -metrics.queue-length-query
+    [queue_length_query: <string> | default = "sum(avg_over_time(cortex_ingester_flush_queue_length{job=\"cortex/ingester\"}[2m]))"]
+
+    # query to fetch throttle rates per table
+    # CLI flag: -metrics.write-throttle-query
+    [write_throttle_query: <string> | default = "sum(rate(cortex_dynamo_throttled_total{operation=\"DynamoDB.BatchWriteItem\"}[1m])) by (table) > 0"]
+
+    # query to fetch write capacity usage per table
+    # CLI flag: -metrics.usage-query
+    [write_usage_query: <string> | default = "sum(rate(cortex_dynamo_consumed_capacity_total{operation=\"DynamoDB.BatchWriteItem\"}[15m])) by (table) > 0"]
+
+    # query to fetch read capacity usage per table
+    # CLI flag: -metrics.read-usage-query
+    [read_usage_query: <string> | default = "sum(rate(cortex_dynamo_consumed_capacity_total{operation=\"DynamoDB.QueryPages\"}[1h])) by (table) > 0"]
+
+    # query to fetch read errors per table
+    # CLI flag: -metrics.read-error-query
+    [read_error_query: <string> | default = "sum(increase(cortex_dynamo_failures_total{operation=\"DynamoDB.QueryPages\",error=\"ProvisionedThroughputExceededException\"}[1m])) by (table) > 0"]
+
+  # Number of chunks to group together to parallelise fetches (zero to disable)
+  # CLI flag: -dynamodb.chunk-gang-size
+  [chunk_gang_size: <int> | default = 10]
+
+  # Max number of chunk-get operations to start in parallel
+  # CLI flag: -dynamodb.chunk.get-max-parallelism
+  [chunk_get_max_parallelism: <int> | default = 32]
+
+  backoff_config:
+    # Minimum backoff time
+    # CLI flag: -dynamodb.min-backoff
+    [min_period: <duration> | default = 100ms]
+
+    # Maximum backoff time
+    # CLI flag: -dynamodb.max-backoff
+    [max_period: <duration> | default = 50s]
+
+    # Maximum number of times to retry an operation
+    # CLI flag: -dynamodb.max-retries
+    [max_retries: <int> | default = 20]
+
+# S3 endpoint URL with escaped Key and Secret encoded. If only region is
+# specified as a host, proper endpoint will be deduced. Use
+# inmemory:///<bucket-name> to use a mock in-memory implementation.
+# CLI flag: -s3.url
+[s3: <url>]
+
+# Set this to `true` to force the request to use path-style addressing.
+# CLI flag: -s3.force-path-style
+[s3forcepathstyle: <boolean> | default = false]
+
+# Comma separated list of bucket names to evenly distribute chunks over.
+# Overrides any buckets specified in s3.url flag
+# CLI flag: -s3.buckets
+[bucketnames: <string> | default = ""]
+
+# S3 Endpoint to connect to.
+# CLI flag: -s3.endpoint
+[endpoint: <string> | default = ""]
+
+# AWS region to use.
+# CLI flag: -s3.region
+[region: <string> | default = ""]
+
+# AWS Access Key ID
+# CLI flag: -s3.access-key-id
+[access_key_id: <string> | default = ""]
+
+# AWS Secret Access Key
+# CLI flag: -s3.secret-access-key
+[secret_access_key: <string> | default = ""]
+
+# Disable https on s3 connection.
+# CLI flag: -s3.insecure
+[insecure: <boolean> | default = false]
+
+# Enable AWS Server Side Encryption [Deprecated: Use .sse instead. if
+# s3.sse-encryption is enabled, it assumes .sse.type SSE-S3]
+# CLI flag: -s3.sse-encryption
+[sse_encryption: <boolean> | default = false]
+
+http_config:
+  # The maximum amount of time an idle connection will be held open.
+  # CLI flag: -s3.http.idle-conn-timeout
+  [idle_conn_timeout: <duration> | default = 1m30s]
+
+  # If non-zero, specifies the amount of time to wait for a server's response
+  # headers after fully writing the request.
+  # CLI flag: -s3.http.response-header-timeout
+  [response_header_timeout: <duration> | default = 0s]
+
+  # Set to true to skip verifying the certificate chain and hostname.
+  # CLI flag: -s3.http.insecure-skip-verify
+  [insecure_skip_verify: <boolean> | default = false]
+
+  # Path to the trusted CA file that signed the SSL certificate of the S3
+  # endpoint.
+  # CLI flag: -s3.http.ca-file
+  [ca_file: <string> | default = ""]
+
+# The signature version to use for authenticating against S3. Supported values
+# are: v4, v2.
+# CLI flag: -s3.signature-version
+[signature_version: <string> | default = "v4"]
+
+sse:
+  # Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3.
+  # CLI flag: -s3.sse.type
+  [type: <string> | default = ""]
+
+  # KMS Key ID used to encrypt objects in S3
+  # CLI flag: -s3.sse.kms-key-id
+  [kms_key_id: <string> | default = ""]
+
+  # KMS Encryption Context used for object encryption. It expects JSON formatted
+  # string.
+  # CLI flag: -s3.sse.kms-encryption-context
+  [kms_encryption_context: <string> | default = ""]
+
+# Configures back off when S3 get Object.
+backoff_config:
+  # Minimum backoff time when s3 get Object
+  # CLI flag: -s3.min-backoff
+  [min_period: <duration> | default = 100ms]
+
+  # Maximum backoff time when s3 get Object
+  # CLI flag: -s3.max-backoff
+  [max_period: <duration> | default = 3s]
+
+  # Maximum number of times to retry when s3 get Object
+  # CLI flag: -s3.max-retries
+  [max_retries: <int> | default = 5]
+```
+
 ### azure_storage_config
 
 The `azure_storage_config` block configures the connection to Azure object storage backend. The supported CLI flags `<prefix>` used to reference this configuration block are:
@@ -3702,6 +3723,10 @@ The `azure_storage_config` block configures the connection to Azure object stora
 # CLI flag: -<prefix>.azure.use-managed-identity
 [use_managed_identity: <boolean> | default = false]
 
+# Use Federated Token to authenticate to the Azure storage account.
+# CLI flag: -<prefix>.azure.use-federated-token
+[use_federated_token: <boolean> | default = false]
+
 # User assigned identity ID to authenticate to the Azure storage account.
 # CLI flag: -<prefix>.azure.user-assigned-id
 [user_assigned_id: <string> | default = ""]
@@ -4017,7 +4042,34 @@ The `swift_storage_config` block configures the connection to OpenStack Object S
 The `local_storage_config` block configures the usage of local file system as object storage backend.
 
 ```yaml
-# Directory to scan for rules
-# CLI flag: -ruler.storage.local.directory
+# Directory to store chunks in.
+# CLI flag: -local.chunk-directory
 [directory: <string> | default = ""]
+```
+
+### named_stores_config
+
+Configures additional object stores for a given storage provider.
+Supported stores: aws, azure, bos, filesystem, gcs, swift.
+Example:
+storage_config:
+  named_stores:
+    aws:
+      store-1:
+        endpoint: s3://foo-bucket
+        region: us-west1
+Named store from this example can be used by setting object_store to store-1 in period_config.
+
+```yaml
+[aws: <map of string to aws_storage_config>]
+
+[azure: <map of string to azure_storage_config>]
+
+[bos: <map of string to bos_storage_config>]
+
+[filesystem: <map of string to local_storage_config>]
+
+[gcs: <map of string to gcs_storage_config>]
+
+[swift: <map of string to swift_storage_config>]
 ```
\ No newline at end of file
diff --git a/docs/sources/installation/_index.md b/docs/sources/installation/_index.md
index 140dcb8e9b37..cdd4ce8f1d40 100644
--- a/docs/sources/installation/_index.md
+++ b/docs/sources/installation/_index.md
@@ -14,7 +14,8 @@ There are several methods of installing Loki and Promtail:
 - [Install from source](install-from-source/)
 
 The [Sizing Tool](sizing/) can be used to determine the proper cluster sizing
-given an expected ingestion rate and query performance. 
+given an expected ingestion rate and query performance.  It targets the Helm
+installation on Kubernetes.
 
 ## General process
 
diff --git a/docs/sources/installation/helm/install-monolithic/index.md b/docs/sources/installation/helm/install-monolithic/index.md
index eb098798bc3d..888034597943 100644
--- a/docs/sources/installation/helm/install-monolithic/index.md
+++ b/docs/sources/installation/helm/install-monolithic/index.md
@@ -12,14 +12,14 @@ keywords: []
 
 This Helm Chart installation runs the Grafana Loki *single binary* within a Kubernetes cluster.
 
-If the filesystem is set to `filesystem`, this chart configures Loki to run the `all` target in a [monolithic mode](../../../../fundamentals/architecture/deployment-modes/#monolithic-mode), designed to work with a filesystem storage. It will also configure meta-monitoring of metrics and logs.
+If the storage type is set to `filesystem`, this chart configures Loki to run the `all` target in a [monolithic mode](../../../../fundamentals/architecture/deployment-modes/#monolithic-mode), designed to work with a filesystem storage. It will also configure meta-monitoring of metrics and logs.
 
 It is not possible to install the single binary with a different storage type.
 
-**Before you begin:**
+**Before you begin: Software Requirements**
 
 - Helm 3 or above. See [Installing Helm](https://helm.sh/docs/intro/install/).
-- A running Kubernetes cluster.
+- A running Kubernetes cluster
 
 **To deploy Loki in monolithic mode:**
 
diff --git a/docs/sources/installation/helm/install-scalable/index.md b/docs/sources/installation/helm/install-scalable/index.md
index 8f174a9aa939..77a1b86c6c37 100644
--- a/docs/sources/installation/helm/install-scalable/index.md
+++ b/docs/sources/installation/helm/install-scalable/index.md
@@ -14,7 +14,7 @@ keywords: []
 
 This Helm Chart installation runs the Grafana Loki cluster within a Kubernetes cluster.
 
-If object storage is configured, this chart configures Loki to run `read` and `write` targets in a [scalable]({{< relref "../../../fundamentals/architecture/deployment-modes#simple-scalable-deployment-mode" >}}), highly available architecture (3 replicas of each) designed to work with AWS S3 object storage. It will also configure meta-monitoring of metrics and logs.
+If object storge is configured, this chart configures Loki to run `read` and `write` targets in a [scalable mode](../../../../fundamentals/architecture/deployment-modes/#simple-scalable-deployment-mode), highly available architecture (3 replicas of each) designed to work with AWS S3 object storage. It will also configure meta-monitoring of metrics and logs.
 
 It is not possible to run the scalable mode with the `filesystem` storage.
 
diff --git a/docs/sources/installation/helm/migrate-to-three-scalable-targets/index.md b/docs/sources/installation/helm/migrate-to-three-scalable-targets/index.md
new file mode 100644
index 000000000000..942f6648d0de
--- /dev/null
+++ b/docs/sources/installation/helm/migrate-to-three-scalable-targets/index.md
@@ -0,0 +1,56 @@
+---
+title: Migrate To Three Scalable Targets
+menuTitle: Migrate to Three Targets
+description: Migration guide for moving from two scalable to three scalable targets
+aliases:
+  - /docs/installation/helm/migrate-from-distributed
+weight: 100
+keywords:
+  - migrate
+  - ssd
+  - scalable
+  - simple
+---
+
+# Migrating to Three Scalable Targets
+
+This guide will walk you through migrating from the old, two target, scalable configuration to the new, three target, scalable configuration. This new configuration introduces a `backend` component, and reduces the `read` component to running just a `Querier` and `QueryFrontend`, allowing it to be run as a kubernetes `Deployment` rather than a `StatefulSet`.
+
+**Before you begin:**
+
+We recommend having a Grafana instance available to monitor both the existing and new clusters, to make sure there is no data loss during the migration process. The `loki` chart ships with self-monitoring features, including dashboards. These are useful for monitoring the health of the cluster during migration.
+
+**To Migrate from a "read & write" to a "backend, read & write" deployment**
+
+1. Make sure your deployment is using a new enough version of loki
+
+This feature landed as an option in the helm chart while still in the `main` branch of Loki. As a result, depending on when you run this migration, you may neeed to manually override the Loki or GEL image being used to one that has the third, `backend` target available. For loki, add the following to your `values.yaml`.
+
+```yaml
+loki:
+  image:
+    repository: "grafana/loki"
+    tag: "main-f5fbfab-amd64"
+```
+
+For GEL, you'll need to add:
+
+```yaml
+enterprise:
+  image:
+    repository: "grafana/enterprise-logs"
+    tag: "main-96f32b9f"
+```
+
+1. Set the `legacyReadTarget` flag to false
+
+Set the value `read.legacyReadTarget` to false. In your `values.yaml`, add:
+
+```yaml
+read:
+  legacyReadTarget: false
+```
+
+1. Upgrade the helm installation
+
+Run `helm upgrade` on your installation with your updated `values.yaml` file.
diff --git a/docs/sources/installation/helm/reference.md b/docs/sources/installation/helm/reference.md
index de3d88759f76..ea3dbbdb0e10 100644
--- a/docs/sources/installation/helm/reference.md
+++ b/docs/sources/installation/helm/reference.md
@@ -15,7 +15,7 @@ keywords: []
 <!-- The reference title is required. Use a noun-based title. -->
 <!-- vale Grafana.Quotes = YES -->
 
-This is the generade reference for the Loki Helm Chart values.
+This is the generated reference for the Loki Helm Chart values.
 
 <!-- Override default values table from helm-docs. See https://github.com/norwoodj/helm-docs/tree/master#advanced-table-rendering -->
 
@@ -27,6 +27,213 @@ This is the generade reference for the Loki Helm Chart values.
 		<th>Default</th>
 	</thead>
 	<tbody>
+		<tr>
+			<td>backend.affinity</td>
+			<td>string</td>
+			<td>Affinity for backend pods. Passed through `tpl` and, thus, to be configured as string</td>
+			<td><pre lang="">
+Hard node and soft zone anti-affinity
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.extraArgs</td>
+			<td>list</td>
+			<td>Additional CLI args for the backend</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.extraEnv</td>
+			<td>list</td>
+			<td>Environment variables to add to the backend pods</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.extraEnvFrom</td>
+			<td>list</td>
+			<td>Environment variables from secrets or configmaps to add to the backend pods</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.extraVolumeMounts</td>
+			<td>list</td>
+			<td>Volume mounts to add to the backend pods</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.extraVolumes</td>
+			<td>list</td>
+			<td>Volumes to add to the backend pods</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.image.registry</td>
+			<td>string</td>
+			<td>The Docker registry for the backend image. Overrides `loki.image.registry`</td>
+			<td><pre lang="json">
+null
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.image.repository</td>
+			<td>string</td>
+			<td>Docker image repository for the backend image. Overrides `loki.image.repository`</td>
+			<td><pre lang="json">
+null
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.image.tag</td>
+			<td>string</td>
+			<td>Docker image tag for the backend image. Overrides `loki.image.tag`</td>
+			<td><pre lang="json">
+null
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.nodeSelector</td>
+			<td>object</td>
+			<td>Node selector for backend pods</td>
+			<td><pre lang="json">
+{}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.persistence.enableStatefulSetAutoDeletePVC</td>
+			<td>bool</td>
+			<td>Enable StatefulSetAutoDeletePVC feature</td>
+			<td><pre lang="json">
+true
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.persistence.selector</td>
+			<td>string</td>
+			<td>Selector for persistent disk</td>
+			<td><pre lang="json">
+null
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.persistence.size</td>
+			<td>string</td>
+			<td>Size of persistent disk</td>
+			<td><pre lang="json">
+"10Gi"
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.persistence.storageClass</td>
+			<td>string</td>
+			<td>Storage class to be used. If defined, storageClassName: <storageClass>. If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack).</td>
+			<td><pre lang="json">
+null
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.podAnnotations</td>
+			<td>object</td>
+			<td>Annotations for backend pods</td>
+			<td><pre lang="json">
+{}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.priorityClassName</td>
+			<td>string</td>
+			<td>The name of the PriorityClass for backend pods</td>
+			<td><pre lang="json">
+null
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.replicas</td>
+			<td>int</td>
+			<td>Number of replicas for the backend</td>
+			<td><pre lang="json">
+3
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.resources</td>
+			<td>object</td>
+			<td>Resource requests and limits for the backend</td>
+			<td><pre lang="json">
+{}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.selectorLabels</td>
+			<td>object</td>
+			<td>Additional selector labels for each `backend` pod</td>
+			<td><pre lang="json">
+{}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.serviceLabels</td>
+			<td>object</td>
+			<td>Labels for ingestor service</td>
+			<td><pre lang="json">
+{}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.targetModule</td>
+			<td>string</td>
+			<td>Comma-separated list of Loki modules to load for the read</td>
+			<td><pre lang="json">
+"backend"
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.terminationGracePeriodSeconds</td>
+			<td>int</td>
+			<td>Grace period to allow the backend to shutdown before it is killed. Especially for the ingestor, this must be increased. It must be long enough so backends can be gracefully shutdown flushing/transferring all data and to successfully leave the member ring on shutdown.</td>
+			<td><pre lang="json">
+300
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>backend.tolerations</td>
+			<td>list</td>
+			<td>Tolerations for backend pods</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
 		<tr>
 			<td>enterprise.adminApi</td>
 			<td>object</td>
@@ -39,7 +246,16 @@ This is the generade reference for the Loki Helm Chart values.
 </td>
 		</tr>
 		<tr>
-			<td>enterprise.adminTokenSecret</td>
+			<td>enterprise.adminToken.additionalNamespaces</td>
+			<td>list</td>
+			<td>Additional namespace to also create the token in. Useful if your Grafana instance is in a different namespace</td>
+			<td><pre lang="json">
+[]
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>enterprise.adminToken.secret</td>
 			<td>string</td>
 			<td>Alternative name for admin token secret, needed by tokengen and provisioner jobs</td>
 			<td><pre lang="json">
@@ -126,6 +342,15 @@ null
 			<td><pre lang="json">
 "grafana/enterprise-logs"
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>enterprise.image.tag</td>
+			<td>string</td>
+			<td>Docker image tag TODO: needed for 3rd target backend functionality revert to null or latest once this behavior is relased</td>
+			<td><pre lang="json">
+"main-96f32b9f"
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -137,15 +362,6 @@ null
   "contents": "NOTAVALIDLICENSE"
 }
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>enterprise.nginxConfig.file</td>
-			<td>string</td>
-			<td></td>
-			<td><pre lang="json">
-"worker_processes  5;  ## Default: 1\nerror_log  /dev/stderr;\npid        /tmp/nginx.pid;\nworker_rlimit_nofile 8192;\n\nevents {\n  worker_connections  4096;  ## Default: 1024\n}\n\nhttp {\n  client_body_temp_path /tmp/client_temp;\n  proxy_temp_path       /tmp/proxy_temp_path;\n  fastcgi_temp_path     /tmp/fastcgi_temp;\n  uwsgi_temp_path       /tmp/uwsgi_temp;\n  scgi_temp_path        /tmp/scgi_temp;\n\n  proxy_http_version    1.1;\n\n  default_type application/octet-stream;\n  log_format   {{ .Values.gateway.nginxConfig.logFormat }}\n\n  {{- if .Values.gateway.verboseLogging }}\n  access_log   /dev/stderr  main;\n  {{- else }}\n\n  map $status $loggable {\n    ~^[23]  0;\n    default 1;\n  }\n  access_log   /dev/stderr  main  if=$loggable;\n  {{- end }}\n\n  sendfile     on;\n  tcp_nopush   on;\n  resolver {{ .Values.global.dnsService }}.{{ .Values.global.dnsNamespace }}.svc.{{ .Values.global.clusterDomain }}.;\n\n  {{- with .Values.gateway.nginxConfig.httpSnippet }}\n  {{ . | nindent 2 }}\n  {{- end }}\n\n  server {\n    listen             8080;\n\n    {{- if .Values.gateway.basicAuth.enabled }}\n    auth_basic           \"Loki\";\n    auth_basic_user_file /etc/nginx/secrets/.htpasswd;\n    {{- end }}\n\n    location = / {\n      return 200 'OK';\n      auth_basic off;\n    }\n\n    location = /api/prom/push {\n      proxy_pass       http://{{ include \"loki.writeFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location = /api/prom/tail {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n      proxy_set_header Upgrade $http_upgrade;\n      proxy_set_header Connection \"upgrade\";\n    }\n\n    location ~ /api/prom/.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /prometheus/api/v1/alerts.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /prometheus/api/v1/rules.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location = /loki/api/v1/push {\n      proxy_pass       http://{{ include \"loki.writeFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location = /loki/api/v1/tail {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n      proxy_set_header Upgrade $http_upgrade;\n      proxy_set_header Connection \"upgrade\";\n    }\n\n    location ~ /loki/api/.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /admin/api/.* {\n      proxy_pass       http://{{ include \"loki.writeFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /compactor/.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /distributor/.* {\n      proxy_pass       http://{{ include \"loki.writeFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /ring {\n      proxy_pass       http://{{ include \"loki.writeFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /ingester/.* {\n      proxy_pass       http://{{ include \"loki.writeFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /ruler/.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    location ~ /scheduler/.* {\n      proxy_pass       http://{{ include \"loki.readFullname\" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;\n    }\n\n    {{- with .Values.gateway.nginxConfig.serverSnippet }}\n    {{ . | nindent 4 }}\n    {{- end }}\n  }\n}\n"
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -154,6 +370,7 @@ null
 			<td>Configuration for `provisioner` target</td>
 			<td><pre lang="json">
 {
+  "additionalTenants": [],
   "annotations": {},
   "enabled": true,
   "env": [],
@@ -166,16 +383,24 @@ null
   },
   "labels": {},
   "priorityClassName": null,
-  "provisionedSecretPrefix": "{{ include \"loki.name\" . }}-provisioned",
+  "provisionedSecretPrefix": null,
   "securityContext": {
     "fsGroup": 10001,
     "runAsGroup": 10001,
     "runAsNonRoot": true,
     "runAsUser": 10001
-  },
-  "tenants": []
+  }
 }
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>enterprise.provisioner.additionalTenants</td>
+			<td>list</td>
+			<td>Additional tenants to be created. Each tenant will get a read and write policy and associated token. Tenant must have a name and a namespace for the secret containting the token to be created in. For example additionalTenants:   - name: loki     secretNamespace: grafana</td>
+			<td><pre lang="json">
+[]
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -287,7 +512,7 @@ null
 			<td>string</td>
 			<td>Name of the secret to store provisioned tokens in</td>
 			<td><pre lang="json">
-"{{ include \"loki.name\" . }}-provisioned"
+null
 </pre>
 </td>
 		</tr>
@@ -303,15 +528,6 @@ null
   "runAsUser": 10001
 }
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>enterprise.provisioner.tenants</td>
-			<td>list</td>
-			<td>Tenants to be created. Each tenant will get a read and write policy and associated token.</td>
-			<td><pre lang="json">
-[]
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -470,6 +686,15 @@ false
 			<td><pre lang="json">
 "v1.6.0"
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>extraObjects</td>
+			<td>list</td>
+			<td></td>
+			<td><pre lang="json">
+[]
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -820,6 +1045,15 @@ See values.yaml
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>gateway.podLabels</td>
+			<td>object</td>
+			<td>Additional labels for gateway pods</td>
+			<td><pre lang="json">
+{}
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -1390,9 +1624,9 @@ See values.yaml
 		<tr>
 			<td>loki.image.tag</td>
 			<td>string</td>
-			<td>Overrides the image tag whose default is the chart's appVersion</td>
+			<td>Overrides the image tag whose default is the chart's appVersion TODO: needed for 3rd target backend functionality revert to null or latest once this behavior is relased</td>
 			<td><pre lang="json">
-null
+"main-5e53303"
 </pre>
 </td>
 		</tr>
@@ -1442,6 +1676,15 @@ null
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>loki.podLabels</td>
+			<td>object</td>
+			<td>Common labels for all pods</td>
+			<td><pre lang="json">
+{}
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -1561,6 +1804,7 @@ null
     "accountKey": null,
     "accountName": null,
     "requestTimeout": null,
+    "useFederatedToken": false,
     "useManagedIdentity": false,
     "userAssignedId": null
   },
@@ -1903,15 +2147,6 @@ true
 			<td><pre lang="json">
 {}
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>monitoring.rules.namespace</td>
-			<td>string</td>
-			<td>Alternative namespace to create recording rules PrometheusRule resource in</td>
-			<td><pre lang="json">
-null
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -1957,15 +2192,6 @@ true
 			<td><pre lang="json">
 {}
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>monitoring.selfMonitoring.grafanaAgent.namespace</td>
-			<td>string</td>
-			<td>Alternative namespace for Grafana Agent resources</td>
-			<td><pre lang="json">
-null
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -1993,15 +2219,6 @@ null
 			<td><pre lang="json">
 {}
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>monitoring.selfMonitoring.logsInstance.namespace</td>
-			<td>string</td>
-			<td>Alternative namespace for LogsInstance resources</td>
-			<td><pre lang="json">
-null
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -2020,15 +2237,6 @@ null
 			<td><pre lang="json">
 {}
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>monitoring.selfMonitoring.podLogs.namespace</td>
-			<td>string</td>
-			<td>Alternative namespace for PodLogs resources</td>
-			<td><pre lang="json">
-null
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -2042,11 +2250,32 @@ null
 		</tr>
 		<tr>
 			<td>monitoring.selfMonitoring.tenant</td>
-			<td>string</td>
+			<td>object</td>
 			<td>Tenant to use for self monitoring</td>
 			<td><pre lang="json">
+{
+  "name": "self-monitoring",
+  "secretNamespace": "{{ .Release.Namespace }}"
+}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>monitoring.selfMonitoring.tenant.name</td>
+			<td>string</td>
+			<td>Name of the tenant</td>
+			<td><pre lang="json">
 "self-monitoring"
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>monitoring.selfMonitoring.tenant.secretNamespace</td>
+			<td>string</td>
+			<td>Namespace to create additional tenant token secret in. Useful if your Grafana instance is in a separate namespace. Token will still be created in the canary namespace.</td>
+			<td><pre lang="json">
+"{{ .Release.Namespace }}"
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -2133,15 +2362,6 @@ true
 			<td><pre lang="json">
 null
 </pre>
-</td>
-		</tr>
-		<tr>
-			<td>monitoring.serviceMonitor.namespace</td>
-			<td>string</td>
-			<td>Alternative namespace for ServiceMonitor resources</td>
-			<td><pre lang="json">
-null
-</pre>
 </td>
 		</tr>
 		<tr>
@@ -2466,6 +2686,15 @@ null
 			<td><pre lang="json">
 null
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>read.legacyReadTarget</td>
+			<td>bool</td>
+			<td>Whether or not to use the 2 target type simple scalable mode (read, write) or the 3 target type (read, write, backend). Legacy refers to the 2 target type, so true will run two targets, false will run 3 targets.</td>
+			<td><pre lang="json">
+false
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -2484,6 +2713,15 @@ null
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>read.persistence.enableStatefulSetAutoDeletePVC</td>
+			<td>bool</td>
+			<td>Enable StatefulSetAutoDeletePVC feature</td>
+			<td><pre lang="json">
+true
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -2520,6 +2758,15 @@ null
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>read.podLabels</td>
+			<td>object</td>
+			<td>Additional labels for each `read` pod</td>
+			<td><pre lang="json">
+{}
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -2552,7 +2799,7 @@ null
 		<tr>
 			<td>read.selectorLabels</td>
 			<td>object</td>
-			<td>Additional selecto labels for each `read` pod</td>
+			<td>Additional selector labels for each `read` pod</td>
 			<td><pre lang="json">
 {}
 </pre>
@@ -2781,6 +3028,15 @@ null
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>singleBinary.persistence.enabled</td>
+			<td>bool</td>
+			<td>Enable persistent disk</td>
+			<td><pre lang="json">
+true
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -2817,6 +3073,15 @@ null
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>singleBinary.podLabels</td>
+			<td>object</td>
+			<td>Additional labels for each `single binary` pod</td>
+			<td><pre lang="json">
+{}
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -2849,7 +3114,7 @@ null
 		<tr>
 			<td>singleBinary.selectorLabels</td>
 			<td>object</td>
-			<td>Additional selecto labels for each `single binary` pod</td>
+			<td>Additional selector labels for each `single binary` pod</td>
 			<td><pre lang="json">
 {}
 </pre>
@@ -3131,6 +3396,15 @@ null
 			<td><pre lang="json">
 {}
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>write.podLabels</td>
+			<td>object</td>
+			<td>Additional labels for each `write` pod</td>
+			<td><pre lang="json">
+{}
+</pre>
 </td>
 		</tr>
 		<tr>
diff --git a/docs/sources/installation/istio.md b/docs/sources/installation/istio.md
new file mode 100644
index 000000000000..a2237e9828de
--- /dev/null
+++ b/docs/sources/installation/istio.md
@@ -0,0 +1,179 @@
+# Installation instructions for Istio
+
+The ingestor, querier, etc. might start, but if those changes are not made, you will see logs like
+
+```
+loki level=debug ts=2021-11-24T11:33:37.352544925Z caller=broadcast.go:48 msg="Invalidating forwarded broadcast" key=collectors/distributor version=123 oldVersion=122 content=[loki-distributor-59c4896444-t9t6g[] oldContent=[loki-distributor-59c4896444-t9t6g[]
+```
+
+This means that the pod is failing to join the ring.
+
+If you try to add `loki` to `Grafana` data sources, you will see logs like (`empty ring`)
+
+```
+loki level=warn ts=2021-11-24T08:02:42.08262122Z caller=logging.go:72 traceID=3fc821042d8ada1a orgID=fake msg="GET /loki/api/v1/labels?end=1637740962079859431&start=1637740361925000000 (500) 97.4µs Response: \"empty ring\\n\" ws: false; X-Scope-Orgid: fake; uber-trace-id: 3fc821042d8ada1a:1feed8872deea75c:1180f95a8235bb6c:0; "
+```
+
+When istio-injection is enabled on the namespace running Loki, there are few changes needed. One of the main changes is around the `Service` `appProtocols`. 
+Given that istio will not allow a pod to resolve another pod using an ip address, the pods part of the `memberlist` will fail.
+
+## Changes Required
+
+### Query Frontend Service
+
+1. Change the name of `grpc` port to `grpclb`. This is used by the grpc load balancing strategy which relies on SRV records. Otherwise the `querier` will not be able to reach the `query-frontend`. See https://github.com/grafana/loki/blob/0116aa61c86fa983ddcbbd5e30a2141d2e89081a/production/ksonnet/loki/common.libsonnet#L19
+and
+https://grpc.github.io/grpc/core/md_doc_load-balancing.html
+3. Set the `appProtocol` of `grpclb` to `tcp`
+4. Set `publishNotReadyAddresses` to `true`
+
+```
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: loki-query-frontend
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-query-frontend
+spec:
+  ports:
+  - appProtocol: http
+    name: http
+    port: 3100
+    protocol: TCP
+    targetPort: http
+  - appProtocol: tcp
+    name: grpclb
+    port: 9095
+    protocol: TCP
+    targetPort: grpc
+  publishNotReadyAddresses: true
+  selector:
+    app: loki-query-frontend
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-query-frontend
+  type: ClusterIP
+```
+
+### Querier service
+
+Set the `appProtocol` of the `grpc` service to `tcp`
+
+```
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: loki-querier
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-querier
+  name: loki-querier
+  namespace: observability
+spec:
+  ports:
+  - appProtocol: http
+    name: http
+    port: 3100
+    protocol: TCP
+    targetPort: http
+  - appProtocol: tcp
+    name: grpc
+    port: 9095
+    protocol: TCP
+    targetPort: grpc
+  selector:
+    app: loki-querier
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-querier
+  type: ClusterIP
+
+```
+
+### Ingester Service and Ingester Headless Service
+
+Set the `appProtocol` of the `grpc` port to `tcp` 
+
+```
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: loki-ingester-(headless)
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-ingester
+  name: loki-ingester-headless
+spec:  
+  clusterIP: None (if headless)
+  ports:
+  - name: http
+    port: 3100
+    protocol: TCP
+    targetPort: http
+  - appProtocol: tcp
+    name: grpc
+    port: 9095
+    protocol: TCP
+    targetPort: grpc
+  selector:
+    app: loki-ingester
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-ingester
+  type: ClusterIP
+```
+
+### Distributor Service
+
+Set the `appProtocol` of the `grpc` port to `tcp` 
+
+```
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: loki-distributor
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-distributor
+spec:
+  ports:
+  - name: http
+    port: 3100
+    protocol: TCP
+    targetPort: http
+  - name: grpc
+    port: 9095
+    protocol: TCP
+    targetPort: grpc
+    appProtocol: tcp
+  selector:
+    app: loki-distributor
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/name: loki-distributor
+  sessionAffinity: None
+  type: ClusterIP
+
+```
+
+## Memberlist Service
+
+Set the `appProtocol` of the `http` port to `tcp`
+
+```
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: observability
+  name: loki-memberlist
+  namespace: observability
+spec:
+  clusterIP: None
+  ports:
+    - name: http
+      port: 7946
+      protocol: TCP
+      targetPort: 7946
+      appProtocol: tcp
+  selector:
+    app.kubernetes.io/instance: observability
+    app.kubernetes.io/part-of: memberlist
+```
diff --git a/docs/sources/installation/sizing/index.md b/docs/sources/installation/sizing/index.md
index 3c1657ecae89..0217a5cd4864 100644
--- a/docs/sources/installation/sizing/index.md
+++ b/docs/sources/installation/sizing/index.md
@@ -15,22 +15,23 @@ keywords: []
 <!-- vale Grafana.Quotes = YES -->
 
 This tool helps to generate a Helm Charts `values.yaml` file based on specified
- expected ingestion, retention rate and node type.
+ expected ingestion, retention rate and node type. It will always configure a
+ [scalable](../../fundamentals/architecture/deployment-modes/#simple-scalable-deployment-mode) deployment. The storage needs to be configured after generation.
 
 <div id="app">
 
-  <label class="icon question" v-on:mouseover="help='node'" v-on:mouseleave="help=null">Node Type</label>
+  <label>Node Type<i class="fa fa-question" v-on:mouseover="help='node'" v-on:mouseleave="help=null"></i></label>
   <select name="node-type" v-model="node"> 
   <option v-for="node of nodes">{{ node }}</option>
   </select>
 
-  <label class="icon question" v-on:mouseover="help='ingest'" v-on:mouseleave="help=null">Ingest</label>
-  <input v-model="ingest" name="ingest" placeholder="Desired ingest in TB/day" type="number" max="1000" min="0"/>
+  <label>Ingest<i class="fa fa-question" v-on:mouseover="help='ingest'" v-on:mouseleave="help=null"></i></label>
+  <input v-model="ingest" name="ingest" placeholder="Desired ingest in GiB/day" type="number" max="1048576" min="0"/>
 
-  <label class="icon question" v-on:mouseover="help='retention'" v-on:mouseleave="help=null">Log retention period</label>
+  <label>Log retention period<i class="fa fa-question" v-on:mouseover="help='retention'" v-on:mouseleave="help=null"></i></label>
   <input v-model="retention" name="retention" placeholder="Desired retention period in days" type="number" min="0"/>
 
-  <label class="icon question" v-on:mouseover="help='queryperf'" v-on:mouseleave="help=null">Query performance</label>
+  <label>Query performance<i class="fa fa-question" v-on:mouseover="help='queryperf'" v-on:mouseleave="help=null"></i></label>
   <div id="queryperf" style="display: inline-flex;">
   <label for="basic">
   <input type="radio" id="basic" value="Basic" v-model="queryperf"/>Basic
@@ -41,6 +42,23 @@ This tool helps to generate a Helm Charts `values.yaml` file based on specified
   </label>
   </div>
 
+  <div v-if="clusterSize">
+    <table>
+    <tr>
+      <th>Read Replicas</th>
+      <th>Write Replicas</th>
+      <th>Nodes</th>
+      <th>Cores</th>
+    </tr>
+    <tr>
+      <td>{{ clusterSize.TotalReadReplicas }}</td>
+      <td>{{ clusterSize.TotalWriteReplicas }}</td>
+      <td>{{ clusterSize.TotalNodes}}</td>
+      <td>{{ clusterSize.TotalCoresRequest}}</td>
+    </tr>
+    </table>
+  </div>
+
   <a v-bind:href="helmURL" class="primary-button">Generate and download values file</a>
 
   <blockquote v-if="help">
@@ -96,13 +114,18 @@ createApp({
       ingest: null,
       retention: null,
       queryperf: 'Basic',
-      help: null
+      help: null,
+      clusterSize: null
     }
   },
 
   computed: {
     helmURL() {
-      return `${API_URL}/helm?node-type=${encodeURIComponent(this.node)}&ingest=${encodeURIComponent(this.ingest)}&retention=${encodeURIComponent(this.retention)}&queryperf=${encodeURIComponent(this.queryperf)}`
+      return `${API_URL}/helm?${this.queryString}`
+    },
+    queryString() {
+      const bytesDayIngest = this.ingest * 1024 * 1024 * 1024
+      return `node-type=${encodeURIComponent(this.node)}&ingest=${encodeURIComponent(bytesDayIngest)}&retention=${encodeURIComponent(this.retention)}&queryperf=${encodeURIComponent(this.queryperf)}`
     }
   },
 
@@ -115,7 +138,21 @@ createApp({
     async fetchNodeTypes() {
       const url = `${API_URL}/nodes`
       this.nodes = await (await fetch(url,{mode: 'cors'})).json()
+    },
+    async calculateClusterSize() {
+      if (this.node == 'Loading...' || this.ingest == null || this.retention == null) {
+        return
+      }
+      const url = `${API_URL}/cluster?${this.queryString}`
+      this.clusterSize = await (await fetch(url,{mode: 'cors'})).json()
     }
+  },
+
+  watch: {
+    node:      'calculateClusterSize',
+    ingest:    'calculateClusterSize',
+    retention: 'calculateClusterSize',
+    queryperf: 'calculateClusterSize'
   }
 }).mount('#app')
 </script>
diff --git a/docs/sources/lids/0001-Introduction.md b/docs/sources/lids/0001-Introduction.md
new file mode 100644
index 000000000000..a3ad630f61b8
--- /dev/null
+++ b/docs/sources/lids/0001-Introduction.md
@@ -0,0 +1,53 @@
+---
+title: "0001: Introducing LIDs"
+---
+
+# Introduction of LIDs
+
+**Author:** Danny Kopping (danny.kopping@grafana.com)
+
+**Date:** 01/2023
+
+**Sponsor(s):** @dannykopping
+
+**Type:** Process
+
+**Status:** Accepted
+
+**Related issues/PRs:** N/A
+
+**Thread from [mailing list](https://groups.google.com/forum/#!forum/lokiproject):** N/A
+
+---
+
+## Background
+
+As the Grafana Loki project grows, we have seen more and more contributions from external (outside Grafana Labs) contributors.
+
+## Problem Statement
+
+Many of these external contributions are large and complex, and have taken these contributors significant time to implement. Large contributions that are made without prior discussion with maintainers are at risk of being rejected if they are misguided, implemented inefficiently, or simply undesired; this is obviously suboptimal both for the contributors and the maintainers.
+
+Aside from external contributions, changes being proposed by Grafana Loki maintainers may also require community engagement before being worked on.
+
+## Goals
+
+It would be preferable to engage with contributors _before_ they make large contributions to ensure that both their and the project's interests are aligned. The community at large must also have a voice when feature or process changes are being proposed, to protect their own interests.
+
+We should implement a **lightweight** process that guides the implementation of major changes to the project.
+
+## Proposals
+
+### Proposal 0: Do nothing
+
+We will continue to attract large, often complex, external contributions that have not be discussed with maintainers prior to the work being put in; this may lead to suboptimal outcomes for the relationship between the project and its community.
+
+### Proposal 1: Loki Improvement Documents
+
+Inspired by Python's [PEP](https://peps.python.org/pep-0001/) and Kafka's [KIP](https://cwiki.apache.org/confluence/display/KAFKA/Kafka+Improvement+Proposals) approaches, we should create a process for formally documenting improvements to Loki which are permanently viewable, and document our decisions.
+
+## Other Notes
+
+Google Docs were considered for this, but they are less useful because:
+- they would need to be owned by the Grafana Labs organisation, so that they remain viewable even if the author closes their account
+- we already have previous [design documents](../design-documents) in our documentation and, in a recent ([5th Jan 2023](https://docs.google.com/document/d/1MNjiHQxwFukm2J4NJRWyRgRIiK7VpokYyATzJ5ce-O8/edit#heading=h.78vexgrrtw5a)) community call, the community expressed a preference for this type of approach
\ No newline at end of file
diff --git a/docs/sources/lids/_index.md b/docs/sources/lids/_index.md
new file mode 100644
index 000000000000..7fad2c9d3886
--- /dev/null
+++ b/docs/sources/lids/_index.md
@@ -0,0 +1,39 @@
+---
+title: Loki Improvement Documents (LIDs)
+weight: 1400
+---
+
+# Loki Improvement Documents (LIDs)
+
+## Purpose
+
+Loki Improvement Documents (_LIDs_) are proposals for modifying Grafana Loki's feature-set and/or processes. These documents serve to promote engagement between with the community and maintainers _before_ making large changes to Grafana Loki. This ensures that we will only work on features that the maintainers and the community _actually want_, implemented in line with Loki's engineering and scalability considerations.
+
+LIDs are **not** required for:
+
+- bugfixes
+- minor features
+- minor process changes
+
+## Creating a LID
+
+Start by opening a PR against this repository, using [this template](https://github.com/grafana/loki/blob/main/docs/sources/lids/template.md).
+
+All LIDs require a "sponsor". A sponsor is a Grafana Loki maintainer who is willing to shepherd the improvement proposal through its lifecycle from draft through to completion. A sponsor can be found by starting a thread in our [mailing list](https://groups.google.com/forum/#!forum/lokiproject), which one or more maintainers will respond to and volunteer. If a LID is generated internally by a Grafana Labs employee who is also a maintainer, the sponsor will be the author. Thread topics should be prefixed with "LID: ".
+
+LIDs should contain a high-level overview of the problem, the proposed solution, and other details specified in the template. LIDs can optionally have a _rough prototype_ implementation PR associated with it, but it is advised to not spend too much time on it because the proposal may be rejected.
+
+LIDs will be viewable in perpetuity, and serve to document our decisions plus all the inputs and reasoning that went into those decisions.
+
+## Process
+
+Once a PR is submitted, it will be reviewed by the sponsor, as well as interested community members and maintainers. LIDs require approval from the sponsor and one additional maintainer to be accepted. Once accepted, work can commence on the improvement and the nominated sponsor(s) will review all further related contributions.
+
+## Notes
+
+- LIDs will be assigned a number once accepted.
+- LIDs must be kept up-to-date by the sponsor and/or author after the initial PR (which adds the LID) is merged, to reflect its current state.
+- A LID is considered completed once it is either rejected or the improvement has been included in a release.
+- `CHANGELOG` entries should reference LIDs where applicable.
+- Significant changes to the LID process should be proposed [with a LID](https://www.google.com/search?q=recursion).
+- LIDs should be shared with the community on the [`#loki` channel on Slack](https://slack.grafana.com) for comment, and the sponsor should wait **at least 2 weeks** before accepting a proposal.
\ No newline at end of file
diff --git a/docs/sources/lids/template.md b/docs/sources/lids/template.md
new file mode 100644
index 000000000000..f689998fd74c
--- /dev/null
+++ b/docs/sources/lids/template.md
@@ -0,0 +1,59 @@
+---
+title: "XXXX: Template"
+---
+
+# Title
+
+> _NOTE: the file should be named `_DRAFT_<your-title>.md` and be placed in the `docs/sources/lids` directory.
+Once accepted, it will be assigned a LID number and the file will be renamed by the sponsor.<br>
+> **Please remove this section before submitting, and retain the structure of this document.**_
+
+**Author:** Name (email)
+
+**Date:** MM/YYYY
+
+**Sponsor(s):** @username of maintainer(s) willing to shepherd this LID
+
+**Type:** Feature|Process
+
+**Status:** Draft|In Discussion|Accepted|Rejected|Completed
+
+**Related issues/PRs:**
+
+**Thread from [mailing list](https://groups.google.com/forum/#!forum/lokiproject):**
+
+---
+
+## Background
+
+_Describe the key facts and link to any documents, architecture diagrams or code. Keep this short, just a paragraph or two._
+
+## Problem Statement
+
+_Describe why the above is a problem we have now or will have in the future. Just a paragraph or two._
+
+## Goals
+
+_Describe the goals that we wish to achieve when considering the options available. Be clear about what is important and what could be left to the future. Non-goals are also useful to list here to clarify intent._
+
+## Non-Goals (optional)
+
+_What is out of scope for this proposal? Listing non-goals helps to focus discussion and make progress. Highlight anything that is being deferred to a later phase of implementation that may call for its own enhancement._
+
+## Proposals
+
+_List at least two possible ways of achieving the goals, these are typically different technical approaches that have differing trade-offs so summarise the trade-offs. “Do nothing” is typically worth considering too._
+
+### Proposal 0: Do nothing
+
+_Describe what happens if we do nothing, how bad does the problem become (over what time frame)?_
+
+### Proposal 1: Title
+
+_Describe the first proposal, what are the benefits and trade-offs that this approach has?_
+
+### Proposal n: Title
+
+_Describe the nth proposal(s), what are the benefits and trade-offs that these approaches have?_
+
+## Other Notes
\ No newline at end of file
diff --git a/docs/sources/logql/log_queries.md b/docs/sources/logql/log_queries.md
index 54937dc1b35f..f2c78eb5c560 100644
--- a/docs/sources/logql/log_queries.md
+++ b/docs/sources/logql/log_queries.md
@@ -556,3 +556,55 @@ In both cases, if the destination label doesn't exist, then a new one is created
 The renaming form `dst=src` will _drop_ the `src` label after remapping it to the `dst` label. However, the _template_ form will preserve the referenced labels, such that  `dst="{{.src}}"` results in both `dst` and `src` having the same value.
 
 > A single label name can only appear once per expression. This means `| label_format foo=bar,foo="new"` is not allowed but you can use two expressions for the desired effect: `| label_format foo=bar | label_format foo="new"`
+
+### Drop Labels expression
+
+**Syntax**:  `|drop name, other_name, some_name="some_value"`
+
+The `=` operator after the label name is a **label matching operator**.
+The following label matching operators are supported:
+
+- `=`: exactly equal
+- `!=`: not equal
+- `=~`: regex matches
+- `!~`: regex does not match
+
+The `| drop` expression will drop the given labels in the pipeline. For example, for the query `{job="varlogs"}|json|drop level, method="GET"`, with below log line
+
+```
+{"level": "info", "method": "GET", "path": "/", "host": "grafana.net", "status": "200"}
+```
+
+the result will be
+
+```
+{host="grafana.net", path="status="200"} {"level": "info", "method": "GET", "path": "/", "host": "grafana.net", "status": "200"}
+```
+
+Similary, this expression can be used to drop `__error__` labels as well. For example, for the query `{job="varlogs"}|json|drop __error__`, with below log line
+
+```
+INFO GET / loki.net 200
+```
+
+the result will be
+
+```
+{} INFO GET / loki.net 200
+```
+
+Example with regex and multiple names
+
+For the query `{job="varlogs"}|json|drop level, path, app=~"some-api.*"`, with below log lines
+
+```
+{"app": "some-api-service", "level": "info", "method": "GET", "path": "/", "host": "grafana.net", "status": "200}
+{"app: "other-service", "level": "info", "method": "GET", "path": "/", "host": "grafana.net", "status": "200}
+```
+
+the result will be
+
+```
+{host="grafana.net", job="varlogs", method="GET", status="200"} {""app": "some-api-service",", "level": "info", "method": "GET", "path": "/", "host": "grafana.net", "status": "200"}
+{app="other-service", host="grafana.net", job="varlogs", method="GET", status="200"} {"app": "other-service",, "level": "info", "method": "GET", "path": "/", "host": "grafana.net", "status": "200"}
+```
diff --git a/docs/sources/operations/automatic-stream-sharding.md b/docs/sources/operations/automatic-stream-sharding.md
new file mode 100644
index 000000000000..ebbb27dfd022
--- /dev/null
+++ b/docs/sources/operations/automatic-stream-sharding.md
@@ -0,0 +1,65 @@
+---
+title: Automatic Stream Sharding
+menuTitle: Automatic stream sharding
+description: Automatic stream sharding can control issues around the per-stream rate limit
+weight: 110
+---
+
+# Automatic stream sharding
+
+Automatic stream sharding will attempt to keep streams under a `desired_rate` by adding new labels and values to
+existing streams. When properly tuned, this should eliminate issues where log producers are rate limited due to the
+per-stream rate limit.
+
+## When to use automatic stream sharding
+
+Large log streams present several problems for Loki, namely increased and uneven resource usage on Ingesters and
+Distributors. The general recommendation is to explore existing log streams for additional label values that are both
+useful for querying and sufficiently low cardinality. There are many cases, however, where no more labels can
+be extracted, or cardinality for a label is dangerously large. To protect itself from such volume leading to operational failure, Loki implements per-stream rate limits;
+but the result is that some data is lost. The per-stream limit also needs human intervention to change, which is not ideal when log volumes increase and decrease.
+
+Loki uses automatic stream sharding to avoid rate limiting and large streams for any log stream by ensuring it is close
+to a configured `desired_rate`.
+
+## How automatic stream sharding works
+
+Automatic stream sharding works by adding a new label, `__stream_shard__`, to streams and incrementing its value to try
+and keep all streams below a configured `desired_rate`.
+
+The feature adds a new API to Ingesters that reports the size of all existing log streams. Once per second, Distributors
+query the API to get a picture of all stream rates in the system. Distributors use the existing stream-rate data and a
+configured `desired_rate` to determine how many shards a given stream should have. The desired number of new log streams
+are created with the label `__stream_shard__` and logs are divided evenly among the streams.
+
+Because automatic stream sharding is reactive and relies on successive calls to Ingesters, the view of current rates is
+always somewhat behind. As a result, the actual size of sharded streams will always be higher than the `desired_rate`.
+In practice, this is still sufficient to keep log producers from being rate limited by per-stream rate limits.
+
+## Enabling and configuring automatic stream sharding
+
+Enable automatic sharding by setting the global or per-tenant override `shard_streams`. This configuration contains
+an `enabled` flag to turn the feature on, a `desired_rate` configuration for the desired stream rate, and an
+optional `logging_enabled` flag to enable debug logging of stream sharding.
+
+*NOTE*: Setting `logging_enabled` may affect the ingestion performance of Loki.
+
+## Automatic stream sharding metrics
+
+Use these metrics to help tune Loki so that it is sharding streams aggressively enough to avoid the per-stream rate
+limit:
+
+- `loki_rate_store_refresh_failures_total`: The total number of failed attempts to refresh the distributor's view of
+  stream rates.
+- `loki_rate_store_streams`: The number of unique streams reported by all Ingesters. Sharded streams are reported as if
+  they were unsharded.
+- `loki_rate_store_max_stream_shards`: The maximum number of shards for any tenant of the system.
+- `loki_rate_store_stream_shards`: A histogram of the distribution of shard counts across all streams.
+- `loki_rate_store_max_stream_rate_bytes`: The maximum stream size in bytes/second for any tenant of the system. Sharded
+  streams are reported as if they are unsharded.
+- `loki_rate_store_max_unique_stream_rate_bytes`: The maximum size of any stream across all tenants. Stream shards are
+  individually reported.
+- `loki_rate_store_stream_rate_bytes`: A histogram of the distribution of stream sizes across all tenants in
+  bytes/second.
+- `loki_stream_sharding_count`: The total number of times that streams have been sharded. Useful for calculating the
+  sharding rate.
diff --git a/docs/sources/operations/canary.png b/docs/sources/operations/canary.png
deleted file mode 100644
index 6e0fe52d9745..000000000000
Binary files a/docs/sources/operations/canary.png and /dev/null differ
diff --git a/docs/sources/operations/loki-canary.md b/docs/sources/operations/loki-canary.md
index 12a6925ee33b..7b20fccae555 100644
--- a/docs/sources/operations/loki-canary.md
+++ b/docs/sources/operations/loki-canary.md
@@ -4,8 +4,6 @@ weight: 60
 ---
 # Loki Canary
 
-![canary](../canary.png)
-
 Loki Canary is a standalone app that audits the log-capturing performance of
 a Grafana Loki cluster.
 
@@ -273,10 +271,9 @@ $ make loki-canary-image
 
 ## Configuration
 
-The address of Loki must be passed in with the `-addr` flag or by setting the
-environment variable `LOKI_ADDRESS`, and if your Loki server uses TLS, `-tls=true`
-must also be provided. Note that using TLS will cause the WebSocket connection
-to use `wss://` instead of `ws://`.
+The address of Loki must be passed in with the `-addr` flag, and if your Loki
+server uses TLS, `-tls=true` must also be provided. Note that using TLS will
+cause the WebSocket connection to use `wss://` instead of `ws://`.
 
 The `-labelname` and `-labelvalue` flags should also be provided, as these are
 used by Loki Canary to filter the log stream to only process logs for the
@@ -304,7 +301,7 @@ All options:
 
 ```
   -addr string
-    	The Loki server URL:Port, e.g. loki:3100. Loki address can also be set using the environment variable LOKI_ADDRESS.
+    	The Loki server URL:Port, e.g. loki:3100
   -buckets int
     	Number of buckets in the response_latency histogram (default 10)
   -ca-file string
@@ -334,7 +331,7 @@ All options:
   -out-of-order-percentage int
     	Percentage (0-100) of log entries that should be sent out of order.
   -pass string
-    	Loki password. This credential should have both read and write permissions to Loki endpoints. Password can also be set using the environment variable LOKI_PASSWORD.
+    	Loki password. This credential should have both read and write permissions to Loki endpoints
   -port int
     	Port which loki-canary should expose metrics (default 3500)
   -pruneinterval duration
@@ -362,7 +359,7 @@ All options:
   -tls
     	Does the loki connection use TLS?
   -user string
-    	Loki username. Username can also be set using the environment variable LOKI_USERNAME.
+    	Loki username.
   -version
     	Print this builds version information
   -wait duration
diff --git a/go.mod b/go.mod
index 919e92898e12..5142a8a1e57b 100644
--- a/go.mod
+++ b/go.mod
@@ -10,19 +10,18 @@ require (
 	github.com/Azure/azure-storage-blob-go v0.14.0
 	github.com/Azure/go-autorest/autorest/adal v0.9.21
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11
-	github.com/Masterminds/sprig/v3 v3.2.2
+	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/Shopify/sarama v1.30.0
 	github.com/Workiva/go-datastructures v1.0.53
-	github.com/alicebob/miniredis/v2 v2.22.0
-	github.com/aws/aws-sdk-go v1.44.128
+	github.com/alicebob/miniredis/v2 v2.30.0
+	github.com/aws/aws-sdk-go v1.44.156
 	github.com/baidubce/bce-sdk-go v0.9.111
 	github.com/bmatcuk/doublestar v1.2.2
 	github.com/buger/jsonparser v1.1.1
 	github.com/c2h5oh/datasize v0.0.0-20200112174442-28bbd4740fee
 	github.com/cespare/xxhash v1.1.0
-	github.com/cespare/xxhash/v2 v2.1.2
-	github.com/cloudflare/cloudflare-go v0.27.0
+	github.com/cespare/xxhash/v2 v2.2.0
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/cristalhq/hedgedhttp v0.7.0
 	github.com/davecgh/go-spew v1.1.1
@@ -48,16 +47,17 @@ require (
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/websocket v1.5.0
-	github.com/grafana/dskit v0.0.0-20221212120341-3e308a49441b
+	github.com/grafana/cloudflare-go v0.0.0-20230110200409-c627cf6792f2
+	github.com/grafana/dskit v0.0.0-20230109170026-7242706251b9
 	github.com/grafana/go-gelf/v2 v2.0.1
-	github.com/grafana/gomemcache v0.0.0-20221213170046-b5da8a745d41
+	github.com/grafana/gomemcache v0.0.0-20230105173749-11f792309e1f
 	github.com/grafana/regexp v0.0.0-20221005093135-b4c2bcb0a4b6
 	github.com/grafana/tail v0.0.0-20221214082743-3a1c242a4d7b
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645
 	github.com/hashicorp/consul/api v1.15.3
-	github.com/hashicorp/golang-lru v0.5.4
-	github.com/imdario/mergo v0.3.12
+	github.com/hashicorp/golang-lru v0.6.0
+	github.com/imdario/mergo v0.3.13
 	github.com/influxdata/go-syslog/v3 v3.0.1-0.20201128200927-a1889d947b48
 	github.com/influxdata/telegraf v1.16.3
 	github.com/jmespath/go-jmespath v0.4.0
@@ -80,9 +80,9 @@ require (
 	// github.com/pierrec/lz4 v2.0.5+incompatible
 	github.com/pierrec/lz4/v4 v4.1.17
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.13.1
+	github.com/prometheus/client_golang v1.14.0
 	github.com/prometheus/client_model v0.3.0
-	github.com/prometheus/common v0.37.0
+	github.com/prometheus/common v0.39.0
 	github.com/prometheus/prometheus v0.40.5
 	github.com/segmentio/fasthash v1.0.3
 	github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749
@@ -99,14 +99,13 @@ require (
 	go.uber.org/atomic v1.10.0
 	go.uber.org/goleak v1.2.0
 	golang.org/x/crypto v0.4.0
-	golang.org/x/net v0.3.0
+	golang.org/x/net v0.5.0
 	golang.org/x/sync v0.1.0
-	golang.org/x/sys v0.3.0
-	golang.org/x/time v0.1.0
+	golang.org/x/sys v0.4.0
+	golang.org/x/time v0.3.0
 	google.golang.org/api v0.102.0
 	google.golang.org/grpc v1.50.1
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
-	gopkg.in/fsnotify.v1 v1.4.7
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	inet.af/netaddr v0.0.0-20211027220019-c74959edd3b6
@@ -114,13 +113,16 @@ require (
 )
 
 require (
+	github.com/Azure/go-autorest/autorest v0.11.28
+	github.com/fsnotify/fsnotify v1.6.0
 	github.com/heroku/x v0.0.50
-	github.com/prometheus/alertmanager v0.24.0
+	github.com/prometheus/alertmanager v0.25.0
 	github.com/prometheus/common/sigv4 v0.1.0
 	github.com/thanos-io/objstore v0.0.0-20220715165016-ce338803bc1e
 	github.com/willf/bloom v2.0.3+incompatible
-	golang.org/x/oauth2 v0.1.0
-	golang.org/x/text v0.5.0
+	golang.org/x/exp v0.0.0-20221031165847-c99f073a8326
+	golang.org/x/oauth2 v0.4.0
+	golang.org/x/text v0.6.0
 )
 
 require (
@@ -132,7 +134,6 @@ require (
 	github.com/Azure/azure-sdk-for-go v65.0.0+incompatible // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
 	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
@@ -140,7 +141,7 @@ require (
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Microsoft/go-winio v0.5.1 // indirect
 	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
@@ -182,19 +183,18 @@ require (
 	github.com/envoyproxy/go-control-plane v0.10.3 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.13 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-kit/kit v0.12.0 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.21.2 // indirect
-	github.com/go-openapi/errors v0.20.2 // indirect
+	github.com/go-openapi/analysis v0.21.4 // indirect
+	github.com/go-openapi/errors v0.20.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/loads v0.21.1 // indirect
-	github.com/go-openapi/spec v0.20.5 // indirect
+	github.com/go-openapi/loads v0.21.2 // indirect
+	github.com/go-openapi/spec v0.20.7 // indirect
 	github.com/go-openapi/strfmt v0.21.3 // indirect
-	github.com/go-openapi/swag v0.21.1 // indirect
-	github.com/go-openapi/validate v0.21.0 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/validate v0.22.0 // indirect
 	github.com/go-zookeeper/zk v1.0.3 // indirect
 	github.com/gofrs/flock v0.7.1 // indirect
 	github.com/gogo/googleapis v1.4.0 // indirect
@@ -211,16 +211,17 @@ require (
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v0.16.2 // indirect
+	github.com/hashicorp/go-hclog v1.2.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-msgpack v0.5.5 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.2 // indirect
-	github.com/hashicorp/memberlist v0.3.1 // indirect
+	github.com/hashicorp/memberlist v0.5.0 // indirect
 	github.com/hashicorp/serf v0.9.7 // indirect
-	github.com/huandu/xstrings v1.3.1 // indirect
+	github.com/huandu/xstrings v1.3.3 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/gofork v1.0.0 // indirect
@@ -234,7 +235,7 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.12 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/miekg/dns v1.1.50 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/minio/sha256-simd v1.0.0 // indirect
@@ -252,7 +253,6 @@ require (
 	github.com/prometheus/exporter-toolkit v0.8.2 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
-	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/rs/xid v1.4.0 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/sercand/kuberesolver v2.4.0+incompatible // indirect
@@ -268,11 +268,11 @@ require (
 	github.com/willf/bitset v1.1.11 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
 	github.com/xdg-go/stringprep v1.0.3 // indirect
-	github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 // indirect
+	github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 // indirect
 	go.etcd.io/etcd/api/v3 v3.5.4 // indirect
 	go.etcd.io/etcd/client/pkg/v3 v3.5.4 // indirect
 	go.etcd.io/etcd/client/v3 v3.5.4 // indirect
-	go.mongodb.org/mongo-driver v1.10.2 // indirect
+	go.mongodb.org/mongo-driver v1.11.0 // indirect
 	go.opencensus.io v0.23.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.36.4 // indirect
 	go.opentelemetry.io/otel v1.11.1 // indirect
@@ -282,10 +282,9 @@ require (
 	go.uber.org/zap v1.21.0 // indirect
 	go4.org/intern v0.0.0-20211027215823-ae77deb06f29 // indirect
 	go4.org/unsafe/assume-no-moving-gc v0.0.0-20220617031537-928513b29760 // indirect
-	golang.org/x/exp v0.0.0-20221031165847-c99f073a8326 // indirect
-	golang.org/x/mod v0.6.0 // indirect
-	golang.org/x/term v0.3.0 // indirect
-	golang.org/x/tools v0.2.0 // indirect
+	golang.org/x/mod v0.7.0 // indirect
+	golang.org/x/term v0.4.0 // indirect
+	golang.org/x/tools v0.4.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c // indirect
@@ -318,17 +317,8 @@ replace github.com/hashicorp/consul => github.com/hashicorp/consul v1.5.1
 // Use fork of gocql that has gokit logs and Prometheus metrics.
 replace github.com/gocql/gocql => github.com/grafana/gocql v0.0.0-20200605141915-ba5dc39ece85
 
-replace github.com/cloudflare/cloudflare-go => github.com/cyriltovena/cloudflare-go v0.27.1-0.20211118103540-ff77400bcb93
-
 exclude k8s.io/client-go v8.0.0+incompatible
 
-// grpc v1.46.0 removed "WithBalancerName()" API, still in use by weaveworks/commons.
-replace google.golang.org/grpc => google.golang.org/grpc v1.45.0
-
 // Replace memberlist with our fork which includes some fixes that haven't been
 // merged upstream yet.
 replace github.com/hashicorp/memberlist => github.com/grafana/memberlist v0.3.1-0.20220714140823-09ffed8adbbe
-
-// Fork containing a line-buffered logger which should improve logging performance.
-// TODO: submit PR to upstream and remove this
-replace github.com/go-kit/log => github.com/dannykopping/go-kit-log v0.2.2-0.20221002180827-5591c1641b6b
diff --git a/go.sum b/go.sum
index 8117378cb54b..bec77b9db156 100644
--- a/go.sum
+++ b/go.sum
@@ -146,10 +146,10 @@ github.com/MasslessParticle/azure-storage-blob-go v0.14.1-0.20220216145902-b5e69
 github.com/MasslessParticle/azure-storage-blob-go v0.14.1-0.20220216145902-b5e698eff68e/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/sprig/v3 v3.2.2 h1:17jRggJu518dr3QaafizSXOjKYp94wKfABxUmyxvxX8=
-github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
+github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
+github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
+github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/Mellanox/rdmamap v0.0.0-20191106181932-7c3c4763a6ee/go.mod h1:jDA6v0TUYrFEIAE5uGJ29LQOeONIgMdP4Rkqb8HUnPM=
 github.com/Microsoft/ApplicationInsights-Go v0.4.2/go.mod h1:CukZ/G66zxXtI+h/VcVn3eVVDGDHfXM2zVILF7bMmsg=
 github.com/Microsoft/go-winio v0.4.3/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
@@ -196,8 +196,8 @@ github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAu
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a h1:HbKu58rmZpUGpz5+4FfNmIU+FmZg2P3Xaj2v2bfNWmk=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
-github.com/alicebob/miniredis/v2 v2.22.0 h1:lIHHiSkEyS1MkKHCHzN+0mWrA4YdbGdimE5iZ2sHSzo=
-github.com/alicebob/miniredis/v2 v2.22.0/go.mod h1:XNqvJdQJv5mSuVMc0ynneafpnL/zv52acZ6kqeS0t88=
+github.com/alicebob/miniredis/v2 v2.30.0 h1:uA3uhDbCxfO9+DI/DuGeAMr9qI+noVWwGPNTFuKID5M=
+github.com/alicebob/miniredis/v2 v2.30.0/go.mod h1:84TWKZlxYkfgMucPBf5SOQBYJceZeQRFIaQgNMiCX6Q=
 github.com/aliyun/aliyun-oss-go-sdk v2.2.2+incompatible h1:9gWa46nstkJ9miBReJcN8Gq34cBFbzSpQZVVT9N09TM=
 github.com/amir/raidman v0.0.0-20170415203553-1ccc43bfb9c9/go.mod h1:eliMa/PW+RDr2QLWRmLH1R1ZA4RInpmvOzDDXtaIZkc=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -227,9 +227,8 @@ github.com/aws/aws-sdk-go v1.15.24/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZo
 github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.34.34/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.43.11/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.44.128 h1:X34pX5t0LIZXjBY11yf9JKMP3c1aZgirh+5PjtaZyJ4=
-github.com/aws/aws-sdk-go v1.44.128/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.44.156 h1:3RhbBTZ87HoI5OP2JjcKdd5qOnyo9YOAW8+Bb/h0vSE=
+github.com/aws/aws-sdk-go v1.44.156/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
 github.com/aws/aws-sdk-go-v2 v1.16.0 h1:cBAYjiiexRAg9v2z9vb6IdxAa7ef4KCtjW7w7e3GxGo=
 github.com/aws/aws-sdk-go-v2 v1.16.0/go.mod h1:lJYcuZZEHWNIb6ugJjbQY1fykdoobWbOS7kJYb4APoI=
@@ -257,8 +256,8 @@ github.com/axiomhq/hyperloglog v0.0.0-20180317131949-fe9507de0228/go.mod h1:IOXA
 github.com/baidubce/bce-sdk-go v0.9.111 h1:yGgtPpZYUZW4uoVorQ4xnuEgVeddACydlcJKW87MDV4=
 github.com/baidubce/bce-sdk-go v0.9.111/go.mod h1:zbYJMQwE4IZuyrJiFO8tO8NbtYiKTFTbwh4eIsqjVdg=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
-github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -282,15 +281,15 @@ github.com/cenkalti/backoff v2.0.0+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QH
 github.com/cenkalti/backoff v2.1.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.1.2/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0 h1:t/LhUZLVitR1Ow2YOnduCsavhwFUklBMoGVYUCqmCqk=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -301,10 +300,16 @@ github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp
 github.com/cisco-ie/nx-telemetry-proto v0.0.0-20190531143454-82441e232cf6/go.mod h1:ugEfq4B8T8ciw/h5mCkgdiDRFS4CkqqhH2dymDB4knc=
 github.com/clbanning/mxj v1.8.4 h1:HuhwZtbyvyOw+3Z1AowPkU87JkJUSv751ELWaiTpj8I=
 github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 h1:hzAQntlaYRkVSFEfj9OTWlVV1H155FMD8BTKktLv0QI=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc h1:PYXxkRUBGUMa5xgMVMDl62vEklZvKpVaxQeN9ie7Hfk=
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
@@ -338,10 +343,6 @@ github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cristalhq/hedgedhttp v0.7.0 h1:C2XPDC+AQH4QJt6vZI4jB5WNyF86QbSJD4C4fW3H3ro=
 github.com/cristalhq/hedgedhttp v0.7.0/go.mod h1:XkqWU6qVMutbhW68NnzjWrGtH8NUx1UfYqGYtHVKIsI=
-github.com/cyriltovena/cloudflare-go v0.27.1-0.20211118103540-ff77400bcb93 h1:PEBeRA25eDfHWkXNJs0HOnMhjIuKMcxKg/Z3VeuoRbU=
-github.com/cyriltovena/cloudflare-go v0.27.1-0.20211118103540-ff77400bcb93/go.mod h1:sPWL/lIC6biLEdyGZwBQ1rGQKF1FhM7N60fuNiFdYTI=
-github.com/dannykopping/go-kit-log v0.2.2-0.20221002180827-5591c1641b6b h1:G8g9mAKEj9O3RsU6Hd/ow6lIcHarlcUl5omV6sFKEOU=
-github.com/dannykopping/go-kit-log v0.2.2-0.20221002180827-5591c1641b6b/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -378,7 +379,6 @@ github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHz
 github.com/docker/go-plugins-helpers v0.0.0-20181025120712-1e6269c305b8 h1:9Hsno4vmXpQ0yVAp07bLxS5dHH24w80xzmUCLil47ME=
 github.com/docker/go-plugins-helpers v0.0.0-20181025120712-1e6269c305b8/go.mod h1:LFyLie6XcDbyKGeVK6bHe+9aJTYCxWLBg5IrJZOaXKA=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libnetwork v0.8.0-dev.2.0.20181012153825-d7b61745d166/go.mod h1:93m0aTqz6z+g32wla4l4WxTrdtvBRmVzYRkYvasA5Z8=
@@ -411,7 +411,16 @@ github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb
 github.com/emicklei/go-restful/v3 v3.8.0 h1:eCZ8ulSerjdAiaNpF7GxXIE7ZCMo1moN1qX+S609eVw=
 github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.0.0-20180919002855-2137d9196328/go.mod h1:SBwIajubJHhxtWwsL9s8ss4safvEdbitLhGGK48rN6g=
+github.com/envoyproxy/go-control-plane v0.6.9/go.mod h1:SBwIajubJHhxtWwsL9s8ss4safvEdbitLhGGK48rN6g=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
+github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/go-control-plane v0.10.3 h1:xdCVXxEe0Y3FQith+0cj2irwZudqGYvecuLB1HtdexY=
 github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
@@ -425,7 +434,6 @@ github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb h1:IT4JYU7k4ikYg1S
 github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb/go.mod h1:bH6Xx7IW64qjjJq8M2u4dxNaBiDfKK+z/3eGDpXEQhc=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/structs v0.0.0-20180123065059-ebf56d35bba7/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
@@ -465,6 +473,10 @@ github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
 github.com/go-kit/kit v0.12.0 h1:e4o3o3IsBfAKQh5Qbbiqyfu97Ku7jrO/JbohvztANh4=
 github.com/go-kit/kit v0.12.0/go.mod h1:lHd+EkCZPIwYItmGDDRdhinkzX2A1sj+M9biaEaizzs=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
+github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
+github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
@@ -481,12 +493,14 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/go-ole/go-ole v1.2.1/go.mod h1:7FAglXiTm7HKlQRDeOQ6ZNUHidzCWXuZWq/1dTyBNF8=
 github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.2.6-0.20210915003542-8b1f7f90f6b1/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-openapi/analysis v0.21.2 h1:hXFrOYFHUAMQdu6zwAiKKJHJQ8kqZs1ux/ru1P1wLJU=
 github.com/go-openapi/analysis v0.21.2/go.mod h1:HZwRk4RRisyG8vx2Oe6aqeSQcoxRp47Xkp3+K6q+LdY=
+github.com/go-openapi/analysis v0.21.4 h1:ZDFLvSNxpDaomuCueM0BlSXxpANBlFYiBvr+GXrvIHc=
+github.com/go-openapi/analysis v0.21.4/go.mod h1:4zQ35W4neeZTqh3ol0rv/O8JBbka9QyAgQRPp9y3pfo=
 github.com/go-openapi/errors v0.19.8/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
 github.com/go-openapi/errors v0.19.9/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.20.2 h1:dxy7PGTqEh94zj2E3h1cUmQQWiM1+aeCROfAr02EmK8=
 github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
+github.com/go-openapi/errors v0.20.3 h1:rz6kiC84sqNQoqrtulzaL/VERgkoCyB6WdEkc2ujzUc=
+github.com/go-openapi/errors v0.20.3/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk=
 github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
@@ -495,29 +509,26 @@ github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1
 github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
 github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
 github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
-github.com/go-openapi/loads v0.21.1 h1:Wb3nVZpdEzDTcly8S4HMkey6fjARRzb7iEaySimlDW0=
 github.com/go-openapi/loads v0.21.1/go.mod h1:/DtAMXXneXFjbQMGEtbamCZb+4x7eGwkvZCvBmwUG+g=
-github.com/go-openapi/runtime v0.23.1/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
+github.com/go-openapi/loads v0.21.2 h1:r2a/xFIYeZ4Qd2TnGpWDIQNcP80dIaZgf704za8enro=
+github.com/go-openapi/loads v0.21.2/go.mod h1:Jq58Os6SSGz0rzh62ptiu8Z31I+OTHqmULx5e/gJbNw=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
-github.com/go-openapi/spec v0.20.5 h1:skHa8av4VnAtJU5zyAUXrrdK/NDiVX8lchbG+BfcdrE=
-github.com/go-openapi/spec v0.20.5/go.mod h1:QbfOSIVt3/sac+a1wzmKbbcLXm5NdZnyBZYtCijp43o=
+github.com/go-openapi/spec v0.20.6/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
+github.com/go-openapi/spec v0.20.7 h1:1Rlu/ZrOCCob0n+JKKJAWhNWMPW8bOZRg8FJaY+0SKI=
+github.com/go-openapi/spec v0.20.7/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
 github.com/go-openapi/strfmt v0.21.0/go.mod h1:ZRQ409bWMj+SOgXofQAGTIo2Ebu72Gs+WaRADcS5iNg=
 github.com/go-openapi/strfmt v0.21.1/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
-github.com/go-openapi/strfmt v0.21.2/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
 github.com/go-openapi/strfmt v0.21.3 h1:xwhj5X6CjXEZZHMWy1zKJxvW9AfHC9pkyUjLvHtKG7o=
 github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg=
 github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.21.1 h1:wm0rhTb5z7qpJRHBdPOMuY4QjVUMbF6/kwoYeRAOrKU=
 github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/validate v0.21.0 h1:+Wqk39yKOhfpLqNLEC0/eViCkzM5FVXVqrvt526+wcI=
-github.com/go-openapi/validate v0.21.0/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
-github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
-github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
-github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
+github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/validate v0.22.0 h1:b0QecH6VslW/TxtpKgzpO1SNG7GU2FsaqKdP1E2T50Y=
+github.com/go-openapi/validate v0.22.0/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
 github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
@@ -526,7 +537,6 @@ github.com/go-sql-driver/mysql v0.0.0-20180618115901-749ddf1598b4/go.mod h1:zAC/
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-test/deep v1.0.1/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-zookeeper/zk v1.0.3 h1:7M2kwOsc//9VeeFiPtf+uSJlVpU66x9Ba5+8XK7/TDg=
 github.com/go-zookeeper/zk v1.0.3/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
@@ -557,12 +567,10 @@ github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY9
 github.com/goburrow/modbus v0.1.0/go.mod h1:Kx552D5rLIS8E7TyUwQ/UdHEqvX5T8tyiGBTlzMcZBg=
 github.com/goburrow/serial v0.1.0/go.mod h1:sAiqG0nRVswsm1C97xsttiYCzSLBmUZ/VSlVLZJ8haA=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/goccy/go-yaml v1.9.5/go.mod h1:U/jl18uSupI5rdI2jmuCswEA2htH9eXfferR3KfscvA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.7.1 h1:DP+LD/t0njgoPBvT5MJLeliUIVQR03hiKR6vezdwHlc=
 github.com/gofrs/flock v0.7.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gofrs/uuid v2.1.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/googleapis v0.0.0-20180223154316-0cd9801be74a/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
 github.com/gogo/googleapis v1.4.0 h1:zgVt4UpGxcqVOw97aRGxT4svlcmdK35fynLNctY32zI=
@@ -592,6 +600,8 @@ github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4er
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
 github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
@@ -726,14 +736,16 @@ github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gotestyourself/gotestyourself v2.2.0+incompatible/go.mod h1:zZKM6oeNM8k+FRljX1mnzVYeS8wiGgQyvST1/GafPbY=
-github.com/grafana/dskit v0.0.0-20221212120341-3e308a49441b h1:3Di+jzpE0CHlzlYtjDq9xL5xinR4FUQ7GoQ44JkfQLc=
-github.com/grafana/dskit v0.0.0-20221212120341-3e308a49441b/go.mod h1:rJRGBDtyQNA3OFh7WecUILvxkgGrdIuA4f9wgZOn3V0=
+github.com/grafana/cloudflare-go v0.0.0-20230110200409-c627cf6792f2 h1:qhugDMdQ4Vp68H0tp/0iN17DM2ehRo1rLEdOFe/gB8I=
+github.com/grafana/cloudflare-go v0.0.0-20230110200409-c627cf6792f2/go.mod h1:w/aiO1POVIeXUQyl0VQSZjl5OAGDTL5aX+4v0RA1tcw=
+github.com/grafana/dskit v0.0.0-20230109170026-7242706251b9 h1:eAPMj0IgfkMn+jxBjIbNjnak7Fu/0HXWF+/DMWRS/Sk=
+github.com/grafana/dskit v0.0.0-20230109170026-7242706251b9/go.mod h1:zj+5BNZAVmQafV583uLTAOzRr963KPdEm4d6NPmtbwg=
 github.com/grafana/go-gelf/v2 v2.0.1 h1:BOChP0h/jLeD+7F9mL7tq10xVkDG15he3T1zHuQaWak=
 github.com/grafana/go-gelf/v2 v2.0.1/go.mod h1:lexHie0xzYGwCgiRGcvZ723bSNyNI8ZRD4s0CLobh90=
 github.com/grafana/gocql v0.0.0-20200605141915-ba5dc39ece85 h1:xLuzPoOzdfNb/RF/IENCw+oLVdZB4G21VPhkHBgwSHY=
 github.com/grafana/gocql v0.0.0-20200605141915-ba5dc39ece85/go.mod h1:crI9WX6p0IhrqB+DqIUHulRW853PaNFf7o4UprV//3I=
-github.com/grafana/gomemcache v0.0.0-20221213170046-b5da8a745d41 h1:YxVdHh0Erfya/wb4mzy/JkTxtmefBICE6gAwSkS+61I=
-github.com/grafana/gomemcache v0.0.0-20221213170046-b5da8a745d41/go.mod h1:6fkC8bkriadatJOc7Pvjcvqr2xh9C79BYRRfE3WWoo0=
+github.com/grafana/gomemcache v0.0.0-20230105173749-11f792309e1f h1:ANwIMe7kOiMNTK88tusoNDb840pWVskI4rCrdoMv5i0=
+github.com/grafana/gomemcache v0.0.0-20230105173749-11f792309e1f/go.mod h1:PGk3RjYHpxMM8HFPhKKo+vve3DdlPUELZLSDEFehPuU=
 github.com/grafana/memberlist v0.3.1-0.20220714140823-09ffed8adbbe h1:yIXAAbLswn7VNWBIvM71O2QsgfgW9fRXZNR0DXe6pDU=
 github.com/grafana/memberlist v0.3.1-0.20220714140823-09ffed8adbbe/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
 github.com/grafana/regexp v0.0.0-20221005093135-b4c2bcb0a4b6 h1:A3dhViTeFDSQcGOXuUi6ukCQSMyDtDISBp2z6OOo2YM=
@@ -778,10 +790,11 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-discover v0.0.0-20190403160810-22221edb15cd/go.mod h1:ueUgD9BeIocT7QNuvxSyJyPAM9dfifBcaWmeybb67OY=
 github.com/hashicorp/go-hclog v0.0.0-20180402200405-69ff559dc25f/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
+github.com/hashicorp/go-hclog v1.2.0 h1:La19f8d7WIlm4ogzNHB0JGqs5AUDAZ2UfCY4sJXcJdM=
+github.com/hashicorp/go-hclog v1.2.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
@@ -798,7 +811,8 @@ github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9
 github.com/hashicorp/go-plugin v0.0.0-20180331002553-e8d22c780116/go.mod h1:JSqWYsict+jzcj0+xElxyrBQRPNoiWQuddnxArJ7XHQ=
 github.com/hashicorp/go-retryablehttp v0.0.0-20180531211321-3b087ef2d313/go.mod h1:fXcdFsQoipQa7mwORhKad5jmDCeSy/RCGzWA08PO0lM=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-retryablehttp v0.7.1 h1:sUiuQAnLlbvmExtFQs72iFW/HXeUn8Z1aJLQ4LJJbTQ=
+github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
+github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
 github.com/hashicorp/go-rootcerts v0.0.0-20160503143440-6bb64b370b90/go.mod h1:o4zcYY1e0GEZI6eSEr+43QDYmuGglw1qSO6qdHUHCgg=
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
@@ -816,8 +830,9 @@ github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
+github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v0.0.0-20180906183839-65a6292f0157/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/hil v0.0.0-20160711231837-1e86c6b523c5/go.mod h1:KHvg/R2/dPtaePb16oW4qIyzkMxXOL38xjRN64adsts=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
@@ -841,8 +856,8 @@ github.com/heroku/x v0.0.50 h1:CA0AXkSumucVJD+T+x+6c7X1iDEb+40F8GNgH5UjJwo=
 github.com/heroku/x v0.0.50/go.mod h1:vr+jORZ6sG3wgEq2FAS6UbOUrz9/DxpQGN/xPHVgbSM=
 github.com/hetznercloud/hcloud-go v1.35.3 h1:WCmFAhLRooih2QHAsbCbEdpIHnshQQmrPqsr3rHE1Ow=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.3.1 h1:4jgBlKK6tLKFvO8u5pmYjG91cqytmDCDvGh7ECVFfFs=
-github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
+github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/hydrogen18/memlistener v0.0.0-20141126152155-54553eb933fb/go.mod h1:qEIFzExnS6016fRpRfxrExeVn2gbClQA99gQhnIcdhE=
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
@@ -851,8 +866,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:
 github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/influxdata/go-syslog/v2 v2.0.1/go.mod h1:hjvie1UTaD5E1fTnDmxaCw8RRDrT4Ve+XHr5O2dKSCo=
 github.com/influxdata/go-syslog/v3 v3.0.1-0.20201128200927-a1889d947b48 h1:0WbZ+ZVg74wbyQoRx1TD4D1Xoz8MsXJSTwdP9F7RMeQ=
@@ -880,7 +895,6 @@ github.com/jcmturner/gokrb5/v8 v8.4.2/go.mod h1:sb+Xq/fTY5yktf/VxLsE3wlfPqQjp0aW
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jefferai/jsonx v0.0.0-20160721235117-9cc31c3135ee/go.mod h1:N0t2vlmpe8nyZB5ouIbJQPDSR+mH6oe7xHB9VZHSUzM=
-github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -957,7 +971,6 @@ github.com/kubernetes/apimachinery v0.0.0-20190119020841-d41becfba9ee/go.mod h1:
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leesper/go_rng v0.0.0-20171009123644-5344a9259b21/go.mod h1:N0SVk0uhy+E1PZ3C9ctsPRlvOPAFPkCNlcPBDkt0N3U=
 github.com/leesper/go_rng v0.0.0-20190531154944-a612b043e353/go.mod h1:N0SVk0uhy+E1PZ3C9ctsPRlvOPAFPkCNlcPBDkt0N3U=
-github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/leodido/ragel-machinery v0.0.0-20181214104525-299bdde78165 h1:bCiVCRCs1Heq84lurVinUPy19keqGEe4jh5vtK37jcg=
 github.com/leodido/ragel-machinery v0.0.0-20181214104525-299bdde78165/go.mod h1:WZxr2/6a/Ar9bMDc2rN/LJrE/hF6bXE4LPyDSIxwAfg=
 github.com/lib/pq v0.0.0-20180523175426-90697d60dd84/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -969,6 +982,7 @@ github.com/lstoll/grpce v1.7.0/go.mod h1:XiCWl3R+avNCT7KsTjv3qCblgsSqd0SC4ymySrH
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-validate v0.0.0-20180911180927-64fcb82c878e/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
+github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20180717111219-efc7eb8984d6/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -981,7 +995,6 @@ github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kN
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
@@ -996,10 +1009,9 @@ github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 h1:I0XW9+e1XWDxdcEniV4rQAIOPUGDq67JSCiRCgGCZLI=
-github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mdlayher/apcupsd v0.0.0-20200608131503-2bf01da7bf1b/go.mod h1:WYK/Z/aXq9cbMFIL5ihcA4sX/r/3/WCas/Qvs/2fXcA=
 github.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=
 github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
@@ -1036,7 +1048,6 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
@@ -1088,7 +1099,6 @@ github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DV
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
-github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -1100,7 +1110,7 @@ github.com/onsi/gomega v1.4.1/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5
 github.com/onsi/gomega v1.4.2/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/gomega v1.24.0 h1:+0glovB9Jd6z3VR+ScSwQqXVTIfJcGA9UBM8yzQxhqg=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/openconfig/gnmi v0.0.0-20180912164834-33a1865c3029/go.mod h1:t+O9It+LKzfOAhKTT5O0ehDix+MTqbtT0T9t+7zzOvc=
 github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
@@ -1161,8 +1171,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/prometheus/alertmanager v0.24.0 h1:HBWR3lk4uy3ys+naDZthDdV7yEsxpaNeZuUS+hJgrOw=
-github.com/prometheus/alertmanager v0.24.0/go.mod h1:r6fy/D7FRuZh5YbnX6J3MBY0eI4Pb5yPYS7/bPSXXqI=
+github.com/prometheus/alertmanager v0.25.0 h1:vbXKUR6PYRiZPRIKfmXaG+dmCKG52RtPL4Btl8hQGvg=
+github.com/prometheus/alertmanager v0.25.0/go.mod h1:MEZ3rFVHqKZsw7IcNS/m4AWZeXThmJhumpiWR4eHU/w=
 github.com/prometheus/client_golang v0.0.0-20180328130430-f504d69affe1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
@@ -1178,8 +1188,8 @@ github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqr
 github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
-github.com/prometheus/client_golang v1.13.1 h1:3gMjIY2+/hzmqhtUC/aQNYldJA6DtH3CgQvwS+02K1c=
-github.com/prometheus/client_golang v1.13.1/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
+github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
+github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
@@ -1200,11 +1210,11 @@ github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB8
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
 github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8pXE=
 github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
+github.com/prometheus/common v0.39.0 h1:oOyhkDq05hPZKItWVBkJ6g6AtGxi+fy7F4JvUV8uhsI=
+github.com/prometheus/common v0.39.0/go.mod h1:6XBZ7lYdLCbkAVhwRsWTZn+IN5AB9F/NXd5w0BbEX0Y=
 github.com/prometheus/common/sigv4 v0.1.0 h1:qoVebwtwwEhS85Czm2dSROY5fTo2PAPEVdDeppTwGX4=
 github.com/prometheus/common/sigv4 v0.1.0/go.mod h1:2Jkxxk9yYvCkE5G1sQT7GuEXm57JrvHu9k5YwTjsNtI=
-github.com/prometheus/exporter-toolkit v0.7.1/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g=
 github.com/prometheus/exporter-toolkit v0.8.2 h1:sbJAfBXQFkG6sUkbwBun8MNdzW9+wd5YfPYofbmj0YM=
 github.com/prometheus/exporter-toolkit v0.8.2/go.mod h1:00shzmJL7KxcsabLWcONwpyNEuWhREOnFqZW7vadFS0=
 github.com/prometheus/procfs v0.0.0-20180408092902-8b1c2da0d56d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1236,10 +1246,8 @@ github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR
 github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rollbar/rollbar-go v1.0.2/go.mod h1:AcFs5f0I+c71bpHlXNNDbOWJiKwjFDtISeXco0L5PKQ=
 github.com/rollbar/rollbar-go v1.2.0/go.mod h1:czC86b8U4xdUH7W2C6gomi2jutLm8qK0OtrF5WMvpcc=
-github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/rs/xid v1.4.0 h1:qd7wPTDkN6KQx2VmMBLrpHkiyQwgFXRnkOLacUiaSNY=
 github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -1400,11 +1408,10 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/gopher-lua v0.0.0-20180630135845-46796da1b0b4/go.mod h1:aEV29XrmTYFr3CiRxZeGHpkvbwq+prZduBqMaascyCU=
-github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 h1:k/gmLsJDWwWqbLCur2yWnJzwQEKRcAHXo6seXGuSwWw=
-github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9/go.mod h1:E1AXubJBdNmFERAOucpDIxNzeGfLzg0mYh+UfMWdChA=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 h1:5mLPGnFdSsevFRFc9q3yYbBkB6tsm4aCwwQV/j1JQAQ=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
 go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
@@ -1417,10 +1424,9 @@ go.etcd.io/etcd/client/v3 v3.5.4 h1:p83BUL3tAYS0OT/r0qglgc3M1JjhM0diV8DSWAhVXv4=
 go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
 go.mongodb.org/mongo-driver v1.7.3/go.mod h1:NqaYOwnXWr5Pm7AOpO5QFxKJ503nbMse/R79oO62zWg=
 go.mongodb.org/mongo-driver v1.7.5/go.mod h1:VXEWRZ6URJIkUq2SCAyapmhH0ZLRBP+FT4xhp5Zvxng=
-go.mongodb.org/mongo-driver v1.8.3/go.mod h1:0sQWfOeY63QTntERDJJ/0SuKK0T1uVSgKCuAROlKEPY=
 go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8=
-go.mongodb.org/mongo-driver v1.10.2 h1:4Wk3cnqOrQCn0P92L3/mmurMxzdvWWs5J9jinAVKD+k=
-go.mongodb.org/mongo-driver v1.10.2/go.mod h1:z4XpeoU6w+9Vht+jAFyLgVrD+jGSQQe0+CBWFHNiHt8=
+go.mongodb.org/mongo-driver v1.11.0 h1:FZKhBSTydeuffHj9CBjXlR8vQLee1cQyTWYPA6/tqiE=
+go.mongodb.org/mongo-driver v1.11.0/go.mod h1:s7p5vEtfbeR1gYi6pnj3c3/urpbLv2T5Sfd6Rp2HBB8=
 go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -1468,7 +1474,6 @@ go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.5.1/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
 go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
@@ -1506,14 +1511,11 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200204104054-c9f3fb736b72/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210920023735-84f357641f63/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
@@ -1522,6 +1524,7 @@ golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20221012134737-56aed061732a/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.4.0 h1:UVQgzMY87xqpKNgb+kDsll2Igd33HszWHFLmpaRMq/8=
 golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1542,6 +1545,8 @@ golang.org/x/exp v0.0.0-20221031165847-c99f073a8326/go.mod h1:CxIveKay+FTh1D0yPZ
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -1566,12 +1571,12 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0 h1:b9gGHsz9/HhJ3HF5DHQytPpuwocVTChQJK3AvoLRD5I=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
+golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
+golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181106065722-10aee1819953/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1626,12 +1631,10 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
 golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210917221730-978cfadd31cf/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -1644,8 +1647,10 @@ golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220907135653-1e95f45603a7/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.3.0 h1:VWL6FNY2bEEmsGVKabSlHu5Irp34xmMRoqb/9lF9lxk=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
+golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/oauth2 v0.0.0-20170807180024-9a379c6b3e95/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1668,8 +1673,8 @@ golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j
 golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
 golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.1.0 h1:isLCZuhj4v+tYv7eskaN4v/TM+A1begWWgyVJDdl1+Y=
-golang.org/x/oauth2 v0.1.0/go.mod h1:G9FE4dLTsbXUu90h/Pf85g4w1D+SSAgR+q46nJZ8M4A=
+golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
+golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1688,6 +1693,7 @@ golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1778,7 +1784,6 @@ golang.org/x/sys v0.0.0-20210902050250-f475640dd07b/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211102061401-a2f17f7b995c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1797,13 +1802,16 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908150016-7ac13a9a928d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
+golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1814,20 +1822,22 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
+golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
@@ -1895,10 +1905,9 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0 h1:G6AHpWxTMGY1KyEYoAQ5WTtIekUUvDNjan3ugu60JvE=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
+golang.org/x/tools v0.4.0 h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4=
+golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2060,8 +2069,49 @@ google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljW
 google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c h1:QgY/XxIAIeccR+Ca/rDdKubLIU9rcJ3xfy1DC/Wd2Oo=
 google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c/go.mod h1:CGI5F/G+E5bKwmfYo09AXuVN4dD894kIKUFmVbP2/Fo=
-google.golang.org/grpc v1.45.0 h1:NEpgUqV3Z+ZjkqMsxMg11IaDrXY4RY6CQukSGK0uI1M=
+google.golang.org/grpc v0.0.0-20180920234847-8997b5fa0873/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
+google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
+google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.0/go.mod h1:chYK+tFQF0nDUGJgXMSgLCQk3phJEuONr2DCgLDdAQM=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.22.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
+google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
+google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
+google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
+google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
+google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
+google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
+google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/examples v0.0.0-20210916203835-567da6b86340/go.mod h1:gID3PKrg7pWKntu9Ss6zTLJ0ttC0X9IHgREOCZwbCVU=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -2097,7 +2147,6 @@ gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qS
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fatih/pool.v2 v2.0.0/go.mod h1:8xVGeu1/2jr2wm5V9SPuMht2H5AEmf5aFMGSQixtjTY=
 gopkg.in/fsnotify.v1 v1.2.1/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/fsnotify/fsnotify.v1 v1.4.7 h1:XNNYLJHt73EyYiCZi6+xjupS9CpvmiDgjPTAjrBlQbo=
 gopkg.in/fsnotify/fsnotify.v1 v1.4.7/go.mod h1:Fyux9zXlo4rWoMSIzpn9fDAYjalPqJ/K1qJ27s+7ltE=
@@ -2121,7 +2170,6 @@ gopkg.in/olivere/elastic.v5 v5.0.70/go.mod h1:FylZT6jQWtfHsicejzOm3jIMVPOAksa80i
 gopkg.in/ory-am/dockertest.v3 v3.3.4/go.mod h1:s9mmoLkaGeAh97qygnNj4xWkiN7e1SKekYC6CovU+ek=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/telebot.v3 v3.0.0/go.mod h1:7rExV8/0mDDNu9epSrDm/8j22KLaActH1Tbee6YjzWg=
 gopkg.in/tomb.v1 v1.0.0-20140529071818-c131134a1947/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
@@ -2140,6 +2188,7 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
@@ -2147,6 +2196,7 @@ gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 honnef.co/go/netdb v0.0.0-20150201073656-a416d700ae39/go.mod h1:rbNo0ST5hSazCG4rGfpHrwnwvzP1QX62WbhzD+ghGzs=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/integration/loki_simple_scalable_test.go b/integration/loki_simple_scalable_test.go
index 47616b163eda..68673ff00290 100644
--- a/integration/loki_simple_scalable_test.go
+++ b/integration/loki_simple_scalable_test.go
@@ -12,69 +12,6 @@ import (
 	"github.com/grafana/loki/integration/cluster"
 )
 
-func TestSimpleScalable_Legacy_IngestQuery(t *testing.T) {
-	clu := cluster.New()
-	defer func() {
-		assert.NoError(t, clu.Cleanup())
-	}()
-
-	var (
-		tRead = clu.AddComponent(
-			"read",
-			"-target=read",
-		)
-		tWrite = clu.AddComponent(
-			"write",
-			"-target=write",
-		)
-	)
-
-	require.NoError(t, clu.Run())
-
-	tenantID := randStringRunes()
-
-	now := time.Now()
-	cliWrite := client.New(tenantID, "", tWrite.HTTPURL())
-	cliWrite.Now = now
-	cliRead := client.New(tenantID, "", tRead.HTTPURL())
-	cliRead.Now = now
-
-	t.Run("ingest logs", func(t *testing.T) {
-		// ingest some log lines
-		require.NoError(t, cliWrite.PushLogLineWithTimestamp("lineA", now.Add(-45*time.Minute), map[string]string{"job": "fake"}))
-		require.NoError(t, cliWrite.PushLogLineWithTimestamp("lineB", now.Add(-45*time.Minute), map[string]string{"job": "fake"}))
-
-		require.NoError(t, cliWrite.PushLogLine("lineC", map[string]string{"job": "fake"}))
-		require.NoError(t, cliWrite.PushLogLine("lineD", map[string]string{"job": "fake"}))
-	})
-
-	t.Run("query", func(t *testing.T) {
-		resp, err := cliRead.RunRangeQuery(context.Background(), `{job="fake"}`)
-		require.NoError(t, err)
-		assert.Equal(t, "streams", resp.Data.ResultType)
-
-		var lines []string
-		for _, stream := range resp.Data.Stream {
-			for _, val := range stream.Values {
-				lines = append(lines, val[1])
-			}
-		}
-		assert.ElementsMatch(t, []string{"lineA", "lineB", "lineC", "lineD"}, lines)
-	})
-
-	t.Run("label-names", func(t *testing.T) {
-		resp, err := cliRead.LabelNames(context.Background())
-		require.NoError(t, err)
-		assert.ElementsMatch(t, []string{"job"}, resp)
-	})
-
-	t.Run("label-values", func(t *testing.T) {
-		resp, err := cliRead.LabelValues(context.Background(), "job")
-		require.NoError(t, err)
-		assert.ElementsMatch(t, []string{"fake"}, resp)
-	})
-}
-
 func TestSimpleScalable_IngestQuery(t *testing.T) {
 	clu := cluster.New()
 	defer func() {
diff --git a/loki-build-image/Dockerfile b/loki-build-image/Dockerfile
index 19c4d3b277da..32a8f259e8ba 100644
--- a/loki-build-image/Dockerfile
+++ b/loki-build-image/Dockerfile
@@ -81,6 +81,16 @@ RUN apt-get update && \
     libsystemd-dev jq && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
+# Install dependencies to cross build Promtail to ARM and ARM64.
+RUN dpkg --add-architecture armhf && \
+    dpkg --add-architecture arm64 && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+    pkg-config \
+    gcc-aarch64-linux-gnu libc6-dev-arm64-cross libsystemd-dev:arm64 \
+    gcc-arm-linux-gnueabihf libc6-dev-armhf-cross libsystemd-dev:armhf && \
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
 COPY --from=docker /usr/bin/docker /usr/bin/docker
 COPY --from=helm /usr/bin/helm /usr/bin/helm
 COPY --from=helm /go/bin/helm-docs /usr/bin/helm-docs
diff --git a/loki-build-image/version-updater.sh b/loki-build-image/version-updater.sh
index 66c58c61ad27..75203c34a186 100755
--- a/loki-build-image/version-updater.sh
+++ b/loki-build-image/version-updater.sh
@@ -2,6 +2,15 @@
 
 set -euo pipefail
 
+# The BSD version of the sed command in MacOS doesn't work with this script.
+# Please install gnu-sed via `brew install gnu-sed`.
+# The gsed command becomes available then.
+SED="sed"
+if command -v gsed &> /dev/null ; then
+  echo "Using gsed"
+  SED="gsed"
+fi
+
 VERSION="${1-}"
 if [[ -z "${VERSION}" ]]; then
   >&2 echo "Usage: $0 <version>"
@@ -10,8 +19,8 @@ fi
 
 echo "Updating loki-build-image references to '${VERSION}'"
 
-find . -type f \( -name '*.yml' -o -name '*.yaml' -o -name '*Dockerfile*' \) -exec grep -lP "grafana/loki-build-image:[0-9]+" {} \; | grep -ve '.drone' |
+find . -type f \( -name '*.yml' -o -name '*.yaml' -o -name '*Dockerfile*' \) -exec grep -lE "grafana/loki-build-image:[0-9]+" {} \; | grep -ve '.drone' |
   while read -r x; do
     echo "Updating ${x}"
-    sed -i -re "s,grafana/loki-build-image:[0-9]+\.[0-9]+\.[0-9]+,grafana/loki-build-image:${VERSION},g" "${x}"
-  done
\ No newline at end of file
+    ${SED} -i -re "s,grafana/loki-build-image:[0-9]+\.[0-9]+\.[0-9]+,grafana/loki-build-image:${VERSION},g" "${x}"
+  done
diff --git a/operator/CHANGELOG.md b/operator/CHANGELOG.md
index 11b38a9e1135..b75b8ae62f61 100644
--- a/operator/CHANGELOG.md
+++ b/operator/CHANGELOG.md
@@ -1,5 +1,9 @@
 ## Main
 
+- [8173](https://github.com/grafana/loki/pull/8173) **periklis**: Remove custom webhook cert mounts for OLM-based deployment (OpenShift)
+- [8001](https://github.com/grafana/loki/pull/8001) **aminesnow**: Add API validation to Alertmanager header auth config
+- [8087](https://github.com/grafana/loki/pull/8087) **xperimental**: Fix status not updating when state of pods changes
+- [8068](https://github.com/grafana/loki/pull/8068) **periklis**: Use lokistack-gateway replicas from size table
 - [8068](https://github.com/grafana/loki/pull/8068) **periklis**: Use lokistack-gateway replicas from size table
 - [7839](https://github.com/grafana/loki/pull/7839) **aminesnow**: Configure Alertmanager per-tenant
 - [7910](https://github.com/grafana/loki/pull/7910) **periklis**: Update Loki operand to v2.7.1
diff --git a/operator/Dockerfile.cross b/operator/Dockerfile.cross
index a524e31728e6..7d54b08572c6 100644
--- a/operator/Dockerfile.cross
+++ b/operator/Dockerfile.cross
@@ -1,4 +1,4 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.25.0
+ARG BUILD_IMAGE=grafana/loki-build-image:0.27.0
 
 FROM golang:1.19.1-alpine as goenv
 RUN go env GOARCH > /goarch && \
diff --git a/operator/apis/config/v1/projectconfig_types.go b/operator/apis/config/v1/projectconfig_types.go
index 8348c23c6861..3650b6357bde 100644
--- a/operator/apis/config/v1/projectconfig_types.go
+++ b/operator/apis/config/v1/projectconfig_types.go
@@ -110,6 +110,8 @@ type FeatureGates struct {
 	AlertingRuleWebhook bool `json:"alertingRuleWebhook,omitempty"`
 	// RecordingRuleWebhook enables the RecordingRule CR validation webhook.
 	RecordingRuleWebhook bool `json:"recordingRuleWebhook,omitempty"`
+	// RulerConfigWebhook enables the RulerConfig CR validation webhook.
+	RulerConfigWebhook bool `json:"rulerConfigWebhook,omitempty"`
 
 	// When DefaultNodeAffinity is enabled the operator will set a default node affinity on all pods.
 	// This will limit scheduling of the pods to Nodes with Linux.
diff --git a/operator/apis/loki/v1/lokistack_types.go b/operator/apis/loki/v1/lokistack_types.go
index de550b5aae6b..54f22edabfde 100644
--- a/operator/apis/loki/v1/lokistack_types.go
+++ b/operator/apis/loki/v1/lokistack_types.go
@@ -739,7 +739,7 @@ const (
 	// ConditionReady defines the condition that all components in the Loki deployment are ready.
 	ConditionReady LokiStackConditionType = "Ready"
 
-	// ConditionPending defines the conditioin that some or all components are in pending state.
+	// ConditionPending defines the condition that some or all components are in pending state.
 	ConditionPending LokiStackConditionType = "Pending"
 
 	// ConditionFailed defines the condition that components in the Loki deployment failed to roll out.
diff --git a/operator/apis/loki/v1beta1/rulerconfig_types.go b/operator/apis/loki/v1beta1/rulerconfig_types.go
index bd5f985bcc5e..7e7b4ddba465 100644
--- a/operator/apis/loki/v1beta1/rulerconfig_types.go
+++ b/operator/apis/loki/v1beta1/rulerconfig_types.go
@@ -522,6 +522,7 @@ type RulerConfigStatus struct {
 
 //+kubebuilder:object:root=true
 //+kubebuilder:subresource:status
+//+kubebuilder:webhook:path=/validate-loki-grafana-com-v1beta1-rulerconfig,mutating=false,failurePolicy=fail,sideEffects=None,groups=loki.grafana.com,resources=rulerconfigs,verbs=create;update,versions=v1beta1,name=vrulerconfig.loki.grafana.com,admissionReviewVersions=v1
 
 // RulerConfig is the Schema for the rulerconfigs API
 //
diff --git a/operator/apis/loki/v1beta1/v1beta1.go b/operator/apis/loki/v1beta1/v1beta1.go
index 64409751721f..9efb16d2afaa 100644
--- a/operator/apis/loki/v1beta1/v1beta1.go
+++ b/operator/apis/loki/v1beta1/v1beta1.go
@@ -53,6 +53,8 @@ var (
 	ErrSchemaRetroactivelyRemoved = errors.New("Cannot retroactively remove schema(s)")
 	// ErrSchemaRetroactivelyChanged when a schema has been retroactively changed
 	ErrSchemaRetroactivelyChanged = errors.New("Cannot retroactively change schema")
+	// ErrHeaderAuthCredentialsConflict when both Credentials and CredentialsFile are used in a header authentication client.
+	ErrHeaderAuthCredentialsConflict = errors.New("credentials and credentialsFile cannot be used at the same time")
 
 	// ErrRuleMustMatchNamespace indicates that an expression used in an alerting or recording rule is missing
 	// matchers for a namespace.
diff --git a/operator/bundle/manifests/loki-operator-manager-config_v1_configmap.yaml b/operator/bundle/manifests/loki-operator-manager-config_v1_configmap.yaml
index 5460d05bdcac..00ad5b103f7e 100644
--- a/operator/bundle/manifests/loki-operator-manager-config_v1_configmap.yaml
+++ b/operator/bundle/manifests/loki-operator-manager-config_v1_configmap.yaml
@@ -49,6 +49,7 @@ data:
       lokiStackWebhook: true
       alertingRuleWebhook: true
       recordingRuleWebhook: true
+      rulerConfigWebhook: true
       #
       # OpenShift feature gates
       #
diff --git a/operator/bundle/manifests/loki-operator-webhook-service_v1_service.yaml b/operator/bundle/manifests/loki-operator-webhook-service_v1_service.yaml
index ce1a245ce7c8..496ea49a9557 100644
--- a/operator/bundle/manifests/loki-operator-webhook-service_v1_service.yaml
+++ b/operator/bundle/manifests/loki-operator-webhook-service_v1_service.yaml
@@ -1,8 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    service.beta.openshift.io/serving-cert-secret-name: loki-operator-webhook-service
   creationTimestamp: null
   labels:
     app.kubernetes.io/instance: loki-operator-v0.0.1
diff --git a/operator/bundle/manifests/loki-operator.clusterserviceversion.yaml b/operator/bundle/manifests/loki-operator.clusterserviceversion.yaml
index 9ff665a728c2..25f62be6d2fd 100644
--- a/operator/bundle/manifests/loki-operator.clusterserviceversion.yaml
+++ b/operator/bundle/manifests/loki-operator.clusterserviceversion.yaml
@@ -1491,9 +1491,6 @@ spec:
                     drop:
                     - ALL
                 volumeMounts:
-                - mountPath: /tmp/k8s-webhook-server/serving-certs
-                  name: webhook-cert
-                  readOnly: true
                 - mountPath: /controller_manager_config.yaml
                   name: manager-config
                   subPath: controller_manager_config.yaml
@@ -1526,10 +1523,6 @@ spec:
                 runAsNonRoot: true
               terminationGracePeriodSeconds: 10
               volumes:
-              - name: webhook-cert
-                secret:
-                  defaultMode: 420
-                  secretName: loki-operator-webhook-service
               - configMap:
                   name: loki-operator-manager-config
                 name: manager-config
@@ -1666,3 +1659,23 @@ spec:
     targetPort: 9443
     type: ValidatingAdmissionWebhook
     webhookPath: /validate-loki-grafana-com-v1beta1-recordingrule
+  - admissionReviewVersions:
+    - v1
+    containerPort: 443
+    deploymentName: loki-operator-controller-manager
+    failurePolicy: Fail
+    generateName: vrulerconfig.loki.grafana.com
+    rules:
+    - apiGroups:
+      - loki.grafana.com
+      apiVersions:
+      - v1beta1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - rulerconfigs
+    sideEffects: None
+    targetPort: 9443
+    type: ValidatingAdmissionWebhook
+    webhookPath: /validate-loki-grafana-com-v1beta1-rulerconfig
diff --git a/operator/config/crd/bases/config.grafana.com_projectconfigs.yaml b/operator/config/crd/bases/config.grafana.com_projectconfigs.yaml
index a25f876fb0e2..928bf53ad826 100644
--- a/operator/config/crd/bases/config.grafana.com_projectconfigs.yaml
+++ b/operator/config/crd/bases/config.grafana.com_projectconfigs.yaml
@@ -72,6 +72,8 @@ spec:
                 type: boolean
               enableRecordingRuleWebhook:
                 type: boolean
+              enableRulerConfigWebhook:
+                type: boolean
               enableServiceMonitors:
                 type: boolean
               enableTlsGrpcServices:
diff --git a/operator/config/overlays/development/controller_manager_config.yaml b/operator/config/overlays/development/controller_manager_config.yaml
index 41707961d9f4..4dcad4d8b858 100644
--- a/operator/config/overlays/development/controller_manager_config.yaml
+++ b/operator/config/overlays/development/controller_manager_config.yaml
@@ -26,3 +26,4 @@ featureGates:
   lokiStackWebhook: false
   alertingRuleWebhook: false
   recordingRuleWebhook: false
+  rulerConfigWebhook: false
diff --git a/operator/config/overlays/openshift/controller_manager_config.yaml b/operator/config/overlays/openshift/controller_manager_config.yaml
index 8f1fc39b812d..8123eb0a3bf0 100644
--- a/operator/config/overlays/openshift/controller_manager_config.yaml
+++ b/operator/config/overlays/openshift/controller_manager_config.yaml
@@ -46,6 +46,7 @@ featureGates:
   lokiStackWebhook: true
   alertingRuleWebhook: true
   recordingRuleWebhook: true
+  rulerConfigWebhook: true
   #
   # OpenShift feature gates
   #
diff --git a/operator/config/overlays/openshift/kustomization.yaml b/operator/config/overlays/openshift/kustomization.yaml
index 032f2aaef567..780faf6a38c8 100644
--- a/operator/config/overlays/openshift/kustomization.yaml
+++ b/operator/config/overlays/openshift/kustomization.yaml
@@ -40,7 +40,6 @@ patchesStrategicMerge:
 - manager_run_flags_patch.yaml
 - manager_webhook_patch.yaml
 - prometheus_service_monitor_patch.yaml
-- webhook_service_annotations_patch.yaml
 
 images:
 - name: controller
diff --git a/operator/config/overlays/openshift/manager_webhook_patch.yaml b/operator/config/overlays/openshift/manager_webhook_patch.yaml
index dc95a45f77ce..4d96970e0da5 100644
--- a/operator/config/overlays/openshift/manager_webhook_patch.yaml
+++ b/operator/config/overlays/openshift/manager_webhook_patch.yaml
@@ -11,12 +11,3 @@ spec:
         - containerPort: 9443
           name: webhook-server
           protocol: TCP
-        volumeMounts:
-        - mountPath: /tmp/k8s-webhook-server/serving-certs
-          name: webhook-cert
-          readOnly: true
-      volumes:
-      - name: webhook-cert
-        secret:
-          defaultMode: 420
-          secretName: loki-operator-webhook-service
diff --git a/operator/config/overlays/openshift/webhook_service_annotations_patch.yaml b/operator/config/overlays/openshift/webhook_service_annotations_patch.yaml
deleted file mode 100644
index 3d6d200ef59e..000000000000
--- a/operator/config/overlays/openshift/webhook_service_annotations_patch.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    service.beta.openshift.io/serving-cert-secret-name: loki-operator-webhook-service
-  name: webhook-service
-  namespace: system
diff --git a/operator/config/webhook/manifests.yaml b/operator/config/webhook/manifests.yaml
index 301dd653d701..ec0138d3b20e 100644
--- a/operator/config/webhook/manifests.yaml
+++ b/operator/config/webhook/manifests.yaml
@@ -65,3 +65,23 @@ webhooks:
     resources:
     - recordingrules
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-loki-grafana-com-v1beta1-rulerconfig
+  failurePolicy: Fail
+  name: vrulerconfig.loki.grafana.com
+  rules:
+  - apiGroups:
+    - loki.grafana.com
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - rulerconfigs
+  sideEffects: None
diff --git a/operator/controllers/loki/internal/lokistack/certrotation_discovery.go b/operator/controllers/loki/internal/lokistack/certrotation_discovery.go
index c92e0115016c..cefbfd325458 100644
--- a/operator/controllers/loki/internal/lokistack/certrotation_discovery.go
+++ b/operator/controllers/loki/internal/lokistack/certrotation_discovery.go
@@ -31,13 +31,8 @@ func AnnotateForRequiredCertRotation(ctx context.Context, k k8s.Client, name, na
 	}
 
 	ss := s.DeepCopy()
-	if ss.Annotations == nil {
-		ss.Annotations = make(map[string]string)
-	}
-
-	ss.Annotations[certRotationRequiredAtKey] = time.Now().UTC().Format(time.RFC3339)
-
-	if err := k.Update(ctx, ss); err != nil {
+	timeStamp := time.Now().UTC().Format(time.RFC3339)
+	if err := updateAnnotation(ctx, k, ss, certRotationRequiredAtKey, timeStamp); err != nil {
 		return kverrors.Wrap(err, fmt.Sprintf("failed to update lokistack `%s` annotation", certRotationRequiredAtKey), "key", key)
 	}
 
diff --git a/operator/controllers/loki/internal/lokistack/ruler_config_discovery.go b/operator/controllers/loki/internal/lokistack/ruler_config_discovery.go
index f4f2e00d9aef..ce7195b36893 100644
--- a/operator/controllers/loki/internal/lokistack/ruler_config_discovery.go
+++ b/operator/controllers/loki/internal/lokistack/ruler_config_discovery.go
@@ -11,6 +11,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+const (
+	annotationRulerConfigDiscoveredAt = "loki.grafana.com/rulerConfigDiscoveredAt"
+)
+
 // AnnotateForRulerConfig adds/updates the `loki.grafana.com/rulerConfigDiscoveredAt` annotation
 // to the named Lokistack in the same namespace of the RulerConfig. If no LokiStack is found, then
 // skip reconciliation.
@@ -28,13 +32,8 @@ func AnnotateForRulerConfig(ctx context.Context, k k8s.Client, name, namespace s
 	}
 
 	ss := s.DeepCopy()
-	if ss.Annotations == nil {
-		ss.Annotations = make(map[string]string)
-	}
-
-	ss.Annotations["loki.grafana.com/rulerConfigDiscoveredAt"] = time.Now().UTC().Format(time.RFC3339)
-
-	if err := k.Update(ctx, ss); err != nil {
+	timeStamp := time.Now().UTC().Format(time.RFC3339)
+	if err := updateAnnotation(ctx, k, ss, annotationRulerConfigDiscoveredAt, timeStamp); err != nil {
 		return kverrors.Wrap(err, "failed to update lokistack `rulerConfigDiscoveredAt` annotation", "key", key)
 	}
 
diff --git a/operator/controllers/loki/internal/lokistack/rules_discovery.go b/operator/controllers/loki/internal/lokistack/rules_discovery.go
index f5082d7884de..fb1a3ce071df 100644
--- a/operator/controllers/loki/internal/lokistack/rules_discovery.go
+++ b/operator/controllers/loki/internal/lokistack/rules_discovery.go
@@ -11,9 +11,15 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+const (
+	annotationRulesDiscoveredAt = "loki.grafana.com/rulesDiscoveredAt"
+)
+
 // AnnotateForDiscoveredRules adds/updates the `loki.grafana.com/rulesDiscoveredAt` annotation
 // to all instance of LokiStack on all namespaces to trigger the reconciliation loop.
 func AnnotateForDiscoveredRules(ctx context.Context, k k8s.Client) error {
+	timeStamp := time.Now().UTC().Format(time.RFC3339)
+
 	var stacks lokiv1.LokiStackList
 	err := k.List(ctx, &stacks, client.MatchingLabelsSelector{Selector: labels.Everything()})
 	if err != nil {
@@ -22,13 +28,7 @@ func AnnotateForDiscoveredRules(ctx context.Context, k k8s.Client) error {
 
 	for _, s := range stacks.Items {
 		ss := s.DeepCopy()
-		if ss.Annotations == nil {
-			ss.Annotations = make(map[string]string)
-		}
-
-		ss.Annotations["loki.grafana.com/rulesDiscoveredAt"] = time.Now().UTC().Format(time.RFC3339)
-
-		if err := k.Update(ctx, ss); err != nil {
+		if err := updateAnnotation(ctx, k, ss, annotationRulesDiscoveredAt, timeStamp); err != nil {
 			return kverrors.Wrap(err, "failed to update lokistack `rulesDiscoveredAt` annotation", "name", ss.Name, "namespace", ss.Namespace)
 		}
 	}
diff --git a/operator/controllers/loki/internal/lokistack/update.go b/operator/controllers/loki/internal/lokistack/update.go
new file mode 100644
index 000000000000..aca04ab85549
--- /dev/null
+++ b/operator/controllers/loki/internal/lokistack/update.go
@@ -0,0 +1,43 @@
+package lokistack
+
+import (
+	"context"
+
+	lokiv1 "github.com/grafana/loki/operator/apis/loki/v1"
+	"github.com/grafana/loki/operator/internal/external/k8s"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func updateAnnotation(ctx context.Context, k k8s.Client, stack *lokiv1.LokiStack, key, value string) error {
+	if stack.Annotations == nil {
+		stack.Annotations = make(map[string]string)
+	}
+	stack.Annotations[key] = value
+
+	err := k.Update(ctx, stack)
+	switch {
+	case err == nil:
+		return nil
+	case errors.IsConflict(err):
+		// break into retry logic below on conflict
+		break
+	case err != nil:
+		return err
+	}
+
+	objectKey := client.ObjectKeyFromObject(stack)
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		if err := k.Get(ctx, objectKey, stack); err != nil {
+			return err
+		}
+
+		if stack.Annotations == nil {
+			stack.Annotations = make(map[string]string)
+		}
+		stack.Annotations[key] = value
+
+		return k.Update(ctx, stack)
+	})
+}
diff --git a/operator/controllers/loki/lokistack_controller.go b/operator/controllers/loki/lokistack_controller.go
index e60d048b2dd6..c9dd7b58341e 100644
--- a/operator/controllers/loki/lokistack_controller.go
+++ b/operator/controllers/loki/lokistack_controller.go
@@ -76,6 +76,22 @@ var (
 		},
 		GenericFunc: func(e event.GenericEvent) bool { return false },
 	})
+	updateOrDeleteWithStatusPred = builder.WithPredicates(predicate.Funcs{
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			return e.ObjectOld.GetGeneration() != e.ObjectNew.GetGeneration() || statusDifferent(e)
+		},
+		CreateFunc: func(_ event.CreateEvent) bool {
+			return false
+		},
+		DeleteFunc: func(e event.DeleteEvent) bool {
+			// DeleteStateUnknown evaluates to false only if the object
+			// has been confirmed as deleted by the api server.
+			return !e.DeleteStateUnknown
+		},
+		GenericFunc: func(_ event.GenericEvent) bool {
+			return false
+		},
+	})
 )
 
 // LokiStackReconciler reconciles a LokiStack object
@@ -173,8 +189,8 @@ func (r *LokiStackReconciler) buildController(bld k8s.Builder) error {
 		Owns(&corev1.Secret{}, updateOrDeleteOnlyPred).
 		Owns(&corev1.ServiceAccount{}, updateOrDeleteOnlyPred).
 		Owns(&corev1.Service{}, updateOrDeleteOnlyPred).
-		Owns(&appsv1.Deployment{}, updateOrDeleteOnlyPred).
-		Owns(&appsv1.StatefulSet{}, updateOrDeleteOnlyPred).
+		Owns(&appsv1.Deployment{}, updateOrDeleteWithStatusPred).
+		Owns(&appsv1.StatefulSet{}, updateOrDeleteWithStatusPred).
 		Owns(&rbacv1.ClusterRole{}, updateOrDeleteOnlyPred).
 		Owns(&rbacv1.ClusterRoleBinding{}, updateOrDeleteOnlyPred).
 		Owns(&rbacv1.Role{}, updateOrDeleteOnlyPred).
@@ -224,3 +240,16 @@ func (r *LokiStackReconciler) enqueueAllLokiStacksHandler() handler.EventHandler
 		return requests
 	})
 }
+
+func statusDifferent(e event.UpdateEvent) bool {
+	switch old := e.ObjectOld.(type) {
+	case *appsv1.Deployment:
+		newObject := e.ObjectNew.(*appsv1.Deployment)
+		return cmp.Diff(old.Status, newObject.Status) != ""
+	case *appsv1.StatefulSet:
+		newObject := e.ObjectNew.(*appsv1.StatefulSet)
+		return cmp.Diff(old.Status, newObject.Status) != ""
+	default:
+		return false
+	}
+}
diff --git a/operator/controllers/loki/lokistack_controller_test.go b/operator/controllers/loki/lokistack_controller_test.go
index dc066218f949..1bd497c24d5d 100644
--- a/operator/controllers/loki/lokistack_controller_test.go
+++ b/operator/controllers/loki/lokistack_controller_test.go
@@ -110,13 +110,13 @@ func TestLokiStackController_RegisterOwnedResourcesForUpdateOrDeleteOnly(t *test
 			obj:           &appsv1.Deployment{},
 			index:         4,
 			ownCallsCount: 11,
-			pred:          updateOrDeleteOnlyPred,
+			pred:          updateOrDeleteWithStatusPred,
 		},
 		{
 			obj:           &appsv1.StatefulSet{},
 			index:         5,
 			ownCallsCount: 11,
-			pred:          updateOrDeleteOnlyPred,
+			pred:          updateOrDeleteWithStatusPred,
 		},
 		{
 			obj:           &rbacv1.ClusterRole{},
diff --git a/operator/docs/lokistack/object_storage.md b/operator/docs/lokistack/object_storage.md
index 935c840ac761..a5f0e252e4fc 100644
--- a/operator/docs/lokistack/object_storage.md
+++ b/operator/docs/lokistack/object_storage.md
@@ -130,7 +130,7 @@ Loki Operator supports [AWS S3](https://aws.amazon.com/), [Azure](https://azure.
 
     ```console
     kubectl create secret generic lokistack-dev-minio \
-      --from-literal=bucketname="<BUCKET_NAME>" \
+      --from-literal=bucketnames="<BUCKET_NAME>" \
       --from-literal=endpoint="<MINIO_BUCKET_ENDPOINT>" \
       --from-literal=access_key_id="<MINIO_ACCESS_KEY_ID>" \
       --from-literal=access_key_secret="<MINIO_ACCESS_KEY_SECRET>"
@@ -165,7 +165,7 @@ Loki Operator supports [AWS S3](https://aws.amazon.com/), [Azure](https://azure.
 
     ```console
     kubectl create secret generic lokistack-dev-odf \
-      --from-literal=bucketname="<BUCKET_NAME>" \
+      --from-literal=bucketnames="<BUCKET_NAME>" \
       --from-literal=endpoint="https://s3.openshift-storage.svc" \
       --from-literal=access_key_id="<ACCESS_KEY_ID>" \
       --from-literal=access_key_secret="<ACCESS_KEY_SECRET>"
diff --git a/operator/go.mod b/operator/go.mod
index d9250c1988c4..329d64bcea88 100644
--- a/operator/go.mod
+++ b/operator/go.mod
@@ -122,7 +122,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common/sigv4 v0.1.0 // indirect
-	github.com/prometheus/exporter-toolkit v0.7.1 // indirect
+	github.com/prometheus/exporter-toolkit v0.7.3 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/sercand/kuberesolver v2.4.0+incompatible // indirect
diff --git a/operator/go.sum b/operator/go.sum
index c21b90bfdff3..9f831634cdf7 100644
--- a/operator/go.sum
+++ b/operator/go.sum
@@ -1074,8 +1074,9 @@ github.com/prometheus/common/sigv4 v0.1.0 h1:qoVebwtwwEhS85Czm2dSROY5fTo2PAPEVdD
 github.com/prometheus/common/sigv4 v0.1.0/go.mod h1:2Jkxxk9yYvCkE5G1sQT7GuEXm57JrvHu9k5YwTjsNtI=
 github.com/prometheus/exporter-toolkit v0.6.1/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g=
 github.com/prometheus/exporter-toolkit v0.7.0/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g=
-github.com/prometheus/exporter-toolkit v0.7.1 h1:c6RXaK8xBVercEeUQ4tRNL8UGWzDHfvj9dseo1FcK1Y=
 github.com/prometheus/exporter-toolkit v0.7.1/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g=
+github.com/prometheus/exporter-toolkit v0.7.3 h1:IYBn0CTGi/nYxstdTUKysuSofUNJ3DQW3FmZ/Ub6rgU=
+github.com/prometheus/exporter-toolkit v0.7.3/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
diff --git a/operator/internal/status/lokistack.go b/operator/internal/status/lokistack.go
index 0a8304719feb..f0d06133720d 100644
--- a/operator/internal/status/lokistack.go
+++ b/operator/internal/status/lokistack.go
@@ -7,11 +7,17 @@ import (
 	"github.com/ViaQ/logerr/v2/kverrors"
 	lokiv1 "github.com/grafana/loki/operator/apis/loki/v1"
 	"github.com/grafana/loki/operator/internal/external/k8s"
+	"k8s.io/client-go/util/retry"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+const (
+	messageReady   = "All components ready"
+	messageFailed  = "Some LokiStack components failed"
+	messagePending = "Some LokiStack components pending on dependencies"
 )
 
 // DegradedError contains information about why the managed LokiStack has an invalid configuration.
@@ -28,183 +34,97 @@ func (e *DegradedError) Error() string {
 // SetReadyCondition updates or appends the condition Ready to the lokistack status conditions.
 // In addition it resets all other Status conditions to false.
 func SetReadyCondition(ctx context.Context, k k8s.Client, req ctrl.Request) error {
-	var s lokiv1.LokiStack
-	if err := k.Get(ctx, req.NamespacedName, &s); err != nil {
-		if apierrors.IsNotFound(err) {
-			return nil
-		}
-		return kverrors.Wrap(err, "failed to lookup lokistack", "name", req.NamespacedName)
-	}
-
-	for _, cond := range s.Status.Conditions {
-		if cond.Type == string(lokiv1.ConditionReady) && cond.Status == metav1.ConditionTrue {
-			return nil
-		}
-	}
-
 	ready := metav1.Condition{
-		Type:               string(lokiv1.ConditionReady),
-		Status:             metav1.ConditionTrue,
-		LastTransitionTime: metav1.Now(),
-		Message:            "All components ready",
-		Reason:             string(lokiv1.ReasonReadyComponents),
-	}
-
-	index := -1
-	for i := range s.Status.Conditions {
-		// Reset all other conditions first
-		s.Status.Conditions[i].Status = metav1.ConditionFalse
-		s.Status.Conditions[i].LastTransitionTime = metav1.Now()
-
-		// Locate existing ready condition if any
-		if s.Status.Conditions[i].Type == string(lokiv1.ConditionReady) {
-			index = i
-		}
+		Type:    string(lokiv1.ConditionReady),
+		Message: messageReady,
+		Reason:  string(lokiv1.ReasonReadyComponents),
 	}
 
-	if index == -1 {
-		s.Status.Conditions = append(s.Status.Conditions, ready)
-	} else {
-		s.Status.Conditions[index] = ready
-	}
-
-	return k.Status().Update(ctx, &s, &client.UpdateOptions{})
+	return updateCondition(ctx, k, req, ready)
 }
 
 // SetFailedCondition updates or appends the condition Failed to the lokistack status conditions.
 // In addition it resets all other Status conditions to false.
 func SetFailedCondition(ctx context.Context, k k8s.Client, req ctrl.Request) error {
-	var s lokiv1.LokiStack
-	if err := k.Get(ctx, req.NamespacedName, &s); err != nil {
-		if apierrors.IsNotFound(err) {
-			return nil
-		}
-		return kverrors.Wrap(err, "failed to lookup lokistack", "name", req.NamespacedName)
-	}
-
-	for _, cond := range s.Status.Conditions {
-		if cond.Type == string(lokiv1.ConditionFailed) && cond.Status == metav1.ConditionTrue {
-			return nil
-		}
-	}
-
 	failed := metav1.Condition{
-		Type:               string(lokiv1.ConditionFailed),
-		Status:             metav1.ConditionTrue,
-		LastTransitionTime: metav1.Now(),
-		Message:            "Some LokiStack components failed",
-		Reason:             string(lokiv1.ReasonFailedComponents),
-	}
-
-	index := -1
-	for i := range s.Status.Conditions {
-		// Reset all other conditions first
-		s.Status.Conditions[i].Status = metav1.ConditionFalse
-		s.Status.Conditions[i].LastTransitionTime = metav1.Now()
-
-		// Locate existing failed condition if any
-		if s.Status.Conditions[i].Type == string(lokiv1.ConditionFailed) {
-			index = i
-		}
-	}
-
-	if index == -1 {
-		s.Status.Conditions = append(s.Status.Conditions, failed)
-	} else {
-		s.Status.Conditions[index] = failed
+		Type:    string(lokiv1.ConditionFailed),
+		Message: messageFailed,
+		Reason:  string(lokiv1.ReasonFailedComponents),
 	}
 
-	return k.Status().Update(ctx, &s, &client.UpdateOptions{})
+	return updateCondition(ctx, k, req, failed)
 }
 
 // SetPendingCondition updates or appends the condition Pending to the lokistack status conditions.
 // In addition it resets all other Status conditions to false.
 func SetPendingCondition(ctx context.Context, k k8s.Client, req ctrl.Request) error {
-	var s lokiv1.LokiStack
-	if err := k.Get(ctx, req.NamespacedName, &s); err != nil {
-		if apierrors.IsNotFound(err) {
-			return nil
-		}
-		return kverrors.Wrap(err, "failed to lookup lokistack", "name", req.NamespacedName)
-	}
-
-	for _, cond := range s.Status.Conditions {
-		if cond.Type == string(lokiv1.ConditionPending) && cond.Status == metav1.ConditionTrue {
-			return nil
-		}
-	}
-
 	pending := metav1.Condition{
-		Type:               string(lokiv1.ConditionPending),
-		Status:             metav1.ConditionTrue,
-		LastTransitionTime: metav1.Now(),
-		Message:            "Some LokiStack components pending on dependendies",
-		Reason:             string(lokiv1.ReasonPendingComponents),
+		Type:    string(lokiv1.ConditionPending),
+		Message: messagePending,
+		Reason:  string(lokiv1.ReasonPendingComponents),
 	}
 
-	index := -1
-	for i := range s.Status.Conditions {
-		// Reset all other conditions first
-		s.Status.Conditions[i].Status = metav1.ConditionFalse
-		s.Status.Conditions[i].LastTransitionTime = metav1.Now()
-
-		// Locate existing pending condition if any
-		if s.Status.Conditions[i].Type == string(lokiv1.ConditionPending) {
-			index = i
-		}
-	}
+	return updateCondition(ctx, k, req, pending)
+}
 
-	if index == -1 {
-		s.Status.Conditions = append(s.Status.Conditions, pending)
-	} else {
-		s.Status.Conditions[index] = pending
+// SetDegradedCondition appends the condition Degraded to the lokistack status conditions.
+func SetDegradedCondition(ctx context.Context, k k8s.Client, req ctrl.Request, msg string, reason lokiv1.LokiStackConditionReason) error {
+	degraded := metav1.Condition{
+		Type:    string(lokiv1.ConditionDegraded),
+		Message: msg,
+		Reason:  string(reason),
 	}
 
-	return k.Status().Update(ctx, &s, &client.UpdateOptions{})
+	return updateCondition(ctx, k, req, degraded)
 }
 
-// SetDegradedCondition appends the condition Degraded to the lokistack status conditions.
-func SetDegradedCondition(ctx context.Context, k k8s.Client, req ctrl.Request, msg string, reason lokiv1.LokiStackConditionReason) error {
-	var s lokiv1.LokiStack
-	if err := k.Get(ctx, req.NamespacedName, &s); err != nil {
+func updateCondition(ctx context.Context, k k8s.Client, req ctrl.Request, condition metav1.Condition) error {
+	var stack lokiv1.LokiStack
+	if err := k.Get(ctx, req.NamespacedName, &stack); err != nil {
 		if apierrors.IsNotFound(err) {
 			return nil
 		}
-		return kverrors.Wrap(err, "failed to lookup lokistack", "name", req.NamespacedName)
+		return kverrors.Wrap(err, "failed to lookup LokiStack", "name", req.NamespacedName)
 	}
 
-	reasonStr := string(reason)
-	for _, cond := range s.Status.Conditions {
-		if cond.Type == string(lokiv1.ConditionDegraded) && cond.Reason == reasonStr && cond.Status == metav1.ConditionTrue {
+	for _, c := range stack.Status.Conditions {
+		if c.Type == condition.Type &&
+			c.Reason == condition.Reason &&
+			c.Message == condition.Message &&
+			c.Status == metav1.ConditionTrue {
+			// resource already has desired condition
 			return nil
 		}
 	}
 
-	degraded := metav1.Condition{
-		Type:               string(lokiv1.ConditionDegraded),
-		Status:             metav1.ConditionTrue,
-		LastTransitionTime: metav1.Now(),
-		Reason:             reasonStr,
-		Message:            msg,
-	}
+	condition.Status = metav1.ConditionTrue
+
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		if err := k.Get(ctx, req.NamespacedName, &stack); err != nil {
+			return err
+		}
+
+		now := metav1.Now()
+		condition.LastTransitionTime = now
 
-	index := -1
-	for i := range s.Status.Conditions {
-		// Reset all other conditions first
-		s.Status.Conditions[i].Status = metav1.ConditionFalse
-		s.Status.Conditions[i].LastTransitionTime = metav1.Now()
+		index := -1
+		for i := range stack.Status.Conditions {
+			// Reset all other conditions first
+			stack.Status.Conditions[i].Status = metav1.ConditionFalse
+			stack.Status.Conditions[i].LastTransitionTime = now
 
-		// Locate existing pending condition if any
-		if s.Status.Conditions[i].Type == string(lokiv1.ConditionDegraded) {
-			index = i
+			// Locate existing pending condition if any
+			if stack.Status.Conditions[i].Type == condition.Type {
+				index = i
+			}
 		}
-	}
 
-	if index == -1 {
-		s.Status.Conditions = append(s.Status.Conditions, degraded)
-	} else {
-		s.Status.Conditions[index] = degraded
-	}
+		if index == -1 {
+			stack.Status.Conditions = append(stack.Status.Conditions, condition)
+		} else {
+			stack.Status.Conditions[index] = condition
+		}
 
-	return k.Status().Update(ctx, &s, &client.UpdateOptions{})
+		return k.Status().Update(ctx, &stack)
+	})
 }
diff --git a/operator/internal/status/lokistack_test.go b/operator/internal/status/lokistack_test.go
index 8e507aad2b6b..4208cd9c2dea 100644
--- a/operator/internal/status/lokistack_test.go
+++ b/operator/internal/status/lokistack_test.go
@@ -1,4 +1,4 @@
-package status_test
+package status
 
 import (
 	"context"
@@ -6,7 +6,6 @@ import (
 
 	lokiv1 "github.com/grafana/loki/operator/apis/loki/v1"
 	"github.com/grafana/loki/operator/internal/external/k8s/k8sfakes"
-	"github.com/grafana/loki/operator/internal/status"
 
 	"github.com/stretchr/testify/require"
 
@@ -18,9 +17,29 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-func TestSetReadyCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.T) {
+func setupFakesNoError(t *testing.T, stack *lokiv1.LokiStack) (*k8sfakes.FakeClient, *k8sfakes.FakeStatusWriter) {
+	sw := &k8sfakes.FakeStatusWriter{}
 	k := &k8sfakes.FakeClient{}
+	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
+		if name.Name == stack.Name && name.Namespace == stack.Namespace {
+			k.SetClientObject(object, stack)
+			return nil
+		}
+		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
+	}
+	k.StatusStub = func() client.StatusWriter { return sw }
+
+	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
+		actual := obj.(*lokiv1.LokiStack)
+		require.NotEmpty(t, actual.Status.Conditions)
+		require.Equal(t, metav1.ConditionTrue, actual.Status.Conditions[0].Status)
+		return nil
+	}
+
+	return k, sw
+}
 
+func TestSetReadyCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.T) {
 	r := ctrl.Request{
 		NamespacedName: types.NamespacedName{
 			Name:      "my-stack",
@@ -28,17 +47,16 @@ func TestSetReadyCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.T
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewBadRequest("something wasn't found")
 	}
 
-	err := status.SetReadyCondition(context.TODO(), k, r)
+	err := SetReadyCondition(context.Background(), k, r)
 	require.Error(t, err)
 }
 
 func TestSetReadyCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	r := ctrl.Request{
 		NamespacedName: types.NamespacedName{
 			Name:      "my-stack",
@@ -46,17 +64,16 @@ func TestSetReadyCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testing.
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
 	}
 
-	err := status.SetReadyCondition(context.TODO(), k, r)
+	err := SetReadyCondition(context.Background(), k, r)
 	require.NoError(t, err)
 }
 
 func TestSetReadyCondition_WhenExisting_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -65,8 +82,10 @@ func TestSetReadyCondition_WhenExisting_DoNothing(t *testing.T) {
 		Status: lokiv1.LokiStackStatus{
 			Conditions: []metav1.Condition{
 				{
-					Type:   string(lokiv1.ConditionReady),
-					Status: metav1.ConditionTrue,
+					Type:    string(lokiv1.ConditionReady),
+					Message: messageReady,
+					Reason:  string(lokiv1.ReasonReadyComponents),
+					Status:  metav1.ConditionTrue,
 				},
 			},
 		},
@@ -79,25 +98,14 @@ func TestSetReadyCondition_WhenExisting_DoNothing(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, _ := setupFakesNoError(t, &s)
 
-	err := status.SetReadyCondition(context.TODO(), k, r)
+	err := SetReadyCondition(context.Background(), k, r)
 	require.NoError(t, err)
 	require.Zero(t, k.StatusCallCount())
 }
 
 func TestSetReadyCondition_WhenExisting_SetReadyConditionTrue(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -120,22 +128,9 @@ func TestSetReadyCondition_WhenExisting_SetReadyConditionTrue(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
-
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		require.Equal(t, metav1.ConditionTrue, actual.Status.Conditions[0].Status)
-		return nil
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	err := status.SetReadyCondition(context.TODO(), k, r)
+	err := SetReadyCondition(context.Background(), k, r)
 	require.NoError(t, err)
 
 	require.NotZero(t, k.StatusCallCount())
@@ -143,11 +138,6 @@ func TestSetReadyCondition_WhenExisting_SetReadyConditionTrue(t *testing.T) {
 }
 
 func TestSetReadyCondition_WhenNoneExisting_AppendReadyCondition(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -162,21 +152,9 @@ func TestSetReadyCondition_WhenNoneExisting_AppendReadyCondition(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		return nil
-	}
-
-	err := status.SetReadyCondition(context.TODO(), k, r)
+	err := SetReadyCondition(context.Background(), k, r)
 	require.NoError(t, err)
 
 	require.NotZero(t, k.StatusCallCount())
@@ -184,8 +162,6 @@ func TestSetReadyCondition_WhenNoneExisting_AppendReadyCondition(t *testing.T) {
 }
 
 func TestSetFailedCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	r := ctrl.Request{
 		NamespacedName: types.NamespacedName{
 			Name:      "my-stack",
@@ -193,17 +169,16 @@ func TestSetFailedCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewBadRequest("something wasn't found")
 	}
 
-	err := status.SetFailedCondition(context.TODO(), k, r)
+	err := SetFailedCondition(context.Background(), k, r)
 	require.Error(t, err)
 }
 
 func TestSetFailedCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	r := ctrl.Request{
 		NamespacedName: types.NamespacedName{
 			Name:      "my-stack",
@@ -211,17 +186,16 @@ func TestSetFailedCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testing
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
 	}
 
-	err := status.SetFailedCondition(context.TODO(), k, r)
+	err := SetFailedCondition(context.Background(), k, r)
 	require.NoError(t, err)
 }
 
 func TestSetFailedCondition_WhenExisting_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -230,8 +204,10 @@ func TestSetFailedCondition_WhenExisting_DoNothing(t *testing.T) {
 		Status: lokiv1.LokiStackStatus{
 			Conditions: []metav1.Condition{
 				{
-					Type:   string(lokiv1.ConditionFailed),
-					Status: metav1.ConditionTrue,
+					Type:    string(lokiv1.ConditionFailed),
+					Reason:  string(lokiv1.ReasonFailedComponents),
+					Message: messageFailed,
+					Status:  metav1.ConditionTrue,
 				},
 			},
 		},
@@ -244,25 +220,14 @@ func TestSetFailedCondition_WhenExisting_DoNothing(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, _ := setupFakesNoError(t, &s)
 
-	err := status.SetFailedCondition(context.TODO(), k, r)
+	err := SetFailedCondition(context.Background(), k, r)
 	require.NoError(t, err)
 	require.Zero(t, k.StatusCallCount())
 }
 
 func TestSetFailedCondition_WhenExisting_SetFailedConditionTrue(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -285,22 +250,9 @@ func TestSetFailedCondition_WhenExisting_SetFailedConditionTrue(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		require.Equal(t, metav1.ConditionTrue, actual.Status.Conditions[0].Status)
-		return nil
-	}
-
-	err := status.SetFailedCondition(context.TODO(), k, r)
+	err := SetFailedCondition(context.Background(), k, r)
 	require.NoError(t, err)
 
 	require.NotZero(t, k.StatusCallCount())
@@ -308,11 +260,6 @@ func TestSetFailedCondition_WhenExisting_SetFailedConditionTrue(t *testing.T) {
 }
 
 func TestSetFailedCondition_WhenNoneExisting_AppendFailedCondition(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -327,21 +274,9 @@ func TestSetFailedCondition_WhenNoneExisting_AppendFailedCondition(t *testing.T)
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
-
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		return nil
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	err := status.SetFailedCondition(context.TODO(), k, r)
+	err := SetFailedCondition(context.Background(), k, r)
 	require.NoError(t, err)
 
 	require.NotZero(t, k.StatusCallCount())
@@ -349,8 +284,6 @@ func TestSetFailedCondition_WhenNoneExisting_AppendFailedCondition(t *testing.T)
 }
 
 func TestSetDegradedCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	msg := "tell me nothing"
 	reason := lokiv1.ReasonMissingObjectStorageSecret
 
@@ -361,17 +294,16 @@ func TestSetDegradedCondition_WhenGetLokiStackReturnsError_ReturnError(t *testin
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewBadRequest("something wasn't found")
 	}
 
-	err := status.SetDegradedCondition(context.TODO(), k, r, msg, reason)
+	err := SetDegradedCondition(context.Background(), k, r, msg, reason)
 	require.Error(t, err)
 }
 
 func TestSetPendingCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	r := ctrl.Request{
 		NamespacedName: types.NamespacedName{
 			Name:      "my-stack",
@@ -379,17 +311,16 @@ func TestSetPendingCondition_WhenGetLokiStackReturnsError_ReturnError(t *testing
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewBadRequest("something wasn't found")
 	}
 
-	err := status.SetPendingCondition(context.TODO(), k, r)
+	err := SetPendingCondition(context.Background(), k, r)
 	require.Error(t, err)
 }
 
 func TestSetPendingCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	r := ctrl.Request{
 		NamespacedName: types.NamespacedName{
 			Name:      "my-stack",
@@ -397,17 +328,16 @@ func TestSetPendingCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testin
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
 	}
 
-	err := status.SetPendingCondition(context.TODO(), k, r)
+	err := SetPendingCondition(context.Background(), k, r)
 	require.NoError(t, err)
 }
 
 func TestSetPendingCondition_WhenExisting_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -416,8 +346,10 @@ func TestSetPendingCondition_WhenExisting_DoNothing(t *testing.T) {
 		Status: lokiv1.LokiStackStatus{
 			Conditions: []metav1.Condition{
 				{
-					Type:   string(lokiv1.ConditionPending),
-					Status: metav1.ConditionTrue,
+					Type:    string(lokiv1.ConditionPending),
+					Reason:  string(lokiv1.ReasonPendingComponents),
+					Message: messagePending,
+					Status:  metav1.ConditionTrue,
 				},
 			},
 		},
@@ -430,25 +362,14 @@ func TestSetPendingCondition_WhenExisting_DoNothing(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, _ := setupFakesNoError(t, &s)
 
-	err := status.SetPendingCondition(context.TODO(), k, r)
+	err := SetPendingCondition(context.Background(), k, r)
 	require.NoError(t, err)
 	require.Zero(t, k.StatusCallCount())
 }
 
 func TestSetPendingCondition_WhenExisting_SetPendingConditionTrue(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -471,33 +392,15 @@ func TestSetPendingCondition_WhenExisting_SetPendingConditionTrue(t *testing.T)
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		require.Equal(t, metav1.ConditionTrue, actual.Status.Conditions[0].Status)
-		return nil
-	}
-
-	err := status.SetPendingCondition(context.TODO(), k, r)
+	err := SetPendingCondition(context.Background(), k, r)
 	require.NoError(t, err)
 	require.NotZero(t, k.StatusCallCount())
 	require.NotZero(t, sw.UpdateCallCount())
 }
 
 func TestSetPendingCondition_WhenNoneExisting_AppendPendingCondition(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	s := lokiv1.LokiStack{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "my-stack",
@@ -512,21 +415,9 @@ func TestSetPendingCondition_WhenNoneExisting_AppendPendingCondition(t *testing.
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
-
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		return nil
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	err := status.SetPendingCondition(context.TODO(), k, r)
+	err := SetPendingCondition(context.Background(), k, r)
 	require.NoError(t, err)
 
 	require.NotZero(t, k.StatusCallCount())
@@ -534,8 +425,6 @@ func TestSetPendingCondition_WhenNoneExisting_AppendPendingCondition(t *testing.
 }
 
 func TestSetDegradedCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	msg := "tell me nothing"
 	reason := lokiv1.ReasonMissingObjectStorageSecret
 
@@ -546,17 +435,16 @@ func TestSetDegradedCondition_WhenGetLokiStackReturnsNotFound_DoNothing(t *testi
 		},
 	}
 
+	k := &k8sfakes.FakeClient{}
 	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
 		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
 	}
 
-	err := status.SetDegradedCondition(context.TODO(), k, r, msg, reason)
+	err := SetDegradedCondition(context.Background(), k, r, msg, reason)
 	require.NoError(t, err)
 }
 
 func TestSetDegradedCondition_WhenExisting_DoNothing(t *testing.T) {
-	k := &k8sfakes.FakeClient{}
-
 	msg := "tell me nothing"
 	reason := lokiv1.ReasonMissingObjectStorageSecret
 	s := lokiv1.LokiStack{
@@ -567,9 +455,10 @@ func TestSetDegradedCondition_WhenExisting_DoNothing(t *testing.T) {
 		Status: lokiv1.LokiStackStatus{
 			Conditions: []metav1.Condition{
 				{
-					Type:   string(lokiv1.ConditionDegraded),
-					Reason: string(reason),
-					Status: metav1.ConditionTrue,
+					Type:    string(lokiv1.ConditionDegraded),
+					Reason:  string(reason),
+					Message: msg,
+					Status:  metav1.ConditionTrue,
 				},
 			},
 		},
@@ -582,25 +471,14 @@ func TestSetDegradedCondition_WhenExisting_DoNothing(t *testing.T) {
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, _ := setupFakesNoError(t, &s)
 
-	err := status.SetDegradedCondition(context.TODO(), k, r, msg, reason)
+	err := SetDegradedCondition(context.Background(), k, r, msg, reason)
 	require.NoError(t, err)
 	require.Zero(t, k.StatusCallCount())
 }
 
 func TestSetDegradedCondition_WhenExisting_SetDegradedConditionTrue(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	msg := "tell me something"
 	reason := lokiv1.ReasonMissingObjectStorageSecret
 	s := lokiv1.LokiStack{
@@ -626,33 +504,15 @@ func TestSetDegradedCondition_WhenExisting_SetDegradedConditionTrue(t *testing.T
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		require.Equal(t, metav1.ConditionTrue, actual.Status.Conditions[0].Status)
-		return nil
-	}
-
-	err := status.SetDegradedCondition(context.TODO(), k, r, msg, reason)
+	err := SetDegradedCondition(context.Background(), k, r, msg, reason)
 	require.NoError(t, err)
 	require.NotZero(t, k.StatusCallCount())
 	require.NotZero(t, sw.UpdateCallCount())
 }
 
 func TestSetDegradedCondition_WhenNoneExisting_AppendDegradedCondition(t *testing.T) {
-	sw := &k8sfakes.FakeStatusWriter{}
-	k := &k8sfakes.FakeClient{}
-
-	k.StatusStub = func() client.StatusWriter { return sw }
-
 	msg := "tell me something"
 	reason := lokiv1.ReasonMissingObjectStorageSecret
 	s := lokiv1.LokiStack{
@@ -669,21 +529,9 @@ func TestSetDegradedCondition_WhenNoneExisting_AppendDegradedCondition(t *testin
 		},
 	}
 
-	k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object, _ ...client.GetOption) error {
-		if r.Name == name.Name && r.Namespace == name.Namespace {
-			k.SetClientObject(object, &s)
-			return nil
-		}
-		return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found")
-	}
-
-	sw.UpdateStub = func(_ context.Context, obj client.Object, _ ...client.UpdateOption) error {
-		actual := obj.(*lokiv1.LokiStack)
-		require.NotEmpty(t, actual.Status.Conditions)
-		return nil
-	}
+	k, sw := setupFakesNoError(t, &s)
 
-	err := status.SetDegradedCondition(context.TODO(), k, r, msg, reason)
+	err := SetDegradedCondition(context.Background(), k, r, msg, reason)
 	require.NoError(t, err)
 
 	require.NotZero(t, k.StatusCallCount())
diff --git a/operator/internal/validation/rulerconfig.go b/operator/internal/validation/rulerconfig.go
new file mode 100644
index 000000000000..764a9e7c8c57
--- /dev/null
+++ b/operator/internal/validation/rulerconfig.go
@@ -0,0 +1,104 @@
+package validation
+
+import (
+	"context"
+	"fmt"
+
+	lokiv1beta1 "github.com/grafana/loki/operator/apis/loki/v1beta1"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+var _ admission.CustomValidator = &RulerConfigValidator{}
+
+// RulerConfigValidator implements a custom validator for RulerConfig resources.
+type RulerConfigValidator struct{}
+
+// SetupWebhookWithManager registers the RulerConfigValidator as a validating webhook
+// with the controller-runtime manager or returns an error.
+func (v *RulerConfigValidator) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(&lokiv1beta1.RulerConfig{}).
+		WithValidator(v).
+		Complete()
+}
+
+// ValidateCreate implements admission.CustomValidator.
+func (v *RulerConfigValidator) ValidateCreate(ctx context.Context, obj runtime.Object) error {
+	return v.validate(ctx, obj)
+}
+
+// ValidateUpdate implements admission.CustomValidator.
+func (v *RulerConfigValidator) ValidateUpdate(ctx context.Context, _, newObj runtime.Object) error {
+	return v.validate(ctx, newObj)
+}
+
+// ValidateDelete implements admission.CustomValidator.
+func (v *RulerConfigValidator) ValidateDelete(_ context.Context, _ runtime.Object) error {
+	// No validation on delete
+	return nil
+}
+
+func (v *RulerConfigValidator) validate(ctx context.Context, obj runtime.Object) error {
+	rulerConfig, ok := obj.(*lokiv1beta1.RulerConfig)
+	if !ok {
+		return apierrors.NewBadRequest(fmt.Sprintf("object is not of type RulerConfig: %t", obj))
+	}
+
+	var allErrs field.ErrorList
+
+	// Check if header auth is defined in AlertManagerSpec
+	am := rulerConfig.Spec.AlertManagerSpec
+	if am != nil && am.Client != nil && am.Client.HeaderAuth != nil {
+		ha := am.Client.HeaderAuth
+		// Credentials and CredentialsFile are mutually exclusive
+		if ha.Credentials != nil && ha.CredentialsFile != nil {
+			allErrs = append(allErrs, field.Invalid(
+				field.NewPath("spec", "alertmanager", "client", "headerAuth", "credentials"),
+				ha.Credentials,
+				lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+			))
+			allErrs = append(allErrs, field.Invalid(
+				field.NewPath("spec", "alertmanager", "client", "headerAuth", "credentialsFile"),
+				ha.CredentialsFile,
+				lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+			))
+		}
+	}
+
+	// Check if header auth is defined in AlertManagerOverrides
+	for tenant, override := range rulerConfig.Spec.Overrides {
+		amo := override.AlertManagerOverrides
+		if amo != nil && amo.Client != nil && amo.Client.HeaderAuth != nil {
+			oha := amo.Client.HeaderAuth
+			// Credentials and CredentialsFile are mutually exclusive
+			if oha.Credentials != nil && oha.CredentialsFile != nil {
+				allErrs = append(allErrs, field.Invalid(
+					field.NewPath("spec", "overrides", tenant, "alertmanager", "client", "headerAuth", "credentials"),
+					oha.Credentials,
+					lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+				))
+				allErrs = append(allErrs, field.Invalid(
+					field.NewPath("spec", "overrides", tenant, "alertmanager", "client", "headerAuth", "credentialsFile"),
+					oha.CredentialsFile,
+					lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+				))
+			}
+		}
+	}
+
+	if len(allErrs) == 0 {
+		return nil
+	}
+
+	return apierrors.NewInvalid(
+		schema.GroupKind{Group: "loki.grafana.com", Kind: "RulerConfig"},
+		rulerConfig.Name,
+		allErrs,
+	)
+}
diff --git a/operator/internal/validation/rulerconfig_test.go b/operator/internal/validation/rulerconfig_test.go
new file mode 100644
index 000000000000..f49b8fcadbb9
--- /dev/null
+++ b/operator/internal/validation/rulerconfig_test.go
@@ -0,0 +1,219 @@
+package validation_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/grafana/loki/operator/apis/loki/v1beta1"
+	lokiv1beta1 "github.com/grafana/loki/operator/apis/loki/v1beta1"
+	"github.com/grafana/loki/operator/internal/validation"
+
+	"github.com/stretchr/testify/require"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/pointer"
+)
+
+var rctt = []struct {
+	desc string
+	spec v1beta1.RulerConfigSpec
+	err  *apierrors.StatusError
+}{
+	{
+		desc: "valid spec with no AM header credentials",
+		spec: v1beta1.RulerConfigSpec{
+			AlertManagerSpec: &lokiv1beta1.AlertManagerSpec{
+				Client: &lokiv1beta1.AlertManagerClientConfig{
+					BasicAuth: &lokiv1beta1.AlertManagerClientBasicAuth{
+						Username: pointer.String("user"),
+						Password: pointer.String("pass"),
+					},
+				},
+			},
+			Overrides: map[string]lokiv1beta1.RulerOverrides{
+				"tenant": {
+					AlertManagerOverrides: &lokiv1beta1.AlertManagerSpec{
+						Client: &lokiv1beta1.AlertManagerClientConfig{
+							BasicAuth: &lokiv1beta1.AlertManagerClientBasicAuth{
+								Username: pointer.String("user1"),
+								Password: pointer.String("pass1"),
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+	{
+		desc: "valid spec with Credentials",
+		spec: v1beta1.RulerConfigSpec{
+			AlertManagerSpec: &lokiv1beta1.AlertManagerSpec{
+				Client: &lokiv1beta1.AlertManagerClientConfig{
+					HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+						Credentials: pointer.String("creds"),
+					},
+				},
+			},
+			Overrides: map[string]lokiv1beta1.RulerOverrides{
+				"tenant": {
+					AlertManagerOverrides: &lokiv1beta1.AlertManagerSpec{
+						Client: &lokiv1beta1.AlertManagerClientConfig{
+							HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+								Credentials: pointer.String("creds1"),
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+	{
+		desc: "valid spec with CredentialsFile",
+		spec: v1beta1.RulerConfigSpec{
+			AlertManagerSpec: &lokiv1beta1.AlertManagerSpec{
+				Client: &lokiv1beta1.AlertManagerClientConfig{
+					HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+						CredentialsFile: pointer.String("creds-file"),
+					},
+				},
+			},
+			Overrides: map[string]lokiv1beta1.RulerOverrides{
+				"tenant": {
+					AlertManagerOverrides: &lokiv1beta1.AlertManagerSpec{
+						Client: &lokiv1beta1.AlertManagerClientConfig{
+							HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+								CredentialsFile: pointer.String("creds-file1"),
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+	{
+		desc: "valid spec with CredentialsFile override",
+		spec: v1beta1.RulerConfigSpec{
+			AlertManagerSpec: &lokiv1beta1.AlertManagerSpec{
+				Client: &lokiv1beta1.AlertManagerClientConfig{
+					HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+						Credentials: pointer.String("creds"),
+					},
+				},
+			},
+			Overrides: map[string]lokiv1beta1.RulerOverrides{
+				"tenant": {
+					AlertManagerOverrides: &lokiv1beta1.AlertManagerSpec{
+						Client: &lokiv1beta1.AlertManagerClientConfig{
+							HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+								CredentialsFile: pointer.String("creds-file1"),
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+	{
+		desc: "both Credentials and CredentialsFile defined",
+		spec: v1beta1.RulerConfigSpec{
+			AlertManagerSpec: &lokiv1beta1.AlertManagerSpec{
+				Client: &lokiv1beta1.AlertManagerClientConfig{
+					HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+						Credentials:     pointer.String("creds"),
+						CredentialsFile: pointer.String("creds-file"),
+					},
+				},
+			},
+			Overrides: map[string]lokiv1beta1.RulerOverrides{
+				"tenant": {
+					AlertManagerOverrides: &lokiv1beta1.AlertManagerSpec{
+						Client: &lokiv1beta1.AlertManagerClientConfig{
+							HeaderAuth: &lokiv1beta1.AlertManagerClientHeaderAuth{
+								Credentials:     pointer.String("creds1"),
+								CredentialsFile: pointer.String("creds-file1"),
+							},
+						},
+					},
+				},
+			},
+		},
+		err: apierrors.NewInvalid(
+			schema.GroupKind{Group: "loki.grafana.com", Kind: "RulerConfig"},
+			"testing-ruler",
+			field.ErrorList{
+				field.Invalid(
+					field.NewPath("spec", "alertmanager", "client", "headerAuth", "credentials"),
+					"creds",
+					lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+				),
+				field.Invalid(
+					field.NewPath("spec", "alertmanager", "client", "headerAuth", "credentialsFile"),
+					"creds-file",
+					lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+				),
+				field.Invalid(
+					field.NewPath("spec", "overrides", "tenant", "alertmanager", "client", "headerAuth", "credentials"),
+					"creds1",
+					lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+				),
+				field.Invalid(
+					field.NewPath("spec", "overrides", "tenant", "alertmanager", "client", "headerAuth", "credentialsFile"),
+					"creds-file1",
+					lokiv1beta1.ErrHeaderAuthCredentialsConflict.Error(),
+				),
+			},
+		),
+	},
+}
+
+func TestRulerConfigValidationWebhook_ValidateCreate(t *testing.T) {
+	for _, tc := range rctt {
+		tc := tc
+		t.Run(tc.desc, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+			l := &v1beta1.RulerConfig{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "testing-ruler",
+				},
+				Spec: tc.spec,
+			}
+
+			v := &validation.RulerConfigValidator{}
+			err := v.ValidateCreate(ctx, l)
+			if err != nil {
+				require.Equal(t, tc.err, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestRulerConfigValidationWebhook_ValidateUpdate(t *testing.T) {
+	for _, tc := range rctt {
+		tc := tc
+		t.Run(tc.desc, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+			l := &v1beta1.RulerConfig{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "testing-ruler",
+				},
+				Spec: tc.spec,
+			}
+
+			v := &validation.RulerConfigValidator{}
+			err := v.ValidateUpdate(ctx, &v1beta1.RulerConfig{}, l)
+			if err != nil {
+				require.Equal(t, tc.err, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/operator/main.go b/operator/main.go
index f7049495464e..b15f239c0b7b 100644
--- a/operator/main.go
+++ b/operator/main.go
@@ -160,6 +160,13 @@ func main() {
 		logger.Error(err, "unable to create controller", "controller", "rulerconfig")
 		os.Exit(1)
 	}
+	if ctrlCfg.Gates.RulerConfigWebhook {
+		v := &validation.RulerConfigValidator{}
+		if err = v.SetupWebhookWithManager(mgr); err != nil {
+			logger.Error(err, "unable to create webhook", "webhook", "rulerconfig")
+			os.Exit(1)
+		}
+	}
 	if ctrlCfg.Gates.BuiltInCertManagement.Enabled {
 		if err = (&lokictrl.CertRotationReconciler{
 			Client:       mgr.GetClient(),
diff --git a/pkg/canary/reader/reader.go b/pkg/canary/reader/reader.go
index 08be36330ad8..f358ff831fa1 100644
--- a/pkg/canary/reader/reader.go
+++ b/pkg/canary/reader/reader.go
@@ -79,7 +79,7 @@ func NewReader(writer io.Writer,
 	receivedChan chan time.Time,
 	useTLS bool,
 	tlsConfig *tls.Config,
-	caFile string,
+	caFile, certFile, keyFile string,
 	address string,
 	user string,
 	pass string,
@@ -97,7 +97,7 @@ func NewReader(writer io.Writer,
 	httpClient := http.DefaultClient
 	if tlsConfig != nil {
 		// For the mTLS case, use a http.Client configured with the client side certificates.
-		rt, err := config.NewTLSRoundTripper(tlsConfig, caFile, func(tls *tls.Config) (http.RoundTripper, error) {
+		rt, err := config.NewTLSRoundTripper(tlsConfig, caFile, certFile, keyFile, func(tls *tls.Config) (http.RoundTripper, error) {
 			return &http.Transport{TLSClientConfig: tls}, nil
 		})
 		if err != nil {
diff --git a/pkg/canary/writer/push.go b/pkg/canary/writer/push.go
index 6c3ebbc6ac9c..932e05fbda75 100644
--- a/pkg/canary/writer/push.go
+++ b/pkg/canary/writer/push.go
@@ -65,7 +65,7 @@ func NewPush(
 	streamName, streamValue string,
 	useTLS bool,
 	tlsCfg *tls.Config,
-	caFile string,
+	caFile, certFile, keyFile string,
 	username, password string,
 	backoffCfg *backoff.Config,
 	logger log.Logger,
@@ -81,7 +81,7 @@ func NewPush(
 
 	// setup tls transport
 	if tlsCfg != nil {
-		rt, err := config.NewTLSRoundTripper(tlsCfg, caFile, func(tls *tls.Config) (http.RoundTripper, error) {
+		rt, err := config.NewTLSRoundTripper(tlsCfg, caFile, certFile, keyFile, func(tls *tls.Config) (http.RoundTripper, error) {
 			return &http.Transport{TLSClientConfig: tls}, nil
 		})
 		if err != nil {
diff --git a/pkg/canary/writer/push_test.go b/pkg/canary/writer/push_test.go
index 0351a2072379..ec335c320cd1 100644
--- a/pkg/canary/writer/push_test.go
+++ b/pkg/canary/writer/push_test.go
@@ -42,7 +42,7 @@ func Test_Push(t *testing.T) {
 	defer mock.Close()
 
 	// without TLS
-	push, err := NewPush(mock.Listener.Addr().String(), "test1", 2*time.Second, config.DefaultHTTPClientConfig, "name", "loki-canary", "stream", "stdout", false, nil, "", "", "", &backoff, log.NewNopLogger())
+	push, err := NewPush(mock.Listener.Addr().String(), "test1", 2*time.Second, config.DefaultHTTPClientConfig, "name", "loki-canary", "stream", "stdout", false, nil, "", "", "", "", "", &backoff, log.NewNopLogger())
 	require.NoError(t, err)
 	ts, payload := testPayload()
 	n, err := push.Write([]byte(payload))
@@ -52,7 +52,7 @@ func Test_Push(t *testing.T) {
 	assertResponse(t, resp, false, labelSet("name", "loki-canary", "stream", "stdout"), ts, payload)
 
 	// with basic Auth
-	push, err = NewPush(mock.Listener.Addr().String(), "test1", 2*time.Second, config.DefaultHTTPClientConfig, "name", "loki-canary", "stream", "stdout", false, nil, "", testUsername, testPassword, &backoff, log.NewNopLogger())
+	push, err = NewPush(mock.Listener.Addr().String(), "test1", 2*time.Second, config.DefaultHTTPClientConfig, "name", "loki-canary", "stream", "stdout", false, nil, "", "", "", testUsername, testPassword, &backoff, log.NewNopLogger())
 	require.NoError(t, err)
 	ts, payload = testPayload()
 	n, err = push.Write([]byte(payload))
@@ -62,7 +62,7 @@ func Test_Push(t *testing.T) {
 	assertResponse(t, resp, true, labelSet("name", "loki-canary", "stream", "stdout"), ts, payload)
 
 	// with custom labels
-	push, err = NewPush(mock.Listener.Addr().String(), "test1", 2*time.Second, config.DefaultHTTPClientConfig, "name", "loki-canary", "pod", "abc", false, nil, "", testUsername, testPassword, &backoff, log.NewNopLogger())
+	push, err = NewPush(mock.Listener.Addr().String(), "test1", 2*time.Second, config.DefaultHTTPClientConfig, "name", "loki-canary", "pod", "abc", false, nil, "", "", "", testUsername, testPassword, &backoff, log.NewNopLogger())
 	require.NoError(t, err)
 	ts, payload = testPayload()
 	n, err = push.Write([]byte(payload))
diff --git a/pkg/logproto/extensions.go b/pkg/logproto/extensions.go
index c98ca66bf14d..27af9e82f464 100644
--- a/pkg/logproto/extensions.go
+++ b/pkg/logproto/extensions.go
@@ -1,8 +1,10 @@
 package logproto
 
 import (
+	"strings"
 	"sync/atomic" //lint:ignore faillint we can't use go.uber.org/atomic with a protobuf struct without wrapping it.
 
+	"github.com/dustin/go-humanize"
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/model/labels"
 
@@ -44,3 +46,17 @@ func (m *IndexStatsResponse) AddChunk(_ model.Fingerprint, chk index.ChunkMeta)
 func (m *IndexStatsResponse) Stats() IndexStatsResponse {
 	return *m
 }
+
+// Helper function for returning the key value pairs
+// to be passed to a logger
+func (m *IndexStatsResponse) LoggingKeyValues() []interface{} {
+	if m == nil {
+		return nil
+	}
+	return []interface{}{
+		"bytes", strings.Replace(humanize.Bytes(m.Bytes), " ", "", 1),
+		"chunks", m.Chunks,
+		"streams", m.Streams,
+		"entries", m.Entries,
+	}
+}
diff --git a/pkg/logql/log/drop_labels.go b/pkg/logql/log/drop_labels.go
new file mode 100644
index 000000000000..eb697cd229ad
--- /dev/null
+++ b/pkg/logql/log/drop_labels.go
@@ -0,0 +1,85 @@
+package log
+
+import (
+	"github.com/grafana/loki/pkg/logqlmodel"
+	"github.com/prometheus/prometheus/model/labels"
+)
+
+type DropLabels struct {
+	dropLabels []DropLabel
+}
+
+type DropLabel struct {
+	Matcher *labels.Matcher
+	Name    string
+}
+
+func NewDropLabel(matcher *labels.Matcher, name string) DropLabel {
+	return DropLabel{
+		Matcher: matcher,
+		Name:    name,
+	}
+}
+
+func NewDropLabels(dl []DropLabel) *DropLabels {
+	return &DropLabels{dropLabels: dl}
+}
+
+func (dl *DropLabels) Process(ts int64, line []byte, lbls *LabelsBuilder) ([]byte, bool) {
+	for _, dropLabel := range dl.dropLabels {
+		if dropLabel.Matcher != nil {
+			dropLabelMatches(dropLabel.Matcher, lbls)
+			continue
+		}
+		name := dropLabel.Name
+		dropLabelNames(name, lbls)
+	}
+	return line, true
+}
+
+func (dl *DropLabels) RequiredLabelNames() []string { return []string{} }
+
+func isErrorLabel(name string) bool {
+	return name == logqlmodel.ErrorLabel
+}
+
+func isErrorDetailsLabel(name string) bool {
+	return name == logqlmodel.ErrorDetailsLabel
+}
+
+func dropLabelNames(name string, lbls *LabelsBuilder) {
+	if isErrorLabel(name) {
+		lbls.ResetError()
+		return
+	}
+	if isErrorDetailsLabel(name) {
+		lbls.ResetErrorDetails()
+		return
+	}
+	if _, ok := lbls.Get(name); ok {
+		lbls.Del(name)
+	}
+}
+
+func dropLabelMatches(matcher *labels.Matcher, lbls *LabelsBuilder) {
+	var value string
+	name := matcher.Name
+	if isErrorLabel(name) {
+		value = lbls.GetErr()
+		if matcher.Matches(value) {
+			lbls.ResetError()
+		}
+		return
+	}
+	if isErrorDetailsLabel(name) {
+		value = lbls.GetErrorDetails()
+		if matcher.Matches(value) {
+			lbls.ResetErrorDetails()
+		}
+		return
+	}
+	value, _ = lbls.Get(name)
+	if matcher.Matches(value) {
+		lbls.Del(name)
+	}
+}
diff --git a/pkg/logql/log/drop_labels_test.go b/pkg/logql/log/drop_labels_test.go
new file mode 100644
index 000000000000..19e275e2d46e
--- /dev/null
+++ b/pkg/logql/log/drop_labels_test.go
@@ -0,0 +1,160 @@
+package log
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/prometheus/prometheus/model/labels"
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/loki/pkg/logqlmodel"
+)
+
+func Test_DropLabels(t *testing.T) {
+	tests := []struct {
+		Name       string
+		dropLabels []DropLabel
+		err        string
+		errDetails string
+		lbs        labels.Labels
+		want       labels.Labels
+	}{
+		{
+			"drop by name",
+			[]DropLabel{
+				{
+					nil,
+					"app",
+				},
+				{
+					nil,
+					"namespace",
+				},
+			},
+			"",
+			"",
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+			labels.Labels{
+				{Name: "pod_uuid", Value: "foo"},
+			},
+		},
+		{
+			"drop by __error__",
+			[]DropLabel{
+				{
+					labels.MustNewMatcher(labels.MatchEqual, logqlmodel.ErrorLabel, errJSON),
+					"",
+				},
+				{
+					nil,
+					"__error_details__",
+				},
+			},
+			errJSON,
+			"json error",
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+		},
+		{
+			"drop with wrong __error__ value",
+			[]DropLabel{
+				{
+					labels.MustNewMatcher(labels.MatchEqual, logqlmodel.ErrorLabel, errLogfmt),
+					"",
+				},
+			},
+			errJSON,
+			"json error",
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+				{Name: logqlmodel.ErrorLabel, Value: errJSON},
+				{Name: logqlmodel.ErrorDetailsLabel, Value: "json error"},
+			},
+		},
+		{
+			"drop by __error_details__",
+			[]DropLabel{
+				{
+					labels.MustNewMatcher(labels.MatchRegexp, logqlmodel.ErrorDetailsLabel, "expecting json.*"),
+					"",
+				},
+				{
+					nil,
+					"__error__",
+				},
+			},
+			errJSON,
+			"expecting json object but it is not",
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+		},
+		{
+			"drop labels with names and matcher",
+			[]DropLabel{
+				{
+					labels.MustNewMatcher(labels.MatchEqual, logqlmodel.ErrorLabel, errJSON),
+					"",
+				},
+				{
+					nil,
+					"__error_details__",
+				},
+				{
+					nil,
+					"app",
+				},
+				{
+					nil,
+					"namespace",
+				},
+			},
+			errJSON,
+			"json error",
+			labels.Labels{
+				{Name: "app", Value: "foo"},
+				{Name: "namespace", Value: "prod"},
+				{Name: "pod_uuid", Value: "foo"},
+			},
+			labels.Labels{
+				{Name: "pod_uuid", Value: "foo"},
+			},
+		},
+	}
+	for _, tt := range tests {
+		dropLabels := NewDropLabels(tt.dropLabels)
+		lbls := NewBaseLabelsBuilder().ForLabels(tt.lbs, tt.lbs.Hash())
+		lbls.Reset()
+		lbls.SetErr(tt.err)
+		lbls.SetErrorDetails(tt.errDetails)
+		dropLabels.Process(0, []byte(""), lbls)
+		sort.Sort(tt.want)
+		require.Equal(t, tt.want, lbls.LabelsResult().Labels())
+	}
+}
diff --git a/pkg/logql/log/labels.go b/pkg/logql/log/labels.go
index 99684f58182c..1081787db436 100644
--- a/pkg/logql/log/labels.go
+++ b/pkg/logql/log/labels.go
@@ -166,6 +166,16 @@ func (b *LabelsBuilder) SetErrorDetails(desc string) *LabelsBuilder {
 	return b
 }
 
+func (b *LabelsBuilder) ResetError() *LabelsBuilder {
+	b.err = ""
+	return b
+}
+
+func (b *LabelsBuilder) ResetErrorDetails() *LabelsBuilder {
+	b.errDetails = ""
+	return b
+}
+
 func (b *LabelsBuilder) GetErrorDetails() string {
 	return b.errDetails
 }
diff --git a/pkg/logql/log/parser.go b/pkg/logql/log/parser.go
index 7175937675f3..b2df06589b11 100644
--- a/pkg/logql/log/parser.go
+++ b/pkg/logql/log/parser.go
@@ -5,9 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"strings"
 	"unicode/utf8"
 
+	"github.com/buger/jsonparser"
 	"github.com/grafana/loki/pkg/logql/log/jsonexpr"
 	"github.com/grafana/loki/pkg/logql/log/logfmt"
 	"github.com/grafana/loki/pkg/logql/log/pattern"
@@ -23,6 +23,9 @@ const (
 	duplicateSuffix = "_extracted"
 	trueString      = "true"
 	falseString     = "false"
+	// How much stack space to allocate for unescaping JSON strings; if a string longer
+	// than this needs to be escaped, it will result in a heap allocation
+	unescapeStackBufSize = 64
 )
 
 var (
@@ -30,13 +33,15 @@ var (
 	_ Stage = &RegexpParser{}
 	_ Stage = &LogfmtParser{}
 
+	trueBytes = []byte("true")
+
 	errUnexpectedJSONObject = fmt.Errorf("expecting json object(%d), but it is not", jsoniter.ObjectValue)
 	errMissingCapture       = errors.New("at least one named capture must be supplied")
 )
 
 type JSONParser struct {
-	buf []byte // buffer used to build json keys
-	lbs *LabelsBuilder
+	prefixBuffer []byte // buffer used to build json keys
+	lbs          *LabelsBuilder
 
 	keys internedStringSet
 }
@@ -44,8 +49,8 @@ type JSONParser struct {
 // NewJSONParser creates a log stage that can parse a json log line and add properties as labels.
 func NewJSONParser() *JSONParser {
 	return &JSONParser{
-		buf:  make([]byte, 0, 1024),
-		keys: internedStringSet{},
+		prefixBuffer: make([]byte, 0, 1024),
+		keys:         internedStringSet{},
 	}
 }
 
@@ -53,14 +58,12 @@ func (j *JSONParser) Process(_ int64, line []byte, lbs *LabelsBuilder) ([]byte,
 	if lbs.ParserLabelHints().NoLabels() {
 		return line, true
 	}
-	it := jsoniter.ConfigFastest.BorrowIterator(line)
-	defer jsoniter.ConfigFastest.ReturnIterator(it)
 
 	// reset the state.
-	j.buf = j.buf[:0]
+	j.prefixBuffer = j.prefixBuffer[:0]
 	j.lbs = lbs
 
-	if err := j.readObject(it); err != nil {
+	if err := jsonparser.ObjectEach(line, j.parseObject); err != nil {
 		lbs.SetErr(errJSON)
 		lbs.SetErrorDetails(err.Error())
 		return line, true
@@ -68,125 +71,114 @@ func (j *JSONParser) Process(_ int64, line []byte, lbs *LabelsBuilder) ([]byte,
 	return line, true
 }
 
-func (j *JSONParser) readObject(it *jsoniter.Iterator) error {
-	// we only care about object and values.
-	if nextType := it.WhatIsNext(); nextType != jsoniter.ObjectValue {
-		return errUnexpectedJSONObject
-	}
-	_ = it.ReadMapCB(j.parseMap(""))
-	if it.Error != nil && it.Error != io.EOF {
-		return it.Error
+func (j *JSONParser) parseObject(key, value []byte, dataType jsonparser.ValueType, offset int) error {
+	switch dataType {
+	case jsonparser.String, jsonparser.Number, jsonparser.Boolean:
+		j.parseLabelValue(key, value, dataType)
+	case jsonparser.Object:
+		prefixLen := len(j.prefixBuffer)
+		var err error
+		if ok := j.nextKeyPrefix(key); ok {
+			err = jsonparser.ObjectEach(value, j.parseObject)
+		}
+		// rollback the prefix as we exit the current object.
+		j.prefixBuffer = j.prefixBuffer[:prefixLen]
+		return err
 	}
+
 	return nil
 }
 
-func (j *JSONParser) parseMap(prefix string) func(iter *jsoniter.Iterator, field string) bool {
-	return func(iter *jsoniter.Iterator, field string) bool {
-		switch iter.WhatIsNext() {
-		// are we looking at a value that needs to be added ?
-		case jsoniter.StringValue, jsoniter.NumberValue, jsoniter.BoolValue:
-			j.parseLabelValue(iter, prefix, field)
-		// Or another new object based on a prefix.
-		case jsoniter.ObjectValue:
-			if key, ok := j.nextKeyPrefix(prefix, field); ok {
-				return iter.ReadMapCB(j.parseMap(key))
-			}
-			// If this keys is not expected we skip the object
-			iter.Skip()
-		default:
-			iter.Skip()
-		}
-		return true
+// nextKeyPrefix load the next prefix in the buffer and tells if it should be processed based on hints.
+func (j *JSONParser) nextKeyPrefix(key []byte) bool {
+	// first add the spacer if needed.
+	if len(j.prefixBuffer) != 0 {
+		j.prefixBuffer = append(j.prefixBuffer, byte(jsonSpacer))
 	}
+	j.prefixBuffer = appendSanitized(j.prefixBuffer, key)
+	return j.lbs.ParserLabelHints().ShouldExtractPrefix(unsafeGetString(j.prefixBuffer))
 }
 
-func (j *JSONParser) nextKeyPrefix(prefix, field string) (string, bool) {
-	// first time we add return the field as prefix.
-	if len(prefix) == 0 {
-		field = sanitizeLabelKey(field, true)
-		if j.lbs.ParserLabelHints().ShouldExtractPrefix(field) {
-			return field, true
-		}
-		return "", false
-	}
-	// otherwise we build the prefix and check using the buffer
-	j.buf = j.buf[:0]
-	j.buf = append(j.buf, prefix...)
-	j.buf = append(j.buf, byte(jsonSpacer))
-	j.buf = append(j.buf, sanitizeLabelKey(field, false)...)
-	// if matches keep going
-	if j.lbs.ParserLabelHints().ShouldExtractPrefix(unsafeGetString(j.buf)) {
-		return string(j.buf), true
-	}
-	return "", false
-}
-
-func (j *JSONParser) parseLabelValue(iter *jsoniter.Iterator, prefix, field string) {
+func (j *JSONParser) parseLabelValue(key, value []byte, dataType jsonparser.ValueType) {
 	// the first time we use the field as label key.
-	if len(prefix) == 0 {
-		key, ok := j.keys.Get(unsafeGetBytes(field), func() (string, bool) {
-			field = sanitizeLabelKey(field, true)
-			if !j.lbs.ParserLabelHints().ShouldExtract(field) {
-				return "", false
-			}
+	if len(j.prefixBuffer) == 0 {
+		key, ok := j.keys.Get(key, func() (string, bool) {
+			field := sanitizeLabelKey(string(key), true)
 			if j.lbs.BaseHas(field) {
 				field = field + duplicateSuffix
 			}
+			if !j.lbs.ParserLabelHints().ShouldExtract(field) {
+				return "", false
+			}
 			return field, true
 		})
 		if !ok {
-			iter.Skip()
 			return
 		}
-		j.lbs.Set(key, readValue(iter))
+		j.lbs.Set(key, readValue(value, dataType))
 		return
 
 	}
 	// otherwise we build the label key using the buffer
-	j.buf = j.buf[:0]
-	j.buf = append(j.buf, prefix...)
-	j.buf = append(j.buf, byte(jsonSpacer))
-	j.buf = append(j.buf, sanitizeLabelKey(field, false)...)
-	key, ok := j.keys.Get(j.buf, func() (string, bool) {
-		if j.lbs.BaseHas(string(j.buf)) {
-			j.buf = append(j.buf, duplicateSuffix...)
+
+	// snapshot the current prefix position
+	prefixLen := len(j.prefixBuffer)
+	j.prefixBuffer = append(j.prefixBuffer, byte(jsonSpacer))
+	j.prefixBuffer = appendSanitized(j.prefixBuffer, key)
+	keyString, ok := j.keys.Get(j.prefixBuffer, func() (string, bool) {
+		if j.lbs.BaseHas(string(j.prefixBuffer)) {
+			j.prefixBuffer = append(j.prefixBuffer, duplicateSuffix...)
 		}
-		if !j.lbs.ParserLabelHints().ShouldExtract(string(j.buf)) {
+		if !j.lbs.ParserLabelHints().ShouldExtract(string(j.prefixBuffer)) {
 			return "", false
 		}
-		return string(j.buf), true
+		return string(j.prefixBuffer), true
 	})
+
+	// reset the prefix position
+	j.prefixBuffer = j.prefixBuffer[:prefixLen]
 	if !ok {
-		iter.Skip()
 		return
 	}
-	j.lbs.Set(key, readValue(iter))
+	j.lbs.Set(keyString, readValue(value, dataType))
 }
 
 func (j *JSONParser) RequiredLabelNames() []string { return []string{} }
 
-func readValue(iter *jsoniter.Iterator) string {
-	switch iter.WhatIsNext() {
-	case jsoniter.StringValue:
-		v := iter.ReadString()
-		// the rune error replacement is rejected by Prometheus, so we skip it.
-		if strings.ContainsRune(v, utf8.RuneError) {
-			return ""
-		}
-		return v
-	case jsoniter.NumberValue:
-		return iter.ReadNumber().String()
-	case jsoniter.BoolValue:
-		if iter.ReadBool() {
+func readValue(v []byte, dataType jsonparser.ValueType) string {
+	switch dataType {
+	case jsonparser.String:
+		return unescapeJSONString(v)
+	case jsonparser.Null:
+		return ""
+	case jsonparser.Number:
+		return string(v)
+	case jsonparser.Boolean:
+		if bytes.Equal(v, trueBytes) {
 			return trueString
 		}
 		return falseString
 	default:
-		iter.Skip()
 		return ""
 	}
 }
 
+func unescapeJSONString(b []byte) string {
+	var stackbuf [unescapeStackBufSize]byte // stack-allocated array for allocation-free unescaping of small strings
+	bU, err := jsonparser.Unescape(b, stackbuf[:])
+	if err != nil {
+		return ""
+	}
+	res := string(bU)
+	// rune error is rejected by Prometheus
+	for _, r := range res {
+		if r == utf8.RuneError {
+			return ""
+		}
+	}
+	return res
+}
+
 type RegexpParser struct {
 	regex     *regexp.Regexp
 	nameIndex map[int]string
diff --git a/pkg/logql/log/parser_test.go b/pkg/logql/log/parser_test.go
index b33e6501187e..3d18e02c4246 100644
--- a/pkg/logql/log/parser_test.go
+++ b/pkg/logql/log/parser_test.go
@@ -80,7 +80,7 @@ func Test_jsonParser_Parse(t *testing.T) {
 			labels.Labels{},
 			labels.Labels{
 				{Name: "__error__", Value: "JSONParserErr"},
-				{Name: "__error_details__", Value: "ReadMapCB: expect \" after {, but found n, error found in #2 byte of ...|{n}|..., bigger context ...|{n}|..."},
+				{Name: "__error_details__", Value: "Value looks like object, but can't find closing '}' symbol"},
 			},
 		},
 		{
diff --git a/pkg/logql/log/pipeline_test.go b/pkg/logql/log/pipeline_test.go
index 24d2c05da6db..e0149321aa32 100644
--- a/pkg/logql/log/pipeline_test.go
+++ b/pkg/logql/log/pipeline_test.go
@@ -1,6 +1,7 @@
 package log
 
 import (
+	"sort"
 	"testing"
 	"time"
 
@@ -134,6 +135,109 @@ var (
 	resSample     float64
 )
 
+func TestDropLabelsPipeline(t *testing.T) {
+	tests := []struct {
+		name       string
+		stages     []Stage
+		lines      [][]byte
+		wantLine   [][]byte
+		wantLabels []labels.Labels
+	}{
+		{
+			"drop __error__",
+			[]Stage{
+				NewLogfmtParser(),
+				NewJSONParser(),
+				NewDropLabels([]DropLabel{
+					{
+						nil,
+						"__error__",
+					},
+					{
+						nil,
+						"__error_details__",
+					},
+				}),
+			},
+			[][]byte{
+				[]byte(`level=info ts=2020-10-18T18:04:22.147378997Z caller=metrics.go:81 status=200`),
+				[]byte(`{"app":"foo","namespace":"prod","pod":{"uuid":"foo","deployment":{"ref":"foobar"}}}`),
+			},
+			[][]byte{
+				[]byte(`level=info ts=2020-10-18T18:04:22.147378997Z caller=metrics.go:81 status=200`),
+				[]byte(`{"app":"foo","namespace":"prod","pod":{"uuid":"foo","deployment":{"ref":"foobar"}}}`),
+			},
+			[]labels.Labels{
+				{
+					{Name: "level", Value: "info"},
+					{Name: "ts", Value: "2020-10-18T18:04:22.147378997Z"},
+					{Name: "caller", Value: "metrics.go:81"},
+					{Name: "status", Value: "200"},
+				},
+				{
+					{Name: "app", Value: "foo"},
+					{Name: "namespace", Value: "prod"},
+					{Name: "pod_uuid", Value: "foo"},
+					{Name: "pod_deployment_ref", Value: "foobar"},
+				},
+			},
+		},
+		{
+			"drop __error__ with matching value",
+			[]Stage{
+				NewLogfmtParser(),
+				NewJSONParser(),
+				NewDropLabels([]DropLabel{
+					{
+						labels.MustNewMatcher(labels.MatchEqual, logqlmodel.ErrorLabel, errLogfmt),
+						"",
+					},
+					{
+						labels.MustNewMatcher(labels.MatchEqual, "status", "200"),
+						"",
+					},
+					{
+						nil,
+						"app",
+					},
+				}),
+			},
+			[][]byte{
+				[]byte(`level=info ts=2020-10-18T18:04:22.147378997Z caller=metrics.go:81 status=200`),
+				[]byte(`{"app":"foo","namespace":"prod","pod":{"uuid":"foo","deployment":{"ref":"foobar"}}}`),
+			},
+			[][]byte{
+				[]byte(`level=info ts=2020-10-18T18:04:22.147378997Z caller=metrics.go:81 status=200`),
+				[]byte(`{"app":"foo","namespace":"prod","pod":{"uuid":"foo","deployment":{"ref":"foobar"}}}`),
+			},
+			[]labels.Labels{
+				{
+					{Name: "level", Value: "info"},
+					{Name: "ts", Value: "2020-10-18T18:04:22.147378997Z"},
+					{Name: "caller", Value: "metrics.go:81"},
+					{Name: logqlmodel.ErrorLabel, Value: errJSON},
+					{Name: logqlmodel.ErrorDetailsLabel, Value: "Value looks like object, but can't find closing '}' symbol"},
+				},
+				{
+					{Name: "namespace", Value: "prod"},
+					{Name: "pod_uuid", Value: "foo"},
+					{Name: "pod_deployment_ref", Value: "foobar"},
+					{Name: logqlmodel.ErrorDetailsLabel, Value: "logfmt syntax error at pos 2 : unexpected '\"'"},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		p := NewPipeline(tt.stages)
+		sp := p.ForStream(labels.Labels{})
+		for i, line := range tt.lines {
+			_, finalLbs, _ := sp.Process(0, line)
+			sort.Sort(tt.wantLabels[i])
+			require.Equal(t, tt.wantLabels[i], finalLbs.Labels())
+		}
+	}
+
+}
 func Benchmark_Pipeline(b *testing.B) {
 	b.ReportAllocs()
 
diff --git a/pkg/logql/log/util.go b/pkg/logql/log/util.go
index 8db9083b4fa5..c4115eb060c5 100644
--- a/pkg/logql/log/util.go
+++ b/pkg/logql/log/util.go
@@ -1,6 +1,7 @@
 package log
 
 import (
+	"bytes"
 	"strings"
 )
 
@@ -36,3 +37,26 @@ func sanitizeLabelKey(key string, isPrefix bool) string {
 		return '_'
 	}, key)
 }
+
+// appendSanitize appends the sanitized key to the slice.
+func appendSanitized(to, key []byte) []byte {
+	if len(key) == 0 {
+		return to
+	}
+	key = bytes.TrimSpace(key)
+
+	if len(to) == 0 && key[0] >= '0' && key[0] <= '9' {
+		to = append(to, '_')
+	}
+	// range over rune
+
+	for _, r := range string(key) {
+		if !((r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || r == '_' || (r >= '0' && r <= '9')) {
+			to = append(to, '_')
+			continue
+		}
+		to = append(to, byte(r))
+
+	}
+	return to
+}
diff --git a/pkg/logql/syntax/ast.go b/pkg/logql/syntax/ast.go
index c7832352dcd5..f9dc906b20d5 100644
--- a/pkg/logql/syntax/ast.go
+++ b/pkg/logql/syntax/ast.go
@@ -446,6 +446,44 @@ func (e *DecolorizeExpr) String() string {
 }
 func (e *DecolorizeExpr) Walk(f WalkFn) { f(e) }
 
+type DropLabelsExpr struct {
+	dropLabels []log.DropLabel
+	implicit
+}
+
+func newDropLabelsExpr(dropLabels []log.DropLabel) *DropLabelsExpr {
+	return &DropLabelsExpr{dropLabels: dropLabels}
+}
+
+func (e *DropLabelsExpr) Shardable() bool { return true }
+
+func (e *DropLabelsExpr) Stage() (log.Stage, error) {
+	return log.NewDropLabels(e.dropLabels), nil
+}
+func (e *DropLabelsExpr) String() string {
+	var sb strings.Builder
+
+	sb.WriteString(fmt.Sprintf("%s %s ", OpPipe, OpDrop))
+
+	for i, dropLabel := range e.dropLabels {
+		if dropLabel.Matcher != nil {
+			sb.WriteString(dropLabel.Matcher.String())
+			if i+1 != len(e.dropLabels) {
+				sb.WriteString(",")
+			}
+		}
+		if dropLabel.Name != "" {
+			sb.WriteString(dropLabel.Name)
+			if i+1 != len(e.dropLabels) {
+				sb.WriteString(",")
+			}
+		}
+	}
+	str := sb.String()
+	return str
+}
+func (e *DropLabelsExpr) Walk(f WalkFn) { f(e) }
+
 func (e *LineFmtExpr) Shardable() bool { return true }
 
 func (e *LineFmtExpr) Walk(f WalkFn) { f(e) }
@@ -460,7 +498,6 @@ func (e *LineFmtExpr) String() string {
 
 type LabelFmtExpr struct {
 	Formats []log.LabelFmt
-
 	implicit
 }
 
@@ -480,7 +517,9 @@ func (e *LabelFmtExpr) Stage() (log.Stage, error) {
 
 func (e *LabelFmtExpr) String() string {
 	var sb strings.Builder
+
 	sb.WriteString(fmt.Sprintf("%s %s ", OpPipe, OpFmtLabel))
+
 	for i, f := range e.Formats {
 		sb.WriteString(f.Name)
 		sb.WriteString("=")
@@ -725,6 +764,9 @@ const (
 
 	// function filters
 	OpFilterIP = "ip"
+
+	// drop labels
+	OpDrop = "drop"
 )
 
 func IsComparisonOperator(op string) bool {
diff --git a/pkg/logql/syntax/expr.y b/pkg/logql/syntax/expr.y
index 4f88935a6986..65a6c44d509b 100644
--- a/pkg/logql/syntax/expr.y
+++ b/pkg/logql/syntax/expr.y
@@ -59,6 +59,9 @@ import (
   UnwrapExpr              *UnwrapExpr
   DecolorizeExpr          *DecolorizeExpr
   OffsetExpr              *OffsetExpr
+  DropLabel               log.DropLabel
+  DropLabels              []log.DropLabel
+  DropLabelsExpr          *DropLabelsExpr 
 }
 
 %start root
@@ -98,6 +101,9 @@ import (
 %type <LineFilter>            lineFilter
 %type <LineFormatExpr>        lineFormatExpr
 %type <DecolorizeExpr>        decolorizeExpr
+%type <DropLabelsExpr>        dropLabelsExpr
+%type <DropLabels>            dropLabels
+%type <DropLabel>             dropLabel
 %type <LabelFormatExpr>       labelFormatExpr
 %type <LabelFormat>           labelFormat
 %type <LabelsFormat>          labelsFormat
@@ -117,7 +123,7 @@ import (
                   BYTES_OVER_TIME BYTES_RATE BOOL JSON REGEXP LOGFMT PIPE LINE_FMT LABEL_FMT UNWRAP AVG_OVER_TIME SUM_OVER_TIME MIN_OVER_TIME
                   MAX_OVER_TIME STDVAR_OVER_TIME STDDEV_OVER_TIME QUANTILE_OVER_TIME BYTES_CONV DURATION_CONV DURATION_SECONDS_CONV
                   FIRST_OVER_TIME LAST_OVER_TIME ABSENT_OVER_TIME VECTOR LABEL_REPLACE UNPACK OFFSET PATTERN IP ON IGNORING GROUP_LEFT GROUP_RIGHT
-                  DECOLORIZE
+                  DECOLORIZE DROP
 
 // Operators are listed with increasing precedence.
 %left <binOp> OR
@@ -254,6 +260,7 @@ pipelineStage:
   | PIPE lineFormatExpr          { $$ = $2 }
   | PIPE decolorizeExpr          { $$ = $2 }
   | PIPE labelFormatExpr         { $$ = $2 }
+  | PIPE dropLabelsExpr          { $$ = $2 }
   ;
 
 filterOp:
@@ -296,11 +303,12 @@ labelsFormat:
   | labelsFormat COMMA error
   ;
 
-labelFormatExpr: LABEL_FMT labelsFormat { $$ = newLabelFmtExpr($2) };
+labelFormatExpr:
+      LABEL_FMT labelsFormat { $$ = newLabelFmtExpr($2) };
 
 labelFilter:
       matcher                                        { $$ = log.NewStringLabelFilter($1) }
-    | ipLabelFilter                                       { $$ = $1 }
+    | ipLabelFilter                                  { $$ = $1 }
     | unitFilter                                     { $$ = $1 }
     | numberFilter                                   { $$ = $1 }
     | OPEN_PARENTHESIS labelFilter CLOSE_PARENTHESIS { $$ = $2 }
@@ -358,6 +366,17 @@ numberFilter:
     | IDENTIFIER CMP_EQ NUMBER  { $$ = log.NewNumericLabelFilter(log.LabelFilterEqual, $1, mustNewFloat($3))}
     ;
 
+dropLabel: 
+      IDENTIFIER { $$ = log.NewDropLabel(nil, $1) }
+    | matcher { $$ = log.NewDropLabel($1, "") }
+
+dropLabels:
+      dropLabel                  { $$ = []log.DropLabel{$1}}
+    | dropLabels COMMA dropLabel { $$ = append($1, $3) }
+    ;
+
+dropLabelsExpr: DROP dropLabels { $$ = newDropLabelsExpr($2) }
+
 // Operator precedence only works if each of these is listed separately.
 binOpExpr:
          expr OR binOpModifier expr          { $$ = mustNewBinOpExpr("or", $3, $1, $4) }
diff --git a/pkg/logql/syntax/expr.y.go b/pkg/logql/syntax/expr.y.go
index 529e4f5a9cda..ede5c71cec94 100644
--- a/pkg/logql/syntax/expr.y.go
+++ b/pkg/logql/syntax/expr.y.go
@@ -6,7 +6,6 @@ package syntax
 import __yyfmt__ "fmt"
 
 //line pkg/logql/syntax/expr.y:2
-
 import (
 	"github.com/grafana/loki/pkg/logql/log"
 	"github.com/prometheus/prometheus/model/labels"
@@ -65,6 +64,9 @@ type exprSymType struct {
 	UnwrapExpr            *UnwrapExpr
 	DecolorizeExpr        *DecolorizeExpr
 	OffsetExpr            *OffsetExpr
+	DropLabel             log.DropLabel
+	DropLabels            []log.DropLabel
+	DropLabelsExpr        *DropLabelsExpr
 }
 
 const BYTES = 57346
@@ -138,21 +140,22 @@ const IGNORING = 57413
 const GROUP_LEFT = 57414
 const GROUP_RIGHT = 57415
 const DECOLORIZE = 57416
-const OR = 57417
-const AND = 57418
-const UNLESS = 57419
-const CMP_EQ = 57420
-const NEQ = 57421
-const LT = 57422
-const LTE = 57423
-const GT = 57424
-const GTE = 57425
-const ADD = 57426
-const SUB = 57427
-const MUL = 57428
-const DIV = 57429
-const MOD = 57430
-const POW = 57431
+const DROP = 57417
+const OR = 57418
+const AND = 57419
+const UNLESS = 57420
+const CMP_EQ = 57421
+const NEQ = 57422
+const LT = 57423
+const LTE = 57424
+const GT = 57425
+const GTE = 57426
+const ADD = 57427
+const SUB = 57428
+const MUL = 57429
+const DIV = 57430
+const MOD = 57431
+const POW = 57432
 
 var exprToknames = [...]string{
 	"$end",
@@ -229,6 +232,7 @@ var exprToknames = [...]string{
 	"GROUP_LEFT",
 	"GROUP_RIGHT",
 	"DECOLORIZE",
+	"DROP",
 	"OR",
 	"AND",
 	"UNLESS",
@@ -252,7 +256,7 @@ const exprEofCode = 1
 const exprErrCode = 2
 const exprInitialStackSize = 16
 
-//line pkg/logql/syntax/expr.y:509
+//line pkg/logql/syntax/expr.y:528
 
 //line yacctab:1
 var exprExca = [...]int8{
@@ -263,112 +267,113 @@ var exprExca = [...]int8{
 
 const exprPrivate = 57344
 
-const exprLast = 551
+const exprLast = 561
 
 var exprAct = [...]int16{
-	258, 204, 82, 4, 185, 64, 173, 5, 178, 213,
-	73, 120, 56, 63, 261, 143, 75, 2, 51, 52,
-	53, 54, 55, 56, 266, 78, 48, 49, 50, 57,
-	58, 61, 62, 59, 60, 51, 52, 53, 54, 55,
-	56, 49, 50, 57, 58, 61, 62, 59, 60, 51,
-	52, 53, 54, 55, 56, 57, 58, 61, 62, 59,
-	60, 51, 52, 53, 54, 55, 56, 157, 158, 107,
-	187, 141, 142, 111, 53, 54, 55, 56, 330, 139,
-	141, 142, 71, 155, 156, 147, 131, 264, 145, 69,
-	70, 152, 71, 263, 67, 330, 264, 92, 261, 69,
-	70, 71, 312, 348, 83, 84, 154, 350, 69, 70,
-	159, 160, 161, 162, 163, 164, 165, 166, 167, 168,
-	169, 170, 171, 172, 345, 206, 304, 262, 338, 304,
-	203, 182, 337, 128, 206, 71, 193, 188, 191, 192,
-	189, 190, 69, 70, 333, 267, 140, 72, 262, 133,
-	195, 124, 327, 211, 207, 335, 314, 72, 200, 205,
-	108, 216, 208, 311, 263, 263, 72, 263, 206, 200,
-	275, 128, 115, 117, 116, 321, 125, 127, 266, 200,
-	296, 224, 225, 226, 305, 175, 263, 275, 275, 124,
-	71, 270, 320, 319, 118, 295, 119, 69, 70, 273,
-	72, 201, 126, 203, 256, 259, 128, 265, 71, 268,
-	145, 107, 271, 111, 272, 69, 70, 260, 257, 71,
-	175, 269, 128, 206, 124, 229, 69, 70, 219, 275,
-	279, 281, 284, 286, 318, 289, 287, 307, 308, 309,
-	124, 206, 174, 261, 209, 81, 128, 83, 84, 71,
-	215, 144, 206, 275, 135, 72, 69, 70, 277, 13,
-	297, 215, 299, 301, 124, 303, 107, 146, 344, 285,
-	302, 313, 298, 72, 134, 107, 176, 174, 315, 128,
-	283, 294, 66, 215, 72, 115, 117, 116, 293, 125,
-	127, 275, 128, 175, 215, 317, 276, 124, 223, 324,
-	325, 215, 282, 215, 107, 326, 175, 118, 13, 119,
-	124, 328, 329, 280, 72, 126, 146, 334, 222, 274,
-	217, 238, 214, 197, 239, 237, 16, 221, 220, 194,
-	340, 151, 341, 342, 13, 234, 150, 196, 235, 233,
-	230, 149, 6, 88, 346, 87, 21, 22, 23, 36,
-	45, 46, 37, 39, 40, 38, 41, 42, 43, 44,
-	24, 25, 176, 174, 80, 227, 218, 210, 202, 231,
-	26, 27, 28, 29, 30, 31, 32, 137, 79, 228,
-	33, 34, 35, 47, 19, 212, 236, 153, 343, 77,
-	332, 136, 253, 13, 138, 254, 252, 349, 331, 310,
-	232, 6, 300, 17, 18, 21, 22, 23, 36, 45,
-	46, 37, 39, 40, 38, 41, 42, 43, 44, 24,
-	25, 250, 86, 247, 251, 249, 248, 246, 85, 26,
-	27, 28, 29, 30, 31, 32, 291, 292, 347, 33,
-	34, 35, 47, 19, 148, 244, 336, 241, 245, 243,
-	242, 240, 13, 89, 3, 323, 322, 288, 278, 255,
-	6, 74, 17, 18, 21, 22, 23, 36, 45, 46,
+	265, 210, 82, 4, 121, 64, 175, 190, 187, 219,
+	73, 75, 2, 63, 180, 5, 145, 56, 78, 48,
+	49, 50, 57, 58, 61, 62, 59, 60, 51, 52,
+	53, 54, 55, 56, 49, 50, 57, 58, 61, 62,
+	59, 60, 51, 52, 53, 54, 55, 56, 57, 58,
+	61, 62, 59, 60, 51, 52, 53, 54, 55, 56,
+	51, 52, 53, 54, 55, 56, 159, 160, 268, 107,
+	193, 143, 144, 111, 53, 54, 55, 56, 273, 141,
+	143, 144, 271, 67, 130, 149, 245, 71, 203, 246,
+	244, 154, 71, 270, 69, 70, 147, 320, 177, 69,
+	70, 156, 125, 157, 158, 161, 162, 163, 164, 165,
+	166, 167, 168, 169, 170, 171, 172, 173, 174, 133,
+	212, 71, 338, 92, 81, 212, 83, 84, 69, 70,
+	338, 209, 184, 312, 192, 312, 71, 199, 194, 197,
+	198, 195, 196, 69, 70, 201, 274, 142, 341, 108,
+	268, 243, 282, 72, 212, 217, 176, 329, 72, 269,
+	71, 211, 269, 222, 213, 214, 358, 69, 70, 212,
+	282, 270, 353, 270, 268, 328, 241, 319, 202, 242,
+	240, 282, 135, 230, 231, 232, 327, 72, 71, 130,
+	130, 83, 84, 66, 282, 69, 70, 270, 130, 326,
+	270, 282, 72, 346, 177, 345, 284, 125, 125, 271,
+	263, 266, 177, 272, 71, 275, 125, 107, 278, 111,
+	279, 69, 70, 267, 147, 264, 72, 276, 116, 118,
+	117, 206, 126, 128, 273, 343, 286, 288, 291, 293,
+	89, 239, 322, 192, 303, 296, 300, 212, 294, 221,
+	119, 209, 120, 304, 72, 221, 71, 130, 127, 129,
+	280, 178, 176, 69, 70, 221, 335, 305, 292, 307,
+	309, 177, 311, 107, 290, 125, 235, 310, 321, 306,
+	72, 225, 107, 282, 289, 323, 221, 206, 283, 212,
+	93, 94, 95, 96, 97, 98, 99, 100, 101, 102,
+	103, 104, 105, 106, 221, 287, 130, 332, 333, 277,
+	206, 221, 107, 334, 215, 137, 136, 313, 13, 336,
+	337, 302, 72, 223, 125, 342, 148, 146, 178, 176,
+	220, 237, 207, 301, 16, 13, 229, 228, 348, 227,
+	349, 350, 13, 148, 226, 200, 153, 152, 151, 88,
+	6, 87, 354, 80, 21, 22, 23, 36, 45, 46,
+	37, 39, 40, 38, 41, 42, 43, 44, 24, 25,
+	315, 316, 317, 356, 352, 325, 281, 238, 26, 27,
+	28, 29, 30, 31, 32, 236, 139, 233, 33, 34,
+	35, 47, 19, 224, 218, 216, 208, 79, 234, 351,
+	138, 260, 13, 140, 261, 259, 155, 340, 77, 339,
+	6, 318, 17, 18, 21, 22, 23, 36, 45, 46,
+	37, 39, 40, 38, 41, 42, 43, 44, 24, 25,
+	257, 308, 254, 258, 256, 255, 253, 86, 26, 27,
+	28, 29, 30, 31, 32, 298, 299, 357, 33, 34,
+	35, 47, 19, 130, 150, 251, 85, 248, 252, 250,
+	249, 247, 13, 355, 344, 331, 330, 295, 285, 262,
+	6, 125, 17, 18, 21, 22, 23, 36, 45, 46,
 	37, 39, 40, 38, 41, 42, 43, 44, 24, 25,
-	290, 199, 198, 186, 121, 197, 196, 183, 26, 27,
-	28, 29, 30, 31, 32, 181, 180, 339, 33, 34,
-	35, 47, 19, 93, 94, 95, 96, 97, 98, 99,
-	100, 101, 102, 103, 104, 105, 106, 316, 179, 79,
-	186, 17, 18, 122, 177, 110, 184, 114, 113, 112,
-	65, 129, 123, 130, 109, 91, 90, 11, 10, 9,
-	132, 20, 12, 15, 8, 306, 14, 7, 76, 68,
+	205, 204, 116, 118, 117, 203, 126, 128, 26, 27,
+	28, 29, 30, 31, 32, 202, 3, 185, 33, 34,
+	35, 47, 19, 74, 119, 297, 120, 183, 188, 122,
+	182, 347, 127, 129, 324, 191, 181, 79, 188, 123,
+	179, 110, 17, 18, 186, 114, 189, 115, 113, 112,
+	65, 131, 124, 132, 109, 91, 90, 11, 10, 9,
+	134, 20, 12, 15, 8, 314, 14, 7, 76, 68,
 	1,
 }
 
 var exprPact = [...]int16{
-	319, -1000, -49, -1000, -1000, 235, 319, -1000, -1000, -1000,
-	-1000, -1000, -1000, 373, 341, 222, -1000, 421, 415, 322,
-	320, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
+	327, -1000, -57, -1000, -1000, 146, 327, -1000, -1000, -1000,
+	-1000, -1000, -1000, 392, 330, 101, -1000, 449, 430, 328,
+	326, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
 	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
-	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, 54, 54,
-	54, 54, 54, 54, 54, 54, 54, 54, 54, 54,
-	54, 54, 54, 235, -1000, 68, 241, -1000, 80, -1000,
-	-1000, -1000, -1000, 250, 230, -49, 375, -1000, -1000, 67,
-	244, 437, 318, 313, 308, -1000, -1000, 319, 380, 319,
-	13, -5, -1000, 319, 319, 319, 319, 319, 319, 319,
-	319, 319, 319, 319, 319, 319, 319, -1000, -1000, -1000,
-	-1000, 287, -1000, -1000, -1000, 513, -1000, 490, -1000, 489,
-	-1000, -1000, -1000, -1000, 217, 481, -1000, 515, 58, -1000,
-	-1000, -1000, 306, -1000, -1000, -1000, -1000, -1000, 514, 480,
-	479, 476, 475, 177, 349, 194, 293, 220, 348, 378,
-	298, 296, 347, 204, -35, 305, 304, 295, 275, -23,
-	-23, -12, -12, -77, -77, -77, -77, -66, -66, -66,
-	-66, -66, -66, 287, 217, 217, 217, 346, -1000, 367,
-	-1000, -1000, 201, -1000, 321, -1000, 357, 331, 317, 443,
-	441, 419, 417, 388, 453, -1000, -1000, -1000, -1000, -1000,
-	-1000, 79, 293, 176, 118, 87, 128, 121, 167, 79,
-	319, 175, 300, 272, -1000, -1000, 234, -1000, 452, -1000,
-	289, 278, 256, 245, 274, 287, 166, 513, 451, -1000,
-	478, 431, 265, -1000, -1000, -1000, 258, -1000, -1000, -1000,
+	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, 80, 80,
+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
+	80, 80, 80, 146, -1000, 174, 448, -1000, 113, -1000,
+	-1000, -1000, -1000, 292, 291, -57, 384, -1000, -1000, 67,
+	320, 447, 325, 324, 323, -1000, -1000, 327, 399, 327,
+	33, -6, -1000, 327, 327, 327, 327, 327, 327, 327,
+	327, 327, 327, 327, 327, 327, 327, -1000, -1000, -1000,
+	-1000, 185, -1000, -1000, -1000, -1000, 521, -1000, 514, -1000,
+	511, -1000, -1000, -1000, -1000, 301, 501, -1000, 523, 520,
+	58, -1000, -1000, -1000, 322, -1000, -1000, -1000, -1000, -1000,
+	522, 499, 489, 485, 484, 308, 377, 242, 303, 290,
+	376, 387, 306, 299, 374, 257, -43, 321, 316, 314,
+	313, -31, -31, -13, -13, -73, -73, -73, -73, -25,
+	-25, -25, -25, -25, -25, 185, 301, 301, 301, 368,
+	-1000, 386, -1000, -1000, 252, -1000, 366, -1000, 319, 358,
+	-1000, 67, -1000, 172, 82, 453, 451, 428, 426, 397,
+	463, -1000, -1000, -1000, -1000, -1000, -1000, 166, 303, 107,
+	150, 200, 184, 122, 285, 166, 327, 236, 357, 264,
+	-1000, -1000, 182, -1000, 462, -1000, 281, 260, 250, 244,
+	193, 185, 79, 521, 461, -1000, 513, 440, 520, 310,
+	-1000, -1000, -1000, 298, -1000, -1000, -1000, -1000, -1000, -1000,
 	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
-	-1000, -1000, -1000, -1000, -1000, 171, -1000, 156, 205, 46,
-	205, 394, -53, 217, -53, 117, 179, 390, 139, 78,
-	-1000, -1000, 132, -1000, 319, 512, -1000, -1000, 276, 210,
-	-1000, 169, -1000, -1000, 168, -1000, 151, -1000, -1000, -1000,
-	-1000, -1000, -1000, 450, 449, -1000, 79, 46, 205, 46,
-	-1000, -1000, 287, -1000, -53, -1000, 129, -1000, -1000, -1000,
-	31, 389, 381, 120, 79, 131, -1000, 440, -1000, -1000,
-	-1000, -1000, 108, 104, -1000, 46, -1000, 492, 48, 46,
-	-26, -53, -53, 379, -1000, -1000, 249, -1000, -1000, 100,
-	46, -1000, -1000, -53, 432, -1000, -1000, 84, 391, 83,
-	-1000,
+	-1000, -1000, 220, -1000, 229, 78, 46, 78, 423, 1,
+	301, 1, 126, 312, 402, 153, 73, -1000, -1000, 218,
+	-1000, 327, 519, -1000, -1000, 356, 175, -1000, 162, -1000,
+	-1000, 151, -1000, 133, -1000, -1000, -1000, -1000, -1000, -1000,
+	-1000, 460, 459, -1000, 166, 46, 78, 46, -1000, -1000,
+	185, -1000, 1, -1000, 243, -1000, -1000, -1000, 83, 400,
+	398, 124, 166, 211, -1000, 458, -1000, -1000, -1000, -1000,
+	181, 179, -1000, 46, -1000, 516, 75, 46, 28, 1,
+	1, 390, -1000, -1000, 355, -1000, -1000, 148, 46, -1000,
+	-1000, 1, 457, -1000, -1000, 354, 441, 142, -1000,
 }
 
 var exprPgo = [...]int16{
-	0, 550, 16, 549, 2, 9, 454, 3, 15, 11,
-	548, 547, 546, 545, 7, 544, 543, 542, 541, 540,
-	539, 538, 537, 453, 536, 535, 534, 13, 5, 533,
-	532, 531, 6, 530, 94, 529, 528, 527, 4, 526,
-	525, 8, 524, 1, 523, 484, 0,
+	0, 560, 11, 559, 2, 9, 506, 3, 16, 4,
+	558, 557, 556, 555, 15, 554, 553, 552, 551, 550,
+	549, 548, 547, 240, 546, 545, 544, 13, 5, 543,
+	542, 541, 6, 540, 83, 539, 538, 537, 536, 7,
+	535, 8, 534, 531, 14, 530, 1, 529, 519, 0,
 }
 
 var exprR1 = [...]int8{
@@ -376,23 +381,23 @@ var exprR1 = [...]int8{
 	7, 6, 6, 6, 8, 8, 8, 8, 8, 8,
 	8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
 	8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
-	43, 43, 43, 13, 13, 13, 11, 11, 11, 11,
+	46, 46, 46, 13, 13, 13, 11, 11, 11, 11,
 	15, 15, 15, 15, 15, 15, 22, 3, 3, 3,
 	3, 14, 14, 14, 10, 10, 9, 9, 9, 9,
-	27, 27, 28, 28, 28, 28, 28, 28, 28, 19,
-	34, 34, 33, 33, 26, 26, 26, 26, 26, 40,
-	35, 36, 38, 38, 39, 39, 39, 37, 32, 32,
-	32, 32, 32, 32, 32, 32, 32, 41, 41, 42,
-	42, 45, 45, 44, 44, 31, 31, 31, 31, 31,
-	31, 31, 29, 29, 29, 29, 29, 29, 29, 30,
-	30, 30, 30, 30, 30, 30, 20, 20, 20, 20,
-	20, 20, 20, 20, 20, 20, 20, 20, 20, 20,
-	20, 24, 24, 25, 25, 25, 25, 23, 23, 23,
-	23, 23, 23, 23, 23, 21, 21, 21, 17, 18,
-	16, 16, 16, 16, 16, 16, 16, 16, 16, 16,
-	16, 12, 12, 12, 12, 12, 12, 12, 12, 12,
-	12, 12, 12, 12, 12, 12, 46, 5, 5, 4,
-	4, 4, 4,
+	27, 27, 28, 28, 28, 28, 28, 28, 28, 28,
+	19, 34, 34, 33, 33, 26, 26, 26, 26, 26,
+	43, 35, 36, 41, 41, 42, 42, 42, 40, 32,
+	32, 32, 32, 32, 32, 32, 32, 32, 44, 44,
+	45, 45, 48, 48, 47, 47, 31, 31, 31, 31,
+	31, 31, 31, 29, 29, 29, 29, 29, 29, 29,
+	30, 30, 30, 30, 30, 30, 30, 39, 39, 38,
+	38, 37, 20, 20, 20, 20, 20, 20, 20, 20,
+	20, 20, 20, 20, 20, 20, 20, 24, 24, 25,
+	25, 25, 25, 23, 23, 23, 23, 23, 23, 23,
+	23, 21, 21, 21, 17, 18, 16, 16, 16, 16,
+	16, 16, 16, 16, 16, 16, 16, 12, 12, 12,
+	12, 12, 12, 12, 12, 12, 12, 12, 12, 12,
+	12, 12, 49, 5, 5, 4, 4, 4, 4,
 }
 
 var exprR2 = [...]int8{
@@ -403,98 +408,98 @@ var exprR2 = [...]int8{
 	3, 6, 3, 1, 1, 1, 4, 6, 5, 7,
 	4, 5, 5, 6, 7, 7, 12, 1, 1, 1,
 	1, 3, 3, 2, 1, 3, 3, 3, 3, 3,
-	1, 2, 1, 2, 2, 2, 2, 2, 2, 1,
-	2, 5, 1, 2, 1, 1, 2, 1, 2, 2,
-	2, 1, 3, 3, 1, 3, 3, 2, 1, 1,
-	1, 1, 3, 2, 3, 3, 3, 3, 1, 1,
-	3, 6, 6, 1, 1, 3, 3, 3, 3, 3,
+	1, 2, 1, 2, 2, 2, 2, 2, 2, 2,
+	1, 2, 5, 1, 2, 1, 1, 2, 1, 2,
+	2, 2, 1, 3, 3, 1, 3, 3, 2, 1,
+	1, 1, 1, 3, 2, 3, 3, 3, 3, 1,
+	1, 3, 6, 6, 1, 1, 3, 3, 3, 3,
 	3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 4, 4, 4, 4,
-	4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
-	4, 0, 1, 5, 4, 5, 4, 1, 1, 2,
-	4, 5, 2, 4, 5, 1, 2, 2, 4, 1,
+	3, 3, 3, 3, 3, 3, 3, 1, 1, 1,
+	3, 2, 4, 4, 4, 4, 4, 4, 4, 4,
+	4, 4, 4, 4, 4, 4, 4, 0, 1, 5,
+	4, 5, 4, 1, 1, 2, 4, 5, 2, 4,
+	5, 1, 2, 2, 4, 1, 1, 1, 1, 1,
 	1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
 	1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-	1, 1, 1, 1, 1, 1, 2, 1, 3, 4,
-	4, 3, 3,
+	1, 1, 2, 1, 3, 4, 4, 3, 3,
 }
 
 var exprChk = [...]int16{
 	-1000, -1, -2, -6, -7, -14, 23, -11, -15, -20,
-	-21, -22, -17, 15, -12, -16, 7, 84, 85, 65,
+	-21, -22, -17, 15, -12, -16, 7, 85, 86, 65,
 	-18, 27, 28, 29, 41, 42, 51, 52, 53, 54,
 	55, 56, 57, 61, 62, 63, 30, 33, 36, 34,
-	35, 37, 38, 39, 40, 31, 32, 64, 75, 76,
-	77, 84, 85, 86, 87, 88, 89, 78, 79, 82,
-	83, 80, 81, -27, -28, -33, 47, -34, -3, 21,
-	22, 14, 79, -7, -6, -2, -10, 16, -9, 5,
+	35, 37, 38, 39, 40, 31, 32, 64, 76, 77,
+	78, 85, 86, 87, 88, 89, 90, 79, 80, 83,
+	84, 81, 82, -27, -28, -33, 47, -34, -3, 21,
+	22, 14, 80, -7, -6, -2, -10, 16, -9, 5,
 	23, 23, -4, 25, 26, 7, 7, 23, 23, -23,
 	-24, -25, 43, -23, -23, -23, -23, -23, -23, -23,
 	-23, -23, -23, -23, -23, -23, -23, -28, -34, -26,
-	-40, -32, -35, -36, -37, 44, 46, 45, 66, 68,
-	-9, -45, -44, -30, 23, 48, 74, 49, 5, -31,
-	-29, 6, -19, 69, 24, 24, 16, 2, 19, 12,
-	79, 13, 14, -8, 7, -14, 23, -7, 7, 23,
-	23, 23, -7, 7, -2, 70, 71, 72, 73, -2,
-	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
-	-2, -2, -2, -32, 76, 19, 75, -42, -41, 5,
-	6, 6, -32, 6, -39, -38, 5, 12, 79, 82,
-	83, 80, 81, 78, 23, -9, 6, 6, 6, 6,
-	2, 24, 19, 9, -43, -27, 47, -14, -8, 24,
-	19, -7, 7, -5, 24, 5, -5, 24, 19, 24,
-	23, 23, 23, 23, -32, -32, -32, 19, 12, 24,
-	19, 12, 69, 8, 4, 7, 69, 8, 4, 7,
+	-43, -32, -35, -36, -40, -37, 44, 46, 45, 66,
+	68, -9, -48, -47, -30, 23, 48, 74, 49, 75,
+	5, -31, -29, 6, -19, 69, 24, 24, 16, 2,
+	19, 12, 80, 13, 14, -8, 7, -14, 23, -7,
+	7, 23, 23, 23, -7, 7, -2, 70, 71, 72,
+	73, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+	-2, -2, -2, -2, -2, -32, 77, 19, 76, -45,
+	-44, 5, 6, 6, -32, 6, -42, -41, 5, -38,
+	-39, 5, -9, 12, 80, 83, 84, 81, 82, 79,
+	23, -9, 6, 6, 6, 6, 2, 24, 19, 9,
+	-46, -27, 47, -14, -8, 24, 19, -7, 7, -5,
+	24, 5, -5, 24, 19, 24, 23, 23, 23, 23,
+	-32, -32, -32, 19, 12, 24, 19, 12, 19, 69,
+	8, 4, 7, 69, 8, 4, 7, 8, 4, 7,
 	8, 4, 7, 8, 4, 7, 8, 4, 7, 8,
-	4, 7, 8, 4, 7, 6, -4, -8, -46, -43,
-	-27, 67, 9, 47, 9, -43, 50, 24, -43, -27,
-	24, -4, -7, 24, 19, 19, 24, 24, 6, -5,
-	24, -5, 24, 24, -5, 24, -5, -41, 6, -38,
-	2, 5, 6, 23, 23, 24, 24, -43, -27, -43,
-	8, -46, -32, -46, 9, 5, -13, 58, 59, 60,
-	9, 24, 24, -43, 24, -7, 5, 19, 24, 24,
-	24, 24, 6, 6, -4, -43, -46, 23, -46, -43,
-	47, 9, 9, 24, -4, 24, 6, 24, 24, 5,
-	-43, -46, -46, 9, 19, 24, -46, 6, 19, 6,
-	24,
+	4, 7, 6, -4, -8, -49, -46, -27, 67, 9,
+	47, 9, -46, 50, 24, -46, -27, 24, -4, -7,
+	24, 19, 19, 24, 24, 6, -5, 24, -5, 24,
+	24, -5, 24, -5, -44, 6, -41, 2, 5, 6,
+	-39, 23, 23, 24, 24, -46, -27, -46, 8, -49,
+	-32, -49, 9, 5, -13, 58, 59, 60, 9, 24,
+	24, -46, 24, -7, 5, 19, 24, 24, 24, 24,
+	6, 6, -4, -46, -49, 23, -49, -46, 47, 9,
+	9, 24, -4, 24, 6, 24, 24, 5, -46, -49,
+	-49, 9, 19, 24, -49, 6, 19, 6, 24,
 }
 
 var exprDef = [...]int16{
 	0, -2, 1, 2, 3, 11, 0, 4, 5, 6,
-	7, 8, 9, 0, 0, 0, 165, 0, 0, 0,
-	0, 181, 182, 183, 184, 185, 186, 187, 188, 189,
-	190, 191, 192, 193, 194, 195, 170, 171, 172, 173,
-	174, 175, 176, 177, 178, 179, 180, 169, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 12, 70, 72, 0, 82, 0, 57,
+	7, 8, 9, 0, 0, 0, 171, 0, 0, 0,
+	0, 187, 188, 189, 190, 191, 192, 193, 194, 195,
+	196, 197, 198, 199, 200, 201, 176, 177, 178, 179,
+	180, 181, 182, 183, 184, 185, 186, 175, 157, 157,
+	157, 157, 157, 157, 157, 157, 157, 157, 157, 157,
+	157, 157, 157, 12, 70, 72, 0, 83, 0, 57,
 	58, 59, 60, 3, 2, 0, 0, 63, 64, 0,
-	0, 0, 0, 0, 0, 166, 167, 0, 0, 0,
-	157, 158, 152, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 71, 83, 73,
-	74, 75, 76, 77, 78, 84, 85, 0, 87, 0,
-	98, 99, 100, 101, 0, 0, 91, 0, 0, 113,
-	114, 80, 0, 79, 10, 13, 61, 62, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 3, 165, 0,
-	0, 0, 3, 0, 136, 0, 0, 159, 162, 137,
-	138, 139, 140, 141, 142, 143, 144, 145, 146, 147,
-	148, 149, 150, 103, 0, 0, 0, 89, 109, 108,
-	86, 88, 0, 90, 97, 94, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 65, 66, 67, 68, 69,
-	39, 46, 0, 14, 0, 0, 0, 0, 0, 50,
-	0, 3, 165, 0, 201, 197, 0, 202, 0, 168,
-	0, 0, 0, 0, 104, 105, 106, 0, 0, 102,
-	0, 0, 0, 120, 127, 134, 0, 119, 126, 133,
-	115, 122, 129, 116, 123, 130, 117, 124, 131, 118,
-	125, 132, 121, 128, 135, 0, 48, 0, 15, 18,
-	34, 0, 22, 0, 26, 0, 0, 0, 0, 0,
-	38, 52, 3, 51, 0, 0, 199, 200, 0, 0,
-	154, 0, 156, 160, 0, 163, 0, 110, 107, 95,
-	96, 92, 93, 0, 0, 81, 47, 19, 35, 36,
-	196, 23, 42, 27, 30, 40, 0, 43, 44, 45,
-	16, 0, 0, 0, 53, 3, 198, 0, 153, 155,
-	161, 164, 0, 0, 49, 37, 31, 0, 17, 20,
-	0, 24, 28, 0, 54, 55, 0, 111, 112, 0,
-	21, 25, 29, 32, 0, 41, 33, 0, 0, 0,
-	56,
+	0, 0, 0, 0, 0, 172, 173, 0, 0, 0,
+	163, 164, 158, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 71, 84, 73,
+	74, 75, 76, 77, 78, 79, 85, 86, 0, 88,
+	0, 99, 100, 101, 102, 0, 0, 92, 0, 0,
+	0, 114, 115, 81, 0, 80, 10, 13, 61, 62,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 3,
+	171, 0, 0, 0, 3, 0, 142, 0, 0, 165,
+	168, 143, 144, 145, 146, 147, 148, 149, 150, 151,
+	152, 153, 154, 155, 156, 104, 0, 0, 0, 90,
+	110, 109, 87, 89, 0, 91, 98, 95, 0, 141,
+	139, 137, 138, 0, 0, 0, 0, 0, 0, 0,
+	0, 65, 66, 67, 68, 69, 39, 46, 0, 14,
+	0, 0, 0, 0, 0, 50, 0, 3, 171, 0,
+	207, 203, 0, 208, 0, 174, 0, 0, 0, 0,
+	105, 106, 107, 0, 0, 103, 0, 0, 0, 0,
+	121, 128, 135, 0, 120, 127, 134, 116, 123, 130,
+	117, 124, 131, 118, 125, 132, 119, 126, 133, 122,
+	129, 136, 0, 48, 0, 15, 18, 34, 0, 22,
+	0, 26, 0, 0, 0, 0, 0, 38, 52, 3,
+	51, 0, 0, 205, 206, 0, 0, 160, 0, 162,
+	166, 0, 169, 0, 111, 108, 96, 97, 93, 94,
+	140, 0, 0, 82, 47, 19, 35, 36, 202, 23,
+	42, 27, 30, 40, 0, 43, 44, 45, 16, 0,
+	0, 0, 53, 3, 204, 0, 159, 161, 167, 170,
+	0, 0, 49, 37, 31, 0, 17, 20, 0, 24,
+	28, 0, 54, 55, 0, 112, 113, 0, 21, 25,
+	29, 32, 0, 41, 33, 0, 0, 0, 56,
 }
 
 var exprTok1 = [...]int8{
@@ -510,7 +515,7 @@ var exprTok2 = [...]int8{
 	52, 53, 54, 55, 56, 57, 58, 59, 60, 61,
 	62, 63, 64, 65, 66, 67, 68, 69, 70, 71,
 	72, 73, 74, 75, 76, 77, 78, 79, 80, 81,
-	82, 83, 84, 85, 86, 87, 88, 89,
+	82, 83, 84, 85, 86, 87, 88, 89, 90,
 }
 
 var exprTok3 = [...]int8{
@@ -856,1212 +861,1248 @@ exprdefault:
 
 	case 1:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:132
+//line pkg/logql/syntax/expr.y:138
 		{
 			exprlex.(*parser).expr = exprDollar[1].Expr
 		}
 	case 2:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:135
+//line pkg/logql/syntax/expr.y:141
 		{
 			exprVAL.Expr = exprDollar[1].LogExpr
 		}
 	case 3:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:136
+//line pkg/logql/syntax/expr.y:142
 		{
 			exprVAL.Expr = exprDollar[1].MetricExpr
 		}
 	case 4:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:140
+//line pkg/logql/syntax/expr.y:146
 		{
 			exprVAL.MetricExpr = exprDollar[1].RangeAggregationExpr
 		}
 	case 5:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:141
+//line pkg/logql/syntax/expr.y:147
 		{
 			exprVAL.MetricExpr = exprDollar[1].VectorAggregationExpr
 		}
 	case 6:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:142
+//line pkg/logql/syntax/expr.y:148
 		{
 			exprVAL.MetricExpr = exprDollar[1].BinOpExpr
 		}
 	case 7:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:143
+//line pkg/logql/syntax/expr.y:149
 		{
 			exprVAL.MetricExpr = exprDollar[1].LiteralExpr
 		}
 	case 8:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:144
+//line pkg/logql/syntax/expr.y:150
 		{
 			exprVAL.MetricExpr = exprDollar[1].LabelReplaceExpr
 		}
 	case 9:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:145
+//line pkg/logql/syntax/expr.y:151
 		{
 			exprVAL.MetricExpr = exprDollar[1].VectorExpr
 		}
 	case 10:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:146
+//line pkg/logql/syntax/expr.y:152
 		{
 			exprVAL.MetricExpr = exprDollar[2].MetricExpr
 		}
 	case 11:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:150
+//line pkg/logql/syntax/expr.y:156
 		{
 			exprVAL.LogExpr = newMatcherExpr(exprDollar[1].Selector)
 		}
 	case 12:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:151
+//line pkg/logql/syntax/expr.y:157
 		{
 			exprVAL.LogExpr = newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].PipelineExpr)
 		}
 	case 13:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:152
+//line pkg/logql/syntax/expr.y:158
 		{
 			exprVAL.LogExpr = exprDollar[2].LogExpr
 		}
 	case 14:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:156
+//line pkg/logql/syntax/expr.y:162
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].duration, nil, nil)
 		}
 	case 15:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:157
+//line pkg/logql/syntax/expr.y:163
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].duration, nil, exprDollar[3].OffsetExpr)
 		}
 	case 16:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:158
+//line pkg/logql/syntax/expr.y:164
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[2].Selector), exprDollar[4].duration, nil, nil)
 		}
 	case 17:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:159
+//line pkg/logql/syntax/expr.y:165
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[2].Selector), exprDollar[4].duration, nil, exprDollar[5].OffsetExpr)
 		}
 	case 18:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:160
+//line pkg/logql/syntax/expr.y:166
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].duration, exprDollar[3].UnwrapExpr, nil)
 		}
 	case 19:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:161
+//line pkg/logql/syntax/expr.y:167
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].duration, exprDollar[4].UnwrapExpr, exprDollar[3].OffsetExpr)
 		}
 	case 20:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:162
+//line pkg/logql/syntax/expr.y:168
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[2].Selector), exprDollar[4].duration, exprDollar[5].UnwrapExpr, nil)
 		}
 	case 21:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:163
+//line pkg/logql/syntax/expr.y:169
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[2].Selector), exprDollar[4].duration, exprDollar[6].UnwrapExpr, exprDollar[5].OffsetExpr)
 		}
 	case 22:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:164
+//line pkg/logql/syntax/expr.y:170
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[1].Selector), exprDollar[3].duration, exprDollar[2].UnwrapExpr, nil)
 		}
 	case 23:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:165
+//line pkg/logql/syntax/expr.y:171
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[1].Selector), exprDollar[3].duration, exprDollar[2].UnwrapExpr, exprDollar[4].OffsetExpr)
 		}
 	case 24:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:166
+//line pkg/logql/syntax/expr.y:172
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[2].Selector), exprDollar[5].duration, exprDollar[3].UnwrapExpr, nil)
 		}
 	case 25:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:167
+//line pkg/logql/syntax/expr.y:173
 		{
 			exprVAL.LogRangeExpr = newLogRange(newMatcherExpr(exprDollar[2].Selector), exprDollar[5].duration, exprDollar[3].UnwrapExpr, exprDollar[6].OffsetExpr)
 		}
 	case 26:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:168
+//line pkg/logql/syntax/expr.y:174
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].PipelineExpr), exprDollar[3].duration, nil, nil)
 		}
 	case 27:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:169
+//line pkg/logql/syntax/expr.y:175
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].PipelineExpr), exprDollar[3].duration, nil, exprDollar[4].OffsetExpr)
 		}
 	case 28:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:170
+//line pkg/logql/syntax/expr.y:176
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[2].Selector), exprDollar[3].PipelineExpr), exprDollar[5].duration, nil, nil)
 		}
 	case 29:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:171
+//line pkg/logql/syntax/expr.y:177
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[2].Selector), exprDollar[3].PipelineExpr), exprDollar[5].duration, nil, exprDollar[6].OffsetExpr)
 		}
 	case 30:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:172
+//line pkg/logql/syntax/expr.y:178
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].PipelineExpr), exprDollar[4].duration, exprDollar[3].UnwrapExpr, nil)
 		}
 	case 31:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:173
+//line pkg/logql/syntax/expr.y:179
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[2].PipelineExpr), exprDollar[4].duration, exprDollar[3].UnwrapExpr, exprDollar[5].OffsetExpr)
 		}
 	case 32:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:174
+//line pkg/logql/syntax/expr.y:180
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[2].Selector), exprDollar[3].PipelineExpr), exprDollar[6].duration, exprDollar[4].UnwrapExpr, nil)
 		}
 	case 33:
 		exprDollar = exprS[exprpt-7 : exprpt+1]
-//line pkg/logql/syntax/expr.y:175
+//line pkg/logql/syntax/expr.y:181
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[2].Selector), exprDollar[3].PipelineExpr), exprDollar[6].duration, exprDollar[4].UnwrapExpr, exprDollar[7].OffsetExpr)
 		}
 	case 34:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:176
+//line pkg/logql/syntax/expr.y:182
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[3].PipelineExpr), exprDollar[2].duration, nil, nil)
 		}
 	case 35:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:177
+//line pkg/logql/syntax/expr.y:183
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[4].PipelineExpr), exprDollar[2].duration, nil, exprDollar[3].OffsetExpr)
 		}
 	case 36:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:178
+//line pkg/logql/syntax/expr.y:184
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[3].PipelineExpr), exprDollar[2].duration, exprDollar[4].UnwrapExpr, nil)
 		}
 	case 37:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:179
+//line pkg/logql/syntax/expr.y:185
 		{
 			exprVAL.LogRangeExpr = newLogRange(newPipelineExpr(newMatcherExpr(exprDollar[1].Selector), exprDollar[4].PipelineExpr), exprDollar[2].duration, exprDollar[5].UnwrapExpr, exprDollar[3].OffsetExpr)
 		}
 	case 38:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:180
+//line pkg/logql/syntax/expr.y:186
 		{
 			exprVAL.LogRangeExpr = exprDollar[2].LogRangeExpr
 		}
 	case 40:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:185
+//line pkg/logql/syntax/expr.y:191
 		{
 			exprVAL.UnwrapExpr = newUnwrapExpr(exprDollar[3].str, "")
 		}
 	case 41:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:186
+//line pkg/logql/syntax/expr.y:192
 		{
 			exprVAL.UnwrapExpr = newUnwrapExpr(exprDollar[5].str, exprDollar[3].ConvOp)
 		}
 	case 42:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:187
+//line pkg/logql/syntax/expr.y:193
 		{
 			exprVAL.UnwrapExpr = exprDollar[1].UnwrapExpr.addPostFilter(exprDollar[3].LabelFilter)
 		}
 	case 43:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:191
+//line pkg/logql/syntax/expr.y:197
 		{
 			exprVAL.ConvOp = OpConvBytes
 		}
 	case 44:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:192
+//line pkg/logql/syntax/expr.y:198
 		{
 			exprVAL.ConvOp = OpConvDuration
 		}
 	case 45:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:193
+//line pkg/logql/syntax/expr.y:199
 		{
 			exprVAL.ConvOp = OpConvDurationSeconds
 		}
 	case 46:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:197
+//line pkg/logql/syntax/expr.y:203
 		{
 			exprVAL.RangeAggregationExpr = newRangeAggregationExpr(exprDollar[3].LogRangeExpr, exprDollar[1].RangeOp, nil, nil)
 		}
 	case 47:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:198
+//line pkg/logql/syntax/expr.y:204
 		{
 			exprVAL.RangeAggregationExpr = newRangeAggregationExpr(exprDollar[5].LogRangeExpr, exprDollar[1].RangeOp, nil, &exprDollar[3].str)
 		}
 	case 48:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:199
+//line pkg/logql/syntax/expr.y:205
 		{
 			exprVAL.RangeAggregationExpr = newRangeAggregationExpr(exprDollar[3].LogRangeExpr, exprDollar[1].RangeOp, exprDollar[5].Grouping, nil)
 		}
 	case 49:
 		exprDollar = exprS[exprpt-7 : exprpt+1]
-//line pkg/logql/syntax/expr.y:200
+//line pkg/logql/syntax/expr.y:206
 		{
 			exprVAL.RangeAggregationExpr = newRangeAggregationExpr(exprDollar[5].LogRangeExpr, exprDollar[1].RangeOp, exprDollar[7].Grouping, &exprDollar[3].str)
 		}
 	case 50:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:205
+//line pkg/logql/syntax/expr.y:211
 		{
 			exprVAL.VectorAggregationExpr = mustNewVectorAggregationExpr(exprDollar[3].MetricExpr, exprDollar[1].VectorOp, nil, nil)
 		}
 	case 51:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:206
+//line pkg/logql/syntax/expr.y:212
 		{
 			exprVAL.VectorAggregationExpr = mustNewVectorAggregationExpr(exprDollar[4].MetricExpr, exprDollar[1].VectorOp, exprDollar[2].Grouping, nil)
 		}
 	case 52:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:207
+//line pkg/logql/syntax/expr.y:213
 		{
 			exprVAL.VectorAggregationExpr = mustNewVectorAggregationExpr(exprDollar[3].MetricExpr, exprDollar[1].VectorOp, exprDollar[5].Grouping, nil)
 		}
 	case 53:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:209
+//line pkg/logql/syntax/expr.y:215
 		{
 			exprVAL.VectorAggregationExpr = mustNewVectorAggregationExpr(exprDollar[5].MetricExpr, exprDollar[1].VectorOp, nil, &exprDollar[3].str)
 		}
 	case 54:
 		exprDollar = exprS[exprpt-7 : exprpt+1]
-//line pkg/logql/syntax/expr.y:210
+//line pkg/logql/syntax/expr.y:216
 		{
 			exprVAL.VectorAggregationExpr = mustNewVectorAggregationExpr(exprDollar[5].MetricExpr, exprDollar[1].VectorOp, exprDollar[7].Grouping, &exprDollar[3].str)
 		}
 	case 55:
 		exprDollar = exprS[exprpt-7 : exprpt+1]
-//line pkg/logql/syntax/expr.y:211
+//line pkg/logql/syntax/expr.y:217
 		{
 			exprVAL.VectorAggregationExpr = mustNewVectorAggregationExpr(exprDollar[6].MetricExpr, exprDollar[1].VectorOp, exprDollar[2].Grouping, &exprDollar[4].str)
 		}
 	case 56:
 		exprDollar = exprS[exprpt-12 : exprpt+1]
-//line pkg/logql/syntax/expr.y:216
+//line pkg/logql/syntax/expr.y:222
 		{
 			exprVAL.LabelReplaceExpr = mustNewLabelReplaceExpr(exprDollar[3].MetricExpr, exprDollar[5].str, exprDollar[7].str, exprDollar[9].str, exprDollar[11].str)
 		}
 	case 57:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:220
+//line pkg/logql/syntax/expr.y:226
 		{
 			exprVAL.Filter = labels.MatchRegexp
 		}
 	case 58:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:221
+//line pkg/logql/syntax/expr.y:227
 		{
 			exprVAL.Filter = labels.MatchEqual
 		}
 	case 59:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:222
+//line pkg/logql/syntax/expr.y:228
 		{
 			exprVAL.Filter = labels.MatchNotRegexp
 		}
 	case 60:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:223
+//line pkg/logql/syntax/expr.y:229
 		{
 			exprVAL.Filter = labels.MatchNotEqual
 		}
 	case 61:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:227
+//line pkg/logql/syntax/expr.y:233
 		{
 			exprVAL.Selector = exprDollar[2].Matchers
 		}
 	case 62:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:228
+//line pkg/logql/syntax/expr.y:234
 		{
 			exprVAL.Selector = exprDollar[2].Matchers
 		}
 	case 63:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:229
+//line pkg/logql/syntax/expr.y:235
 		{
 		}
 	case 64:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:233
+//line pkg/logql/syntax/expr.y:239
 		{
 			exprVAL.Matchers = []*labels.Matcher{exprDollar[1].Matcher}
 		}
 	case 65:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:234
+//line pkg/logql/syntax/expr.y:240
 		{
 			exprVAL.Matchers = append(exprDollar[1].Matchers, exprDollar[3].Matcher)
 		}
 	case 66:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:238
+//line pkg/logql/syntax/expr.y:244
 		{
 			exprVAL.Matcher = mustNewMatcher(labels.MatchEqual, exprDollar[1].str, exprDollar[3].str)
 		}
 	case 67:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:239
+//line pkg/logql/syntax/expr.y:245
 		{
 			exprVAL.Matcher = mustNewMatcher(labels.MatchNotEqual, exprDollar[1].str, exprDollar[3].str)
 		}
 	case 68:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:240
+//line pkg/logql/syntax/expr.y:246
 		{
 			exprVAL.Matcher = mustNewMatcher(labels.MatchRegexp, exprDollar[1].str, exprDollar[3].str)
 		}
 	case 69:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:241
+//line pkg/logql/syntax/expr.y:247
 		{
 			exprVAL.Matcher = mustNewMatcher(labels.MatchNotRegexp, exprDollar[1].str, exprDollar[3].str)
 		}
 	case 70:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:245
+//line pkg/logql/syntax/expr.y:251
 		{
 			exprVAL.PipelineExpr = MultiStageExpr{exprDollar[1].PipelineStage}
 		}
 	case 71:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:246
+//line pkg/logql/syntax/expr.y:252
 		{
 			exprVAL.PipelineExpr = append(exprDollar[1].PipelineExpr, exprDollar[2].PipelineStage)
 		}
 	case 72:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:250
+//line pkg/logql/syntax/expr.y:256
 		{
 			exprVAL.PipelineStage = exprDollar[1].LineFilters
 		}
 	case 73:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:251
+//line pkg/logql/syntax/expr.y:257
 		{
 			exprVAL.PipelineStage = exprDollar[2].LabelParser
 		}
 	case 74:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:252
+//line pkg/logql/syntax/expr.y:258
 		{
 			exprVAL.PipelineStage = exprDollar[2].JSONExpressionParser
 		}
 	case 75:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:253
+//line pkg/logql/syntax/expr.y:259
 		{
 			exprVAL.PipelineStage = &LabelFilterExpr{LabelFilterer: exprDollar[2].LabelFilter}
 		}
 	case 76:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:254
+//line pkg/logql/syntax/expr.y:260
 		{
 			exprVAL.PipelineStage = exprDollar[2].LineFormatExpr
 		}
 	case 77:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:255
+//line pkg/logql/syntax/expr.y:261
 		{
 			exprVAL.PipelineStage = exprDollar[2].DecolorizeExpr
 		}
 	case 78:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:256
+//line pkg/logql/syntax/expr.y:262
 		{
 			exprVAL.PipelineStage = exprDollar[2].LabelFormatExpr
 		}
 	case 79:
+		exprDollar = exprS[exprpt-2 : exprpt+1]
+//line pkg/logql/syntax/expr.y:263
+		{
+			exprVAL.PipelineStage = exprDollar[2].DropLabelsExpr
+		}
+	case 80:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:260
+//line pkg/logql/syntax/expr.y:267
 		{
 			exprVAL.FilterOp = OpFilterIP
 		}
-	case 80:
+	case 81:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:264
+//line pkg/logql/syntax/expr.y:271
 		{
 			exprVAL.LineFilter = newLineFilterExpr(exprDollar[1].Filter, "", exprDollar[2].str)
 		}
-	case 81:
+	case 82:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:265
+//line pkg/logql/syntax/expr.y:272
 		{
 			exprVAL.LineFilter = newLineFilterExpr(exprDollar[1].Filter, exprDollar[2].FilterOp, exprDollar[4].str)
 		}
-	case 82:
+	case 83:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:269
+//line pkg/logql/syntax/expr.y:276
 		{
 			exprVAL.LineFilters = exprDollar[1].LineFilter
 		}
-	case 83:
+	case 84:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:270
+//line pkg/logql/syntax/expr.y:277
 		{
 			exprVAL.LineFilters = newNestedLineFilterExpr(exprDollar[1].LineFilters, exprDollar[2].LineFilter)
 		}
-	case 84:
+	case 85:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:274
+//line pkg/logql/syntax/expr.y:281
 		{
 			exprVAL.LabelParser = newLabelParserExpr(OpParserTypeJSON, "")
 		}
-	case 85:
+	case 86:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:275
+//line pkg/logql/syntax/expr.y:282
 		{
 			exprVAL.LabelParser = newLabelParserExpr(OpParserTypeLogfmt, "")
 		}
-	case 86:
+	case 87:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:276
+//line pkg/logql/syntax/expr.y:283
 		{
 			exprVAL.LabelParser = newLabelParserExpr(OpParserTypeRegexp, exprDollar[2].str)
 		}
-	case 87:
+	case 88:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:277
+//line pkg/logql/syntax/expr.y:284
 		{
 			exprVAL.LabelParser = newLabelParserExpr(OpParserTypeUnpack, "")
 		}
-	case 88:
+	case 89:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:278
+//line pkg/logql/syntax/expr.y:285
 		{
 			exprVAL.LabelParser = newLabelParserExpr(OpParserTypePattern, exprDollar[2].str)
 		}
-	case 89:
+	case 90:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:282
+//line pkg/logql/syntax/expr.y:289
 		{
 			exprVAL.JSONExpressionParser = newJSONExpressionParser(exprDollar[2].JSONExpressionList)
 		}
-	case 90:
+	case 91:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:284
+//line pkg/logql/syntax/expr.y:291
 		{
 			exprVAL.LineFormatExpr = newLineFmtExpr(exprDollar[2].str)
 		}
-	case 91:
+	case 92:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:286
+//line pkg/logql/syntax/expr.y:293
 		{
 			exprVAL.DecolorizeExpr = newDecolorizeExpr()
 		}
-	case 92:
+	case 93:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:289
+//line pkg/logql/syntax/expr.y:296
 		{
 			exprVAL.LabelFormat = log.NewRenameLabelFmt(exprDollar[1].str, exprDollar[3].str)
 		}
-	case 93:
+	case 94:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:290
+//line pkg/logql/syntax/expr.y:297
 		{
 			exprVAL.LabelFormat = log.NewTemplateLabelFmt(exprDollar[1].str, exprDollar[3].str)
 		}
-	case 94:
+	case 95:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:294
+//line pkg/logql/syntax/expr.y:301
 		{
 			exprVAL.LabelsFormat = []log.LabelFmt{exprDollar[1].LabelFormat}
 		}
-	case 95:
+	case 96:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:295
+//line pkg/logql/syntax/expr.y:302
 		{
 			exprVAL.LabelsFormat = append(exprDollar[1].LabelsFormat, exprDollar[3].LabelFormat)
 		}
-	case 97:
+	case 98:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:299
+//line pkg/logql/syntax/expr.y:307
 		{
 			exprVAL.LabelFormatExpr = newLabelFmtExpr(exprDollar[2].LabelsFormat)
 		}
-	case 98:
+	case 99:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:302
+//line pkg/logql/syntax/expr.y:310
 		{
 			exprVAL.LabelFilter = log.NewStringLabelFilter(exprDollar[1].Matcher)
 		}
-	case 99:
+	case 100:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:303
+//line pkg/logql/syntax/expr.y:311
 		{
 			exprVAL.LabelFilter = exprDollar[1].IPLabelFilter
 		}
-	case 100:
+	case 101:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:304
+//line pkg/logql/syntax/expr.y:312
 		{
 			exprVAL.LabelFilter = exprDollar[1].UnitFilter
 		}
-	case 101:
+	case 102:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:305
+//line pkg/logql/syntax/expr.y:313
 		{
 			exprVAL.LabelFilter = exprDollar[1].NumberFilter
 		}
-	case 102:
+	case 103:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:306
+//line pkg/logql/syntax/expr.y:314
 		{
 			exprVAL.LabelFilter = exprDollar[2].LabelFilter
 		}
-	case 103:
+	case 104:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:307
+//line pkg/logql/syntax/expr.y:315
 		{
 			exprVAL.LabelFilter = log.NewAndLabelFilter(exprDollar[1].LabelFilter, exprDollar[2].LabelFilter)
 		}
-	case 104:
+	case 105:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:308
+//line pkg/logql/syntax/expr.y:316
 		{
 			exprVAL.LabelFilter = log.NewAndLabelFilter(exprDollar[1].LabelFilter, exprDollar[3].LabelFilter)
 		}
-	case 105:
+	case 106:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:309
+//line pkg/logql/syntax/expr.y:317
 		{
 			exprVAL.LabelFilter = log.NewAndLabelFilter(exprDollar[1].LabelFilter, exprDollar[3].LabelFilter)
 		}
-	case 106:
+	case 107:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:310
+//line pkg/logql/syntax/expr.y:318
 		{
 			exprVAL.LabelFilter = log.NewOrLabelFilter(exprDollar[1].LabelFilter, exprDollar[3].LabelFilter)
 		}
-	case 107:
+	case 108:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:314
+//line pkg/logql/syntax/expr.y:322
 		{
 			exprVAL.JSONExpression = log.NewJSONExpr(exprDollar[1].str, exprDollar[3].str)
 		}
-	case 108:
+	case 109:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:315
+//line pkg/logql/syntax/expr.y:323
 		{
 			exprVAL.JSONExpression = log.NewJSONExpr(exprDollar[1].str, exprDollar[1].str)
 		}
-	case 109:
+	case 110:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:318
+//line pkg/logql/syntax/expr.y:326
 		{
 			exprVAL.JSONExpressionList = []log.JSONExpression{exprDollar[1].JSONExpression}
 		}
-	case 110:
+	case 111:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:319
+//line pkg/logql/syntax/expr.y:327
 		{
 			exprVAL.JSONExpressionList = append(exprDollar[1].JSONExpressionList, exprDollar[3].JSONExpression)
 		}
-	case 111:
+	case 112:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:323
+//line pkg/logql/syntax/expr.y:331
 		{
 			exprVAL.IPLabelFilter = log.NewIPLabelFilter(exprDollar[5].str, exprDollar[1].str, log.LabelFilterEqual)
 		}
-	case 112:
+	case 113:
 		exprDollar = exprS[exprpt-6 : exprpt+1]
-//line pkg/logql/syntax/expr.y:324
+//line pkg/logql/syntax/expr.y:332
 		{
 			exprVAL.IPLabelFilter = log.NewIPLabelFilter(exprDollar[5].str, exprDollar[1].str, log.LabelFilterNotEqual)
 		}
-	case 113:
+	case 114:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:328
+//line pkg/logql/syntax/expr.y:336
 		{
 			exprVAL.UnitFilter = exprDollar[1].DurationFilter
 		}
-	case 114:
+	case 115:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:329
+//line pkg/logql/syntax/expr.y:337
 		{
 			exprVAL.UnitFilter = exprDollar[1].BytesFilter
 		}
-	case 115:
-		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:332
-		{
-			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterGreaterThan, exprDollar[1].str, exprDollar[3].duration)
-		}
 	case 116:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:333
+//line pkg/logql/syntax/expr.y:340
 		{
-			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterGreaterThanOrEqual, exprDollar[1].str, exprDollar[3].duration)
+			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterGreaterThan, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 117:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:334
+//line pkg/logql/syntax/expr.y:341
 		{
-			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterLesserThan, exprDollar[1].str, exprDollar[3].duration)
+			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterGreaterThanOrEqual, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 118:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:335
+//line pkg/logql/syntax/expr.y:342
 		{
-			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterLesserThanOrEqual, exprDollar[1].str, exprDollar[3].duration)
+			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterLesserThan, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 119:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:336
+//line pkg/logql/syntax/expr.y:343
 		{
-			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterNotEqual, exprDollar[1].str, exprDollar[3].duration)
+			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterLesserThanOrEqual, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 120:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:337
+//line pkg/logql/syntax/expr.y:344
 		{
-			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterEqual, exprDollar[1].str, exprDollar[3].duration)
+			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterNotEqual, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 121:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:338
+//line pkg/logql/syntax/expr.y:345
 		{
 			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterEqual, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 122:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:342
+//line pkg/logql/syntax/expr.y:346
 		{
-			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterGreaterThan, exprDollar[1].str, exprDollar[3].bytes)
+			exprVAL.DurationFilter = log.NewDurationLabelFilter(log.LabelFilterEqual, exprDollar[1].str, exprDollar[3].duration)
 		}
 	case 123:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:343
+//line pkg/logql/syntax/expr.y:350
 		{
-			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterGreaterThanOrEqual, exprDollar[1].str, exprDollar[3].bytes)
+			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterGreaterThan, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 124:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:344
+//line pkg/logql/syntax/expr.y:351
 		{
-			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterLesserThan, exprDollar[1].str, exprDollar[3].bytes)
+			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterGreaterThanOrEqual, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 125:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:345
+//line pkg/logql/syntax/expr.y:352
 		{
-			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterLesserThanOrEqual, exprDollar[1].str, exprDollar[3].bytes)
+			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterLesserThan, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 126:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:346
+//line pkg/logql/syntax/expr.y:353
 		{
-			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterNotEqual, exprDollar[1].str, exprDollar[3].bytes)
+			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterLesserThanOrEqual, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 127:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:347
+//line pkg/logql/syntax/expr.y:354
 		{
-			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterEqual, exprDollar[1].str, exprDollar[3].bytes)
+			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterNotEqual, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 128:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:348
+//line pkg/logql/syntax/expr.y:355
 		{
 			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterEqual, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 129:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:352
+//line pkg/logql/syntax/expr.y:356
 		{
-			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterGreaterThan, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+			exprVAL.BytesFilter = log.NewBytesLabelFilter(log.LabelFilterEqual, exprDollar[1].str, exprDollar[3].bytes)
 		}
 	case 130:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:353
+//line pkg/logql/syntax/expr.y:360
 		{
-			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterGreaterThanOrEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterGreaterThan, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
 		}
 	case 131:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:354
+//line pkg/logql/syntax/expr.y:361
 		{
-			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterLesserThan, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterGreaterThanOrEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
 		}
 	case 132:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:355
+//line pkg/logql/syntax/expr.y:362
 		{
-			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterLesserThanOrEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterLesserThan, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
 		}
 	case 133:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:356
+//line pkg/logql/syntax/expr.y:363
 		{
-			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterNotEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterLesserThanOrEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
 		}
 	case 134:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:357
+//line pkg/logql/syntax/expr.y:364
 		{
-			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterNotEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
 		}
 	case 135:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:358
+//line pkg/logql/syntax/expr.y:365
 		{
 			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
 		}
 	case 136:
+		exprDollar = exprS[exprpt-3 : exprpt+1]
+//line pkg/logql/syntax/expr.y:366
+		{
+			exprVAL.NumberFilter = log.NewNumericLabelFilter(log.LabelFilterEqual, exprDollar[1].str, mustNewFloat(exprDollar[3].str))
+		}
+	case 137:
+		exprDollar = exprS[exprpt-1 : exprpt+1]
+//line pkg/logql/syntax/expr.y:370
+		{
+			exprVAL.DropLabel = log.NewDropLabel(nil, exprDollar[1].str)
+		}
+	case 138:
+		exprDollar = exprS[exprpt-1 : exprpt+1]
+//line pkg/logql/syntax/expr.y:371
+		{
+			exprVAL.DropLabel = log.NewDropLabel(exprDollar[1].Matcher, "")
+		}
+	case 139:
+		exprDollar = exprS[exprpt-1 : exprpt+1]
+//line pkg/logql/syntax/expr.y:374
+		{
+			exprVAL.DropLabels = []log.DropLabel{exprDollar[1].DropLabel}
+		}
+	case 140:
+		exprDollar = exprS[exprpt-3 : exprpt+1]
+//line pkg/logql/syntax/expr.y:375
+		{
+			exprVAL.DropLabels = append(exprDollar[1].DropLabels, exprDollar[3].DropLabel)
+		}
+	case 141:
+		exprDollar = exprS[exprpt-2 : exprpt+1]
+//line pkg/logql/syntax/expr.y:378
+		{
+			exprVAL.DropLabelsExpr = newDropLabelsExpr(exprDollar[2].DropLabels)
+		}
+	case 142:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:363
+//line pkg/logql/syntax/expr.y:382
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("or", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 137:
+	case 143:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:364
+//line pkg/logql/syntax/expr.y:383
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("and", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 138:
+	case 144:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:365
+//line pkg/logql/syntax/expr.y:384
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("unless", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 139:
+	case 145:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:366
+//line pkg/logql/syntax/expr.y:385
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("+", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 140:
+	case 146:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:367
+//line pkg/logql/syntax/expr.y:386
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("-", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 141:
+	case 147:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:368
+//line pkg/logql/syntax/expr.y:387
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("*", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 142:
+	case 148:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:369
+//line pkg/logql/syntax/expr.y:388
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("/", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 143:
+	case 149:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:370
+//line pkg/logql/syntax/expr.y:389
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("%", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 144:
+	case 150:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:371
+//line pkg/logql/syntax/expr.y:390
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("^", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 145:
+	case 151:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:372
+//line pkg/logql/syntax/expr.y:391
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("==", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 146:
+	case 152:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:373
+//line pkg/logql/syntax/expr.y:392
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("!=", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 147:
+	case 153:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:374
+//line pkg/logql/syntax/expr.y:393
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr(">", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 148:
+	case 154:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:375
+//line pkg/logql/syntax/expr.y:394
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr(">=", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 149:
+	case 155:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:376
+//line pkg/logql/syntax/expr.y:395
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("<", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 150:
+	case 156:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:377
+//line pkg/logql/syntax/expr.y:396
 		{
 			exprVAL.BinOpExpr = mustNewBinOpExpr("<=", exprDollar[3].BinOpModifier, exprDollar[1].Expr, exprDollar[4].Expr)
 		}
-	case 151:
+	case 157:
 		exprDollar = exprS[exprpt-0 : exprpt+1]
-//line pkg/logql/syntax/expr.y:381
+//line pkg/logql/syntax/expr.y:400
 		{
 			exprVAL.BoolModifier = &BinOpOptions{VectorMatching: &VectorMatching{Card: CardOneToOne}}
 		}
-	case 152:
+	case 158:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:385
+//line pkg/logql/syntax/expr.y:404
 		{
 			exprVAL.BoolModifier = &BinOpOptions{VectorMatching: &VectorMatching{Card: CardOneToOne}, ReturnBool: true}
 		}
-	case 153:
+	case 159:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:392
+//line pkg/logql/syntax/expr.y:411
 		{
 			exprVAL.OnOrIgnoringModifier = exprDollar[1].BoolModifier
 			exprVAL.OnOrIgnoringModifier.VectorMatching.On = true
 			exprVAL.OnOrIgnoringModifier.VectorMatching.MatchingLabels = exprDollar[4].Labels
 		}
-	case 154:
+	case 160:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:398
+//line pkg/logql/syntax/expr.y:417
 		{
 			exprVAL.OnOrIgnoringModifier = exprDollar[1].BoolModifier
 			exprVAL.OnOrIgnoringModifier.VectorMatching.On = true
 		}
-	case 155:
+	case 161:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:403
+//line pkg/logql/syntax/expr.y:422
 		{
 			exprVAL.OnOrIgnoringModifier = exprDollar[1].BoolModifier
 			exprVAL.OnOrIgnoringModifier.VectorMatching.MatchingLabels = exprDollar[4].Labels
 		}
-	case 156:
+	case 162:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:408
+//line pkg/logql/syntax/expr.y:427
 		{
 			exprVAL.OnOrIgnoringModifier = exprDollar[1].BoolModifier
 		}
-	case 157:
+	case 163:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:414
+//line pkg/logql/syntax/expr.y:433
 		{
 			exprVAL.BinOpModifier = exprDollar[1].BoolModifier
 		}
-	case 158:
+	case 164:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:415
+//line pkg/logql/syntax/expr.y:434
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 		}
-	case 159:
+	case 165:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:417
+//line pkg/logql/syntax/expr.y:436
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 			exprVAL.BinOpModifier.VectorMatching.Card = CardManyToOne
 		}
-	case 160:
+	case 166:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:422
+//line pkg/logql/syntax/expr.y:441
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 			exprVAL.BinOpModifier.VectorMatching.Card = CardManyToOne
 		}
-	case 161:
+	case 167:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:427
+//line pkg/logql/syntax/expr.y:446
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 			exprVAL.BinOpModifier.VectorMatching.Card = CardManyToOne
 			exprVAL.BinOpModifier.VectorMatching.Include = exprDollar[4].Labels
 		}
-	case 162:
+	case 168:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:433
+//line pkg/logql/syntax/expr.y:452
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 			exprVAL.BinOpModifier.VectorMatching.Card = CardOneToMany
 		}
-	case 163:
+	case 169:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:438
+//line pkg/logql/syntax/expr.y:457
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 			exprVAL.BinOpModifier.VectorMatching.Card = CardOneToMany
 		}
-	case 164:
+	case 170:
 		exprDollar = exprS[exprpt-5 : exprpt+1]
-//line pkg/logql/syntax/expr.y:443
+//line pkg/logql/syntax/expr.y:462
 		{
 			exprVAL.BinOpModifier = exprDollar[1].OnOrIgnoringModifier
 			exprVAL.BinOpModifier.VectorMatching.Card = CardOneToMany
 			exprVAL.BinOpModifier.VectorMatching.Include = exprDollar[4].Labels
 		}
-	case 165:
+	case 171:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:451
+//line pkg/logql/syntax/expr.y:470
 		{
 			exprVAL.LiteralExpr = mustNewLiteralExpr(exprDollar[1].str, false)
 		}
-	case 166:
+	case 172:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:452
+//line pkg/logql/syntax/expr.y:471
 		{
 			exprVAL.LiteralExpr = mustNewLiteralExpr(exprDollar[2].str, false)
 		}
-	case 167:
+	case 173:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:453
+//line pkg/logql/syntax/expr.y:472
 		{
 			exprVAL.LiteralExpr = mustNewLiteralExpr(exprDollar[2].str, true)
 		}
-	case 168:
+	case 174:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:457
+//line pkg/logql/syntax/expr.y:476
 		{
 			exprVAL.VectorExpr = NewVectorExpr(exprDollar[3].str)
 		}
-	case 169:
+	case 175:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:460
+//line pkg/logql/syntax/expr.y:479
 		{
 			exprVAL.Vector = OpTypeVector
 		}
-	case 170:
+	case 176:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:464
+//line pkg/logql/syntax/expr.y:483
 		{
 			exprVAL.VectorOp = OpTypeSum
 		}
-	case 171:
+	case 177:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:465
+//line pkg/logql/syntax/expr.y:484
 		{
 			exprVAL.VectorOp = OpTypeAvg
 		}
-	case 172:
+	case 178:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:466
+//line pkg/logql/syntax/expr.y:485
 		{
 			exprVAL.VectorOp = OpTypeCount
 		}
-	case 173:
+	case 179:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:467
+//line pkg/logql/syntax/expr.y:486
 		{
 			exprVAL.VectorOp = OpTypeMax
 		}
-	case 174:
+	case 180:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:468
+//line pkg/logql/syntax/expr.y:487
 		{
 			exprVAL.VectorOp = OpTypeMin
 		}
-	case 175:
+	case 181:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:469
+//line pkg/logql/syntax/expr.y:488
 		{
 			exprVAL.VectorOp = OpTypeStddev
 		}
-	case 176:
+	case 182:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:470
+//line pkg/logql/syntax/expr.y:489
 		{
 			exprVAL.VectorOp = OpTypeStdvar
 		}
-	case 177:
+	case 183:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:471
+//line pkg/logql/syntax/expr.y:490
 		{
 			exprVAL.VectorOp = OpTypeBottomK
 		}
-	case 178:
+	case 184:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:472
+//line pkg/logql/syntax/expr.y:491
 		{
 			exprVAL.VectorOp = OpTypeTopK
 		}
-	case 179:
+	case 185:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:473
+//line pkg/logql/syntax/expr.y:492
 		{
 			exprVAL.VectorOp = OpTypeSort
 		}
-	case 180:
+	case 186:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:474
+//line pkg/logql/syntax/expr.y:493
 		{
 			exprVAL.VectorOp = OpTypeSortDesc
 		}
-	case 181:
+	case 187:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:478
+//line pkg/logql/syntax/expr.y:497
 		{
 			exprVAL.RangeOp = OpRangeTypeCount
 		}
-	case 182:
+	case 188:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:479
+//line pkg/logql/syntax/expr.y:498
 		{
 			exprVAL.RangeOp = OpRangeTypeRate
 		}
-	case 183:
+	case 189:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:480
+//line pkg/logql/syntax/expr.y:499
 		{
 			exprVAL.RangeOp = OpRangeTypeRateCounter
 		}
-	case 184:
+	case 190:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:481
+//line pkg/logql/syntax/expr.y:500
 		{
 			exprVAL.RangeOp = OpRangeTypeBytes
 		}
-	case 185:
+	case 191:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:482
+//line pkg/logql/syntax/expr.y:501
 		{
 			exprVAL.RangeOp = OpRangeTypeBytesRate
 		}
-	case 186:
+	case 192:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:483
+//line pkg/logql/syntax/expr.y:502
 		{
 			exprVAL.RangeOp = OpRangeTypeAvg
 		}
-	case 187:
+	case 193:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:484
+//line pkg/logql/syntax/expr.y:503
 		{
 			exprVAL.RangeOp = OpRangeTypeSum
 		}
-	case 188:
+	case 194:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:485
+//line pkg/logql/syntax/expr.y:504
 		{
 			exprVAL.RangeOp = OpRangeTypeMin
 		}
-	case 189:
+	case 195:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:486
+//line pkg/logql/syntax/expr.y:505
 		{
 			exprVAL.RangeOp = OpRangeTypeMax
 		}
-	case 190:
+	case 196:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:487
+//line pkg/logql/syntax/expr.y:506
 		{
 			exprVAL.RangeOp = OpRangeTypeStdvar
 		}
-	case 191:
+	case 197:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:488
+//line pkg/logql/syntax/expr.y:507
 		{
 			exprVAL.RangeOp = OpRangeTypeStddev
 		}
-	case 192:
+	case 198:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:489
+//line pkg/logql/syntax/expr.y:508
 		{
 			exprVAL.RangeOp = OpRangeTypeQuantile
 		}
-	case 193:
+	case 199:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:490
+//line pkg/logql/syntax/expr.y:509
 		{
 			exprVAL.RangeOp = OpRangeTypeFirst
 		}
-	case 194:
+	case 200:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:491
+//line pkg/logql/syntax/expr.y:510
 		{
 			exprVAL.RangeOp = OpRangeTypeLast
 		}
-	case 195:
+	case 201:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:492
+//line pkg/logql/syntax/expr.y:511
 		{
 			exprVAL.RangeOp = OpRangeTypeAbsent
 		}
-	case 196:
+	case 202:
 		exprDollar = exprS[exprpt-2 : exprpt+1]
-//line pkg/logql/syntax/expr.y:496
+//line pkg/logql/syntax/expr.y:515
 		{
 			exprVAL.OffsetExpr = newOffsetExpr(exprDollar[2].duration)
 		}
-	case 197:
+	case 203:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/syntax/expr.y:499
+//line pkg/logql/syntax/expr.y:518
 		{
 			exprVAL.Labels = []string{exprDollar[1].str}
 		}
-	case 198:
+	case 204:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:500
+//line pkg/logql/syntax/expr.y:519
 		{
 			exprVAL.Labels = append(exprDollar[1].Labels, exprDollar[3].str)
 		}
-	case 199:
+	case 205:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:504
+//line pkg/logql/syntax/expr.y:523
 		{
 			exprVAL.Grouping = &Grouping{Without: false, Groups: exprDollar[3].Labels}
 		}
-	case 200:
+	case 206:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/syntax/expr.y:505
+//line pkg/logql/syntax/expr.y:524
 		{
 			exprVAL.Grouping = &Grouping{Without: true, Groups: exprDollar[3].Labels}
 		}
-	case 201:
+	case 207:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:506
+//line pkg/logql/syntax/expr.y:525
 		{
 			exprVAL.Grouping = &Grouping{Without: false, Groups: nil}
 		}
-	case 202:
+	case 208:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
-//line pkg/logql/syntax/expr.y:507
+//line pkg/logql/syntax/expr.y:526
 		{
 			exprVAL.Grouping = &Grouping{Without: true, Groups: nil}
 		}
diff --git a/pkg/logql/syntax/lex.go b/pkg/logql/syntax/lex.go
index ec9d9fdd832b..5a9783651a9a 100644
--- a/pkg/logql/syntax/lex.go
+++ b/pkg/logql/syntax/lex.go
@@ -72,6 +72,9 @@ var tokens = map[string]int{
 	// filter functions
 	OpFilterIP:   IP,
 	OpDecolorize: DECOLORIZE,
+
+	// drop labels
+	OpDrop: DROP,
 }
 
 // functionTokens are tokens that needs to be suffixes with parenthesis
diff --git a/pkg/logql/syntax/prettier.go b/pkg/logql/syntax/prettier.go
index ba4a5f66fdb7..297cd25e8acb 100644
--- a/pkg/logql/syntax/prettier.go
+++ b/pkg/logql/syntax/prettier.go
@@ -110,6 +110,10 @@ func (e *LabelParserExpr) Pretty(level int) string {
 	return commonPrefixIndent(level, e)
 }
 
+func (e *DropLabelsExpr) Pretty(level int) string {
+	return commonPrefixIndent(level, e)
+}
+
 // e.g: | level!="error"
 func (e *LabelFilterExpr) Pretty(level int) string {
 	return commonPrefixIndent(level, e)
diff --git a/pkg/loki/config_wrapper_test.go b/pkg/loki/config_wrapper_test.go
index 0c3fe2856b84..1a482916ac0c 100644
--- a/pkg/loki/config_wrapper_test.go
+++ b/pkg/loki/config_wrapper_test.go
@@ -579,6 +579,46 @@ storage_config:
 			assert.EqualValues(t, defaults.Ruler.StoreConfig.S3, config.Ruler.StoreConfig.S3)
 		})
 
+		t.Run("named storage config provided via config file is preserved", func(t *testing.T) {
+			namedStoresConfig := `common:
+  storage:
+    s3:
+      endpoint: s3://common-bucket
+      region: us-east1
+      access_key_id: abc123
+      secret_access_key: def789
+storage_config:
+  named_stores:
+    aws:
+      store-1:
+        endpoint: s3://foo-bucket
+        region: us-west1
+        access_key_id: 123abc
+        secret_access_key: 789def
+      store-2:
+        endpoint: s3://bar-bucket
+        region: us-west2
+        access_key_id: 456def
+        secret_access_key: 789abc`
+			config, _ := testContext(namedStoresConfig, nil)
+
+			// should be set by common config
+			assert.Equal(t, "s3://common-bucket", config.StorageConfig.AWSStorageConfig.S3Config.Endpoint)
+			assert.Equal(t, "us-east1", config.StorageConfig.AWSStorageConfig.S3Config.Region)
+			assert.Equal(t, "abc123", config.StorageConfig.AWSStorageConfig.S3Config.AccessKeyID)
+			assert.Equal(t, "def789", config.StorageConfig.AWSStorageConfig.S3Config.SecretAccessKey.String())
+
+			assert.Equal(t, "s3://foo-bucket", config.StorageConfig.NamedStores.AWS["store-1"].S3Config.Endpoint)
+			assert.Equal(t, "us-west1", config.StorageConfig.NamedStores.AWS["store-1"].S3Config.Region)
+			assert.Equal(t, "123abc", config.StorageConfig.NamedStores.AWS["store-1"].S3Config.AccessKeyID)
+			assert.Equal(t, "789def", config.StorageConfig.NamedStores.AWS["store-1"].S3Config.SecretAccessKey.String())
+
+			assert.Equal(t, "s3://bar-bucket", config.StorageConfig.NamedStores.AWS["store-2"].S3Config.Endpoint)
+			assert.Equal(t, "us-west2", config.StorageConfig.NamedStores.AWS["store-2"].S3Config.Region)
+			assert.Equal(t, "456def", config.StorageConfig.NamedStores.AWS["store-2"].S3Config.AccessKeyID)
+			assert.Equal(t, "789abc", config.StorageConfig.NamedStores.AWS["store-2"].S3Config.SecretAccessKey.String())
+		})
+
 		t.Run("partial ruler config from file is honored for overriding things like bucket names", func(t *testing.T) {
 			specificRulerConfig := `common:
   storage:
diff --git a/pkg/querier/queryrange/shard_resolver.go b/pkg/querier/queryrange/shard_resolver.go
index 0196b41b9b56..a02bf6e26d91 100644
--- a/pkg/querier/queryrange/shard_resolver.go
+++ b/pkg/querier/queryrange/shard_resolver.go
@@ -101,17 +101,16 @@ func (r *dynamicShardResolver) Shards(e syntax.Expr) (int, error) {
 
 		results = append(results, casted.Response)
 		level.Debug(sp).Log(
-			"msg", "queried index",
-			"type", "single",
-			"matchers", matchers,
-			"bytes", strings.Replace(humanize.Bytes(casted.Response.Bytes), " ", "", 1),
-			"chunks", casted.Response.Chunks,
-			"streams", casted.Response.Streams,
-			"entries", casted.Response.Entries,
-			"duration", time.Since(start),
-			"from", adjustedFrom.Time(),
-			"through", adjustedThrough.Time(),
-			"length", adjustedThrough.Sub(adjustedFrom),
+			append(
+				casted.Response.LoggingKeyValues(),
+				"msg", "queried index",
+				"type", "single",
+				"matchers", matchers,
+				"duration", time.Since(start),
+				"from", adjustedFrom.Time(),
+				"through", adjustedThrough.Time(),
+				"length", adjustedThrough.Sub(adjustedFrom),
+			)...,
 		)
 		return nil
 	}); err != nil {
@@ -125,17 +124,16 @@ func (r *dynamicShardResolver) Shards(e syntax.Expr) (int, error) {
 		bytesPerShard = combined.Bytes / uint64(factor)
 	}
 	level.Debug(sp).Log(
-		"msg", "queried index",
-		"type", "combined",
-		"len", len(results),
-		"bytes", strings.Replace(humanize.Bytes(combined.Bytes), " ", "", 1),
-		"chunks", combined.Chunks,
-		"streams", combined.Streams,
-		"entries", combined.Entries,
-		"max_parallelism", r.maxParallelism,
-		"duration", time.Since(start),
-		"factor", factor,
-		"bytes_per_shard", strings.Replace(humanize.Bytes(bytesPerShard), " ", "", 1),
+		append(
+			combined.LoggingKeyValues(),
+			"msg", "queried index",
+			"type", "combined",
+			"len", len(results),
+			"max_parallelism", r.maxParallelism,
+			"duration", time.Since(start),
+			"factor", factor,
+			"bytes_per_shard", strings.Replace(humanize.Bytes(bytesPerShard), " ", "", 1),
+		)...,
 	)
 	return factor, nil
 }
diff --git a/pkg/scheduler/scheduler.go b/pkg/scheduler/scheduler.go
index a15dc4a257fa..6610ffe1e98c 100644
--- a/pkg/scheduler/scheduler.go
+++ b/pkg/scheduler/scheduler.go
@@ -762,5 +762,9 @@ func (s *Scheduler) OnRingInstanceHeartbeat(_ *ring.BasicLifecycler, _ *ring.Des
 }
 
 func (s *Scheduler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
-	s.ring.ServeHTTP(w, req)
+	if s.cfg.UseSchedulerRing {
+		s.ring.ServeHTTP(w, req)
+	} else {
+		_, _ = w.Write([]byte("QueryScheduler running with '-query-scheduler.use-scheduler-ring' set to false."))
+	}
 }
diff --git a/pkg/sizing/algorithm.go b/pkg/sizing/algorithm.go
index d91f07690ef6..6a9012ddc248 100644
--- a/pkg/sizing/algorithm.go
+++ b/pkg/sizing/algorithm.go
@@ -5,9 +5,10 @@ import (
 )
 
 type ClusterSize struct {
-	totalNodes         int
-	totalReadReplicas  int
-	totalWriteReplicas int
+	TotalNodes         int
+	TotalReadReplicas  int
+	TotalWriteReplicas int
+	TotalCoresRequest  float64
 
 	expectedMaxReadThroughputBytesSec float64
 	expectedMaxIngestBytesDay         float64
@@ -20,9 +21,10 @@ const (
 	Super QueryPerf = "super"
 )
 
-func calculateClusterSize(nt NodeType, tbDayIngest int, qperf QueryPerf) ClusterSize {
-	// 1 Petabyte per day is maximum
-	bytesDayIngest := math.Min(float64(tbDayIngest), 1000.0) * 1e12
+func calculateClusterSize(nt NodeType, bytesDayIngest float64, qperf QueryPerf) ClusterSize {
+
+	// 1 Petabyte per day is maximum. We use decimal prefix https://en.wikipedia.org/wiki/Binary_prefix
+	bytesDayIngest = math.Min(bytesDayIngest, 1e15)
 	bytesSecondIngest := bytesDayIngest / 86400
 	numWriteReplicasNeeded := math.Ceil(bytesSecondIngest / nt.writePod.rateBytesSecond)
 
@@ -32,7 +34,7 @@ func calculateClusterSize(nt NodeType, tbDayIngest int, qperf QueryPerf) Cluster
 	replicasOnLastNode := math.Mod(numWriteReplicasNeeded, writeReplicasPerNode)
 
 	coresOnLastNode := 0.0
-	if replicasOnLastNode >= 0.0 {
+	if replicasOnLastNode > 0.0 {
 		coresOnLastNode = math.Max(float64(nt.cores)-replicasOnLastNode*nt.writePod.cpuRequest, 0.0)
 	}
 
@@ -43,12 +45,13 @@ func calculateClusterSize(nt NodeType, tbDayIngest int, qperf QueryPerf) Cluster
 	readReplicasOnFullyPackedWriteNodes := readReplicasPerNode * fullyWritePackedNodes
 	readReplicasOnPartiallyPackedWriteNodes := math.Floor(coresOnLastNode / nt.readPod.cpuRequest)
 
-	basicQperfReadReplicas := readReplicasOnFullyPackedWriteNodes + readReplicasOnPartiallyPackedWriteNodes
+	// Required read replicase without considering required query performance.
+	baselineReadReplicas := readReplicasOnFullyPackedWriteNodes + readReplicasOnPartiallyPackedWriteNodes
 
 	scaleUp := 0.25
 	additionalReadReplicas := 0.0
 	if qperf != Basic {
-		additionalReadReplicas = basicQperfReadReplicas * scaleUp
+		additionalReadReplicas = baselineReadReplicas * scaleUp
 	}
 
 	readReplicasPerEmptyNode := math.Floor(float64(nt.cores) / nt.readPod.cpuRequest)
@@ -57,15 +60,16 @@ func calculateClusterSize(nt NodeType, tbDayIngest int, qperf QueryPerf) Cluster
 	actualNodesAddedForReads := calculateActualReadNodes(additionalNodesNeededForReads)
 	actualReadReplicasAdded := actualNodesAddedForReads * readReplicasPerEmptyNode
 
-	totalReadReplicas := actualReadReplicasAdded + basicQperfReadReplicas
+	totalReadReplicas := actualReadReplicasAdded + baselineReadReplicas
 	totalReadThroughputBytesSec := totalReadReplicas * nt.readPod.rateBytesSecond
 
 	totalNodesNeeded := nodesNeededForWrites + actualNodesAddedForReads
-
+	totalCoresLimit := numWriteReplicasNeeded*nt.writePod.cpuRequest + totalReadReplicas*nt.readPod.cpuRequest
 	return ClusterSize{
-		totalNodes:         int(totalNodesNeeded),
-		totalReadReplicas:  int(totalReadReplicas),
-		totalWriteReplicas: int(numWriteReplicasNeeded),
+		TotalNodes:         int(totalNodesNeeded),
+		TotalReadReplicas:  int(totalReadReplicas),
+		TotalWriteReplicas: int(numWriteReplicasNeeded),
+		TotalCoresRequest:  totalCoresLimit,
 
 		expectedMaxReadThroughputBytesSec: totalReadThroughputBytesSec,
 		expectedMaxIngestBytesDay:         (nt.writePod.rateBytesSecond * numWriteReplicasNeeded) * 86400,
diff --git a/pkg/sizing/algorithm_test.go b/pkg/sizing/algorithm_test.go
index ff99dc879f8c..35c5a1571ba4 100644
--- a/pkg/sizing/algorithm_test.go
+++ b/pkg/sizing/algorithm_test.go
@@ -7,8 +7,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func Test_AlgorithTest_Algorith(t *testing.T) {
-	f := func(ingest int) bool {
+func Test_Algorithm(t *testing.T) {
+	f := func(ingest float64) bool {
 		if ingest < 0 {
 			ingest = -ingest
 		}
@@ -16,12 +16,12 @@ func Test_AlgorithTest_Algorith(t *testing.T) {
 		for _, cloud := range NodeTypesByProvider {
 			for _, node := range cloud {
 				size := calculateClusterSize(node, ingest, Basic)
-				postiveReplicas = size.totalNodes > 0.0 && size.totalReadReplicas > 0.0 && size.totalWriteReplicas > 0.0
+				postiveReplicas = size.TotalNodes > 0.0 && size.TotalReadReplicas > 0.0 && size.TotalWriteReplicas > 0.0
 				require.Truef(t, postiveReplicas, "Cluster size was empty: ingest=%d cluster=%v node=%v", ingest, size, node)
-				require.InDelta(t, size.totalReadReplicas, size.totalWriteReplicas, 5.0, "Replicas have different sizes: ingest=%d node=%s", ingest, node.name)
+				require.InDelta(t, size.TotalReadReplicas, size.TotalWriteReplicas, 5.0, "Replicas have different sizes: ingest=%d node=%s", ingest, node.name)
 
 				size = calculateClusterSize(node, ingest, Super)
-				postiveReplicas = size.totalNodes > 0.0 && size.totalReadReplicas > 0.0 && size.totalWriteReplicas > 0.0
+				postiveReplicas = size.TotalNodes > 0.0 && size.TotalReadReplicas > 0.0 && size.TotalWriteReplicas > 0.0
 				require.Truef(t, postiveReplicas, "Cluster size was empty: ingest=%d cluster=%v node=%v", ingest, size, node)
 			}
 		}
@@ -32,4 +32,21 @@ func Test_AlgorithTest_Algorith(t *testing.T) {
 	if err := quick.Check(f, nil); err != nil {
 		t.Error(err)
 	}
+
+	// Sanity check for 1TB/Day
+	size := calculateClusterSize(NodeTypesByProvider["AWS"]["t2.xlarge"], 1e12, Basic)
+	require.Equalf(t, 4, size.TotalNodes, "given ingest=1PB/Day totla nodes must be big")
+}
+
+func Test_CoresNodeInvariant(t *testing.T) {
+	for _, queryPerformance := range []QueryPerf{Basic, Super} {
+		for _, ingest := range []float64{30, 300, 1000, 2000} {
+			for _, cloud := range NodeTypesByProvider {
+				for _, node := range cloud {
+					size := calculateClusterSize(node, ingest, queryPerformance)
+					require.LessOrEqualf(t, size.TotalCoresRequest, float64(size.TotalNodes*node.cores), "given ingest=%d node=%s total cores must be less than available cores", ingest, node.name)
+				}
+			}
+		}
+	}
 }
diff --git a/pkg/sizing/helm.go b/pkg/sizing/helm.go
index 9ff9676f1cd5..8e988c8b55b2 100644
--- a/pkg/sizing/helm.go
+++ b/pkg/sizing/helm.go
@@ -50,7 +50,7 @@ func constructHelmValues(cluster ClusterSize, nodeType NodeType) Values {
 			AuthEnabled: false,
 		},
 		Read: Read{
-			Replicas: cluster.totalReadReplicas,
+			Replicas: cluster.TotalReadReplicas,
 			Resources: Resources{
 				Requests: struct {
 					CPU    float64 `json:"cpu"`
@@ -69,7 +69,7 @@ func constructHelmValues(cluster ClusterSize, nodeType NodeType) Values {
 			},
 		},
 		Write: Write{
-			Replicas: cluster.totalWriteReplicas,
+			Replicas: cluster.TotalWriteReplicas,
 			Resources: Resources{
 				Requests: struct {
 					CPU    float64 `json:"cpu"`
diff --git a/pkg/sizing/http.go b/pkg/sizing/http.go
index f48569c75450..7a40a08e4af6 100644
--- a/pkg/sizing/http.go
+++ b/pkg/sizing/http.go
@@ -33,12 +33,12 @@ func decodeMesage(req *http.Request, msg *Message) error {
 
 	msg.Ingest, err = strconv.Atoi(req.FormValue("ingest"))
 	if err != nil {
-		return err
+		return fmt.Errorf("cannot read ingest: %w", err)
 	}
 
 	msg.Retention, err = strconv.Atoi(req.FormValue("retention"))
 	if err != nil {
-		return err
+		return fmt.Errorf("cannot read retention: %w", err)
 	}
 
 	msg.QueryPerformance = QueryPerf(strings.ToLower(req.FormValue("queryperf")))
@@ -67,13 +67,13 @@ func (h *Handler) GenerateHelmValues(w http.ResponseWriter, req *http.Request) {
 
 	w.Header().Set("Content-Type", "application/x-yaml; charset=utf-8")
 
-	cluster := calculateClusterSize(msg.NodeType, msg.Ingest, msg.QueryPerformance)
+	cluster := calculateClusterSize(msg.NodeType, float64(msg.Ingest), msg.QueryPerformance)
 	helm := constructHelmValues(cluster, msg.NodeType)
 
 	enc := yaml.NewEncoder(w)
 	err = enc.Encode(helm)
 	if err != nil {
-		level.Error(h.logger).Log("msg", "could not encode Helm Char values", "error", err)
+		level.Error(h.logger).Log("msg", "could not encode Helm Chart values", "error", err)
 	}
 }
 
@@ -88,7 +88,7 @@ func (h *Handler) Nodes(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	err := json.NewEncoder(w).Encode(nodes)
 	if err != nil {
-		level.Error(h.logger).Log("msg", "could not encode Helm Char values", "error", err)
+		level.Error(h.logger).Log("msg", "could not encode node values", "error", err)
 	}
 }
 
@@ -96,6 +96,25 @@ func (h *Handler) respondError(w http.ResponseWriter, err error) {
 	w.WriteHeader(http.StatusBadRequest)
 	_, err = w.Write([]byte(fmt.Sprintf("error: %v", err)))
 	if err != nil {
-		level.Error(h.logger).Log("msg", "could not encode Helm Char values", "error", err)
+		level.Error(h.logger).Log("msg", "could not write error message", "error", err)
+	}
+}
+
+func (h *Handler) Cluster(w http.ResponseWriter, req *http.Request) {
+	var msg Message
+
+	err := decodeMesage(req, &msg)
+	if err != nil {
+		level.Error(h.logger).Log("error", err)
+		h.respondError(w, err)
+		return
+	}
+
+	cluster := calculateClusterSize(msg.NodeType, float64(msg.Ingest), msg.QueryPerformance)
+
+	w.Header().Set("Content-Type", "application/json")
+	err = json.NewEncoder(w).Encode(cluster)
+	if err != nil {
+		level.Error(h.logger).Log("msg", "could not encode cluster size", "error", err)
 	}
 }
diff --git a/pkg/sizing/node.go b/pkg/sizing/node.go
index 2bf4bee1143a..0f6d7405209a 100644
--- a/pkg/sizing/node.go
+++ b/pkg/sizing/node.go
@@ -26,7 +26,7 @@ var StandardWrite = NodePod{
 
 var StandardRead = NodePod{
 	cpuRequest:      3,
-	cpuLimit:        0, // Undefined
+	cpuLimit:        3, // Undefined TODO: Is this a bug
 	memoryRequest:   6,
 	memoryLimit:     8,
 	rateBytesSecond: 768 * 1024 * 1024,
diff --git a/pkg/storage/async_store.go b/pkg/storage/async_store.go
index cba63af34f59..e054f86cedd2 100644
--- a/pkg/storage/async_store.go
+++ b/pkg/storage/async_store.go
@@ -10,6 +10,7 @@ import (
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/model/labels"
 
+	"github.com/grafana/loki/pkg/logql/syntax"
 	"github.com/grafana/loki/pkg/storage/chunk"
 	"github.com/grafana/loki/pkg/storage/chunk/fetcher"
 	"github.com/grafana/loki/pkg/storage/config"
@@ -50,6 +51,12 @@ func NewAsyncStore(cfg AsyncStoreCfg, store stores.Store, scfg config.SchemaConf
 	}
 }
 
+// queryIngesters uses the queryIngestersWithin flag but will always query them when it's 0.
+func (a *AsyncStore) shouldQueryIngesters(through, now model.Time) bool {
+	// don't query ingesters if the query does not overlap with queryIngestersWithin.
+	return a.queryIngestersWithin == 0 || through.After(now.Add(-a.queryIngestersWithin))
+}
+
 func (a *AsyncStore) GetChunkRefs(ctx context.Context, userID string, from, through model.Time, matchers ...*labels.Matcher) ([][]chunk.Chunk, []*fetcher.Fetcher, error) {
 	spanLogger := spanlogger.FromContext(ctx)
 
@@ -66,13 +73,10 @@ func (a *AsyncStore) GetChunkRefs(ctx context.Context, userID string, from, thro
 	var ingesterChunks []string
 
 	go func() {
-		if a.queryIngestersWithin != 0 {
-			// don't query ingesters if the query does not overlap with queryIngestersWithin.
-			if !through.After(model.Now().Add(-a.queryIngestersWithin)) {
-				level.Debug(util_log.Logger).Log("msg", "skipping querying ingesters for chunk ids", "query-from", from, "query-through", through)
-				errs <- nil
-				return
-			}
+		if !a.shouldQueryIngesters(through, model.Now()) {
+			level.Debug(util_log.Logger).Log("msg", "skipping querying ingesters for chunk ids", "query-from", from, "query-through", through)
+			errs <- nil
+			return
 		}
 
 		var err error
@@ -100,28 +104,44 @@ func (a *AsyncStore) GetChunkRefs(ctx context.Context, userID string, from, thro
 }
 
 func (a *AsyncStore) Stats(ctx context.Context, userID string, from, through model.Time, matchers ...*labels.Matcher) (*stats.Stats, error) {
-	if a.queryIngestersWithin != 0 {
-		// don't query ingesters if the query does not overlap with queryIngestersWithin.
-		if !through.After(model.Now().Add(-a.queryIngestersWithin)) {
-			return a.Store.Stats(ctx, userID, from, through, matchers...)
-		}
-	}
 
+	logger := util_log.WithContext(ctx, util_log.Logger)
+	matchersStr := syntax.MatchersString(matchers)
 	type f func() (*stats.Stats, error)
-	jobs := []f{
-		f(func() (*stats.Stats, error) {
-			return a.ingesterQuerier.Stats(ctx, userID, from, through, matchers...)
-		}),
-		f(func() (*stats.Stats, error) {
-			return a.Store.Stats(ctx, userID, from, through, matchers...)
-		}),
+	var jobs []f
+
+	if a.shouldQueryIngesters(through, model.Now()) {
+		jobs = append(jobs, f(func() (*stats.Stats, error) {
+			stats, err := a.ingesterQuerier.Stats(ctx, userID, from, through, matchers...)
+			level.Debug(logger).Log(
+				append(
+					stats.LoggingKeyValues(),
+					"msg", "queried statistics",
+					"matchers", matchersStr,
+					"source", "ingesters",
+				)...,
+			)
+			return stats, err
+		}))
 	}
-	resps := make([]*stats.Stats, len(jobs))
+	jobs = append(jobs, f(func() (*stats.Stats, error) {
+		stats, err := a.Store.Stats(ctx, userID, from, through, matchers...)
+		level.Debug(logger).Log(
+			append(
+				stats.LoggingKeyValues(),
+				"msg", "queried statistics",
+				"matchers", matchersStr,
+				"source", "store",
+			)...,
+		)
+		return stats, err
+	}))
 
+	resps := make([]*stats.Stats, len(jobs))
 	if err := concurrency.ForEachJob(
 		ctx,
 		len(jobs),
-		2,
+		len(jobs),
 		func(ctx context.Context, i int) error {
 			resp, err := jobs[i]()
 			resps[i] = resp
diff --git a/pkg/storage/async_store_test.go b/pkg/storage/async_store_test.go
index 30e96381cc1b..8fcc6ed173c6 100644
--- a/pkg/storage/async_store_test.go
+++ b/pkg/storage/async_store_test.go
@@ -263,6 +263,7 @@ func TestAsyncStore_QueryIngestersWithin(t *testing.T) {
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
+
 			store := newStoreMock()
 			store.On("GetChunkRefs", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([][]chunk.Chunk{}, []*fetcher.Fetcher{}, nil)
 
diff --git a/pkg/storage/chunk/cache/memcached_client.go b/pkg/storage/chunk/cache/memcached_client.go
index 874eb295b69b..e2aae686947d 100644
--- a/pkg/storage/chunk/cache/memcached_client.go
+++ b/pkg/storage/chunk/cache/memcached_client.go
@@ -24,7 +24,7 @@ import (
 
 // MemcachedClient interface exists for mocking memcacheClient.
 type MemcachedClient interface {
-	GetMulti(keys []string) (map[string]*memcache.Item, error)
+	GetMulti(keys []string, opts ...memcache.Option) (map[string]*memcache.Item, error)
 	Set(item *memcache.Item) error
 }
 
diff --git a/pkg/storage/chunk/cache/memcached_client_test.go b/pkg/storage/chunk/cache/memcached_client_test.go
index 32413ea221d6..d1b2008230b5 100644
--- a/pkg/storage/chunk/cache/memcached_client_test.go
+++ b/pkg/storage/chunk/cache/memcached_client_test.go
@@ -17,7 +17,7 @@ func newMockMemcache() *mockMemcache {
 	}
 }
 
-func (m *mockMemcache) GetMulti(keys []string) (map[string]*memcache.Item, error) {
+func (m *mockMemcache) GetMulti(keys []string, _ ...memcache.Option) (map[string]*memcache.Item, error) {
 	m.RLock()
 	defer m.RUnlock()
 	result := map[string]*memcache.Item{}
diff --git a/pkg/storage/chunk/cache/memcached_test.go b/pkg/storage/chunk/cache/memcached_test.go
index e544d40044c2..4082c331a10e 100644
--- a/pkg/storage/chunk/cache/memcached_test.go
+++ b/pkg/storage/chunk/cache/memcached_test.go
@@ -125,7 +125,7 @@ func newMockMemcacheFailing() *mockMemcacheFailing {
 	}
 }
 
-func (c *mockMemcacheFailing) GetMulti(keys []string) (map[string]*memcache.Item, error) {
+func (c *mockMemcacheFailing) GetMulti(keys []string, _ ...memcache.Option) (map[string]*memcache.Item, error) {
 	calls := c.calls.Inc()
 	if calls%3 == 0 {
 		return nil, errors.New("fail")
diff --git a/pkg/storage/chunk/client/azure/blob_storage_client.go b/pkg/storage/chunk/client/azure/blob_storage_client.go
index 1585de49dae5..1ab87a631c37 100644
--- a/pkg/storage/chunk/client/azure/blob_storage_client.go
+++ b/pkg/storage/chunk/client/azure/blob_storage_client.go
@@ -9,6 +9,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -16,6 +17,7 @@ import (
 	"github.com/Azure/azure-pipeline-go/pipeline"
 	"github.com/Azure/azure-storage-blob-go/azblob"
 	"github.com/Azure/go-autorest/autorest/adal"
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/Azure/go-autorest/autorest/azure/auth"
 	"github.com/grafana/dskit/flagext"
 	"github.com/mattn/go-ieproxy"
@@ -32,6 +34,7 @@ import (
 const (
 	// Environment
 	azureGlobal       = "AzureGlobal"
+	azurePublicCloud  = "AzurePublicCloud"
 	azureChinaCloud   = "AzureChinaCloud"
 	azureGermanCloud  = "AzureGermanCloud"
 	azureUSGovernment = "AzureUSGovernment"
@@ -48,6 +51,11 @@ var (
 		azureUSGovernment: "blob.core.usgovcloudapi.net",
 	}
 
+	defaultAuthFunctions = authFunctions{
+		NewOAuthConfigFunc: adal.NewOAuthConfig,
+		NewServicePrincipalTokenFromFederatedTokenFunc: adal.NewServicePrincipalTokenFromFederatedToken,
+	}
+
 	// default Azure http client.
 	defaultClientFactory = func() *http.Client {
 		return &http.Client{
@@ -79,6 +87,7 @@ type BlobStorageConfig struct {
 	ContainerName       string         `yaml:"container_name"`
 	Endpoint            string         `yaml:"endpoint_suffix"`
 	UseManagedIdentity  bool           `yaml:"use_managed_identity"`
+	UseFederatedToken   bool           `yaml:"use_federated_token"`
 	UserAssignedID      string         `yaml:"user_assigned_id"`
 	UseServicePrincipal bool           `yaml:"use_service_principal"`
 	ClientID            string         `yaml:"client_id"`
@@ -94,6 +103,11 @@ type BlobStorageConfig struct {
 	MaxRetryDelay       time.Duration  `yaml:"max_retry_delay"`
 }
 
+type authFunctions struct {
+	NewOAuthConfigFunc                             func(activeDirectoryEndpoint, tenantID string) (*adal.OAuthConfig, error)
+	NewServicePrincipalTokenFromFederatedTokenFunc func(oauthConfig adal.OAuthConfig, clientID string, jwt string, resource string, callbacks ...adal.TokenRefreshCallback) (*adal.ServicePrincipalToken, error)
+}
+
 // RegisterFlags adds the flags required to config this to the given FlagSet
 func (c *BlobStorageConfig) RegisterFlags(f *flag.FlagSet) {
 	c.RegisterFlagsWithPrefix("", f)
@@ -107,6 +121,7 @@ func (c *BlobStorageConfig) RegisterFlagsWithPrefix(prefix string, f *flag.FlagS
 	f.StringVar(&c.ContainerName, prefix+"azure.container-name", "loki", "Name of the storage account blob container used to store chunks. This container must be created before running cortex.")
 	f.StringVar(&c.Endpoint, prefix+"azure.endpoint-suffix", "", "Azure storage endpoint suffix without schema. The storage account name will be prefixed to this value to create the FQDN.")
 	f.BoolVar(&c.UseManagedIdentity, prefix+"azure.use-managed-identity", false, "Use Managed Identity to authenticate to the Azure storage account.")
+	f.BoolVar(&c.UseFederatedToken, prefix+"azure.use-federated-token", false, "Use Federated Token to authenticate to the Azure storage account.")
 	f.StringVar(&c.UserAssignedID, prefix+"azure.user-assigned-id", "", "User assigned identity ID to authenticate to the Azure storage account.")
 	f.StringVar(&c.ChunkDelimiter, prefix+"azure.chunk-delimiter", "-", "Chunk delimiter for blob ID to be used")
 	f.DurationVar(&c.RequestTimeout, prefix+"azure.request-timeout", 30*time.Second, "Timeout for requests made against azure blob storage.")
@@ -316,7 +331,7 @@ func (b *BlobStorage) newPipeline(hedgingCfg hedging.Config, hedging bool) (pipe
 		})
 	}
 
-	if !b.cfg.UseManagedIdentity && !b.cfg.UseServicePrincipal && b.cfg.UserAssignedID == "" {
+	if !b.cfg.UseFederatedToken && !b.cfg.UseManagedIdentity && !b.cfg.UseServicePrincipal && b.cfg.UserAssignedID == "" {
 		credential, err := azblob.NewSharedKeyCredential(b.cfg.StorageAccountName, b.cfg.StorageAccountKey.String())
 		if err != nil {
 			return nil, err
@@ -341,7 +356,7 @@ func (b *BlobStorage) getOAuthToken() (azblob.TokenCredential, error) {
 	if b.tc != nil {
 		return b.tc, nil
 	}
-	spt, err := b.getServicePrincipalToken()
+	spt, err := b.getServicePrincipalToken(defaultAuthFunctions)
 	if err != nil {
 		return nil, err
 	}
@@ -368,7 +383,7 @@ func (b *BlobStorage) getOAuthToken() (azblob.TokenCredential, error) {
 	return b.tc, nil
 }
 
-func (b *BlobStorage) getServicePrincipalToken() (*adal.ServicePrincipalToken, error) {
+func (b *BlobStorage) getServicePrincipalToken(authFunctions authFunctions) (*adal.ServicePrincipalToken, error) {
 	var endpoint string
 	if b.cfg.Endpoint != "" {
 		endpoint = b.cfg.Endpoint
@@ -378,6 +393,28 @@ func (b *BlobStorage) getServicePrincipalToken() (*adal.ServicePrincipalToken, e
 
 	resource := fmt.Sprintf("https://%s.%s", b.cfg.StorageAccountName, endpoint)
 
+	if b.cfg.UseFederatedToken {
+		token, err := b.servicePrincipalTokenFromFederatedToken(resource, authFunctions.NewOAuthConfigFunc, authFunctions.NewServicePrincipalTokenFromFederatedTokenFunc)
+		var customRefreshFunc adal.TokenRefresh = func(context context.Context, resource string) (*adal.Token, error) {
+			newToken, err := b.servicePrincipalTokenFromFederatedToken(resource, authFunctions.NewOAuthConfigFunc, authFunctions.NewServicePrincipalTokenFromFederatedTokenFunc)
+			if err != nil {
+				return nil, err
+			}
+
+			err = newToken.Refresh()
+			if err != nil {
+				return nil, err
+			}
+
+			token := newToken.Token()
+
+			return &token, nil
+		}
+
+		token.SetCustomRefreshFunc(customRefreshFunc)
+		return token, err
+	}
+
 	if b.cfg.UseServicePrincipal {
 		config := auth.NewClientCredentialsConfig(b.cfg.ClientID, b.cfg.ClientSecret.String(), b.cfg.TenantID)
 		config.Resource = resource
@@ -395,6 +432,35 @@ func (b *BlobStorage) getServicePrincipalToken() (*adal.ServicePrincipalToken, e
 	return msiConfig.ServicePrincipalToken()
 }
 
+func (b *BlobStorage) servicePrincipalTokenFromFederatedToken(resource string, newOAuthConfigFunc func(activeDirectoryEndpoint, tenantID string) (*adal.OAuthConfig, error), newServicePrincipalTokenFromFederatedTokenFunc func(oauthConfig adal.OAuthConfig, clientID string, jwt string, resource string, callbacks ...adal.TokenRefreshCallback) (*adal.ServicePrincipalToken, error)) (*adal.ServicePrincipalToken, error) {
+	environmentName := azurePublicCloud
+	if b.cfg.Environment != azureGlobal {
+		environmentName = b.cfg.Environment
+	}
+
+	env, err := azure.EnvironmentFromName(environmentName)
+	if err != nil {
+		return nil, err
+	}
+
+	azClientID := os.Getenv("AZURE_CLIENT_ID")
+	azTenantID := os.Getenv("AZURE_TENANT_ID")
+
+	jwtBytes, err := os.ReadFile(os.Getenv("AZURE_FEDERATED_TOKEN_FILE"))
+	if err != nil {
+		return nil, err
+	}
+
+	jwt := string(jwtBytes)
+
+	oauthConfig, err := newOAuthConfigFunc(env.ActiveDirectoryEndpoint, azTenantID)
+	if err != nil {
+		return nil, err
+	}
+
+	return newServicePrincipalTokenFromFederatedTokenFunc(*oauthConfig, azClientID, jwt, resource)
+}
+
 // List implements chunk.ObjectClient.
 func (b *BlobStorage) List(ctx context.Context, prefix, delimiter string) ([]client.StorageObject, []client.StorageCommonPrefix, error) {
 	var storageObjects []client.StorageObject
diff --git a/pkg/storage/chunk/client/azure/blob_storage_client_test.go b/pkg/storage/chunk/client/azure/blob_storage_client_test.go
index 79cd7c686782..f73cc399953e 100644
--- a/pkg/storage/chunk/client/azure/blob_storage_client_test.go
+++ b/pkg/storage/chunk/client/azure/blob_storage_client_test.go
@@ -5,12 +5,16 @@ import (
 	"context"
 	"net/http"
 	"net/url"
+	"os"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/Azure/go-autorest/autorest/adal"
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/grafana/dskit/flagext"
 	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
 	"go.uber.org/atomic"
 
 	"github.com/grafana/loki/pkg/storage/chunk/client/hedging"
@@ -24,6 +28,58 @@ func (fn RoundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error)
 	return fn(req)
 }
 
+type FederatedTokenTestSuite struct {
+	suite.Suite
+	config                      *BlobStorage
+	mockOAuthConfig             *adal.OAuthConfig
+	mockedServicePrincipalToken *adal.ServicePrincipalToken
+}
+
+func (suite *FederatedTokenTestSuite) SetupTest() {
+	suite.mockOAuthConfig, _ = adal.NewOAuthConfig("foo", "bar")
+	suite.mockedServicePrincipalToken = new(adal.ServicePrincipalToken)
+	suite.config = &BlobStorage{
+		cfg: &BlobStorageConfig{
+			ContainerName:      "foo",
+			StorageAccountName: "bar",
+			Environment:        azureGlobal,
+			UseFederatedToken:  true,
+		},
+	}
+
+	suite.T().Setenv("AZURE_CLIENT_ID", "myClientId")
+	suite.T().Setenv("AZURE_TENANT_ID", "myTenantId")
+
+	tmpDir := suite.T().TempDir()
+	_ = os.WriteFile(tmpDir+"/jwtToken", []byte("myJwtToken"), 0666)
+	suite.T().Setenv("AZURE_FEDERATED_TOKEN_FILE", tmpDir+"/jwtToken")
+}
+
+func (suite *FederatedTokenTestSuite) TestGetServicePrincipalToken() {
+	newOAuthConfigFunc := func(activeDirectoryEndpoint, tenantID string) (*adal.OAuthConfig, error) {
+		require.Equal(suite.T(), azure.PublicCloud.ActiveDirectoryEndpoint, activeDirectoryEndpoint)
+		require.Equal(suite.T(), "myTenantId", tenantID)
+
+		_, err := adal.NewOAuthConfig(activeDirectoryEndpoint, tenantID)
+		require.NoError(suite.T(), err)
+
+		return suite.mockOAuthConfig, nil
+	}
+
+	servicePrincipalTokenFromFederatedTokenFunc := func(oauthConfig adal.OAuthConfig, clientID string, jwt string, resource string, callbacks ...adal.TokenRefreshCallback) (*adal.ServicePrincipalToken, error) {
+		require.True(suite.T(), *suite.mockOAuthConfig == oauthConfig, "should return the mocked object")
+		require.Equal(suite.T(), "myClientId", clientID)
+		require.Equal(suite.T(), "myJwtToken", jwt)
+		require.Equal(suite.T(), "https://bar.blob.core.windows.net", resource)
+		return suite.mockedServicePrincipalToken, nil
+	}
+
+	token, err := suite.config.getServicePrincipalToken(authFunctions{newOAuthConfigFunc, servicePrincipalTokenFromFederatedTokenFunc})
+
+	require.NoError(suite.T(), err)
+	require.True(suite.T(), suite.mockedServicePrincipalToken == token, "should return the mocked object")
+}
+
 func Test_Hedging(t *testing.T) {
 	for _, tc := range []struct {
 		name          string
@@ -131,6 +187,10 @@ func Test_DefaultBlobURL(t *testing.T) {
 	require.Equal(t, *expect, bloburl.URL())
 }
 
+func Test_UseFederatedToken(t *testing.T) {
+	suite.Run(t, new(FederatedTokenTestSuite))
+}
+
 func Test_EndpointSuffixWithBlob(t *testing.T) {
 	c, err := NewBlobStorage(&BlobStorageConfig{
 		ContainerName:      "foo",
diff --git a/pkg/storage/config/schema_config.go b/pkg/storage/config/schema_config.go
index 8e152b823956..bcc0f39c6e56 100644
--- a/pkg/storage/config/schema_config.go
+++ b/pkg/storage/config/schema_config.go
@@ -93,7 +93,7 @@ type PeriodConfig struct {
 	// type of index client to use.
 	IndexType string `yaml:"store" doc:"description=store and object_store below affect which <storage_config> key is used.\nWhich store to use for the index. Either aws, aws-dynamo, gcp, bigtable, bigtable-hashed, cassandra, boltdb or boltdb-shipper. "`
 	// type of object client to use; if omitted, defaults to store.
-	ObjectType  string              `yaml:"object_store" doc:"description=Which store to use for the chunks. Either aws, azure, gcp, bigtable, gcs, cassandra, swift or filesystem. If omitted, defaults to the same value as store."`
+	ObjectType  string              `yaml:"object_store" doc:"description=Which store to use for the chunks. Either aws, azure, gcp, bigtable, gcs, cassandra, swift, filesystem or a named_store (refer to named_stores_config). If omitted, defaults to the same value as store."`
 	Schema      string              `yaml:"schema" doc:"description=The schema version to use, current recommended schema is v11."`
 	IndexTables PeriodicTableConfig `yaml:"index" doc:"description=Configures how the index is updated and stored."`
 	ChunkTables PeriodicTableConfig `yaml:"chunks" doc:"description=Configured how the chunks are updated and stored."`
diff --git a/pkg/storage/factory.go b/pkg/storage/factory.go
index 00c224ae0b6c..1ce69523b715 100644
--- a/pkg/storage/factory.go
+++ b/pkg/storage/factory.go
@@ -32,10 +32,12 @@ import (
 	util_log "github.com/grafana/loki/pkg/util/log"
 )
 
-// BoltDB Shipper is supposed to be run as a singleton.
-// This could also be done in NewBoltDBIndexClientWithShipper factory method but we are doing it here because that method is used
-// in tests for creating multiple instances of it at a time.
-var boltDBIndexClientWithShipper index.Client
+var (
+	// BoltDB Shipper is supposed to be run as a singleton.
+	// This could also be done in NewBoltDBIndexClientWithShipper factory method but we are doing it here because that method is used
+	// in tests for creating multiple instances of it at a time.
+	boltDBIndexClientWithShipper index.Client
+)
 
 // ResetBoltDBIndexClientWithShipper allows to reset the singleton.
 // MUST ONLY BE USED IN TESTS
@@ -55,9 +57,108 @@ type StoreLimits interface {
 	MaxQueryLength(userID string) time.Duration
 }
 
+// NamedStores helps configure additional object stores from a given storage provider
+type NamedStores struct {
+	AWS        map[string]aws.StorageConfig         `yaml:"aws"`
+	Azure      map[string]azure.BlobStorageConfig   `yaml:"azure"`
+	BOS        map[string]baidubce.BOSStorageConfig `yaml:"bos"`
+	Filesystem map[string]local.FSConfig            `yaml:"filesystem"`
+	GCS        map[string]gcp.GCSConfig             `yaml:"gcs"`
+	Swift      map[string]openstack.SwiftConfig     `yaml:"swift"`
+
+	// contains mapping from named store reference name to store type
+	storeType map[string]string `yaml:"-"`
+}
+
+func (ns *NamedStores) populateStoreType() error {
+	ns.storeType = make(map[string]string)
+
+	checkForDuplicates := func(name string) error {
+		switch name {
+		case config.StorageTypeAWS, config.StorageTypeAWSDynamo, config.StorageTypeS3,
+			config.StorageTypeGCP, config.StorageTypeGCPColumnKey, config.StorageTypeBigTable, config.StorageTypeBigTableHashed, config.StorageTypeGCS,
+			config.StorageTypeAzure, config.StorageTypeBOS, config.StorageTypeSwift, config.StorageTypeCassandra,
+			config.StorageTypeFileSystem, config.StorageTypeInMemory, config.StorageTypeGrpc:
+			return fmt.Errorf("named store %q should not match with the name of a predefined storage type", name)
+		}
+
+		if st, ok := ns.storeType[name]; ok {
+			return fmt.Errorf("named store %q is already defined under %s", name, st)
+		}
+
+		return nil
+	}
+
+	for name := range ns.AWS {
+		if err := checkForDuplicates(name); err != nil {
+			return err
+		}
+		ns.storeType[name] = config.StorageTypeAWS
+	}
+
+	for name := range ns.Azure {
+		if err := checkForDuplicates(name); err != nil {
+			return err
+		}
+		ns.storeType[name] = config.StorageTypeAzure
+	}
+
+	for name := range ns.BOS {
+		if err := checkForDuplicates(name); err != nil {
+			return err
+		}
+		ns.storeType[name] = config.StorageTypeBOS
+	}
+
+	for name := range ns.Filesystem {
+		if err := checkForDuplicates(name); err != nil {
+			return err
+		}
+		ns.storeType[name] = config.StorageTypeFileSystem
+	}
+
+	for name := range ns.GCS {
+		if err := checkForDuplicates(name); err != nil {
+			return err
+		}
+		ns.storeType[name] = config.StorageTypeGCS
+	}
+
+	for name := range ns.Swift {
+		if err := checkForDuplicates(name); err != nil {
+			return err
+		}
+		ns.storeType[name] = config.StorageTypeSwift
+	}
+
+	return nil
+}
+
+func (ns *NamedStores) validate() error {
+	for name, awsCfg := range ns.AWS {
+		if err := awsCfg.Validate(); err != nil {
+			return errors.Wrap(err, fmt.Sprintf("invalid AWS Storage config with name %s", name))
+		}
+	}
+
+	for name, azureCfg := range ns.Azure {
+		if err := azureCfg.Validate(); err != nil {
+			return errors.Wrap(err, fmt.Sprintf("invalid Azure Storage config with name %s", name))
+		}
+	}
+
+	for name, swiftCfg := range ns.Swift {
+		if err := swiftCfg.Validate(); err != nil {
+			return errors.Wrap(err, fmt.Sprintf("invalid Swift Storage config with name %s", name))
+		}
+	}
+
+	return ns.populateStoreType()
+}
+
 // Config chooses which storage client to use.
 type Config struct {
-	AWSStorageConfig       aws.StorageConfig         `yaml:"aws" doc:"description=Configures storing chunks in AWS. Required options only required when aws is present."`
+	AWSStorageConfig       aws.StorageConfig         `yaml:"aws"`
 	AzureStorageConfig     azure.BlobStorageConfig   `yaml:"azure"`
 	BOSStorageConfig       baidubce.BOSStorageConfig `yaml:"bos"`
 	GCPStorageConfig       gcp.Config                `yaml:"bigtable" doc:"description=Configures storing indexes in Bigtable. Required fields only required when bigtable is defined in config."`
@@ -68,6 +169,7 @@ type Config struct {
 	Swift                  openstack.SwiftConfig     `yaml:"swift"`
 	GrpcConfig             grpc.Config               `yaml:"grpc_store"`
 	Hedging                hedging.Config            `yaml:"hedging"`
+	NamedStores            NamedStores               `yaml:"named_stores"`
 
 	IndexCacheValidity time.Duration `yaml:"index_cache_validity"`
 
@@ -134,7 +236,8 @@ func (cfg *Config) Validate() error {
 	if err := cfg.TSDBShipperConfig.Validate(); err != nil {
 		return errors.Wrap(err, "invalid tsdb config")
 	}
-	return nil
+
+	return cfg.NamedStores.validate()
 }
 
 // NewIndexClient makes a new index client of the desired type.
@@ -198,11 +301,20 @@ func NewIndexClient(name string, cfg Config, schemaCfg config.SchemaConfig, limi
 
 // NewChunkClient makes a new chunk.Client of the desired types.
 func NewChunkClient(name string, cfg Config, schemaCfg config.SchemaConfig, clientMetrics ClientMetrics, registerer prometheus.Registerer) (client.Client, error) {
-	switch name {
+	var (
+		storeType = name
+	)
+
+	// lookup storeType for named stores
+	if nsType, ok := cfg.NamedStores.storeType[name]; ok {
+		storeType = nsType
+	}
+
+	switch storeType {
 	case config.StorageTypeInMemory:
 		return testutils.NewMockStorage(), nil
 	case config.StorageTypeAWS, config.StorageTypeS3:
-		c, err := aws.NewS3ObjectClient(cfg.AWSStorageConfig.S3Config, cfg.Hedging)
+		c, err := NewObjectClient(name, cfg, clientMetrics)
 		if err != nil {
 			return nil, err
 		}
@@ -217,13 +329,13 @@ func NewChunkClient(name string, cfg Config, schemaCfg config.SchemaConfig, clie
 		}
 		return aws.NewDynamoDBChunkClient(cfg.AWSStorageConfig.DynamoDBConfig, schemaCfg, registerer)
 	case config.StorageTypeAzure:
-		c, err := azure.NewBlobStorage(&cfg.AzureStorageConfig, clientMetrics.AzureMetrics, cfg.Hedging)
+		c, err := NewObjectClient(name, cfg, clientMetrics)
 		if err != nil {
 			return nil, err
 		}
 		return client.NewClientWithMaxParallel(c, nil, cfg.MaxParallelGetChunk, schemaCfg), nil
 	case config.StorageTypeBOS:
-		c, err := baidubce.NewBOSObjectStorage(&cfg.BOSStorageConfig)
+		c, err := NewObjectClient(name, cfg, clientMetrics)
 		if err != nil {
 			return nil, err
 		}
@@ -233,13 +345,13 @@ func NewChunkClient(name string, cfg Config, schemaCfg config.SchemaConfig, clie
 	case config.StorageTypeGCPColumnKey, config.StorageTypeBigTable, config.StorageTypeBigTableHashed:
 		return gcp.NewBigtableObjectClient(context.Background(), cfg.GCPStorageConfig, schemaCfg)
 	case config.StorageTypeGCS:
-		c, err := gcp.NewGCSObjectClient(context.Background(), cfg.GCSConfig, cfg.Hedging)
+		c, err := NewObjectClient(name, cfg, clientMetrics)
 		if err != nil {
 			return nil, err
 		}
 		return client.NewClientWithMaxParallel(c, nil, cfg.MaxParallelGetChunk, schemaCfg), nil
 	case config.StorageTypeSwift:
-		c, err := openstack.NewSwiftObjectClient(cfg.Swift, cfg.Hedging)
+		c, err := NewObjectClient(name, cfg, clientMetrics)
 		if err != nil {
 			return nil, err
 		}
@@ -247,11 +359,11 @@ func NewChunkClient(name string, cfg Config, schemaCfg config.SchemaConfig, clie
 	case config.StorageTypeCassandra:
 		return cassandra.NewObjectClient(cfg.CassandraStorageConfig, schemaCfg, registerer, cfg.MaxParallelGetChunk)
 	case config.StorageTypeFileSystem:
-		store, err := local.NewFSObjectClient(cfg.FSConfig)
+		c, err := NewObjectClient(name, cfg, clientMetrics)
 		if err != nil {
 			return nil, err
 		}
-		return client.NewClientWithMaxParallel(store, client.FSEncoder, cfg.MaxParallelGetChunk, schemaCfg), nil
+		return client.NewClientWithMaxParallel(c, client.FSEncoder, cfg.MaxParallelGetChunk, schemaCfg), nil
 	case config.StorageTypeGrpc:
 		return grpc.NewStorageClient(cfg.GrpcConfig, schemaCfg)
 	default:
@@ -331,21 +443,87 @@ func (c *ClientMetrics) Unregister() {
 
 // NewObjectClient makes a new StorageClient of the desired types.
 func NewObjectClient(name string, cfg Config, clientMetrics ClientMetrics) (client.ObjectClient, error) {
-	switch name {
+	var (
+		namedStore string
+		storeType  = name
+	)
+
+	// lookup storeType for named stores
+	if nsType, ok := cfg.NamedStores.storeType[name]; ok {
+		storeType = nsType
+		namedStore = name
+	}
+
+	switch storeType {
 	case config.StorageTypeAWS, config.StorageTypeS3:
-		return aws.NewS3ObjectClient(cfg.AWSStorageConfig.S3Config, cfg.Hedging)
+		s3Cfg := cfg.AWSStorageConfig.S3Config
+		if namedStore != "" {
+			awsCfg, ok := cfg.NamedStores.AWS[namedStore]
+			if !ok {
+				return nil, fmt.Errorf("Unrecognized named aws storage config %s", name)
+			}
+
+			s3Cfg = awsCfg.S3Config
+		}
+
+		return aws.NewS3ObjectClient(s3Cfg, cfg.Hedging)
 	case config.StorageTypeGCS:
-		return gcp.NewGCSObjectClient(context.Background(), cfg.GCSConfig, cfg.Hedging)
+		gcsCfg := cfg.GCSConfig
+		if namedStore != "" {
+			var ok bool
+			gcsCfg, ok = cfg.NamedStores.GCS[namedStore]
+			if !ok {
+				return nil, fmt.Errorf("Unrecognized named gcs storage config %s", name)
+			}
+		}
+
+		return gcp.NewGCSObjectClient(context.Background(), gcsCfg, cfg.Hedging)
 	case config.StorageTypeAzure:
-		return azure.NewBlobStorage(&cfg.AzureStorageConfig, clientMetrics.AzureMetrics, cfg.Hedging)
+		azureCfg := cfg.AzureStorageConfig
+		if namedStore != "" {
+			var ok bool
+			azureCfg, ok = cfg.NamedStores.Azure[namedStore]
+			if !ok {
+				return nil, fmt.Errorf("Unrecognized named azure storage config %s", name)
+			}
+		}
+
+		return azure.NewBlobStorage(&azureCfg, clientMetrics.AzureMetrics, cfg.Hedging)
 	case config.StorageTypeSwift:
-		return openstack.NewSwiftObjectClient(cfg.Swift, cfg.Hedging)
+		swiftCfg := cfg.Swift
+		if namedStore != "" {
+			var ok bool
+			swiftCfg, ok = cfg.NamedStores.Swift[namedStore]
+			if !ok {
+				return nil, fmt.Errorf("Unrecognized named swift storage config %s", name)
+			}
+		}
+
+		return openstack.NewSwiftObjectClient(swiftCfg, cfg.Hedging)
 	case config.StorageTypeInMemory:
 		return testutils.NewMockStorage(), nil
 	case config.StorageTypeFileSystem:
-		return local.NewFSObjectClient(cfg.FSConfig)
+		fsCfg := cfg.FSConfig
+		if namedStore != "" {
+			var ok bool
+			fsCfg, ok = cfg.NamedStores.Filesystem[namedStore]
+			if !ok {
+				return nil, fmt.Errorf("Unrecognized named filesystem storage config %s", name)
+			}
+		}
+
+		return local.NewFSObjectClient(fsCfg)
 	case config.StorageTypeBOS:
-		return baidubce.NewBOSObjectStorage(&cfg.BOSStorageConfig)
+		bosCfg := cfg.BOSStorageConfig
+		if namedStore != "" {
+			var ok bool
+			bosCfg, ok = cfg.NamedStores.BOS[namedStore]
+			if !ok {
+				return nil, fmt.Errorf("Unrecognized named bos storage config %s", name)
+			}
+		}
+
+		return baidubce.NewBOSObjectStorage(&bosCfg)
 	default:
 		return nil, fmt.Errorf("Unrecognized storage client %v, choose one of: %v, %v, %v, %v, %v", name, config.StorageTypeAWS, config.StorageTypeS3, config.StorageTypeGCS, config.StorageTypeAzure, config.StorageTypeFileSystem)
 	}
diff --git a/pkg/storage/factory_test.go b/pkg/storage/factory_test.go
index e245fd49539e..70a66d88413f 100644
--- a/pkg/storage/factory_test.go
+++ b/pkg/storage/factory_test.go
@@ -2,16 +2,24 @@ package storage
 
 import (
 	"os"
+	"path"
 	"testing"
 	"time"
 
 	"github.com/go-kit/log"
 	"github.com/grafana/dskit/flagext"
 	"github.com/prometheus/common/model"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/grafana/loki/pkg/storage/chunk/client/aws"
 	"github.com/grafana/loki/pkg/storage/chunk/client/cassandra"
+	"github.com/grafana/loki/pkg/storage/chunk/client/gcp"
+	"github.com/grafana/loki/pkg/storage/chunk/client/local"
 	"github.com/grafana/loki/pkg/storage/config"
+	"github.com/grafana/loki/pkg/storage/stores/indexshipper"
+	"github.com/grafana/loki/pkg/storage/stores/shipper"
+	util_log "github.com/grafana/loki/pkg/util/log"
 	"github.com/grafana/loki/pkg/validation"
 )
 
@@ -84,6 +92,143 @@ func TestCassandraInMultipleSchemas(t *testing.T) {
 	store.Stop()
 }
 
+func TestNamedStores(t *testing.T) {
+	tempDir := t.TempDir()
+
+	// config for BoltDB Shipper
+	boltdbShipperConfig := shipper.Config{}
+	flagext.DefaultValues(&boltdbShipperConfig)
+	boltdbShipperConfig.ActiveIndexDirectory = path.Join(tempDir, "index")
+	boltdbShipperConfig.SharedStoreType = "named-store"
+	boltdbShipperConfig.CacheLocation = path.Join(tempDir, "boltdb-shipper-cache")
+	boltdbShipperConfig.Mode = indexshipper.ModeReadWrite
+
+	cfg := Config{
+		NamedStores: NamedStores{
+			Filesystem: map[string]local.FSConfig{
+				"named-store": {Directory: path.Join(tempDir, "named-store")},
+			},
+		},
+		FSConfig: local.FSConfig{
+			Directory: path.Join(tempDir, "default"),
+		},
+		BoltDBShipperConfig: boltdbShipperConfig,
+	}
+	err := cfg.NamedStores.validate()
+	require.NoError(t, err)
+
+	schemaConfig := config.SchemaConfig{
+		Configs: []config.PeriodConfig{
+			{
+				From:       config.DayTime{Time: timeToModelTime(parseDate("2019-01-01"))},
+				IndexType:  "boltdb-shipper",
+				ObjectType: "named-store",
+				Schema:     "v9",
+				IndexTables: config.PeriodicTableConfig{
+					Prefix: "index_",
+					Period: time.Hour * 168,
+				},
+			},
+		},
+	}
+
+	limits, err := validation.NewOverrides(validation.Limits{}, nil)
+	require.NoError(t, err)
+
+	t.Run("period config referring to configured named store", func(t *testing.T) {
+		err := os.Remove(cfg.NamedStores.Filesystem["named-store"].Directory)
+		if err != nil {
+			require.True(t, os.IsNotExist(err))
+		}
+
+		err = os.Remove(cfg.FSConfig.Directory)
+		if err != nil {
+			require.True(t, os.IsNotExist(err))
+		}
+
+		store, err := NewStore(cfg, config.ChunkStoreConfig{}, schemaConfig, limits, cm, nil, util_log.Logger)
+		require.NoError(t, err)
+		defer store.Stop()
+
+		// FSObjectClient creates the configured dir on init, ensure that correct cfg is picked by checking for it.
+		_, err = os.Stat(cfg.NamedStores.Filesystem["named-store"].Directory)
+		require.NoError(t, err)
+
+		// dir specified in StorageConfig/FSConfig should not be created as we are not referring to it.
+		_, err = os.Stat(cfg.FSConfig.Directory)
+		require.True(t, os.IsNotExist(err))
+
+	})
+
+	t.Run("period config referring to unrecognized store", func(t *testing.T) {
+		schemaConfig := schemaConfig
+		schemaConfig.Configs[0].ObjectType = "not-found"
+		_, err := NewStore(cfg, config.ChunkStoreConfig{}, schemaConfig, limits, cm, nil, util_log.Logger)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "Unrecognized storage client not-found, choose one of: aws, azure, cassandra, inmemory, gcp, bigtable, bigtable-hashed, grpc-store")
+	})
+}
+
+func TestNamedStores_populateStoreType(t *testing.T) {
+	t.Run("found duplicates", func(t *testing.T) {
+		ns := NamedStores{
+			AWS: map[string]aws.StorageConfig{
+				"store-1": {},
+				"store-2": {},
+			},
+			GCS: map[string]gcp.GCSConfig{
+				"store-1": {},
+			},
+		}
+
+		err := ns.populateStoreType()
+		require.ErrorContains(t, err, `named store "store-1" is already defined under`)
+
+	})
+
+	t.Run("illegal store name", func(t *testing.T) {
+		ns := NamedStores{
+			GCS: map[string]gcp.GCSConfig{
+				"aws": {},
+			},
+		}
+
+		err := ns.populateStoreType()
+		require.ErrorContains(t, err, `named store "aws" should not match with the name of a predefined storage type`)
+
+	})
+
+	t.Run("lookup populated entries", func(t *testing.T) {
+		ns := NamedStores{
+			AWS: map[string]aws.StorageConfig{
+				"store-1": {},
+				"store-2": {},
+			},
+			GCS: map[string]gcp.GCSConfig{
+				"store-3": {},
+			},
+		}
+
+		err := ns.populateStoreType()
+		require.NoError(t, err)
+
+		storeType, ok := ns.storeType["store-1"]
+		assert.True(t, ok)
+		assert.Equal(t, config.StorageTypeAWS, storeType)
+
+		storeType, ok = ns.storeType["store-2"]
+		assert.True(t, ok)
+		assert.Equal(t, config.StorageTypeAWS, storeType)
+
+		storeType, ok = ns.storeType["store-3"]
+		assert.True(t, ok)
+		assert.Equal(t, config.StorageTypeGCS, storeType)
+
+		_, ok = ns.storeType["store-4"]
+		assert.False(t, ok)
+	})
+}
+
 // DefaultSchemaConfig creates a simple schema config for testing
 func DefaultSchemaConfig(store, schema string, from model.Time) config.SchemaConfig {
 	s := config.SchemaConfig{
diff --git a/pkg/storage/store_test.go b/pkg/storage/store_test.go
index 21652feb59f1..2b0a2ca953d6 100644
--- a/pkg/storage/store_test.go
+++ b/pkg/storage/store_test.go
@@ -1039,6 +1039,7 @@ func TestStore_MultipleBoltDBShippersInConfig(t *testing.T) {
 		},
 	}
 
+	ResetBoltDBIndexClientWithShipper()
 	store, err := NewStore(cfg, config.ChunkStoreConfig{}, schemaConfig, limits, cm, nil, util_log.Logger)
 	require.NoError(t, err)
 
diff --git a/pkg/storage/stores/indexshipper/compactor/compactor.go b/pkg/storage/stores/indexshipper/compactor/compactor.go
index dcd324462360..76f7fea170d1 100644
--- a/pkg/storage/stores/indexshipper/compactor/compactor.go
+++ b/pkg/storage/stores/indexshipper/compactor/compactor.go
@@ -7,8 +7,6 @@ import (
 	"net/http"
 	"path/filepath"
 	"sort"
-	"strconv"
-	"strings"
 	"sync"
 	"time"
 
@@ -731,30 +729,11 @@ func sortTablesByRange(tables []string) {
 }
 
 func schemaPeriodForTable(cfg config.SchemaConfig, tableName string) (config.PeriodConfig, bool) {
-	// first round removes configs that does not have the prefix.
-	candidates := []config.PeriodConfig{}
-	for _, schema := range cfg.Configs {
-		if strings.HasPrefix(tableName, schema.IndexTables.Prefix) {
-			candidates = append(candidates, schema)
-		}
-	}
-	// WARN we  assume period is always daily. This is only true for boltdb-shipper.
-	var (
-		matched config.PeriodConfig
-		found   bool
-	)
-	for _, schema := range candidates {
-		periodIndex, err := strconv.ParseInt(strings.TrimPrefix(tableName, schema.IndexTables.Prefix), 10, 64)
-		if err != nil {
-			continue
-		}
-		periodSec := int64(schema.IndexTables.Period / time.Second)
-		tableTs := model.TimeFromUnix(periodIndex * periodSec)
-		if tableTs.After(schema.From.Time) || tableTs == schema.From.Time {
-			matched = schema
-			found = true
-		}
+	tableInterval := retention.ExtractIntervalFromTableName(tableName)
+	schemaCfg, err := cfg.SchemaForTime(tableInterval.Start)
+	if err != nil || schemaCfg.IndexTables.TableFor(tableInterval.Start) != tableName {
+		return config.PeriodConfig{}, false
 	}
 
-	return matched, found
+	return schemaCfg, true
 }
diff --git a/pkg/storage/stores/indexshipper/compactor/compactor_test.go b/pkg/storage/stores/indexshipper/compactor/compactor_test.go
index b18574cfa1f6..b958cfc25147 100644
--- a/pkg/storage/stores/indexshipper/compactor/compactor_test.go
+++ b/pkg/storage/stores/indexshipper/compactor/compactor_test.go
@@ -104,9 +104,12 @@ func setupTestCompactor(t *testing.T, tempDir string) *Compactor {
 	c, err := NewCompactor(cfg, objectClient, config.SchemaConfig{
 		Configs: []config.PeriodConfig{
 			{
-				From:        config.DayTime{Time: model.Time(0)},
-				IndexType:   indexType,
-				IndexTables: config.PeriodicTableConfig{Prefix: indexTablePrefix},
+				From:      config.DayTime{Time: model.Time(0)},
+				IndexType: indexType,
+				IndexTables: config.PeriodicTableConfig{
+					Prefix: indexTablePrefix,
+					Period: config.ObjectStorageIndexRequiredPeriod,
+				},
 			},
 		},
 	}, nil, nil)
@@ -152,6 +155,53 @@ func Test_schemaPeriodForTable(t *testing.T) {
 	indexFromTime := func(t time.Time) string {
 		return fmt.Sprintf("%d", t.Unix()/int64(24*time.Hour/time.Second))
 	}
+	tsdbIndexTablePrefix := fmt.Sprintf("%stsdb_", indexTablePrefix)
+	schemaCfg := config.SchemaConfig{Configs: []config.PeriodConfig{
+		{
+			From:       dayFromTime(start),
+			IndexType:  "boltdb",
+			ObjectType: "filesystem",
+			Schema:     "v9",
+			IndexTables: config.PeriodicTableConfig{
+				Prefix: indexTablePrefix,
+				Period: time.Hour * 24,
+			},
+			RowShards: 16,
+		},
+		{
+			From:       dayFromTime(start.Add(25 * time.Hour)),
+			IndexType:  "boltdb",
+			ObjectType: "filesystem",
+			Schema:     "v12",
+			IndexTables: config.PeriodicTableConfig{
+				Prefix: indexTablePrefix,
+				Period: time.Hour * 24,
+			},
+			RowShards: 16,
+		},
+		{
+			From:       dayFromTime(start.Add(73 * time.Hour)),
+			IndexType:  "tsdb",
+			ObjectType: "filesystem",
+			Schema:     "v12",
+			IndexTables: config.PeriodicTableConfig{
+				Prefix: tsdbIndexTablePrefix,
+				Period: time.Hour * 24,
+			},
+			RowShards: 16,
+		},
+		{
+			From:       dayFromTime(start.Add(100 * time.Hour)),
+			IndexType:  "tsdb",
+			ObjectType: "filesystem",
+			Schema:     "v12",
+			IndexTables: config.PeriodicTableConfig{
+				Prefix: indexTablePrefix,
+				Period: time.Hour * 24,
+			},
+			RowShards: 16,
+		},
+	}}
 	tests := []struct {
 		name          string
 		config        config.SchemaConfig
@@ -163,14 +213,16 @@ func Test_schemaPeriodForTable(t *testing.T) {
 		{"first table", schemaCfg, indexTablePrefix + indexFromTime(dayFromTime(start).Time.Time()), schemaCfg.Configs[0], true},
 		{"4 hour after first table", schemaCfg, indexTablePrefix + indexFromTime(dayFromTime(start).Time.Time().Add(4*time.Hour)), schemaCfg.Configs[0], true},
 		{"second schema", schemaCfg, indexTablePrefix + indexFromTime(dayFromTime(start.Add(28*time.Hour)).Time.Time()), schemaCfg.Configs[1], true},
-		{"third schema", schemaCfg, indexTablePrefix + indexFromTime(dayFromTime(start.Add(75*time.Hour)).Time.Time()), schemaCfg.Configs[2], true},
+		{"third schema", schemaCfg, tsdbIndexTablePrefix + indexFromTime(dayFromTime(start.Add(75*time.Hour)).Time.Time()), schemaCfg.Configs[2], true},
+		{"unexpected table prefix", schemaCfg, indexTablePrefix + indexFromTime(dayFromTime(start.Add(75*time.Hour)).Time.Time()), config.PeriodConfig{}, false},
+		{"unexpected table number", schemaCfg, tsdbIndexTablePrefix + indexFromTime(time.Now()), config.PeriodConfig{}, false},
 		{"now", schemaCfg, indexTablePrefix + indexFromTime(time.Now()), schemaCfg.Configs[3], true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			actual, actualFound := schemaPeriodForTable(tt.config, tt.tableName)
-			require.Equal(t, tt.expected, actual)
 			require.Equal(t, tt.expectedFound, actualFound)
+			require.Equal(t, tt.expected, actual)
 		})
 	}
 }
diff --git a/vendor/github.com/go-kit/log/line_buffer.go b/pkg/util/log/line_buffer.go
similarity index 94%
rename from vendor/github.com/go-kit/log/line_buffer.go
rename to pkg/util/log/line_buffer.go
index 7f545c8c7fd9..6305184046fb 100644
--- a/vendor/github.com/go-kit/log/line_buffer.go
+++ b/pkg/util/log/line_buffer.go
@@ -4,15 +4,16 @@ import (
 	"bytes"
 	"io"
 	"sync"
-	"sync/atomic"
 	"time"
+
+	"go.uber.org/atomic"
 )
 
 // LineBufferedLogger buffers log lines to be flushed periodically. Without a line buffer, Log() will call the write
 // syscall for every log line which is expensive if logging thousands of lines per second.
 type LineBufferedLogger struct {
 	buf     *threadsafeBuffer
-	entries uint32
+	entries atomic.Uint32
 	cap     uint32
 	w       io.Writer
 
@@ -21,7 +22,7 @@ type LineBufferedLogger struct {
 
 // Size returns the number of entries in the buffer.
 func (l *LineBufferedLogger) Size() uint32 {
-	return atomic.LoadUint32(&l.entries)
+	return l.entries.Load()
 }
 
 // Write writes the given bytes to the line buffer, and increments the entries counter.
@@ -36,7 +37,7 @@ func (l *LineBufferedLogger) Write(p []byte) (n int, err error) {
 		}
 	}
 
-	atomic.AddUint32(&l.entries, 1)
+	l.entries.Inc()
 
 	return l.buf.Write(p)
 }
@@ -49,7 +50,7 @@ func (l *LineBufferedLogger) Flush() error {
 	}
 
 	// reset the counter
-	atomic.StoreUint32(&l.entries, 0)
+	l.entries.Store(0)
 
 	// WriteTo() calls Reset() on the underlying buffer, so it's not needed here
 	_, err := l.buf.WriteTo(l.w)
@@ -89,8 +90,7 @@ func WithFlushCallback(fn func(entries uint32)) LineBufferedLoggerOption {
 // WithPrellocatedBuffer preallocates a buffer to reduce GC cycles and slice resizing.
 func WithPrellocatedBuffer(size uint32) LineBufferedLoggerOption {
 	return func(l *LineBufferedLogger) {
-		l.buf = newThreadsafeBuffer(bytes.NewBuffer(make([]byte, size)))
-		l.buf.Reset()
+		l.buf = newThreadsafeBuffer(bytes.NewBuffer(make([]byte, 0, size)))
 	}
 }
 
diff --git a/pkg/util/log/line_buffer_test.go b/pkg/util/log/line_buffer_test.go
new file mode 100644
index 000000000000..4338da65ea01
--- /dev/null
+++ b/pkg/util/log/line_buffer_test.go
@@ -0,0 +1,180 @@
+package log
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-kit/log"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	flushPeriod = 10 * time.Millisecond
+	bufferSize  = 10e6
+)
+
+// BenchmarkLineBuffered creates line-buffered loggers of various capacities to see which perform best.
+func BenchmarkLineBuffered(b *testing.B) {
+
+	for i := 1; i <= 2048; i *= 2 {
+		f := outFile(b)
+		defer os.RemoveAll(f.Name())
+
+		bufLog := NewLineBufferedLogger(f, uint32(i),
+			WithFlushPeriod(flushPeriod),
+			WithPrellocatedBuffer(bufferSize),
+		)
+		l := log.NewLogfmtLogger(bufLog)
+
+		b.Run(fmt.Sprintf("capacity:%d", i), func(b *testing.B) {
+			b.ReportAllocs()
+			b.StartTimer()
+
+			require.NoError(b, f.Truncate(0))
+
+			logger := log.With(l, "common_key", "common_value")
+			for j := 0; j < b.N; j++ {
+				logger.Log("foo_key", "foo_value")
+			}
+
+			// force a final flush for outstanding lines in buffer
+			bufLog.Flush()
+			b.StopTimer()
+
+			contents, err := os.ReadFile(f.Name())
+			require.NoErrorf(b, err, "could not read test file: %s", f.Name())
+
+			lines := strings.Split(string(contents), "\n")
+			require.Equal(b, b.N, len(lines)-1)
+		})
+	}
+}
+
+// BenchmarkLineUnbuffered should perform roughly equivalently to a line-buffered logger with a capacity of 1.
+func BenchmarkLineUnbuffered(b *testing.B) {
+	b.ReportAllocs()
+
+	f := outFile(b)
+	defer os.RemoveAll(f.Name())
+
+	l := log.NewLogfmtLogger(f)
+	benchmarkRunner(b, l, baseMessage)
+
+	b.StopTimer()
+
+	contents, err := os.ReadFile(f.Name())
+	require.NoErrorf(b, err, "could not read test file: %s", f.Name())
+
+	lines := strings.Split(string(contents), "\n")
+	require.Equal(b, b.N, len(lines)-1)
+}
+
+func BenchmarkLineDiscard(b *testing.B) {
+	b.ReportAllocs()
+
+	l := log.NewLogfmtLogger(io.Discard)
+	benchmarkRunner(b, l, baseMessage)
+}
+
+func TestLineBufferedConcurrency(t *testing.T) {
+	t.Parallel()
+	bufLog := NewLineBufferedLogger(io.Discard, 32,
+		WithFlushPeriod(flushPeriod),
+		WithPrellocatedBuffer(bufferSize),
+	)
+	testConcurrency(t, log.NewLogfmtLogger(bufLog), 10000)
+}
+
+func TestOnFlushCallback(t *testing.T) {
+	var (
+		flushCount     uint32
+		flushedEntries int
+		buf            bytes.Buffer
+	)
+
+	callback := func(entries uint32) {
+		flushCount++
+		flushedEntries += int(entries)
+	}
+
+	bufLog := NewLineBufferedLogger(&buf, 2,
+		WithFlushPeriod(flushPeriod),
+		WithPrellocatedBuffer(bufferSize),
+		WithFlushCallback(callback),
+	)
+
+	l := log.NewLogfmtLogger(bufLog)
+	require.NoError(t, l.Log("line"))
+	require.NoError(t, l.Log("line"))
+	// first flush
+	require.NoError(t, l.Log("line"))
+
+	// force a second
+	require.NoError(t, bufLog.Flush())
+
+	require.Equal(t, uint32(2), flushCount)
+	require.Equal(t, len(strings.Split(buf.String(), "\n"))-1, flushedEntries)
+}
+
+// outFile creates a real OS file for testing.
+// We cannot use stdout/stderr since we need to read the contents afterwards to validate, and we have to write to a file
+// to benchmark the impact of write() syscalls.
+func outFile(b *testing.B) *os.File {
+	f, err := os.CreateTemp(b.TempDir(), "linebuffer*")
+	require.NoErrorf(b, err, "cannot create test file")
+
+	return f
+}
+
+// Copied from go-kit/log
+// These test are designed to be run with the race detector.
+
+func testConcurrency(t *testing.T, logger log.Logger, total int) {
+	n := int(math.Sqrt(float64(total)))
+	share := total / n
+
+	errC := make(chan error, n)
+
+	for i := 0; i < n; i++ {
+		go func() {
+			errC <- spam(logger, share)
+		}()
+	}
+
+	for i := 0; i < n; i++ {
+		err := <-errC
+		if err != nil {
+			t.Fatalf("concurrent logging error: %v", err)
+		}
+	}
+}
+
+func spam(logger log.Logger, count int) error {
+	for i := 0; i < count; i++ {
+		err := logger.Log("key", i)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func benchmarkRunner(b *testing.B, logger log.Logger, f func(log.Logger)) {
+	lc := log.With(logger, "common_key", "common_value")
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		f(lc)
+	}
+}
+
+var (
+	baseMessage = func(logger log.Logger) { logger.Log("foo_key", "foo_value") }
+	withMessage = func(logger log.Logger) { log.With(logger, "a", "b").Log("c", "d") }
+)
diff --git a/pkg/util/log/log.go b/pkg/util/log/log.go
index 5a46a0f5ba74..9924cba22762 100644
--- a/pkg/util/log/log.go
+++ b/pkg/util/log/log.go
@@ -21,7 +21,7 @@ var (
 	// Prefer accepting a non-global logger as an argument.
 	Logger = log.NewNopLogger()
 
-	bufferedLogger *log.LineBufferedLogger
+	bufferedLogger *LineBufferedLogger
 )
 
 // InitLogger initialises the global gokit logger (util_log.Logger) and overrides the
@@ -94,10 +94,10 @@ func newPrometheusLogger(l logging.Level, format logging.Format, reg prometheus.
 	if buffered {
 		// retain a reference to this logger because it doesn't conform to the standard Logger interface,
 		// and we can't unwrap it to get the underlying logger when we flush on shutdown
-		bufferedLogger = log.NewLineBufferedLogger(os.Stderr, logEntries,
-			log.WithFlushPeriod(flushTimeout),
-			log.WithPrellocatedBuffer(logBufferSize),
-			log.WithFlushCallback(func(entries uint32) {
+		bufferedLogger = NewLineBufferedLogger(os.Stderr, logEntries,
+			WithFlushPeriod(flushTimeout),
+			WithPrellocatedBuffer(logBufferSize),
+			WithFlushCallback(func(entries uint32) {
 				logFlushes.Observe(float64(entries))
 			}),
 		)
diff --git a/pkg/validation/limits.go b/pkg/validation/limits.go
index 0dd98a022129..5f4a3eabd4d2 100644
--- a/pkg/validation/limits.go
+++ b/pkg/validation/limits.go
@@ -172,7 +172,7 @@ func (l *Limits) RegisterFlags(f *flag.FlagSet) {
 	f.StringVar(&l.IngestionRateStrategy, "distributor.ingestion-rate-limit-strategy", "global", "Whether the ingestion rate limit should be applied individually to each distributor instance (local), or evenly shared across the cluster (global). The ingestion rate strategy cannot be overridden on a per-tenant basis.\n- local: enforces the limit on a per distributor basis. The actual effective rate limit will be N times higher, where N is the number of distributor replicas.\n- global: enforces the limit globally, configuring a per-distributor local rate limiter as 'ingestion_rate / N', where N is the number of distributor replicas (it's automatically adjusted if the number of replicas change). The global strategy requires the distributors to form their own ring, which is used to keep track of the current number of healthy distributor replicas.")
 	f.Float64Var(&l.IngestionRateMB, "distributor.ingestion-rate-limit-mb", 4, "Per-user ingestion rate limit in sample size per second. Units in MB.")
 	f.Float64Var(&l.IngestionBurstSizeMB, "distributor.ingestion-burst-size-mb", 6, "Per-user allowed ingestion burst size (in sample size). Units in MB. The burst size refers to the per-distributor local rate limiter even in the case of the 'global' strategy, and should be set at least to the maximum logs size expected in a single push request.")
-	f.Var(&l.MaxLineSize, "distributor.max-line-size", "Maximum line size on ingestion path. Example: 256kb. There is no limit when unset or set to 0.")
+	f.Var(&l.MaxLineSize, "distributor.max-line-size", "Maximum line size on ingestion path. Example: 256kb. Any log line exceeding this limit will be discarded unless `distributor.max-line-size-truncate` is set which in case it is truncated instead of discarding it completely. There is no limit when unset or set to 0.")
 	f.BoolVar(&l.MaxLineSizeTruncate, "distributor.max-line-size-truncate", false, "Whether to truncate lines that exceed max_line_size.")
 	f.IntVar(&l.MaxLabelNameLength, "validation.max-length-label-name", 1024, "Maximum length accepted for label names.")
 	f.IntVar(&l.MaxLabelValueLength, "validation.max-length-label-value", 2048, "Maximum length accepted for label value. This setting also applies to the metric name.")
diff --git a/production/README.md b/production/README.md
index 4dcecb8d482f..971f1374ace7 100644
--- a/production/README.md
+++ b/production/README.md
@@ -35,7 +35,7 @@ To test locally, we recommend using the `docker-compose.yaml` file in this direc
    docker-compose up
    ```
 
-1. Grafana should now be available at http://localhost:3000/. Log in with `admin` / `admin` and follow the [steps for configuring the datasource in Grafana](../docs/sources/getting-started/grafana.md), using `http://loki:3100` for the URL field.
+1. Grafana should now be available at http://localhost:3000/.
 
 **Note:** When running locally, Promtail starts before Loki is ready. This can lead to the error message "Data source connected, but no labels received." After a couple seconds, Promtail will forward all newly created log messages correctly.
 Until this is fixed we recommend [building and running from source](#build-and-run-from-source).
diff --git a/production/docker-compose.yaml b/production/docker-compose.yaml
index 49050bd933dc..f129dba5521d 100644
--- a/production/docker-compose.yaml
+++ b/production/docker-compose.yaml
@@ -21,6 +21,29 @@ services:
       - loki
 
   grafana:
+    environment:
+      - GF_PATHS_PROVISIONING=/etc/grafana/provisioning
+      - GF_AUTH_ANONYMOUS_ENABLED=true
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+    entrypoint:
+      - sh
+      - -euc
+      - |
+        mkdir -p /etc/grafana/provisioning/datasources
+        cat <<EOF > /etc/grafana/provisioning/datasources/ds.yaml
+        apiVersion: 1
+        datasources:
+        - name: Loki
+          type: loki
+          access: proxy 
+          orgId: 1
+          url: http://loki:3100
+          basicAuth: false
+          isDefault: true
+          version: 1
+          editable: false
+        EOF
+        /run.sh
     image: grafana/grafana:latest
     ports:
       - "3000:3000"
diff --git a/production/docker/README.md b/production/docker/README.md
index 750616d052bc..73bc7f20be5a 100644
--- a/production/docker/README.md
+++ b/production/docker/README.md
@@ -23,13 +23,14 @@ graph LR
     Grafana --> |Query logs| nginx["nginx (port: 8080)"]
     Promtail -->|Send logs| nginx
 
-    nginx -.-> |read path| QueryFrontend["query-frontend"]
+    nginx -.-> |read path| QueryFrontend
     nginx -.-> |write path| Distributor
 
-    QueryFrontend -.-> Querier
-
     subgraph LokiRead["loki -target=read"]
+        QueryFrontend["query-frontend"]
         Querier["querier"]
+
+        QueryFrontend -.-> Querier
     end
 
     subgraph Minio["Minio Storage"]
diff --git a/production/helm/cr.yaml b/production/helm/cr.yaml
index 646f6fa9307d..8f23e97be70b 100644
--- a/production/helm/cr.yaml
+++ b/production/helm/cr.yaml
@@ -1,6 +1,4 @@
 git-repo: helm-charts
-key: Grafana Loki
 owner: grafana
-sign: true
 skip-existing: true
 release-name-template: "helm-{{ .Name }}-{{ .Version }}"
diff --git a/production/helm/loki/CHANGELOG.md b/production/helm/loki/CHANGELOG.md
index 0d4803db0f5f..a0dbe4f601ba 100644
--- a/production/helm/loki/CHANGELOG.md
+++ b/production/helm/loki/CHANGELOG.md
@@ -11,6 +11,31 @@ Entries should be ordered as follows:
 
 Entries should include a reference to the pull request that introduced the change.
 
+## 4.0
+
+- [FEATURE] Added `enterprise.adminToken.additionalNamespaces` which are a list of additional namespaces to create secrets containing the GEL admin token in. This is especially useful if your Grafana instance is in another namespace.
+- [CHANGE] **BREAKING** Remove `enterprise.nginxConfig.file`. Both enterprise and gateway configurations now share the same nginx config, use `gateway.nginxConfig.file` for both. Admin routes will 404 on OSS deployments.
+- [CHANGE] **BREAKING** Default simple deployment mode to new, 3 target configuration (read, write, and backend). This new configuration allows the `read` target to be run as a deployment and auto-scaled. To go back to the legacy, 2 target configuration, set `read.legacyReadTraget` to `true`.
+- [CHANGE] **BREAKING** Change how tenants are defined
+- [CHANGE] **BREKAING** Remove `enterprise.adminTokenSecret`. This is now defined under `enterprise.adminToken.secret`.
+- [CHANGE] **BREKAING** Rename and change format of `enterprise.provisioner.tenants`. Property has been renamed to `enterprise.provisioner.additionalTenants`, and is now an array of objects rather than string. Each object must contain a `name` and a `secretNamespace` field, where `name` is the name of the tenant and `secretNamespace` is the namespace to create the secret with the tenant's read and write token.
+- [CHANGE] **BREAKING** Change the structure of `monitoring.selfMonitoring.tenant` from a string to an object. The new object must have a `name` and a `secretNamespace` field, where `name` is the name of the self-monitoring tenant and `secretNamespace` is the namespace to create an additional secret with the tenant's token. A secret will still also be created in the release namespace as it's needed by the Loki canary.
+- [CHANGE] **BREAKING** Remove ability to create self-monitoring resources in different namespaces (with the exception of dashboard configmaps).
+
+## 3.10.0
+
+- [CHANGE] Deprecate `enterprise.nginxConfig.file`. Both enterprise and gateway configurations now share the same nginx config. Admin routes will 404 on OSS deployments. Will be removed in version 4 of the chart, please use `gateway.nginxConfig.file` for both OSS and Enterprise gateways.
+- [FEATURE] Added new simple deployment target `backend`. Running 3 targets for simple deployment will soon be the default in Loki. This new target allows the `read` target to be run as a deployment and auto-scaled.
+
+## 3.9.0
+
+- [BUGFIX] Fix race condition between minio create bucket job and enterprise tokengen job
+
+## 3.8.2
+
+- [BUGFIX] Fix autoscaling/v2 template
+- [FEATURE] Added `extraObjects` helm values to extra manifests.
+
 ## 3.8.1
 
 - [ENHANCEMENT] Add the ability to specify container lifecycle
@@ -40,6 +65,7 @@ Entries should include a reference to the pull request that introduced the chang
 ## 3.4.3
 
 - [ENHANCEMENT] Allow to change Loki `-target` argument
+- [ENHANCEMENT] Add toggle for persistence disk in single-binary mode
 
 ## 3.4.2
 
diff --git a/production/helm/loki/Chart.yaml b/production/helm/loki/Chart.yaml
index 6345aea828c1..f5d08163d8ca 100644
--- a/production/helm/loki/Chart.yaml
+++ b/production/helm/loki/Chart.yaml
@@ -4,7 +4,7 @@ name: loki
 description: Helm chart for Grafana Loki in simple, scalable mode
 type: application
 appVersion: 2.7.0
-version: 3.8.1
+version: 4.0.0
 home: https://grafana.github.io/helm-charts
 sources:
   - https://github.com/grafana/loki
diff --git a/production/helm/loki/README.md b/production/helm/loki/README.md
index 2acfb9f20cad..39f5df22da74 100644
--- a/production/helm/loki/README.md
+++ b/production/helm/loki/README.md
@@ -1,6 +1,6 @@
 # loki
 
-![Version: 3.8.1](https://img.shields.io/badge/Version-3.8.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.7.0](https://img.shields.io/badge/AppVersion-2.7.0-informational?style=flat-square)
+![Version: 4.0.0](https://img.shields.io/badge/Version-4.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.7.0](https://img.shields.io/badge/AppVersion-2.7.0-informational?style=flat-square)
 
 Helm chart for Grafana Loki in simple, scalable mode
 
@@ -17,4 +17,4 @@ Helm chart for Grafana Loki in simple, scalable mode
 | https://charts.min.io/ | minio(minio) | 4.0.12 |
 | https://grafana.github.io/helm-charts | grafana-agent-operator(grafana-agent-operator) | 0.2.3 |
 
-[Find more information in the Loki Helm Chart [documentation](https://grafana.com/docs/loki/next/installation/helm).
+Find more information in the Loki Helm Chart [documentation](https://grafana.com/docs/loki/next/installation/helm).
diff --git a/production/helm/loki/README.md.gotmpl b/production/helm/loki/README.md.gotmpl
index 163aaad13d0b..dcd577845d4b 100644
--- a/production/helm/loki/README.md.gotmpl
+++ b/production/helm/loki/README.md.gotmpl
@@ -8,4 +8,4 @@
 
 {{ template "chart.requirementsSection" . }}
 
-[Find more information in the Loki Helm Chart [documentation](https://grafana.com/docs/loki/next/installation/helm).
+Find more information in the Loki Helm Chart [documentation](https://grafana.com/docs/loki/next/installation/helm).
diff --git a/production/helm/loki/ci/default-values.yaml b/production/helm/loki/ci/default-values.yaml
index 6fe3c1014a73..2b8340643c39 100644
--- a/production/helm/loki/ci/default-values.yaml
+++ b/production/helm/loki/ci/default-values.yaml
@@ -6,6 +6,8 @@ read:
   replicas: 1
 write:
   replicas: 1
+backend:
+  replicas: 1
 monitoring:
   serviceMonitor:
     labels:
diff --git a/production/helm/loki/ci/enterprise.yaml b/production/helm/loki/ci/enterprise.yaml
index 98b95148d30e..f271dc563762 100644
--- a/production/helm/loki/ci/enterprise.yaml
+++ b/production/helm/loki/ci/enterprise.yaml
@@ -15,10 +15,12 @@ storage:
   type: local
 read:
   replicas: 1
+write:
+  replicas: 1
   persistence:
     enabled: true
     size: 100Mi
-write:
+backend:
   replicas: 1
   persistence:
     enabled: true
diff --git a/production/helm/loki/ci/ingress-values.yaml b/production/helm/loki/ci/ingress-values.yaml
index 23233b487cb9..3d5fa688d1fd 100644
--- a/production/helm/loki/ci/ingress-values.yaml
+++ b/production/helm/loki/ci/ingress-values.yaml
@@ -15,6 +15,8 @@ read:
   replicas: 1
 write:
   replicas: 1
+backend:
+  replicas: 1
 monitoring:
   lokiCanary:
     enabled: false
diff --git a/production/helm/loki/reference.md.gotmpl b/production/helm/loki/reference.md.gotmpl
index 6054229c4d8b..eaabb49f70fa 100644
--- a/production/helm/loki/reference.md.gotmpl
+++ b/production/helm/loki/reference.md.gotmpl
@@ -15,7 +15,7 @@ keywords: []
 <!-- The reference title is required. Use a noun-based title. -->
 <!-- vale Grafana.Quotes = YES -->
 
-This is the generade reference for the Loki Helm Chart values.
+This is the generated reference for the Loki Helm Chart values.
 
 <!-- Override default values table from helm-docs. See https://github.com/norwoodj/helm-docs/tree/master#advanced-table-rendering -->
 {{ define "chart.valuesTableHtml" }}
diff --git a/production/helm/loki/src/alerts.yaml b/production/helm/loki/src/alerts.yaml
index 9ff179a2866a..b1e96877628d 100644
--- a/production/helm/loki/src/alerts.yaml
+++ b/production/helm/loki/src/alerts.yaml
@@ -6,9 +6,9 @@ groups:
       message: |
         {{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}% errors.
     expr: |
-      100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[1m])) by (namespace, job, route)
+      100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[2m])) by (namespace, job, route)
         /
-      sum(rate(loki_request_duration_seconds_count[1m])) by (namespace, job, route)
+      sum(rate(loki_request_duration_seconds_count[2m])) by (namespace, job, route)
         > 10
     for: 15m
     labels:
@@ -33,9 +33,9 @@ groups:
   - alert: LokiTooManyCompactorsRunning
     annotations:
       message: |
-        {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
+        {{ $labels.cluster }} {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
     expr: |
-      sum(loki_boltdb_shipper_compactor_running) by (namespace) > 1
+      sum(loki_boltdb_shipper_compactor_running) by (namespace, cluster) > 1
     for: 5m
     labels:
       severity: warning
@@ -46,7 +46,7 @@ groups:
       message: |
         {{ $labels.job }} is experiencing {{ printf "%.2f" $value }}s 99th percentile latency.
     expr: |
-      histogram_quantile(0.99, sum(rate(loki_canary_response_latency_seconds_bucket[5m])) by (le, namespace, cluster)) > 5
+      histogram_quantile(0.99, sum(rate(loki_canary_response_latency_seconds_bucket[5m])) by (le, namespace, job)) > 5
     for: '15m'
     labels:
       severity: 'warning'
diff --git a/production/helm/loki/templates/_helpers.tpl b/production/helm/loki/templates/_helpers.tpl
index f2b797146baa..967fb3802d48 100644
--- a/production/helm/loki/templates/_helpers.tpl
+++ b/production/helm/loki/templates/_helpers.tpl
@@ -79,8 +79,8 @@ Common labels
 {{- define "loki.labels" -}}
 helm.sh/chart: {{ include "loki.chart" . }}
 {{ include "loki.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- if or (.Chart.AppVersion) (.Values.loki.image.tag) }}
+app.kubernetes.io/version: {{ .Values.loki.image.tag | default .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
@@ -215,6 +215,7 @@ azure:
   {{- end }}
   container_name: {{ $.Values.loki.storage.bucketNames.chunks }}
   use_managed_identity: {{ .useManagedIdentity }}
+  use_federated_token: {{ .useFederatedToken }}
   {{- with .userAssignedId }}
   user_assigned_id: {{ . }}
   {{- end }}
@@ -273,6 +274,7 @@ gcs:
 {{- end -}}
 {{- else if eq .Values.loki.storage.type "azure" -}}
 {{- with .Values.loki.storage.azure }}
+type: "azure"
 azure:
   account_name: {{ .accountName }}
   {{- with .accountKey }}
@@ -280,6 +282,7 @@ azure:
   {{- end }}
   container_name: {{ $.Values.loki.storage.bucketNames.ruler }}
   use_managed_identity: {{ .useManagedIdentity }}
+  use_federated_token: {{ .useFederatedToken }}
   {{- with .userAssignedId }}
   user_assigned_id: {{ . }}
   {{- end }}
@@ -287,24 +290,18 @@ azure:
   request_timeout: {{ . }}
   {{- end }}
 {{- end -}}
+{{- else }}
+type: "local"
 {{- end -}}
 {{- end -}}
 
-{{/* Predicate function to determin if custom ruler config should be included */}}
-{{- define "loki.shouldIncludeRulerConfig" }}
-{{- or (not (empty .Values.loki.rulerConfig)) (.Values.minio.enabled) (eq .Values.loki.storage.type "s3") (eq .Values.loki.storage.type "gcs") }}
-{{- end }}
-
 {{/* Loki ruler config */}}
 {{- define "loki.rulerConfig" }}
-{{- if eq (include "loki.shouldIncludeRulerConfig" .) "true" }}
 ruler:
+  storage:
+    {{- include "loki.rulerStorageConfig" . | nindent 4}}
 {{- if (not (empty .Values.loki.rulerConfig)) }}
 {{- toYaml .Values.loki.rulerConfig | nindent 2}}
-{{- else }}
-  storage:
-  {{- include "loki.rulerStorageConfig" . | nindent 4}}
-{{- end }}
 {{- end }}
 {{- end }}
 
@@ -478,10 +475,179 @@ Create the service endpoint including port for MinIO.
 
 {{/* Name of kubernetes secret to persist GEL admin token to */}}
 {{- define "enterprise-logs.adminTokenSecret" }}
-{{- .Values.enterprise.adminTokenSecret | default (printf "%s-admin-token" (include "loki.name" . )) -}}
+{{- .Values.enterprise.adminToken.secret | default (printf "%s-admin-token" (include "loki.name" . )) -}}
 {{- end -}}
 
-{{/* Name of kubernetes secret to persist canary credentials in */}}
-{{- define "enterprise-logs.canarySecret" }}
-{{- .Values.enterprise.canarySecret | default (printf "%s-canary-secret" (include "loki.name" . )) -}}
+{{/* Prefix for provisioned secrets created for each provisioned tenant */}}
+{{- define "enterprise-logs.provisionedSecretPrefix" }}
+{{- .Values.enterprise.provisioner.provisionedSecretPrefix | default (printf "%s-provisioned" (include "loki.name" . )) -}}
 {{- end -}}
+
+{{/* Name of kubernetes secret to persist canary credentials in */}}
+{{- define "enterprise-logs.selfMonitoringTenantSecret" }}
+{{- .Values.enterprise.canarySecret | default (printf "%s-%s" (include "enterprise-logs.provisionedSecretPrefix" . ) .Values.monitoring.selfMonitoring.tenant.name) -}}
+{{- end -}}
+
+{{/* Snippet for the nginx file used by gateway */}}
+{{- define "loki.nginxFile" }}
+worker_processes  5;  ## Default: 1
+error_log  /dev/stderr;
+pid        /tmp/nginx.pid;
+worker_rlimit_nofile 8192;
+
+events {
+  worker_connections  4096;  ## Default: 1024
+}
+
+http {
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path       /tmp/proxy_temp_path;
+  fastcgi_temp_path     /tmp/fastcgi_temp;
+  uwsgi_temp_path       /tmp/uwsgi_temp;
+  scgi_temp_path        /tmp/scgi_temp;
+
+  proxy_http_version    1.1;
+
+  default_type application/octet-stream;
+  log_format   {{ .Values.gateway.nginxConfig.logFormat }}
+
+  {{- if .Values.gateway.verboseLogging }}
+  access_log   /dev/stderr  main;
+  {{- else }}
+
+  map $status $loggable {
+    ~^[23]  0;
+    default 1;
+  }
+  access_log   /dev/stderr  main  if=$loggable;
+  {{- end }}
+
+  sendfile     on;
+  tcp_nopush   on;
+  resolver {{ .Values.global.dnsService }}.{{ .Values.global.dnsNamespace }}.svc.{{ .Values.global.clusterDomain }}.;
+
+  {{- with .Values.gateway.nginxConfig.httpSnippet }}
+  {{ . | nindent 2 }}
+  {{- end }}
+
+  server {
+    listen             8080;
+
+    {{- if .Values.gateway.basicAuth.enabled }}
+    auth_basic           "Loki";
+    auth_basic_user_file /etc/nginx/secrets/.htpasswd;
+    {{- end }}
+
+    location = / {
+      return 200 'OK';
+      auth_basic off;
+    }
+
+    location = /api/prom/push {
+      proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    location = /api/prom/tail {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+
+    location ~ /api/prom/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    
+    {{- if .Values.read.legacyReadTarget }}
+    location ~ /prometheus/api/v1/alerts.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    location ~ /prometheus/api/v1/rules.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    location ~ /ruler/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- else }}
+    location ~ /prometheus/api/v1/alerts.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    location ~ /prometheus/api/v1/rules.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    location ~ /ruler/.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- end }}
+
+    location = /loki/api/v1/push {
+      proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    location = /loki/api/v1/tail {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+
+    {{- if .Values.read.legacyReadTarget }}
+    location ~ /compactor/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- else }}
+    location ~ /compactor/.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- end }}
+
+    location ~ /distributor/.* {
+      proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    location ~ /ring {
+      proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    location ~ /ingester/.* {
+      proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    {{- if .Values.read.legacyReadTarget }}
+    location ~ /store-gateway/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- else }}
+    location ~ /store-gateway/.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- end }}
+
+    {{- if .Values.read.legacyReadTarget }}
+    location ~ /query-scheduler/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    location ~ /scheduler/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- else }}
+    location ~ /query-scheduler/.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    location ~ /scheduler/.* {
+      proxy_pass       http://{{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+    {{- end }}
+
+    location ~ /loki/api/.* {
+      proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    location ~ /admin/api/.* {
+      proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
+    }
+
+    {{- with .Values.gateway.nginxConfig.serverSnippet }}
+    {{ . | nindent 4 }}
+    {{- end }}
+  }
+}
+{{- end }}
diff --git a/production/helm/loki/templates/backend/_helpers-backend.tpl b/production/helm/loki/templates/backend/_helpers-backend.tpl
new file mode 100644
index 000000000000..08f5f8f7b619
--- /dev/null
+++ b/production/helm/loki/templates/backend/_helpers-backend.tpl
@@ -0,0 +1,32 @@
+{{/*
+backend fullname
+*/}}
+{{- define "loki.backendFullname" -}}
+{{ include "loki.name" . }}-backend
+{{- end }}
+
+{{/*
+backend common labels
+*/}}
+{{- define "loki.backendLabels" -}}
+{{ include "loki.labels" . }}
+app.kubernetes.io/component: backend
+{{- end }}
+
+{{/*
+backend selector labels
+*/}}
+{{- define "loki.backendSelectorLabels" -}}
+{{ include "loki.selectorLabels" . }}
+app.kubernetes.io/component: backend
+{{- end }}
+
+{{/*
+backend priority class name
+*/}}
+{{- define "loki.backendPriorityClassName" -}}
+{{- $pcn := coalesce .Values.global.priorityClassName .Values.backend.priorityClassName -}}
+{{- if $pcn }}
+priorityClassName: {{ $pcn }}
+{{- end }}
+{{- end }}
diff --git a/production/helm/loki/templates/backend/poddisruptionbudget-backend.yaml b/production/helm/loki/templates/backend/poddisruptionbudget-backend.yaml
new file mode 100644
index 000000000000..92c0d579502a
--- /dev/null
+++ b/production/helm/loki/templates/backend/poddisruptionbudget-backend.yaml
@@ -0,0 +1,14 @@
+{{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
+{{- if and $isSimpleScalable (gt (int .Values.backend.replicas) 1) (not .Values.read.legacyReadTarget ) }}
+apiVersion: {{ include "loki.podDisruptionBudget.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "loki.backendFullname" . }}
+  labels:
+    {{- include "loki.backendLabels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "loki.backendSelectorLabels" . | nindent 6 }}
+  maxUnavailable: 1
+{{- end }}
diff --git a/production/helm/loki/templates/backend/service-backend-headless.yaml b/production/helm/loki/templates/backend/service-backend-headless.yaml
new file mode 100644
index 000000000000..04451070886b
--- /dev/null
+++ b/production/helm/loki/templates/backend/service-backend-headless.yaml
@@ -0,0 +1,25 @@
+{{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
+{{- if and $isSimpleScalable (not .Values.read.legacyReadTarget ) }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "loki.backendFullname" . }}-headless
+  labels:
+    {{- include "loki.backendSelectorLabels" . | nindent 4 }}
+    prometheus.io/service-monitor: "false"
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+    - name: http-metrics
+      port: 3100
+      targetPort: http-metrics
+      protocol: TCP
+    - name: grpc
+      port: 9095
+      targetPort: grpc
+      protocol: TCP
+  selector:
+    {{- include "loki.backendSelectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/production/helm/loki/templates/backend/service-backend.yaml b/production/helm/loki/templates/backend/service-backend.yaml
new file mode 100644
index 000000000000..b42f715340fd
--- /dev/null
+++ b/production/helm/loki/templates/backend/service-backend.yaml
@@ -0,0 +1,26 @@
+{{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
+{{- if and $isSimpleScalable (not .Values.read.legacyReadTarget ) }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "loki.backendFullname" . }}
+  labels:
+    {{- include "loki.backendLabels" . | nindent 4 }}
+    {{- with .Values.backend.serviceLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: http-metrics
+      port: 3100
+      targetPort: http-metrics
+      protocol: TCP
+    - name: grpc
+      port: 9095
+      targetPort: grpc
+      protocol: TCP
+  selector:
+    {{- include "loki.backendSelectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/production/helm/loki/templates/backend/statefulset-backend.yaml b/production/helm/loki/templates/backend/statefulset-backend.yaml
new file mode 100644
index 000000000000..716393b63e8f
--- /dev/null
+++ b/production/helm/loki/templates/backend/statefulset-backend.yaml
@@ -0,0 +1,141 @@
+{{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
+{{- if and $isSimpleScalable (not .Values.read.legacyReadTarget ) }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "loki.backendFullname" . }}
+  labels:
+    {{- include "loki.backendLabels" . | nindent 4 }}
+    app.kubernetes.io/part-of: memberlist
+spec:
+  replicas: {{ .Values.backend.replicas }}
+  podManagementPolicy: Parallel
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+  serviceName: {{ include "loki.backendFullname" . }}-headless
+  revisionHistoryLimit: {{ .Values.loki.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "loki.backendSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- with .Values.loki.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.backend.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "loki.backendSelectorLabels" . | nindent 8 }}
+        {{- with .Values.backend.selectorLabels }}
+        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- end }}
+        app.kubernetes.io/part-of: memberlist
+    spec:
+      serviceAccountName: {{ include "loki.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "loki.backendPriorityClassName" . | nindent 6 }}
+      securityContext:
+        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+      terminationGracePeriodSeconds: {{ .Values.backend.terminationGracePeriodSeconds }}
+      containers:
+        - name: backend
+          image: {{ include "loki.image" . }}
+          imagePullPolicy: {{ .Values.loki.image.pullPolicy }}
+          args:
+            - -config.file=/etc/loki/config/config.yaml
+            - -target={{ .Values.backend.targetModule }}
+            - -legacy-read-mode=false
+            {{- with .Values.backend.extraArgs }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: http-metrics
+              containerPort: 3100
+              protocol: TCP
+            - name: grpc
+              containerPort: 9095
+              protocol: TCP
+            - name: http-memberlist
+              containerPort: 7946
+              protocol: TCP
+          {{- with .Values.backend.extraEnv }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- toYaml .Values.loki.containerSecurityContext | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.loki.readinessProbe | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/loki/config
+            - name: data
+              mountPath: /var/loki
+            {{- if .Values.enterprise.enabled }}
+            - name: license
+              mountPath: /etc/loki/license
+            {{- end}}
+            {{- with .Values.backend.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.backend.resources | nindent 12 }}
+      {{- with .Values.backend.affinity }}
+      affinity:
+        {{- tpl . $ | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: config
+          {{- if .Values.loki.existingSecretForConfig }}
+          secret:
+            secretName: {{ .Values.loki.existingSecretForConfig }}
+          {{- else }}
+          configMap:
+            name: {{ include "loki.name" . }}
+          {{- end }}
+        {{- if .Values.enterprise.enabled }}
+        - name: license
+          secret:
+          {{- if .Values.enterprise.useExternalLicense }}
+            secretName: {{ .Values.enterprise.externalLicenseName }}
+          {{- else }}
+            secretName: enterprise-logs-license
+          {{- end }}
+        {{- end }}
+        {{- with .Values.backend.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        {{- with .Values.backend.persistence.storageClass }}
+        storageClassName: {{ if (eq "-" .) }}""{{ else }}{{ . }}{{ end }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.backend.persistence.size | quote }}
+{{- end }}
diff --git a/production/helm/loki/templates/extra-manifests.yaml b/production/helm/loki/templates/extra-manifests.yaml
new file mode 100644
index 000000000000..a9bb3b6ba8ef
--- /dev/null
+++ b/production/helm/loki/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{ range .Values.extraObjects }}
+---
+{{ tpl (toYaml .) $ }}
+{{ end }}
diff --git a/production/helm/loki/templates/gateway/configmap-gateway.yaml b/production/helm/loki/templates/gateway/configmap-gateway.yaml
index b3d8b4a8c9f0..f9c0c74d5357 100644
--- a/production/helm/loki/templates/gateway/configmap-gateway.yaml
+++ b/production/helm/loki/templates/gateway/configmap-gateway.yaml
@@ -8,5 +8,5 @@ metadata:
     {{- include "loki.gatewayLabels" . | nindent 4 }}
 data:
   nginx.conf: |
-    {{- tpl (ternary .Values.enterprise.nginxConfig.file .Values.gateway.nginxConfig.file .Values.enterprise.enabled) . | nindent 4 }}
+    {{- tpl .Values.gateway.nginxConfig.file . | indent 2 }}
 {{- end }}
diff --git a/production/helm/loki/templates/gateway/deployment-gateway.yaml b/production/helm/loki/templates/gateway/deployment-gateway.yaml
index 8620fa723541..4c1de3189820 100644
--- a/production/helm/loki/templates/gateway/deployment-gateway.yaml
+++ b/production/helm/loki/templates/gateway/deployment-gateway.yaml
@@ -29,6 +29,12 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
+        {{- with .Values.loki.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.gateway.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         {{- include "loki.gatewaySelectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "loki.serviceAccountName" . -}}
diff --git a/production/helm/loki/templates/gateway/hpa.yaml b/production/helm/loki/templates/gateway/hpa.yaml
index 9df136f671dc..daa462ec0709 100644
--- a/production/helm/loki/templates/gateway/hpa.yaml
+++ b/production/helm/loki/templates/gateway/hpa.yaml
@@ -1,6 +1,7 @@
 {{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
+{{- $autoscalingv2 := .Capabilities.APIVersions.Has "autoscaling/v2" -}}
 {{- if and $isSimpleScalable .Values.gateway.autoscaling.enabled }}
-{{- if .Capabilities.APIVersions.Has "autoscaling/v2" }}
+{{- if $autoscalingv2 }}
 apiVersion: autoscaling/v2
 {{- else }}
 apiVersion: autoscaling/v2beta1
@@ -22,12 +23,24 @@ spec:
     - type: Resource
       resource:
         name: memory
+        {{- if $autoscalingv2 }}
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+        {{- else }}
         targetAverageUtilization: {{ . }}
+        {{- end }}
   {{- end }}
   {{- with .Values.gateway.autoscaling.targetCPUUtilizationPercentage }}
     - type: Resource
       resource:
         name: cpu
+        {{- if $autoscalingv2 }}
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+        {{- else }}
         targetAverageUtilization: {{ . }}
+        {{- end }}
   {{- end }}
 {{- end }}
diff --git a/production/helm/loki/templates/loki-canary/daemonset.yaml b/production/helm/loki/templates/loki-canary/daemonset.yaml
index 0c7b5a34b42d..7b5d9c0d55e4 100644
--- a/production/helm/loki/templates/loki-canary/daemonset.yaml
+++ b/production/helm/loki/templates/loki-canary/daemonset.yaml
@@ -41,8 +41,8 @@ spec:
             - -tenant-id=$(USER)
             - -pass=$(PASS)
             {{- else if $.Values.loki.auth_enabled }}
-            - -user={{ $.Values.monitoring.selfMonitoring.tenant }}
-            - -tenant-id={{ $.Values.monitoring.selfMonitoring.tenant }}
+            - -user={{ $.Values.monitoring.selfMonitoring.tenant.name }}
+            - -tenant-id={{ $.Values.monitoring.selfMonitoring.tenant.name }}
             {{- end }}
             {{- with .extraArgs }}
             {{- toYaml . | nindent 12 }}
@@ -62,12 +62,12 @@ spec:
             - name: USER
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "enterprise-logs.canarySecret" $ }}
+                  name: {{ include "enterprise-logs.selfMonitoringTenantSecret" $ }}
                   key: username
             - name: PASS
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "enterprise-logs.canarySecret" $ }}
+                  name: {{ include "enterprise-logs.selfMonitoringTenantSecret" $ }}
                   key: password
             {{- end -}}
             {{- with .extraEnv }}
diff --git a/production/helm/loki/templates/loki-canary/service.yaml b/production/helm/loki/templates/loki-canary/service.yaml
index 5bc2538927ba..6d7ace5cbd44 100644
--- a/production/helm/loki/templates/loki-canary/service.yaml
+++ b/production/helm/loki/templates/loki-canary/service.yaml
@@ -1,11 +1,12 @@
-{{- if .Values.monitoring.lokiCanary.enabled -}}
+{{- with .Values.monitoring.lokiCanary -}}
+{{- if .enabled -}}
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "loki-canary.fullname" . }}
+  name: {{ include "loki-canary.fullname" $ }}
   labels:
-    {{- include "loki-canary.labels" . | nindent 4 }}
+    {{- include "loki-canary.labels" $ | nindent 4 }}
 spec:
   type: ClusterIP
   ports:
@@ -14,5 +15,6 @@ spec:
       targetPort: http-metrics
       protocol: TCP
   selector:
-    {{- include "loki-canary.selectorLabels" . | nindent 4 }}
+    {{- include "loki-canary.selectorLabels" $ | nindent 4 }}
+{{- end -}}
 {{- end -}}
diff --git a/production/helm/loki/templates/loki-canary/serviceaccount.yaml b/production/helm/loki/templates/loki-canary/serviceaccount.yaml
index 5c2973bedf10..27949423b091 100644
--- a/production/helm/loki/templates/loki-canary/serviceaccount.yaml
+++ b/production/helm/loki/templates/loki-canary/serviceaccount.yaml
@@ -1,18 +1,20 @@
-{{- if .Values.monitoring.lokiCanary.enabled -}}
+{{- with .Values.monitoring.lokiCanary -}}
+{{- if .enabled -}}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "loki-canary.fullname" . }}
+  name: {{ include "loki-canary.fullname" $ }}
   labels:
-    {{- include "loki-canary.labels" . | nindent 4 }}
+    {{- include "loki-canary.labels" $ | nindent 4 }}
   annotations:
-  {{- with .Values.monitoring.lokiCanary.annotations }}
+  {{- with .annotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
-automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
-{{- with .Values.serviceAccount.imagePullSecrets }}
+automountServiceAccountToken: {{ $.Values.serviceAccount.automountServiceAccountToken }}
+{{- with $.Values.serviceAccount.imagePullSecrets }}
 imagePullSecrets:
   {{- toYaml . | nindent 2 }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/production/helm/loki/templates/monitoring/_helpers-monitoring.tpl b/production/helm/loki/templates/monitoring/_helpers-monitoring.tpl
index 44a026966358..342fd2b6b261 100644
--- a/production/helm/loki/templates/monitoring/_helpers-monitoring.tpl
+++ b/production/helm/loki/templates/monitoring/_helpers-monitoring.tpl
@@ -15,13 +15,13 @@ Client definition for LogsInstance
   {{- if .Values.enterprise.enabled }}
   basicAuth:
     username:
-      name: {{ include "enterprise-logs.canarySecret" . }}
+      name: {{ include "enterprise-logs.selfMonitoringTenantSecret" . }}
       key: username
     password:
-      name: {{ include "enterprise-logs.canarySecret" . }}
+      name: {{ include "enterprise-logs.selfMonitoringTenantSecret" . }}
       key: password
   {{- else if .Values.loki.auth_enabled }}
-  tenantId: {{ .Values.monitoring.selfMonitoring.tenant }}
+  tenantId: {{ .Values.monitoring.selfMonitoring.tenant.name }}
   {{- end }}
 {{- end -}}
 
diff --git a/production/helm/loki/templates/monitoring/grafana-agent.yaml b/production/helm/loki/templates/monitoring/grafana-agent.yaml
index 74177b489085..0ac0f6cad31f 100644
--- a/production/helm/loki/templates/monitoring/grafana-agent.yaml
+++ b/production/helm/loki/templates/monitoring/grafana-agent.yaml
@@ -4,7 +4,6 @@ apiVersion: monitoring.grafana.com/v1alpha1
 kind: GrafanaAgent
 metadata:
   name: {{ include "loki.fullname" $ }}
-  namespace: {{ .namespace | default $.Release.Namespace }}
   labels:
     {{- include "loki.labels" $ | nindent 4 }}
     {{- with .labels }}
diff --git a/production/helm/loki/templates/monitoring/logs-instance.yaml b/production/helm/loki/templates/monitoring/logs-instance.yaml
index a5b5046ff517..34ab6e9a53b4 100644
--- a/production/helm/loki/templates/monitoring/logs-instance.yaml
+++ b/production/helm/loki/templates/monitoring/logs-instance.yaml
@@ -4,7 +4,6 @@ apiVersion: monitoring.grafana.com/v1alpha1
 kind: LogsInstance
 metadata:
   name: {{ include "loki.fullname" $ }}
-  namespace: {{ .namespace | default $.Release.Namespace }}
   {{- with .annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/production/helm/loki/templates/monitoring/metrics-instance.yaml b/production/helm/loki/templates/monitoring/metrics-instance.yaml
index 9126eb8f9875..82102c0ed3fa 100644
--- a/production/helm/loki/templates/monitoring/metrics-instance.yaml
+++ b/production/helm/loki/templates/monitoring/metrics-instance.yaml
@@ -5,7 +5,6 @@ apiVersion: monitoring.grafana.com/v1alpha1
 kind: MetricsInstance
 metadata:
   name: {{ include "loki.fullname" $ }}
-  namespace: {{ .namespace | default $.Release.Namespace }}
   {{- with .annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/production/helm/loki/templates/monitoring/pod-logs.yaml b/production/helm/loki/templates/monitoring/pod-logs.yaml
index 955f4e8ecbed..c12fecf042d7 100644
--- a/production/helm/loki/templates/monitoring/pod-logs.yaml
+++ b/production/helm/loki/templates/monitoring/pod-logs.yaml
@@ -5,7 +5,6 @@ apiVersion: monitoring.grafana.com/v1alpha1
 kind: PodLogs
 metadata:
   name: {{ include "loki.fullname" $ }}
-  namespace: {{ .namespace | default $.Release.Namespace }}
   {{- with .annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -25,9 +24,18 @@ spec:
     - action: labelmap
       regex: __meta_kubernetes_pod_label_(.+)
     - action: replace
-      replacement: "{{ $.Release.Namespace }}/$1"
+      replacement: "$1"
+      separator: "-"
       sourceLabels:
-        - __meta_kubernetes_pod_controller_name
+        - __meta_kubernetes_pod_label_app_kubernetes_io_instance
+        - __meta_kubernetes_pod_label_app_kubernetes_io_component
+      targetLabel: __service__
+    - action: replace
+      replacement: "$1"
+      separator: "/"
+      sourceLabels:
+        - __meta_kubernetes_namespace
+        - __service__
       targetLabel: job
     - action: replace
       sourceLabels:
@@ -36,7 +44,7 @@ spec:
     - replacement: "{{ include "loki.fullname" $ }}"
       targetLabel: cluster
     {{- with .relabelings }}
-    {{- toYaml . | nindent 8 }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
   namespaceSelector:
     matchNames:
diff --git a/production/helm/loki/templates/monitoring/prometheus-alerts.yaml b/production/helm/loki/templates/monitoring/prometheus-alerts.yaml
index 058863de483b..e3eee03d1b29 100644
--- a/production/helm/loki/templates/monitoring/prometheus-alerts.yaml
+++ b/production/helm/loki/templates/monitoring/prometheus-alerts.yaml
@@ -14,7 +14,6 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   name: {{ include "loki.fullname" $ }}-alerts
-  namespace: {{ .namespace | default $.Release.Namespace }}
 spec:
   groups:
   {{- include "loki.ruleGroupToYaml" ($.Files.Get "src/alerts.yaml" | fromYaml).groups | indent 4 }}
diff --git a/production/helm/loki/templates/monitoring/prometheus-rules.yaml b/production/helm/loki/templates/monitoring/prometheus-rules.yaml
index e421aa0b9abc..8aef8859be1a 100644
--- a/production/helm/loki/templates/monitoring/prometheus-rules.yaml
+++ b/production/helm/loki/templates/monitoring/prometheus-rules.yaml
@@ -14,7 +14,6 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   name: {{ include "loki.fullname" $ }}-rules
-  namespace: {{ .namespace | default $.Release.Namespace }}
 spec:
   groups:
   {{- include "loki.ruleGroupToYaml" (tpl ($.Files.Get "src/rules.yaml.tpl") $ | fromYaml).groups | indent 4 }}
diff --git a/production/helm/loki/templates/monitoring/servicemonitor.yaml b/production/helm/loki/templates/monitoring/servicemonitor.yaml
index 8c37cbd1bfdc..c5dca1fb45ea 100644
--- a/production/helm/loki/templates/monitoring/servicemonitor.yaml
+++ b/production/helm/loki/templates/monitoring/servicemonitor.yaml
@@ -5,9 +5,6 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "loki.fullname" $ }}
-  {{- with .namespace }}
-  namespace: {{ . }}
-  {{- end }}
   {{- with .annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/production/helm/loki/templates/provisioner/_helpers.yaml b/production/helm/loki/templates/provisioner/_helpers.yaml
index be4a7cba5c18..8b04b07796ac 100644
--- a/production/helm/loki/templates/provisioner/_helpers.yaml
+++ b/production/helm/loki/templates/provisioner/_helpers.yaml
@@ -29,8 +29,4 @@ provisioner image name
 {{- include "loki.baseImage" $dict -}}
 {{- end -}}
 
-{{/* Prefix for provisioned secrets created for each provisioned tenant */}}
-{{- define "enterprise-logs.provisionedSecretPrefix" }}
-{{- .Values.enterprise.provisioner.provisionedSecretPrefix | default (printf "%s-provisioned" (include "loki.name" . )) -}}
-{{- end -}}
 
diff --git a/production/helm/loki/templates/provisioner/job-provisioner.yaml b/production/helm/loki/templates/provisioner/job-provisioner.yaml
index e92a5a44c792..d13b11d05208 100644
--- a/production/helm/loki/templates/provisioner/job-provisioner.yaml
+++ b/production/helm/loki/templates/provisioner/job-provisioner.yaml
@@ -14,7 +14,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
     {{- end }}
     "helm.sh/hook": post-install
-    "helm.sh/hook-weight": "10"
+    "helm.sh/hook-weight": "15"
 spec:
   backoffLimit: 6
   completions: 1
@@ -50,16 +50,16 @@ spec:
             - /bin/sh
             - -euc
             - |
-              {{- range .Values.enterprise.provisioner.tenants }}
+              {{- range .Values.enterprise.provisioner.additionalTenants }}
               /usr/bin/enterprise-logs-provisioner \
                 -bootstrap-path=/bootstrap \
                 -cluster-name={{ include "loki.clusterName" $ }} \
                 -gel-url={{ include "loki.address" $ }} \
-                -instance={{ . }} \
-                -access-policy=write-{{ . }}:{{ . }}:logs:write \
-                -access-policy=read-{{ . }}:{{ . }}:logs:read \
-                -token=write-{{ . }} \
-                -token=read-{{ . }}
+                -instance={{ .name }} \
+                -access-policy=write-{{ .name }}:{{ .name }}:logs:write \
+                -access-policy=read-{{ .name }}:{{ .name }}:logs:read \
+                -token=write-{{ .name }} \
+                -token=read-{{ .name }}
               {{- end -}}
 
               {{- with .Values.monitoring.selfMonitoring.tenant }}
@@ -67,9 +67,9 @@ spec:
                 -bootstrap-path=/bootstrap \
                 -cluster-name={{ include "loki.clusterName" $ }} \
                 -gel-url={{ include "loki.address" $ }} \
-                -instance={{ . }} \
-                -access-policy=canary:{{ . }}:logs:write,logs:read \
-                -token=canary
+                -instance={{ .name }} \
+                -access-policy=self-monitoring:{{ .name }}:logs:write,logs:read \
+                -token=self-monitoring
               {{- end }}
           volumeMounts:
             {{- with .Values.enterprise.provisioner.extraVolumeMounts }}
@@ -92,15 +92,21 @@ spec:
             - /bin/bash
             - -euc
             - |
-              {{- range .Values.enterprise.provisioner.tenants }}
-              kubectl create secret generic "{{ include "enterprise-logs.provisionedSecretPrefix" $ }}-{{ . }}" \
-                --from-literal=token-write="$(cat /bootstrap/token-write-{{ . }})" \
-                --from-literal=token-read="$(cat /bootstrap/token-read-{{ . }})"
-              {{- end -}}
+              {{- range .Values.enterprise.provisioner.additionalTenants }}
+              kubectl --namespace "{{ .secretNamespace }}" create secret generic "{{ include "enterprise-logs.provisionedSecretPrefix" $ }}-{{ .name }}" \
+                --from-literal=token-write="$(cat /bootstrap/token-write-{{ .name }})" \
+                --from-literal=token-read="$(cat /bootstrap/token-read-{{ .name }})"
+              {{- end }}
+              {{- $namespace := $.Release.Namespace }}
               {{- with .Values.monitoring.selfMonitoring.tenant }}
-              kubectl create secret generic "{{ include "enterprise-logs.canarySecret" $ }}" \
-                --from-literal=username="{{ $.Values.monitoring.selfMonitoring.tenant }}" \
+              kubectl --namespace "{{ $namespace }}" create secret generic "{{ include "enterprise-logs.selfMonitoringTenantSecret" $ }}" \
+                --from-literal=username="{{ .name }}" \
                 --from-literal=password="$(cat /bootstrap/token-canary)"
+              {{- if not (eq .secretNamespace $namespace) }}
+              kubectl --namespace "{{ .secretNamespace }}" create secret generic "{{ include "enterprise-logs.selfMonitoringTenantSecret" $ }}" \
+                --from-literal=username="{{ .name }}" \
+                --from-literal=password="$(cat /bootstrap/token-canary)"
+              {{- end }}
               {{- end }}
           volumeMounts:
             {{- with .Values.enterprise.provisioner.extraVolumeMounts }}
diff --git a/production/helm/loki/templates/provisioner/role-provisioner.yaml b/production/helm/loki/templates/provisioner/role-provisioner.yaml
index 6163ac07f1d4..a8da5990cf30 100644
--- a/production/helm/loki/templates/provisioner/role-provisioner.yaml
+++ b/production/helm/loki/templates/provisioner/role-provisioner.yaml
@@ -1,6 +1,6 @@
 {{ if and .Values.enterprise.provisioner.enabled .Values.enterprise.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: {{ template "enterprise-logs.provisionerFullname" . }}
   labels:
diff --git a/production/helm/loki/templates/provisioner/rolebinding-provisioner.yaml b/production/helm/loki/templates/provisioner/rolebinding-provisioner.yaml
index 8138e924314a..0fc46f46e949 100644
--- a/production/helm/loki/templates/provisioner/rolebinding-provisioner.yaml
+++ b/production/helm/loki/templates/provisioner/rolebinding-provisioner.yaml
@@ -1,7 +1,7 @@
 {{ if and .Values.enterprise.provisioner.enabled .Values.enterprise.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   name: {{ template "enterprise-logs.provisionerFullname" . }}
   labels:
@@ -16,9 +16,10 @@ metadata:
     "helm.sh/hook": post-install
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: {{ template "enterprise-logs.provisionerFullname" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ template "enterprise-logs.provisionerFullname" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}
diff --git a/production/helm/loki/templates/provisioner/serviceaccount-provisioner.yaml b/production/helm/loki/templates/provisioner/serviceaccount-provisioner.yaml
index c8132f6ab31c..2dc67d2485e8 100644
--- a/production/helm/loki/templates/provisioner/serviceaccount-provisioner.yaml
+++ b/production/helm/loki/templates/provisioner/serviceaccount-provisioner.yaml
@@ -4,6 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ template "enterprise-logs.provisionerFullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "enterprise-logs.provisionerLabels" . | nindent 4 }}
     {{- with .Values.enterprise.provisioner.labels }}
diff --git a/production/helm/loki/templates/read/deployment-read.yaml b/production/helm/loki/templates/read/deployment-read.yaml
new file mode 100644
index 000000000000..231a064d2421
--- /dev/null
+++ b/production/helm/loki/templates/read/deployment-read.yaml
@@ -0,0 +1,143 @@
+{{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
+{{- if and $isSimpleScalable (not .Values.read.legacyReadTarget ) }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "loki.readFullname" . }}
+  labels:
+    app.kubernetes.io/part-of: memberlist
+    {{- include "loki.readLabels" . | nindent 4 }}
+spec:
+  {{- if not .Values.read.autoscaling.enabled }}
+  replicas: {{ .Values.read.replicas }}
+  {{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  revisionHistoryLimit: {{ .Values.loki.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "loki.readSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- with .Values.loki.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.read.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        app.kubernetes.io/part-of: memberlist
+        {{- include "loki.readSelectorLabels" . | nindent 8 }}
+        {{- with .Values.loki.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.read.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.read.selectorLabels }}
+        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "loki.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "loki.readPriorityClassName" . | nindent 6 }}
+      securityContext:
+        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+      terminationGracePeriodSeconds: {{ .Values.read.terminationGracePeriodSeconds }}
+      containers:
+        - name: read
+          image: {{ include "loki.image" . }}
+          imagePullPolicy: {{ .Values.loki.image.pullPolicy }}
+          args:
+            - -config.file=/etc/loki/config/config.yaml
+            - -target={{ .Values.read.targetModule }}
+            - -legacy-read-mode=false
+            - -common.compactor-grpc-address={{ include "loki.backendFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:9095
+            {{- with .Values.read.extraArgs }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: http-metrics
+              containerPort: 3100
+              protocol: TCP
+            - name: grpc
+              containerPort: 9095
+              protocol: TCP
+            - name: http-memberlist
+              containerPort: 7946
+              protocol: TCP
+          {{- with .Values.read.extraEnv }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.read.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- toYaml .Values.loki.containerSecurityContext | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.loki.readinessProbe | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/loki/config
+            - name: tmp
+              mountPath: /tmp
+            - name: data
+              mountPath: /var/loki
+            {{- if .Values.enterprise.enabled }}
+            - name: license
+              mountPath: /etc/loki/license
+            {{- end}}
+            {{- with .Values.read.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.read.resources | nindent 12 }}
+      {{- with .Values.read.affinity }}
+      affinity:
+        {{- tpl . $ | nindent 8 }}
+      {{- end }}
+      {{- with .Values.read.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.read.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: data
+          emptyDir: {}
+        - name: config
+          {{- if .Values.loki.existingSecretForConfig }}
+          secret:
+            secretName: {{ .Values.loki.existingSecretForConfig }}
+          {{- else }}
+          configMap:
+            name: {{ include "loki.name" . }}
+          {{- end }}
+        {{- if .Values.enterprise.enabled }}
+        - name: license
+          secret:
+          {{- if .Values.enterprise.useExternalLicense }}
+            secretName: {{ .Values.enterprise.externalLicenseName }}
+          {{- else }}
+            secretName: enterprise-logs-license
+          {{- end }}
+        {{- end }}
+        {{- with .Values.read.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+{{- end }}
diff --git a/production/helm/loki/templates/read/service-read-headless.yaml b/production/helm/loki/templates/read/service-read-headless.yaml
index 7f1e0724fdad..ec2d57a1e54b 100644
--- a/production/helm/loki/templates/read/service-read-headless.yaml
+++ b/production/helm/loki/templates/read/service-read-headless.yaml
@@ -20,6 +20,7 @@ spec:
       port: 9095
       targetPort: grpc
       protocol: TCP
+      appProtocol: tcp
   selector:
     {{- include "loki.readSelectorLabels" . | nindent 4 }}
 {{- end }}
diff --git a/production/helm/loki/templates/read/statefulset-read.yaml b/production/helm/loki/templates/read/statefulset-read.yaml
index e9d77199a7b6..ab2cfc198bae 100644
--- a/production/helm/loki/templates/read/statefulset-read.yaml
+++ b/production/helm/loki/templates/read/statefulset-read.yaml
@@ -1,5 +1,5 @@
 {{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
-{{- if $isSimpleScalable }}
+{{- if and $isSimpleScalable (.Values.read.legacyReadTarget ) }}
 ---
 apiVersion: apps/v1
 kind: StatefulSet
@@ -16,7 +16,7 @@ spec:
       partition: 0
   serviceName: {{ printf "%s-headless" (include "loki.readFullname" .) }}
   revisionHistoryLimit: {{ .Values.loki.revisionHistoryLimit }}
-  {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+  {{- if and (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) (.Values.read.persistence.enableStatefulSetAutoDeletePVC)  }}
   {{/*
     Data on the read nodes is easy to replace, so we want to always delete PVCs to make
     operation easier, and will rely on re-fetching data when needed.
@@ -41,6 +41,12 @@ spec:
       labels:
         app.kubernetes.io/part-of: memberlist
         {{- include "loki.readSelectorLabels" . | nindent 8 }}
+        {{- with .Values.loki.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.read.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         {{- with .Values.read.selectorLabels }}
         {{- tpl (toYaml .) $ | nindent 8 }}
         {{- end }}
diff --git a/production/helm/loki/templates/single-binary/statefulset.yaml b/production/helm/loki/templates/single-binary/statefulset.yaml
index 30dccc67760f..9ce792b4143f 100644
--- a/production/helm/loki/templates/single-binary/statefulset.yaml
+++ b/production/helm/loki/templates/single-binary/statefulset.yaml
@@ -31,6 +31,12 @@ spec:
         {{- end }}
       labels:
         {{- include "loki.singleBinarySelectorLabels" . | nindent 8 }}
+        {{- with .Values.loki.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.singleBinary.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         {{- with .Values.singleBinary.selectorLabels }}
         {{- tpl (toYaml .) $ | nindent 8 }}
         {{- end }}
@@ -83,12 +89,14 @@ spec:
               mountPath: /tmp
             - name: config
               mountPath: /etc/loki/config
+            {{- if .Values.singleBinary.persistence.enabled }}
             - name: storage
               mountPath: /var/loki
+            {{- end }}
             {{- if .Values.enterprise.enabled }}
             - name: license
               mountPath: /etc/loki/license
-            {{- end}}
+            {{- end }}
             {{- with .Values.singleBinary.extraVolumeMounts }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -129,6 +137,7 @@ spec:
         {{- with .Values.singleBinary.extraVolumes }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+  {{- if .Values.singleBinary.persistence.enabled }}
   volumeClaimTemplates:
     - metadata:
         name: storage
@@ -145,4 +154,5 @@ spec:
         selector:
           {{- toYaml . | nindent 10 }}
         {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/production/helm/loki/templates/tests/_helpers.tpl b/production/helm/loki/templates/tests/_helpers.tpl
index b3152f908f09..9ef7c157a6a9 100644
--- a/production/helm/loki/templates/tests/_helpers.tpl
+++ b/production/helm/loki/templates/tests/_helpers.tpl
@@ -1,7 +1,16 @@
 {{/*
 Docker image name for loki helm test
 */}}
-{{- define "loki.helm-test-image" -}}
+{{- define "loki.helmTestImage" -}}
 {{- $dict := dict "service" .Values.test.image "global" .Values.global.image "defaultVersion" "latest" -}}
 {{- include "loki.baseImage" $dict -}}
 {{- end -}}
+
+
+{{/*
+test common labels
+*/}}
+{{- define "loki.helmTestLabels" -}}
+{{ include "loki.labels" . }}
+app.kubernetes.io/component: helm-test
+{{- end }}
diff --git a/production/helm/loki/templates/tests/test-canary.yaml b/production/helm/loki/templates/tests/test-canary.yaml
index 246fb4dfdc4c..eb4177239fca 100644
--- a/production/helm/loki/templates/tests/test-canary.yaml
+++ b/production/helm/loki/templates/tests/test-canary.yaml
@@ -6,7 +6,7 @@ kind: Pod
 metadata:
   name: "{{ include "loki.name" $ }}-helm-test"
   labels:
-    {{- include "loki.labels" $ | nindent 4 }}
+    {{- include "loki.helmTestLabels" $ | nindent 4 }}
     {{- with .labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
@@ -18,7 +18,7 @@ metadata:
 spec:
   containers:
     - name: loki-helm-test
-      image: {{ include "loki.helm-test-image" $ }}
+      image: {{ include "loki.helmTestImage" $ }}
       env:
         - name: CANARY_PROMETHEUS_ADDRESS
           value: "{{ .prometheusAddress }}"
diff --git a/production/helm/loki/templates/tokengen/role-tokengen.yaml b/production/helm/loki/templates/tokengen/clusterrole-tokengen.yaml
similarity index 97%
rename from production/helm/loki/templates/tokengen/role-tokengen.yaml
rename to production/helm/loki/templates/tokengen/clusterrole-tokengen.yaml
index 6b94bf31d174..a4c4ed53038f 100644
--- a/production/helm/loki/templates/tokengen/role-tokengen.yaml
+++ b/production/helm/loki/templates/tokengen/clusterrole-tokengen.yaml
@@ -1,7 +1,7 @@
 {{- $isSimpleScalable := eq (include "loki.deployment.isScalable" .) "true" -}}
 {{ if and $isSimpleScalable .Values.enterprise.tokengen.enabled .Values.enterprise.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: {{ template "enterprise-logs.tokengenFullname" . }}
   labels:
diff --git a/production/helm/loki/templates/tokengen/rolebinding-tokengen.yaml b/production/helm/loki/templates/tokengen/clusterrolebinding-tokengen.yaml
similarity index 90%
rename from production/helm/loki/templates/tokengen/rolebinding-tokengen.yaml
rename to production/helm/loki/templates/tokengen/clusterrolebinding-tokengen.yaml
index ce9c0df07ed5..1754459632b1 100644
--- a/production/helm/loki/templates/tokengen/rolebinding-tokengen.yaml
+++ b/production/helm/loki/templates/tokengen/clusterrolebinding-tokengen.yaml
@@ -2,7 +2,7 @@
 {{ if and $isSimpleScalable .Values.enterprise.tokengen.enabled .Values.enterprise.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   name: {{ template "enterprise-logs.tokengenFullname" . }}
   labels:
@@ -17,9 +17,10 @@ metadata:
     "helm.sh/hook": post-install
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: {{ template "enterprise-logs.tokengenFullname" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ template "enterprise-logs.tokengenFullname" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}
diff --git a/production/helm/loki/templates/tokengen/job-tokengen.yaml b/production/helm/loki/templates/tokengen/job-tokengen.yaml
index 32c0cf3bf0a6..dc9f88e5e1d1 100644
--- a/production/helm/loki/templates/tokengen/job-tokengen.yaml
+++ b/production/helm/loki/templates/tokengen/job-tokengen.yaml
@@ -15,7 +15,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
     {{- end }}
     "helm.sh/hook": post-install
-    "helm.sh/hook-weight": "0"
+    "helm.sh/hook-weight": "10"
 spec:
   backoffLimit: 6
   completions: 1
@@ -79,6 +79,11 @@ spec:
             - -euc
             - |
               kubectl create secret generic "{{ include "enterprise-logs.adminTokenSecret" . }}" --from-file=token=/shared/admin-token
+              {{- with .Values.enterprise.adminToken.additionalNamespaces }}
+              {{- range . }}
+              kubectl --namespace "{{ . }}" create secret generic "{{ include "enterprise-logs.adminTokenSecret" $ }}" --from-file=token=/shared/admin-token
+              {{- end }}
+              {{- end }}
           volumeMounts:
             {{- if .Values.enterprise.tokengen.extraVolumeMounts }}
               {{ toYaml .Values.enterprise.tokengen.extraVolumeMounts | nindent 12 }}
diff --git a/production/helm/loki/templates/tokengen/serviceaccount-tokengen.yaml b/production/helm/loki/templates/tokengen/serviceaccount-tokengen.yaml
index 77a9d656d5e1..4162ba518723 100644
--- a/production/helm/loki/templates/tokengen/serviceaccount-tokengen.yaml
+++ b/production/helm/loki/templates/tokengen/serviceaccount-tokengen.yaml
@@ -5,6 +5,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ template "enterprise-logs.tokengenFullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "enterprise-logs.tokengenLabels" . | nindent 4 }}
     {{- with .Values.enterprise.tokengen.labels }}
diff --git a/production/helm/loki/templates/write/service-write-headless.yaml b/production/helm/loki/templates/write/service-write-headless.yaml
index e35ba7ad8ce8..26f1682a5245 100644
--- a/production/helm/loki/templates/write/service-write-headless.yaml
+++ b/production/helm/loki/templates/write/service-write-headless.yaml
@@ -20,6 +20,7 @@ spec:
       port: 9095
       targetPort: grpc
       protocol: TCP
+      appProtocol: tcp
   selector:
     {{- include "loki.writeSelectorLabels" . | nindent 4 }}
 {{- end }}
diff --git a/production/helm/loki/templates/write/statefulset-write.yaml b/production/helm/loki/templates/write/statefulset-write.yaml
index b3af3f6e96da..e5133f54f9cc 100644
--- a/production/helm/loki/templates/write/statefulset-write.yaml
+++ b/production/helm/loki/templates/write/statefulset-write.yaml
@@ -32,6 +32,12 @@ spec:
         {{- end }}
       labels:
         {{- include "loki.writeSelectorLabels" . | nindent 8 }}
+        {{- with .Values.loki.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.write.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         {{- with .Values.write.selectorLabels }}
         {{- tpl (toYaml .) $ | nindent 8 }}
         {{- end }}
diff --git a/production/helm/loki/values.yaml b/production/helm/loki/values.yaml
index e99db2907f37..938467f84be7 100644
--- a/production/helm/loki/values.yaml
+++ b/production/helm/loki/values.yaml
@@ -45,11 +45,15 @@ loki:
     # -- Docker image repository
     repository: grafana/loki
     # -- Overrides the image tag whose default is the chart's appVersion
-    tag: null
+    # TODO: needed for 3rd target backend functionality
+    # revert to null or latest once this behavior is relased
+    tag: "main-5e53303"
     # -- Docker image pull policy
     pullPolicy: IfNotPresent
   # -- Common annotations for all pods
   podAnnotations: {}
+  # -- Common labels for all pods
+  podLabels: {}
   # -- The number of old ReplicaSets to retain to allow rollback
   revisionHistoryLimit: 10
   # -- The SecurityContext for Loki pods
@@ -103,14 +107,19 @@ loki:
     {{- end }}
 
     {{- with .Values.loki.memcached.chunk_cache }}
-    {{- if and .enabled .host }}
+    {{- if and .enabled (or .host .addresses) }}
     chunk_store_config:
       chunk_cache_config:
         memcached:
           batch_size: {{ .batch_size }}
           parallelism: {{ .parallelism }}
         memcached_client:
+          {{- if .host }}
           host: {{ .host }}
+          {{- end }}
+          {{- if .addresses }}
+          addresses: {{ .addresses }}
+          {{- end }}
           service: {{ .service }}
     {{- end }}
     {{- end }}
@@ -135,13 +144,18 @@ loki:
     {{- with .Values.loki.memcached.results_cache }}
     query_range:
       align_queries_with_step: true
-      {{- if and .enabled .host }}
+      {{- if and .enabled (or .host .addresses) }}
       cache_results: {{ .enabled }}
       results_cache:
         cache:
           default_validity: {{ .default_validity }}
           memcached_client:
+            {{- if .host }}
             host: {{ .host }}
+            {{- end }}
+            {{- if .addresses }}
+            addresses: {{ .addresses }}
+            {{- end }}
             service: {{ .service }}
             timeout: {{ .timeout }}
       {{- end }}
@@ -217,6 +231,7 @@ loki:
       accountName: null
       accountKey: null
       useManagedIdentity: false
+      useFederatedToken: false
       userAssignedId: null
       requestTimeout: null
     filesystem:
@@ -323,11 +338,19 @@ enterprise:
     registry: docker.io
     # -- Docker image repository
     repository: grafana/enterprise-logs
+    # -- Docker image tag
+    # TODO: needed for 3rd target backend functionality
+    # revert to null or latest once this behavior is relased
+    tag: main-96f32b9f
     # -- Docker image pull policy
     pullPolicy: IfNotPresent
 
-  # -- Alternative name for admin token secret, needed by tokengen and provisioner jobs
-  adminTokenSecret: null
+  adminToken:
+    # -- Alternative name for admin token secret, needed by tokengen and provisioner jobs
+    secret: null
+    # -- Additional namespace to also create the token in. Useful if your Grafana instance
+    # is in a different namespace
+    additionalNamespaces: []
 
   # -- Alternative name of the secret to store token for the canary
   canarySecret: null
@@ -368,10 +391,14 @@ enterprise:
     # -- Whether the job should be part of the deployment
     enabled: true
     # -- Name of the secret to store provisioned tokens in
-    provisionedSecretPrefix: '{{ include "loki.name" . }}-provisioned'
-    # -- Tenants to be created. Each tenant will get a read and write policy
-    # and associated token.
-    tenants: []
+    provisionedSecretPrefix: null
+    # -- Additional tenants to be created. Each tenant will get a read and write policy
+    # and associated token. Tenant must have a name and a namespace for the secret containting
+    # the token to be created in. For example
+    # additionalTenants:
+    #   - name: loki
+    #     secretNamespace: grafana
+    additionalTenants: []
     # -- Additional Kubernetes environment
     env: []
     # -- Additional labels for the `provisioner` Job
@@ -399,131 +426,6 @@ enterprise:
     # -- Volume mounts to add to the provisioner pods
     extraVolumeMounts: []
 
-  nginxConfig:
-    file: |
-      worker_processes  5;  ## Default: 1
-      error_log  /dev/stderr;
-      pid        /tmp/nginx.pid;
-      worker_rlimit_nofile 8192;
-
-      events {
-        worker_connections  4096;  ## Default: 1024
-      }
-
-      http {
-        client_body_temp_path /tmp/client_temp;
-        proxy_temp_path       /tmp/proxy_temp_path;
-        fastcgi_temp_path     /tmp/fastcgi_temp;
-        uwsgi_temp_path       /tmp/uwsgi_temp;
-        scgi_temp_path        /tmp/scgi_temp;
-
-        proxy_http_version    1.1;
-
-        default_type application/octet-stream;
-        log_format   {{ .Values.gateway.nginxConfig.logFormat }}
-
-        {{- if .Values.gateway.verboseLogging }}
-        access_log   /dev/stderr  main;
-        {{- else }}
-
-        map $status $loggable {
-          ~^[23]  0;
-          default 1;
-        }
-        access_log   /dev/stderr  main  if=$loggable;
-        {{- end }}
-
-        sendfile     on;
-        tcp_nopush   on;
-        resolver {{ .Values.global.dnsService }}.{{ .Values.global.dnsNamespace }}.svc.{{ .Values.global.clusterDomain }}.;
-
-        {{- with .Values.gateway.nginxConfig.httpSnippet }}
-        {{ . | nindent 2 }}
-        {{- end }}
-
-        server {
-          listen             8080;
-
-          {{- if .Values.gateway.basicAuth.enabled }}
-          auth_basic           "Loki";
-          auth_basic_user_file /etc/nginx/secrets/.htpasswd;
-          {{- end }}
-
-          location = / {
-            return 200 'OK';
-            auth_basic off;
-          }
-
-          location = /api/prom/push {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location = /api/prom/tail {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-          }
-
-          location ~ /api/prom/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /prometheus/api/v1/alerts.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /prometheus/api/v1/rules.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location = /loki/api/v1/push {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location = /loki/api/v1/tail {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-          }
-
-          location ~ /loki/api/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /admin/api/.* {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /compactor/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /distributor/.* {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /ring {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /ingester/.* {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /ruler/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /scheduler/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          {{- with .Values.gateway.nginxConfig.serverSnippet }}
-          {{ . | nindent 4 }}
-          {{- end }}
-        }
-      }
-
 # -- Options that may be necessary when performing a migration from another helm chart
 migrate:
   # -- When migrating from a distributed chart like loki-distributed or enterprise-logs
@@ -597,8 +499,6 @@ monitoring:
     enabled: true
     # -- Include alerting rules
     alerting: true
-    # -- Alternative namespace to create recording rules PrometheusRule resource in
-    namespace: null
     # -- Additional annotations for the rules PrometheusRule resource
     annotations: {}
     # -- Additional labels for the rules PrometheusRule resource
@@ -618,8 +518,6 @@ monitoring:
   serviceMonitor:
     # -- If enabled, ServiceMonitor resources for Prometheus Operator are created
     enabled: true
-    # -- Alternative namespace for ServiceMonitor resources
-    namespace: null
     # -- Namespace selector for ServiceMonitor resources
     namespaceSelector: {}
     # -- ServiceMonitor annotations
@@ -657,7 +555,12 @@ monitoring:
     enabled: true
 
     # -- Tenant to use for self monitoring
-    tenant: "self-monitoring"
+    tenant:
+      # -- Name of the tenant
+      name: "self-monitoring"
+      # -- Namespace to create additional tenant token secret in. Useful if your Grafana instance
+      # is in a separate namespace. Token will still be created in the canary namespace.
+      secretNamespace: "{{ .Release.Namespace }}"
 
     # Grafana Agent configuration
     grafanaAgent:
@@ -665,8 +568,6 @@ monitoring:
       # Note that helm will not install CRDs if this flag is enabled during an upgrade.
       # In that case install the CRDs manually from https://github.com/grafana/agent/tree/main/production/operator/crds
       installOperator: true
-      # -- Alternative namespace for Grafana Agent resources
-      namespace: null
       # -- Grafana Agent annotations
       annotations: {}
       # -- Additional Grafana Agent labels
@@ -676,8 +577,6 @@ monitoring:
 
     # PodLogs configuration
     podLogs:
-      # -- Alternative namespace for PodLogs resources
-      namespace: null
       # -- PodLogs annotations
       annotations: {}
       # -- Additional PodLogs labels
@@ -688,8 +587,6 @@ monitoring:
 
     # LogsInstance configuration
     logsInstance:
-      # -- Alternative namespace for LogsInstance resources
-      namespace: null
       # -- LogsInstance annotations
       annotations: {}
       # -- Additional LogsInstance labels
@@ -726,7 +623,7 @@ monitoring:
       # -- Docker image pull policy
       pullPolicy: IfNotPresent
 
-# Configuration for the write
+# Configuration for the write pod(s)
 write:
   # -- Number of replicas for the write
   replicas: 3
@@ -741,6 +638,8 @@ write:
   priorityClassName: null
   # -- Annotations for write pods
   podAnnotations: {}
+  # -- Additional labels for each `write` pod
+  podLabels: {}
   # -- Additional selector labels for each `write` pod
   selectorLabels: {}
   # -- Labels for ingestor service
@@ -790,7 +689,7 @@ write:
     # -- Selector for persistent disk
     selector: null
 
-# Configuration for the read node(s)
+# Configuration for the read pod(s)
 read:
   # -- Number of replicas for the read
   replicas: 3
@@ -816,12 +715,18 @@ read:
   priorityClassName: null
   # -- Annotations for read pods
   podAnnotations: {}
-  # -- Additional selecto labels for each `read` pod
+  # -- Additional labels for each `read` pod
+  podLabels: {}
+  # -- Additional selector labels for each `read` pod
   selectorLabels: {}
   # -- Labels for read service
   serviceLabels: {}
   # -- Comma-separated list of Loki modules to load for the read
   targetModule: "read"
+  # -- Whether or not to use the 2 target type simple scalable mode (read, write) or the
+  # 3 target type (read, write, backend). Legacy refers to the 2 target type, so true will
+  # run two targets, false will run 3 targets.
+  legacyReadTarget: false
   # -- Additional CLI args for the read
   extraArgs: []
   # -- Environment variables to add to the read pods
@@ -852,6 +757,72 @@ read:
   # -- Tolerations for read pods
   tolerations: []
   persistence:
+    # -- Enable StatefulSetAutoDeletePVC feature
+    enableStatefulSetAutoDeletePVC: true
+    # -- Size of persistent disk
+    size: 10Gi
+    # -- Storage class to be used.
+    # If defined, storageClassName: <storageClass>.
+    # If set to "-", storageClassName: "", which disables dynamic provisioning.
+    # If empty or set to null, no storageClassName spec is
+    # set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack).
+    storageClass: null
+    # -- Selector for persistent disk
+    selector: null
+
+# Configuration for the backend pod(s)
+backend:
+  # -- Number of replicas for the backend
+  replicas: 3
+  image:
+    # -- The Docker registry for the backend image. Overrides `loki.image.registry`
+    registry: null
+    # -- Docker image repository for the backend image. Overrides `loki.image.repository`
+    repository: null
+    # -- Docker image tag for the backend image. Overrides `loki.image.tag`
+    tag: null
+  # -- The name of the PriorityClass for backend pods
+  priorityClassName: null
+  # -- Annotations for backend pods
+  podAnnotations: {}
+  # -- Additional selector labels for each `backend` pod
+  selectorLabels: {}
+  # -- Labels for ingestor service
+  serviceLabels: {}
+  # -- Comma-separated list of Loki modules to load for the read
+  targetModule: "backend"
+  # -- Additional CLI args for the backend
+  extraArgs: []
+  # -- Environment variables to add to the backend pods
+  extraEnv: []
+  # -- Environment variables from secrets or configmaps to add to the backend pods
+  extraEnvFrom: []
+  # -- Volume mounts to add to the backend pods
+  extraVolumeMounts: []
+  # -- Volumes to add to the backend pods
+  extraVolumes: []
+  # -- Resource requests and limits for the backend
+  resources: {}
+  # -- Grace period to allow the backend to shutdown before it is killed. Especially for the ingestor,
+  # this must be increased. It must be long enough so backends can be gracefully shutdown flushing/transferring
+  # all data and to successfully leave the member ring on shutdown.
+  terminationGracePeriodSeconds: 300
+  # -- Affinity for backend pods. Passed through `tpl` and, thus, to be configured as string
+  # @default -- Hard node and soft zone anti-affinity
+  affinity: |
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              {{- include "loki.backendSelectorLabels" . | nindent 10 }}
+          topologyKey: kubernetes.io/hostname
+  # -- Node selector for backend pods
+  nodeSelector: {}
+  # -- Tolerations for backend pods
+  tolerations: []
+  persistence:
+    # -- Enable StatefulSetAutoDeletePVC feature
+    enableStatefulSetAutoDeletePVC: true
     # -- Size of persistent disk
     size: 10Gi
     # -- Storage class to be used.
@@ -889,7 +860,9 @@ singleBinary:
   priorityClassName: null
   # -- Annotations for single binary pods
   podAnnotations: {}
-  # -- Additional selecto labels for each `single binary` pod
+  # -- Additional labels for each `single binary` pod
+  podLabels: {}
+  # -- Additional selector labels for each `single binary` pod
   selectorLabels: {}
   # -- Comma-separated list of Loki modules to load for the single binary
   targetModule: "all"
@@ -921,6 +894,8 @@ singleBinary:
   # -- Tolerations for single binary pods
   tolerations: []
   persistence:
+    # -- Enable persistent disk
+    enabled: true
     # -- Size of persistent disk
     size: 10Gi
     # -- Storage class to be used.
@@ -1010,6 +985,8 @@ gateway:
   priorityClassName: null
   # -- Annotations for gateway pods
   podAnnotations: {}
+  # -- Additional labels for gateway pods
+  podLabels: {}
   # -- Additional CLI args for the gateway
   extraArgs: []
   # -- Environment variables to add to the gateway pods
@@ -1125,101 +1102,7 @@ gateway:
     # -- Config file contents for Nginx. Passed through the `tpl` function to allow templating
     # @default -- See values.yaml
     file: |
-      worker_processes  5;  ## Default: 1
-      error_log  /dev/stderr;
-      pid        /tmp/nginx.pid;
-      worker_rlimit_nofile 8192;
-
-      events {
-        worker_connections  4096;  ## Default: 1024
-      }
-
-      http {
-        client_body_temp_path /tmp/client_temp;
-        proxy_temp_path       /tmp/proxy_temp_path;
-        fastcgi_temp_path     /tmp/fastcgi_temp;
-        uwsgi_temp_path       /tmp/uwsgi_temp;
-        scgi_temp_path        /tmp/scgi_temp;
-
-        proxy_http_version    1.1;
-
-        default_type application/octet-stream;
-        log_format   {{ .Values.gateway.nginxConfig.logFormat }}
-
-        {{- if .Values.gateway.verboseLogging }}
-        access_log   /dev/stderr  main;
-        {{- else }}
-
-        map $status $loggable {
-          ~^[23]  0;
-          default 1;
-        }
-        access_log   /dev/stderr  main  if=$loggable;
-        {{- end }}
-
-        sendfile     on;
-        tcp_nopush   on;
-        resolver {{ .Values.global.dnsService }}.{{ .Values.global.dnsNamespace }}.svc.{{ .Values.global.clusterDomain }}.;
-
-        {{- with .Values.gateway.nginxConfig.httpSnippet }}
-        {{ . | nindent 2 }}
-        {{- end }}
-
-        server {
-          listen             8080;
-
-          {{- if .Values.gateway.basicAuth.enabled }}
-          auth_basic           "Loki";
-          auth_basic_user_file /etc/nginx/secrets/.htpasswd;
-          {{- end }}
-
-          location = / {
-            return 200 'OK';
-            auth_basic off;
-          }
-
-          location = /api/prom/push {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location = /api/prom/tail {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-          }
-
-          location ~ /api/prom/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /prometheus/api/v1/alerts.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location ~ /prometheus/api/v1/rules.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location = /loki/api/v1/push {
-            proxy_pass       http://{{ include "loki.writeFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          location = /loki/api/v1/tail {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-          }
-
-          location ~ /loki/api/.* {
-            proxy_pass       http://{{ include "loki.readFullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}:3100$request_uri;
-          }
-
-          {{- with .Values.gateway.nginxConfig.serverSnippet }}
-          {{ . | nindent 4 }}
-          {{- end }}
-        }
-      }
-
+      {{- include "loki.nginxFile" . | indent 2 -}}
 networkPolicy:
   # -- Specifies whether Network Policies should be created
   enabled: false
@@ -1292,3 +1175,24 @@ minio:
     requests:
       cpu: 100m
       memory: 128Mi
+
+# Create extra manifests via values. Would be passed through `tpl` for templating
+extraObjects: []
+# - apiVersion: v1
+#   kind: ConfigMap
+#   metadata:
+#     name: loki-alerting-rules
+#   data:
+#     loki-alerting-rules.yaml: |-
+#       groups:
+#         - name: example
+#           rules:
+#           - alert: example
+#             expr: |
+#               sum(count_over_time({app="loki"} |~ "error")) > 0
+#             for: 3m
+#             labels:
+#               severity: warning
+#               category: logs
+#             annotations:
+#               message: "loki has encountered errors"
diff --git a/production/helm/public.pgp b/production/helm/public.pgp
deleted file mode 100644
index f3d730f09723..000000000000
--- a/production/helm/public.pgp
+++ /dev/null
@@ -1,31 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQENBF5/50EBCAC3Pab5BojOdLJT+6aJmfWF3HbVbI4l/TOIxMdvI8jneCA+wBX7
-Pp3x4LoSUWX968fX4Mfqyf/fqgHxQltzm5S+MCakROnVkmy5ecsbm61plcvGA1uU
-PiYtsWccXvq+cO22onNieSTV7z/330jAFwOGYRrT/utIVmEOefD64uQx6YXhglEU
-PmE2N6OVdajd8mlfKStaq/ef1NCwnax4EgWXBnVMrRfouZX//ouguYOyDaQ7IqcG
-kFvEaSVqF5hYyVR2Ot+C7hH4/JNy2q6cf6J2N2JS8PE9aMkc7W6VE7BDi0CTweQ4
-0ejK7Y8oRUrKNZH/fsJK5SpqW8kai0NBKDPDABEBAAG0KUdyYWZhbmEgTG9raSA8
-bG9raS10ZWFtQGdvb2dsZWdyb3Vwcy5jb20+iQFUBBMBCAA+FiEEZzewM0g2wzSd
-/y3UcFSpVZ08+wsFAl5/50ECGwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgEC
-F4AACgkQcFSpVZ08+wudGAf+OU26FHzudVMd4uMWHlQZGSCAGQWriGeFntYke1Ri
-str5cjJo78kLYcMKUXfHGrILBEpO7WYr/VEPMxnKNkW8qC9sV/W+Gz+OpEZ7Zuli
-3Y9vRI44kJ18Wo7vDryucy9WLR99GmHn0W7C/PMpuXa8P+X5jEQUs5WAm8Rkd3vC
-gS0niAf/k3AwWSPxJV+VEy/rAqSuA61tiPiTXOhaD3OpfsCgCigT4epqr/YBLuYF
-K728443pJZbxf1TrT8sBacPPg7KK9UkuafZapC/cQ4+0b8/o4CSbPiOPRbysKYmP
-9nwg36lFlR0VSI9y68H6KPHe0dTjfgZISUD7QU1okdTVQbkBDQRef+dBAQgA8+h8
-GneZ6QjLrDSVDndNkukP7q0d2abiSx4hzA65mr6lwfGwg20jHKPeYbuYt0n7wUg8
-e3cIkbN2b/CKojgAesLQMHo/TmH0blY3VWoI6WWyTioOWPII9qc4cKnKZGjA8fG1
-CBse3ZNUbHDtvJP/qBbQd4j6waEjIwODaTCwpWGboKDG0o7Zoemx+YwGN7678g1B
-E1f8ckwL1FoHZ8ID+bNsBBEUYO+Iup/gcdhZUVsJ1TdTmDfYdpDNMeQ7fyeRyl6O
-kUk+Za/ieJhc6Tv+EdPbXmWiTcQDCwiCb7lrQOqcv68q8zcRRjRaqF03dUz8onOl
-dhUUqWpIxGdh1+gXTQARAQABiQE8BBgBCAAmFiEEZzewM0g2wzSd/y3UcFSpVZ08
-+wsFAl5/50ECGwwFCQPCZwAACgkQcFSpVZ08+wssFwgAobGpA0FgW+uJ7N05q9lm
-WB4ohlUnPSCUaxvzeLxxDPdw0xlxr5rMDwqD9Zvg546fzVx0xxbHka+l/toIV1oI
-yQEPIQSPWNUxt5AYfgi/+uhX1qHhFzFU+ebvwWCxxwCM7WBmItswoAFkPfwFbbu9
-7L3HUaRWZbXneaYfPCrg+mv/20r8BGXD8TMTBmkKPwHqmfO1XhwWFEvRRNeYWUMe
-GzLqvocxJoZWulgemrdTj4QNIb9HY+UhZuMxkRk3Lvz34dURK4bg86V/KgR3h0Y5
-wWovQyy1DnH+QryT//MT8lMfbD19bjfsuEwRTCEvEWUptg0Y9EfYNe8cHQADTBHE
-Hg==
-=pugM
------END PGP PUBLIC KEY BLOCK-----
diff --git a/production/ksonnet/loki/common.libsonnet b/production/ksonnet/loki/common.libsonnet
index e77ea556eabd..cdcfa49b9e03 100644
--- a/production/ksonnet/loki/common.libsonnet
+++ b/production/ksonnet/loki/common.libsonnet
@@ -39,4 +39,39 @@ local k = import 'ksonnet-util/kausal.libsonnet';
       container.mixin.readinessProbe.withInitialDelaySeconds(15) +
       container.mixin.readinessProbe.withTimeoutSeconds(1),
   },
+
+  // functions for k8s objects
+  newLokiPdb(deploymentName, maxUnavailable=1)::
+    local podDisruptionBudget = $.policy.v1beta1.podDisruptionBudget;
+    local pdbName = '%s-pdb' % deploymentName;
+
+    podDisruptionBudget.new() +
+    podDisruptionBudget.mixin.metadata.withName(pdbName) +
+    podDisruptionBudget.mixin.metadata.withLabels({ name: pdbName }) +
+    podDisruptionBudget.mixin.spec.selector.withMatchLabels({ name: deploymentName }) +
+    podDisruptionBudget.mixin.spec.withMaxUnavailable(maxUnavailable),
+
+  newIngesterPdb(ingesterName)::
+    $.newLokiPdb(ingesterName),
+
+  newLokiStatefulSet(name, replicas, container, pvc, podManagementPolicy='Parallel')::
+    local statefulSet = $.apps.v1.statefulSet;
+
+    statefulSet.new(name, replicas, [container], pvc) +
+    statefulSet.mixin.spec.withServiceName(name) +
+    // statefulSet.mixin.metadata.withNamespace($._config.namespace) +
+    // statefulSet.mixin.metadata.withLabels({ name: name }) +
+    statefulSet.mixin.spec.template.metadata.withLabels({ name: name }) +
+    statefulSet.mixin.spec.selector.withMatchLabels({ name: name }) +
+    // statefulSet.mixin.spec.template.spec.securityContext.withRunAsUser(0) +
+    statefulSet.mixin.spec.template.spec.securityContext.withFsGroup(10001) +  // 10001 is the group ID assigned to Loki in the Dockerfile
+    statefulSet.mixin.spec.updateStrategy.withType('RollingUpdate') +
+    $.config_hash_mixin +
+    (if podManagementPolicy != null then statefulSet.mixin.spec.withPodManagementPolicy(podManagementPolicy) else {}) +
+    (if !std.isObject($._config.node_selector) then {} else statefulSet.mixin.spec.template.spec.withNodeSelectorMixin($._config.node_selector)) +
+    k.util.configVolumeMount('loki', '/etc/loki/config') +
+    k.util.configVolumeMount(
+      $._config.overrides_configmap_mount_name,
+      $._config.overrides_configmap_mount_path,
+    ),
 }
diff --git a/production/ksonnet/loki/config.libsonnet b/production/ksonnet/loki/config.libsonnet
index 64e86cf01752..c0cf1f15b6dc 100644
--- a/production/ksonnet/loki/config.libsonnet
+++ b/production/ksonnet/loki/config.libsonnet
@@ -3,6 +3,7 @@
     namespace: error 'must define namespace',
     cluster: error 'must define cluster',
     http_listen_port: 3100,
+    node_selector: null,
 
     create_service_monitor: false,
 
@@ -82,6 +83,10 @@
       topology_spread_max_skew: 1,
     },
 
+    ingester_allow_multiple_replicas_on_same_node: false,
+    ingester_data_disk_size: '10Gi',
+    ingester_data_disk_class: 'fast',
+
     // Bigtable variables
     bigtable_instance: error 'must specify bigtable instance',
     bigtable_project: error 'must specify bigtable project',
diff --git a/production/ksonnet/loki/images.libsonnet b/production/ksonnet/loki/images.libsonnet
index 0f0576d2dad2..b867161e6d8a 100644
--- a/production/ksonnet/loki/images.libsonnet
+++ b/production/ksonnet/loki/images.libsonnet
@@ -6,15 +6,15 @@
 
     loki: 'grafana/loki:2.7.1',
 
-    distributor: self.loki,
-    ingester: self.loki,
-    querier: self.loki,
-    tableManager: self.loki,
-    query_frontend: self.loki,
-    query_scheduler: self.loki,
-    ruler: self.loki,
-    compactor: self.loki,
-    index_gateway: self.loki,
-    overrides_exporter: self.loki,
+    distributor:: self.loki,
+    ingester:: self.loki,
+    querier:: self.loki,
+    tableManager:: self.loki,
+    query_frontend:: self.loki,
+    query_scheduler:: self.loki,
+    ruler:: self.loki,
+    compactor:: self.loki,
+    index_gateway:: self.loki,
+    overrides_exporter:: self.loki,
   },
 }
diff --git a/production/ksonnet/loki/ingester.libsonnet b/production/ksonnet/loki/ingester.libsonnet
index 16ca1d7e4763..0ad62a5357ad 100644
--- a/production/ksonnet/loki/ingester.libsonnet
+++ b/production/ksonnet/loki/ingester.libsonnet
@@ -5,6 +5,28 @@ local k = import 'ksonnet-util/kausal.libsonnet';
   local volumeMount = k.core.v1.volumeMount,
   local statefulSet = k.apps.v1.statefulSet,
 
+  // The ingesters should persist TSDB blocks and WAL on a persistent
+  // volume in order to be crash resilient.
+  local ingester_data_pvc =
+    pvc.new() +
+    pvc.mixin.spec.resources.withRequests({ storage: $._config.ingester_data_disk_size }) +
+    pvc.mixin.spec.withAccessModes(['ReadWriteOnce']) +
+    pvc.mixin.spec.withStorageClassName($._config.ingester_data_disk_class) +
+    pvc.mixin.metadata.withName('ingester-data'),
+
+  newIngesterStatefulSet(name, container, with_anti_affinity=true)::
+    // local ingesterContainer = container + $.core.v1.container.withVolumeMountsMixin([
+    //   volumeMount.new('ingester-data', '/data'),
+    // ]);
+
+    $.newLokiStatefulSet(name, 3, container, ingester_data_pvc) +
+    // When the ingester needs to flush blocks to the storage, it may take quite a lot of time.
+    // For this reason, we grant an high termination period (80 minutes).
+    statefulSet.mixin.spec.template.spec.withTerminationGracePeriodSeconds(4800) +
+    // $.lokiVolumeMounts +
+    $.util.podPriority('high') +
+    (if with_anti_affinity then $.util.antiAffinity else {}),
+
   ingester_args::
     $._config.commonArgs {
       target: 'ingester',
@@ -59,21 +81,7 @@ local k = import 'ksonnet-util/kausal.libsonnet';
     pvc.mixin.spec.withStorageClassName($._config.ingester_pvc_class)
   else {},
 
-  ingester_statefulset: if $._config.stateful_ingesters then
-    statefulSet.new('ingester', 3, [$.ingester_container], $.ingester_data_pvc) +
-    statefulSet.mixin.spec.withServiceName('ingester') +
-    statefulSet.mixin.spec.withPodManagementPolicy('Parallel') +
-    $.config_hash_mixin +
-    k.util.configVolumeMount('loki', '/etc/loki/config') +
-    k.util.configVolumeMount(
-      $._config.overrides_configmap_mount_name,
-      $._config.overrides_configmap_mount_path,
-    ) +
-    k.util.antiAffinity +
-    statefulSet.mixin.spec.updateStrategy.withType('RollingUpdate') +
-    statefulSet.mixin.spec.template.spec.securityContext.withFsGroup(10001) +  // 10001 is the group ID assigned to Loki in the Dockerfile
-    statefulSet.mixin.spec.template.spec.withTerminationGracePeriodSeconds(4800)
-  else {},
+  ingester_statefulset: self.newIngesterStatefulSet('ingester', $.ingester_container, !$._config.ingester_allow_multiple_replicas_on_same_node),
 
   ingester_service:
     if !$._config.stateful_ingesters then
diff --git a/production/loki-mixin-compiled-ssd/alerts.yaml b/production/loki-mixin-compiled-ssd/alerts.yaml
index d3f56cb192d4..b1e979ed16bc 100644
--- a/production/loki-mixin-compiled-ssd/alerts.yaml
+++ b/production/loki-mixin-compiled-ssd/alerts.yaml
@@ -6,9 +6,9 @@ groups:
       message: |
         {{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}% errors.
     expr: |
-      100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[1m])) by (namespace, job, route)
+      100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[2m])) by (namespace, job, route)
         /
-      sum(rate(loki_request_duration_seconds_count[1m])) by (namespace, job, route)
+      sum(rate(loki_request_duration_seconds_count[2m])) by (namespace, job, route)
         > 10
     for: 15m
     labels:
@@ -26,16 +26,16 @@ groups:
       message: |
         {{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}s 99th percentile latency.
     expr: |
-      namespace_job_route:loki_request_duration_seconds:99quantile{route!~"(?i).*tail.*"} > 1
+      namespace_job_route:loki_request_duration_seconds:99quantile{route!~"(?i).*tail.*|/schedulerpb.SchedulerForQuerier/QuerierLoop"} > 1
     for: 15m
     labels:
       severity: critical
   - alert: LokiTooManyCompactorsRunning
     annotations:
       message: |
-        {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
+        {{ $labels.cluster }} {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
     expr: |
-      sum(loki_boltdb_shipper_compactor_running) by (namespace) > 1
+      sum(loki_boltdb_shipper_compactor_running) by (namespace, cluster) > 1
     for: 5m
     labels:
       severity: warning
diff --git a/production/loki-mixin-compiled/alerts.yaml b/production/loki-mixin-compiled/alerts.yaml
index d3f56cb192d4..b1e979ed16bc 100644
--- a/production/loki-mixin-compiled/alerts.yaml
+++ b/production/loki-mixin-compiled/alerts.yaml
@@ -6,9 +6,9 @@ groups:
       message: |
         {{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}% errors.
     expr: |
-      100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[1m])) by (namespace, job, route)
+      100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[2m])) by (namespace, job, route)
         /
-      sum(rate(loki_request_duration_seconds_count[1m])) by (namespace, job, route)
+      sum(rate(loki_request_duration_seconds_count[2m])) by (namespace, job, route)
         > 10
     for: 15m
     labels:
@@ -26,16 +26,16 @@ groups:
       message: |
         {{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}s 99th percentile latency.
     expr: |
-      namespace_job_route:loki_request_duration_seconds:99quantile{route!~"(?i).*tail.*"} > 1
+      namespace_job_route:loki_request_duration_seconds:99quantile{route!~"(?i).*tail.*|/schedulerpb.SchedulerForQuerier/QuerierLoop"} > 1
     for: 15m
     labels:
       severity: critical
   - alert: LokiTooManyCompactorsRunning
     annotations:
       message: |
-        {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
+        {{ $labels.cluster }} {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
     expr: |
-      sum(loki_boltdb_shipper_compactor_running) by (namespace) > 1
+      sum(loki_boltdb_shipper_compactor_running) by (namespace, cluster) > 1
     for: 5m
     labels:
       severity: warning
diff --git a/production/loki-mixin/alerts.libsonnet b/production/loki-mixin/alerts.libsonnet
index 43d8d86bd330..bb0234fd7dc7 100644
--- a/production/loki-mixin/alerts.libsonnet
+++ b/production/loki-mixin/alerts.libsonnet
@@ -7,9 +7,9 @@
           {
             alert: 'LokiRequestErrors',
             expr: |||
-              100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[1m])) by (namespace, job, route)
+              100 * sum(rate(loki_request_duration_seconds_count{status_code=~"5.."}[2m])) by (namespace, job, route)
                 /
-              sum(rate(loki_request_duration_seconds_count[1m])) by (namespace, job, route)
+              sum(rate(loki_request_duration_seconds_count[2m])) by (namespace, job, route)
                 > 10
             |||,
             'for': '15m',
@@ -39,7 +39,7 @@
           {
             alert: 'LokiRequestLatency',
             expr: |||
-              namespace_job_route:loki_request_duration_seconds:99quantile{route!~"(?i).*tail.*"} > 1
+              namespace_job_route:loki_request_duration_seconds:99quantile{route!~"(?i).*tail.*|/schedulerpb.SchedulerForQuerier/QuerierLoop"} > 1
             |||,
             'for': '15m',
             labels: {
@@ -54,7 +54,7 @@
           {
             alert: 'LokiTooManyCompactorsRunning',
             expr: |||
-              sum(loki_boltdb_shipper_compactor_running) by (namespace) > 1
+              sum(loki_boltdb_shipper_compactor_running) by (namespace, cluster) > 1
             |||,
             'for': '5m',
             labels: {
@@ -62,7 +62,7 @@
             },
             annotations: {
               message: |||
-                {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
+                {{ $labels.cluster }} {{ $labels.namespace }} has had {{ printf "%.0f" $value }} compactors running for more than 5m. Only one compactor should run at a time.
               |||,
             },
           },
diff --git a/tools/dev/k3d/Makefile b/tools/dev/k3d/Makefile
index 45142a0c7376..e36e1332ba85 100644
--- a/tools/dev/k3d/Makefile
+++ b/tools/dev/k3d/Makefile
@@ -1,4 +1,4 @@
-.PHONY: loki-distributed down add-repos update-repos prepare build-latest-image
+.PHONY: loki-distributed down add-repos update-repos prepare prepare-gel build-latest-image
 
 IMAGE_TAG := $(shell ../../../tools/image-tag)
 EXISTING_REGISTRY_PORT := $(shell k3d registry list -o json | jq -r '.[] | select(.name == "k3d-grafana") | .portMappings."5000/tcp" | .[0].HostPort')
@@ -10,7 +10,7 @@ loki-distributed: prepare build-latest-image
 	sleep 5
 	tk apply --ext-str registry="k3d-grafana:$(REGISTRY_PORT)" environments/loki-distributed
 
-enterprise-logs: prepare
+enterprise-logs: prepare-gel
 	$(CURDIR)/scripts/create_cluster.sh enterprise-logs $(REGISTRY_PORT)
 	# wait 5s for the cluster to be ready
 	sleep 5
@@ -23,7 +23,7 @@ helm-cluster: prepare
 	# wait 5s for the cluster to be ready
 	sleep 5
 	$(MAKE) -C $(CURDIR) apply-helm-cluster
-	
+
 apply-enterprise-logs:
 	tk apply --ext-str registry="k3d-grafana:$(REGISTRY_PORT)" environments/enterprise-logs
 
@@ -66,13 +66,14 @@ secrets: secrets/grafana.jwt secrets/gel.jwt
 
 secrets/grafana.jwt:
 	mkdir -p secrets/
-	op document get "loki/grafana.jwt" > $(CURDIR)/secrets/grafana.jwt
+	op document get "loki/grafana.jwt" --output=$(CURDIR)/secrets/grafana.jwt
 
 secrets/gel.jwt:
 	mkdir -p secrets/
-	op document get "loki/gel.jwt" > $(CURDIR)/secrets/gel.jwt
+	op document get "loki/gel.jwt" --output=$(CURDIR)/secrets/gel.jwt
 
-prepare: create-registry update-repos secrets
+prepare: create-registry update-repos
+prepare-gel: prepare secrets
 
 build-latest-image:
 	make -C $(CURDIR)/../../.. loki-image
@@ -81,4 +82,10 @@ build-latest-image:
 
 HELM_DIR := $(shell cd $(CURDIR)/../../../production/helm/loki && pwd)
 helm-install-enterprise-logs:
-	helm install loki "$(HELM_DIR)" -n loki --values "$(CURDIR)/environments/helm-cluster/values/enterprise-logs.yaml"
+	helm install enterprise-logs-test-fixture "$(HELM_DIR)" -n loki --create-namespace --values "$(CURDIR)/environments/helm-cluster/values/enterprise-logs.yaml"
+
+helm-upgrade-enterprise-logs:
+	helm upgrade enterprise-logs-test-fixture "$(HELM_DIR)" -n loki --values "$(CURDIR)/environments/helm-cluster/values/enterprise-logs.yaml"
+
+helm-uninstall-enterprise-logs:
+	helm uninstall enterprise-logs-test-fixture -n loki
diff --git a/tools/dev/k3d/environments/helm-cluster/main.jsonnet b/tools/dev/k3d/environments/helm-cluster/main.jsonnet
index 0f03889a3d28..7db5e3051155 100644
--- a/tools/dev/k3d/environments/helm-cluster/main.jsonnet
+++ b/tools/dev/k3d/environments/helm-cluster/main.jsonnet
@@ -74,16 +74,11 @@ local spec = (import './spec.json').spec;
            + grafana.withEnterpriseLicenseText(importstr '../../secrets/grafana.jwt')
            + grafana.addDatasource('prometheus', $.prometheus_datasource)
            + grafana.addDatasource('loki', $.loki_datasource)
+           + grafana.addPlugin('https://dl.grafana.com/gel/releases/grafana-enterprise-logs-app-v2.6.0.zip;grafana-enterprise-logs-app')
            + {
              local container = k.core.v1.container,
              grafana_deployment+:
-               k.apps.v1.deployment.hostVolumeMount(
-                 name='enterprise-logs-app',
-                 hostPath='/var/lib/grafana/plugins/grafana-enterprise-logs-app/dist',
-                 path='/grafana-enterprise-logs-app',
-                 volumeMixin=k.core.v1.volume.hostPath.withType('Directory')
-               )
-               + k.apps.v1.deployment.emptyVolumeMount('grafana-var', '/var/lib/grafana')
+               k.apps.v1.deployment.emptyVolumeMount('grafana-var', '/var/lib/grafana')
                + k.apps.v1.deployment.emptyVolumeMount('grafana-plugins', '/etc/grafana/provisioning/plugins')
                + k.apps.v1.deployment.spec.template.spec.withInitContainersMixin([
                  container.new('startup', 'alpine:latest') +
@@ -91,10 +86,6 @@ local spec = (import './spec.json').spec;
                    '/bin/sh',
                    '-euc',
                    |||
-                     mkdir -p /var/lib/grafana/plugins
-                     cp -r /grafana-enterprise-logs-app /var/lib/grafana/plugins/grafana-enterprise-logs-app
-                     chown -R 472:472 /var/lib/grafana/plugins
-
                      cat > /etc/grafana/provisioning/plugins/enterprise-logs.yaml <<EOF
                      apiVersion: 1
                      apps:
@@ -108,7 +99,6 @@ local spec = (import './spec.json').spec;
                    ||| % lokiGatewayUrl,
                  ]) +
                  container.withVolumeMounts([
-                   k.core.v1.volumeMount.new('enterprise-logs-app', '/grafana-enterprise-logs-app', false),
                    k.core.v1.volumeMount.new('grafana-var', '/var/lib/grafana', false),
                    k.core.v1.volumeMount.new('grafana-plugins', '/etc/grafana/provisioning/plugins', false),
                  ]) +
@@ -121,8 +111,7 @@ local spec = (import './spec.json').spec;
                ]) + k.apps.v1.deployment.mapContainers(
                  function(c) c {
                    env+: [
-                     envVar.new('GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS', 'grafana-enterprise-logs-app'),
-                     envVar.fromSecretRef('PROVISIONED_TENANT_TOKEN', '%s-%s' % [provisionedSecretPrefix, tenant], 'token-read'),
+                     envVar.fromSecretRef('PROVISIONED_TENANT_TOKEN', '%s-%s' % [provisionedSecretPrefix, tenant], 'password'),
                    ],
                  }
                ),
diff --git a/tools/dev/k3d/environments/helm-cluster/spec.json b/tools/dev/k3d/environments/helm-cluster/spec.json
index c55f1489316b..ce92a78dca53 100644
--- a/tools/dev/k3d/environments/helm-cluster/spec.json
+++ b/tools/dev/k3d/environments/helm-cluster/spec.json
@@ -6,7 +6,7 @@
     "namespace": "environments/helm-cluster/main.jsonnet"
   },
   "spec": {
-    "apiServer": "https://0.0.0.0:43237",
+    "apiServer": "https://0.0.0.0:39135",
     "namespace": "k3d-helm-cluster",
     "resourceDefaults": {},
     "expectVersions": {}
diff --git a/tools/dev/k3d/environments/helm-cluster/values/enterprise-logs.yaml b/tools/dev/k3d/environments/helm-cluster/values/enterprise-logs.yaml
index bebb4b24901c..2bf364e04f89 100644
--- a/tools/dev/k3d/environments/helm-cluster/values/enterprise-logs.yaml
+++ b/tools/dev/k3d/environments/helm-cluster/values/enterprise-logs.yaml
@@ -1,14 +1,24 @@
 ---
 enterprise:
   enabled: true
-  adminTokenSecret: "gel-admin-token"
+  adminToken:
+    secret: "gel-admin-token"
+    additionalNamespaces:
+      - k3d-helm-cluster
+  useExternalLicense: true
+  externalLicenseName: gel-license
   provisioner:
     provisionedSecretPrefix: "provisioned-secret"
-    tenants:
-      - loki
+    additionalTenants:
+      - name: team-a
+        namespace: k3d-helm-cluster
 monitoring:
-  selfMonitoring+:
-    tenant: "loki"
+  selfMonitoring:
+    tenant:
+      name: loki
+      secretNamespace: k3d-helm-cluster
   serviceMonitor:
     labels:
       release: "prometheus"
+minio:
+  enabled: true
diff --git a/tools/dev/k3d/jsonnetfile.lock.json b/tools/dev/k3d/jsonnetfile.lock.json
index ec9dd9276252..dbe1f5a3e648 100644
--- a/tools/dev/k3d/jsonnetfile.lock.json
+++ b/tools/dev/k3d/jsonnetfile.lock.json
@@ -8,7 +8,7 @@
           "subdir": "consul"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "Po3c1Ic96ngrJCtOazic/7OsLkoILOKZWXWyZWl+od8="
     },
     {
@@ -18,7 +18,7 @@
           "subdir": "enterprise-metrics"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "hi2ZpHKl7qWXmSZ46sAycjWEQK6oGsoECuDKQT1dA+k="
     },
     {
@@ -28,7 +28,7 @@
           "subdir": "etcd-operator"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "duHm6wmUju5KHQurOe6dnXoKgl5gTUsfGplgbmAOsHw="
     },
     {
@@ -38,7 +38,7 @@
           "subdir": "grafana"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "Y5nheroSOIwmE+djEVPq4OvvTxKenzdHhpEwaR3Ebjs="
     },
     {
@@ -48,7 +48,7 @@
           "subdir": "jaeger-agent-mixin"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "nsukyr2SS8h97I2mxvBazXZp2fxu1i6eg+rKq3/NRwY="
     },
     {
@@ -58,7 +58,7 @@
           "subdir": "ksonnet-util"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "/pkNOLhRqvQoPA0yYdUuJvpPHqhkCLauAUMD2ZHMIkE="
     },
     {
@@ -78,7 +78,7 @@
           "subdir": "memcached"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "SWywAq4U0MRPMbASU0Ez8O9ArRNeoZzb75sEuReueow="
     },
     {
@@ -88,7 +88,7 @@
           "subdir": "tanka-util"
         }
       },
-      "version": "d68f9a6e0b1af7c4c4056dc2b43fb8f3bac01f43",
+      "version": "02bd2cbc7c71bbffeb807b58d1b45b58230b3224",
       "sum": "ShSIissXdvCy1izTCDZX6tY7qxCoepE5L+WJ52Hw7ZQ="
     },
     {
@@ -118,8 +118,8 @@
           "subdir": "1.20"
         }
       },
-      "version": "21f1224e3d351cf85951221d91d015eef790ed48",
-      "sum": "Sj/Xxz4AvIDs3HI3uQ3TYOiAO2zcYs1veMBRFpPsc0Q="
+      "version": "4613c97af18622848e4ffac3c4a78a9349f1d716",
+      "sum": "KZac8iaWuW0tiN54OE9uE+Squ6SVnOHz6Wk2QgmPe3o="
     }
   ],
   "legacyImports": false
diff --git a/tools/doc-generator/parse/parser.go b/tools/doc-generator/parse/parser.go
index 0ddf1cdd5a96..09d1fa42e728 100644
--- a/tools/doc-generator/parse/parser.go
+++ b/tools/doc-generator/parse/parser.go
@@ -283,7 +283,7 @@ func config(block *ConfigBlock, cfg interface{}, flags map[uintptr]*flag.Flag, r
 			}
 		}
 
-		fieldType, err := getFieldType(field.Type)
+		fieldType, err := getFieldType(field.Type, rootBlocks)
 		if err != nil {
 			return nil, errors.Wrapf(err, "config=%s.%s", t.PkgPath(), t.Name())
 		}
@@ -375,11 +375,15 @@ func getFieldCustomType(t reflect.Type) (string, bool) {
 	}
 }
 
-func getFieldType(t reflect.Type) (string, error) {
+func getFieldType(t reflect.Type, rootBlocks []RootBlock) (string, error) {
 	if typ, isCustom := getFieldCustomType(t); isCustom {
 		return typ, nil
 	}
 
+	if rootName, _, isRoot := isRootBlock(t, rootBlocks); isRoot {
+		return rootName, nil
+	}
+
 	// Fallback to auto-detection of built-in data types
 	switch t.Kind() {
 	case reflect.Bool:
@@ -412,17 +416,21 @@ func getFieldType(t reflect.Type) (string, error) {
 		return fieldString, nil
 	case reflect.Slice:
 		// Get the type of elements
-		elemType, err := getFieldType(t.Elem())
+		elemType, err := getFieldType(t.Elem(), rootBlocks)
 		if err != nil {
 			return "", err
 		}
 		return "list of " + elemType + "s", nil
 	case reflect.Map:
-		return fmt.Sprintf("map of %s to %s", t.Key(), t.Elem().String()), nil
+		elemType, err := getFieldType(t.Elem(), rootBlocks)
+		if err != nil {
+			return "", err
+		}
+		return fmt.Sprintf("map of %s to %s", t.Key(), elemType), nil
 	case reflect.Struct:
 		return t.Name(), nil
 	case reflect.Ptr:
-		return getFieldType(t.Elem())
+		return getFieldType(t.Elem(), rootBlocks)
 	case reflect.Interface:
 		return t.Name(), nil
 	default:
diff --git a/tools/doc-generator/parse/root_blocks.go b/tools/doc-generator/parse/root_blocks.go
index 4da57ebc836c..7d656b4b23bb 100644
--- a/tools/doc-generator/parse/root_blocks.go
+++ b/tools/doc-generator/parse/root_blocks.go
@@ -21,7 +21,6 @@ import (
 	"github.com/grafana/loki/pkg/querier/queryrange"
 	querier_worker "github.com/grafana/loki/pkg/querier/worker"
 	"github.com/grafana/loki/pkg/ruler"
-	"github.com/grafana/loki/pkg/ruler/rulestore/local"
 	"github.com/grafana/loki/pkg/scheduler"
 	"github.com/grafana/loki/pkg/storage"
 	"github.com/grafana/loki/pkg/storage/chunk/cache"
@@ -29,6 +28,7 @@ import (
 	"github.com/grafana/loki/pkg/storage/chunk/client/azure"
 	"github.com/grafana/loki/pkg/storage/chunk/client/baidubce"
 	"github.com/grafana/loki/pkg/storage/chunk/client/gcp"
+	"github.com/grafana/loki/pkg/storage/chunk/client/local"
 	"github.com/grafana/loki/pkg/storage/chunk/client/openstack"
 	storage_config "github.com/grafana/loki/pkg/storage/config"
 	"github.com/grafana/loki/pkg/storage/stores/indexshipper/compactor"
@@ -190,6 +190,11 @@ var (
 		},
 
 		// Storage config
+		{
+			Name:       "aws_storage_config",
+			StructType: reflect.TypeOf(aws.StorageConfig{}),
+			Desc:       "The aws_storage_config block configures the connection to dynamoDB and S3 object storage. Either one of them or both can be configured.",
+		},
 		{
 			Name:       "azure_storage_config",
 			StructType: reflect.TypeOf(azure.BlobStorageConfig{}),
@@ -217,8 +222,21 @@ var (
 		},
 		{
 			Name:       "local_storage_config",
-			StructType: reflect.TypeOf(local.Config{}),
+			StructType: reflect.TypeOf(local.FSConfig{}),
 			Desc:       "The local_storage_config block configures the usage of local file system as object storage backend.",
 		},
+		{
+			Name:       "named_stores_config",
+			StructType: reflect.TypeOf(storage.NamedStores{}),
+			Desc: `Configures additional object stores for a given storage provider.
+Supported stores: aws, azure, bos, filesystem, gcs, swift.
+Example:
+storage_config:
+  named_stores:
+    aws:
+      store-1:
+        endpoint: s3://foo-bucket
+        region: us-west1
+Named store from this example can be used by setting object_store to store-1 in period_config.`},
 	}
 )
diff --git a/tools/lambda-promtail/README.md b/tools/lambda-promtail/README.md
index d912fc4f112d..3c6c94343742 100644
--- a/tools/lambda-promtail/README.md
+++ b/tools/lambda-promtail/README.md
@@ -48,22 +48,23 @@ The `lambda-promtail` code picks this value up via an environment variable.
 Also, if your deployment requires a [VPC configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#vpc_config), make sure to edit the `vpc_config` field in `main.tf` manually. Additonal documentation for the Lambda specific Terraform configuration is [here](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#vpc_config). If you want to link kinesis data stream to Lambda as event source, see [here](https://docs.aws.amazon.com/ko_kr/lambda/latest/dg/with-kinesis.html).
 
 `lambda-promtail` supports authentication either using HTTP Basic Auth or using Bearer Token.  
+For development purposes you can set the environment variable SKIP_TLS_VERIFY to `true`, so you can use self signed certificates, but this is not recommended in production. Default is `false`.
 
 Then use Terraform to deploy:
 
 ```bash
 ## use cloudwatch log group
-terraform apply -var "<ecr-repo>:<tag>" -var "write_address=https://your-loki-url/loki/api/v1/push" -var "password=<basic-auth-pw>" -var "username=<basic-auth-username>" -var 'bearer_token=<bearer-token>' -var 'log_group_names=["log-group-01", "log-group-02"]' -var 'extra_labels="name1,value1,name2,value2"' -var "tenant_id=<value>"
+terraform apply -var "<ecr-repo>:<tag>" -var "write_address=https://your-loki-url/loki/api/v1/push" -var "password=<basic-auth-pw>" -var "username=<basic-auth-username>" -var 'bearer_token=<bearer-token>' -var 'log_group_names=["log-group-01", "log-group-02"]' -var 'extra_labels="name1,value1,name2,value2"' -var "tenant_id=<value>" -var 'skip_tls_verify="false"'
 ```
 
 ```bash
 ## use kinesis data stream
-terraform apply -var "<ecr-repo>:<tag>" -var "write_address=https://your-loki-url/loki/api/v1/push" -var "password=<basic-auth-pw>" -var "username=<basic-auth-username>" -var 'kinesis_stream_name=["kinesis-stream-01", "kinesis-stream-02"]' -var 'extra_labels="name1,value1,name2,value2"' -var "tenant_id=<value>"
+terraform apply -var "<ecr-repo>:<tag>" -var "write_address=https://your-loki-url/loki/api/v1/push" -var "password=<basic-auth-pw>" -var "username=<basic-auth-username>" -var 'kinesis_stream_name=["kinesis-stream-01", "kinesis-stream-02"]' -var 'extra_labels="name1,value1,name2,value2"' -var "tenant_id=<value>" -var 'skip_tls_verify="false"'
 
 or CloudFormation:
 
 ```bash
-aws cloudformation create-stack --stack-name lambda-promtail-stack --template-body file://template.yaml --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM --region us-east-2 --parameters ParameterKey=WriteAddress,ParameterValue=https://your-loki-url/loki/api/v1/push ParameterKey=Username,ParameterValue=<basic-auth-username> ParameterKey=Password,ParameterValue=<basic-auth-pw> ParameterKey=BearerToken,ParameterValue=<bearer-token> ParameterKey=LambdaPromtailImage,ParameterValue=<ecr-repo>:<tag> ParameterKey=ExtraLabels,ParameterValue="name1,value1,name2,value2" ParameterKey=TenantID,ParameterValue=<value>
+aws cloudformation create-stack --stack-name lambda-promtail-stack --template-body file://template.yaml --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM --region us-east-2 --parameters ParameterKey=WriteAddress,ParameterValue=https://your-loki-url/loki/api/v1/push ParameterKey=Username,ParameterValue=<basic-auth-username> ParameterKey=Password,ParameterValue=<basic-auth-pw> ParameterKey=BearerToken,ParameterValue=<bearer-token> ParameterKey=LambdaPromtailImage,ParameterValue=<ecr-repo>:<tag> ParameterKey=ExtraLabels,ParameterValue="name1,value1,name2,value2" ParameterKey=TenantID,ParameterValue=<value> ParameterKey=SkipTlsVerify,ParameterValue="false"
 ```
 
 # Appendix
diff --git a/tools/lambda-promtail/lambda-promtail/kinesis.go b/tools/lambda-promtail/lambda-promtail/kinesis.go
index 800dd7903eef..e7ba69e5caab 100644
--- a/tools/lambda-promtail/lambda-promtail/kinesis.go
+++ b/tools/lambda-promtail/lambda-promtail/kinesis.go
@@ -15,7 +15,7 @@ func parseKinesisEvent(ctx context.Context, b batchIf, ev *events.KinesisEvent)
 	}
 
 	for _, record := range ev.Records {
-		timestamp := time.UnixMilli(record.Kinesis.ApproximateArrivalTimestamp.Unix())
+		timestamp := time.Unix(record.Kinesis.ApproximateArrivalTimestamp.Unix(),0)
 
 		labels := model.LabelSet{
 			model.LabelName("__aws_log_type"):                 model.LabelValue("kinesis"),
diff --git a/tools/lambda-promtail/lambda-promtail/main.go b/tools/lambda-promtail/lambda-promtail/main.go
index 58821d9be0f7..64c53879485a 100644
--- a/tools/lambda-promtail/lambda-promtail/main.go
+++ b/tools/lambda-promtail/lambda-promtail/main.go
@@ -33,6 +33,8 @@ var (
 	batchSize                                                 int
 	s3Clients                                                 map[string]*s3.Client
 	extraLabels                                               model.LabelSet
+	skipTlsVerify                                             bool
+	printLogLine                                              bool
 )
 
 func setupArguments() {
@@ -68,6 +70,12 @@ func setupArguments() {
 		panic("both username and bearerToken are not allowed")
 	}
 
+	skipTls := os.Getenv("SKIP_TLS_VERIFY")
+	// Anything other than case-insensitive 'true' is treated as 'false'.
+	if strings.EqualFold(skipTls, "true") {
+		skipTlsVerify = true
+	}
+
 	tenantID = os.Getenv("TENANT_ID")
 
 	keep := os.Getenv("KEEP_STREAM")
@@ -83,6 +91,12 @@ func setupArguments() {
 		batchSize, _ = strconv.Atoi(batch)
 	}
 
+	print := os.Getenv("PRINT_LOG_LINE")
+	printLogLine = true
+	if strings.EqualFold(print, "false") {
+		printLogLine = false
+	}
+
 	s3Clients = make(map[string]*s3.Client)
 }
 
diff --git a/tools/lambda-promtail/lambda-promtail/promtail.go b/tools/lambda-promtail/lambda-promtail/promtail.go
index afa13de4c4c1..56efaa434a65 100644
--- a/tools/lambda-promtail/lambda-promtail/promtail.go
+++ b/tools/lambda-promtail/lambda-promtail/promtail.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto/tls"
 	"fmt"
 	"io"
 	"net/http"
@@ -189,7 +190,13 @@ func send(ctx context.Context, buf []byte) (int, error) {
 		req.Header.Set("Authorization", "Bearer "+bearerToken)
 	}
 
-	resp, err := http.DefaultClient.Do(req.WithContext(ctx))
+	promtailClient := &http.Client{}
+
+	if skipTlsVerify == true {
+		promtailClient = &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}}
+	}
+
+	resp, err := promtailClient.Do(req.WithContext(ctx))
 	if err != nil {
 		return -1, err
 	}
diff --git a/tools/lambda-promtail/lambda-promtail/s3.go b/tools/lambda-promtail/lambda-promtail/s3.go
index eb10c2e54693..c3acc3c543c2 100644
--- a/tools/lambda-promtail/lambda-promtail/s3.go
+++ b/tools/lambda-promtail/lambda-promtail/s3.go
@@ -19,16 +19,25 @@ import (
 )
 
 var (
-	// regex that parses the log file name fields
+	// AWS Application Load Balancers
 	// source:  https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-log-file-format
 	// format:  bucket[/prefix]/AWSLogs/aws-account-id/elasticloadbalancing/region/yyyy/mm/dd/aws-account-id_elasticloadbalancing_region_app.load-balancer-id_end-time_ip-address_random-string.log.gz
 	// example: my-bucket/AWSLogs/123456789012/elasticloadbalancing/us-east-1/2022/01/24/123456789012_elasticloadbalancing_us-east-1_app.my-loadbalancer.b13ea9d19f16d015_20220124T0000Z_0.0.0.0_2et2e1mx.log.gz
-	filenameRegex = regexp.MustCompile(`AWSLogs\/(?P<account_id>\d+)\/elasticloadbalancing\/(?P<region>[\w-]+)\/(?P<year>\d+)\/(?P<month>\d+)\/(?P<day>\d+)\/\d+\_elasticloadbalancing\_\w+-\w+-\d_(?:(?:app|nlb|net)\.*?)?(?P<lb>[a-zA-Z0-9\-]+)`)
+	// VPC Flow Logs
+	// source: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-path
+	// format: bucket-and-optional-prefix/AWSLogs/account_id/vpcflowlogs/region/year/month/day/aws_account_id_vpcflowlogs_region_flow_log_id_YYYYMMDDTHHmmZ_hash.log.gz
+	// example: 123456789012_vpcflowlogs_us-east-1_fl-1234abcd_20180620T1620Z_fe123456.log.gz
+	filenameRegex = regexp.MustCompile(`AWSLogs\/(?P<account_id>\d+)\/(?P<type>\w+)\/(?P<region>[\w-]+)\/(?P<year>\d+)\/(?P<month>\d+)\/(?P<day>\d+)\/\d+\_(?:elasticloadbalancing|vpcflowlogs)\_\w+-\w+-\d_(?:(?:app|nlb|net)\.*?)?(?P<src>[a-zA-Z0-9\-]+)`)
 
 	// regex that extracts the timestamp (RFC3339) from message log
 	timestampRegex = regexp.MustCompile(`\w+ (?P<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+Z)`)
 )
 
+const (
+	FLOW_LOG_TYPE string = "vpcflowlogs"
+	LB_LOG_TYPE   string = "elasticloadbalancing"
+)
+
 func getS3Object(ctx context.Context, labels map[string]string) (io.ReadCloser, error) {
 	var s3Client *s3.Client
 
@@ -66,21 +75,41 @@ func parseS3Log(ctx context.Context, b *batch, labels map[string]string, obj io.
 
 	scanner := bufio.NewScanner(gzreader)
 
+	skipHeader := false
+	logType := labels["type"]
+	if labels["type"] == FLOW_LOG_TYPE {
+		skipHeader = true
+		logType = "s3_vpc_flow"
+	} else if labels["type"] == LB_LOG_TYPE {
+		logType = "s3_lb"
+	}
+
 	ls := model.LabelSet{
-		model.LabelName("__aws_log_type"):        model.LabelValue("s3_lb"),
-		model.LabelName("__aws_s3_log_lb"):       model.LabelValue(labels["lb"]),
-		model.LabelName("__aws_s3_log_lb_owner"): model.LabelValue(labels["account_id"]),
+		model.LabelName("__aws_log_type"):                          model.LabelValue(logType),
+		model.LabelName(fmt.Sprintf("__aws_%s_lb", logType)):       model.LabelValue(labels["src"]),
+		model.LabelName(fmt.Sprintf("__aws_%s_lb_owner", logType)): model.LabelValue(labels["account_id"]),
 	}
 
 	ls = applyExtraLabels(ls)
 
+	timestamp := time.Now()
+	var lineCount int
 	for scanner.Scan() {
 		log_line := scanner.Text()
-		match := timestampRegex.FindStringSubmatch(log_line)
+		lineCount++
+		if lineCount == 1 && skipHeader {
+			continue
+		}
+		if printLogLine {
+			fmt.Println(log_line)
+		}
 
-		timestamp, err := time.Parse(time.RFC3339, match[1])
-		if err != nil {
-			return err
+		match := timestampRegex.FindStringSubmatch(log_line)
+		if len(match) > 0 {
+			timestamp, err = time.Parse(time.RFC3339, match[1])
+			if err != nil {
+				return err
+			}
 		}
 
 		if err := b.add(ctx, entry{ls, logproto.Entry{
diff --git a/tools/lambda-promtail/lambda-promtail/s3_test.go b/tools/lambda-promtail/lambda-promtail/s3_test.go
new file mode 100644
index 000000000000..9a5451033008
--- /dev/null
+++ b/tools/lambda-promtail/lambda-promtail/s3_test.go
@@ -0,0 +1,161 @@
+package main
+
+import (
+	"context"
+	"io"
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/aws/aws-lambda-go/events"
+	"github.com/grafana/loki/pkg/logproto"
+)
+
+func Test_getLabels(t *testing.T) {
+	type args struct {
+		record events.S3EventRecord
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    map[string]string
+		wantErr bool
+	}{
+		{
+			name: "s3_lb",
+			args: args{
+				record: events.S3EventRecord{
+					AWSRegion: "us-east-1",
+					S3: events.S3Entity{
+						Bucket: events.S3Bucket{
+							Name: "elb_logs_test",
+							OwnerIdentity: events.S3UserIdentity{
+								PrincipalID: "test",
+							},
+						},
+						Object: events.S3Object{
+							Key: "my-bucket/AWSLogs/123456789012/elasticloadbalancing/us-east-1/2022/01/24/123456789012_elasticloadbalancing_us-east-1_app.my-loadbalancer.b13ea9d19f16d015_20220124T0000Z_0.0.0.0_2et2e1mx.log.gz",
+						},
+					},
+				},
+			},
+			want: map[string]string{
+				"account_id":    "123456789012",
+				"bucket":        "elb_logs_test",
+				"bucket_owner":  "test",
+				"bucket_region": "us-east-1",
+				"day":           "24",
+				"key":           "my-bucket/AWSLogs/123456789012/elasticloadbalancing/us-east-1/2022/01/24/123456789012_elasticloadbalancing_us-east-1_app.my-loadbalancer.b13ea9d19f16d015_20220124T0000Z_0.0.0.0_2et2e1mx.log.gz",
+				"month":         "01",
+				"region":        "us-east-1",
+				"src":           "my-loadbalancer",
+				"type":          "elasticloadbalancing",
+				"year":          "2022",
+			},
+			wantErr: false,
+		},
+		{
+			name: "s3_flow_logs",
+			args: args{
+				record: events.S3EventRecord{
+					AWSRegion: "us-east-1",
+					S3: events.S3Entity{
+						Bucket: events.S3Bucket{
+							Name: "elb_logs_test",
+							OwnerIdentity: events.S3UserIdentity{
+								PrincipalID: "test",
+							},
+						},
+						Object: events.S3Object{
+							Key: "my-bucket/AWSLogs/123456789012/vpcflowlogs/us-east-1/2022/01/24/123456789012_vpcflowlogs_us-east-1_fl-1234abcd_20180620T1620Z_fe123456.log.gz",
+						},
+					},
+				},
+			},
+			want: map[string]string{
+				"account_id":    "123456789012",
+				"bucket":        "elb_logs_test",
+				"bucket_owner":  "test",
+				"bucket_region": "us-east-1",
+				"day":           "24",
+				"key":           "my-bucket/AWSLogs/123456789012/vpcflowlogs/us-east-1/2022/01/24/123456789012_vpcflowlogs_us-east-1_fl-1234abcd_20180620T1620Z_fe123456.log.gz",
+				"month":         "01",
+				"region":        "us-east-1",
+				"src":           "fl-1234abcd",
+				"type":          "vpcflowlogs",
+				"year":          "2022",
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := getLabels(tt.args.record)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("getLabels() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getLabels() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_parseS3Log(t *testing.T) {
+	type args struct {
+		b         *batch
+		labels    map[string]string
+		obj       io.ReadCloser
+		filename  string
+		batchSize int
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{
+			name: "vpcflowlogs",
+			args: args{
+				batchSize: 1024, // Set large enough we don't try and send to promtail
+				filename:  "../testdata/vpcflowlog.log.gz",
+				b: &batch{
+					streams: map[string]*logproto.Stream{},
+				},
+				labels: map[string]string{
+					"type": FLOW_LOG_TYPE,
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "albaccesslogs",
+			args: args{
+				batchSize: 1024, // Set large enough we don't try and send to promtail
+				filename:  "../testdata/albaccesslog.log.gz",
+				b: &batch{
+					streams: map[string]*logproto.Stream{},
+				},
+				labels: map[string]string{
+					"type": LB_LOG_TYPE,
+				},
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var err error
+			batchSize = tt.args.batchSize
+			tt.args.obj, err = os.Open(tt.args.filename)
+			if err != nil {
+				t.Errorf("parseS3Log() failed to open test file: %s - %v", tt.args.filename, err)
+			}
+
+			if err := parseS3Log(context.Background(), tt.args.b, tt.args.labels, tt.args.obj); (err != nil) != tt.wantErr {
+				t.Errorf("parseS3Log() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/tools/lambda-promtail/main.tf b/tools/lambda-promtail/main.tf
index 19d36de97a64..37f53b3d9a4a 100644
--- a/tools/lambda-promtail/main.tf
+++ b/tools/lambda-promtail/main.tf
@@ -52,7 +52,7 @@ resource "aws_iam_role_policy" "logs" {
         "Resource" : "arn:aws:kms:*:*:*",
       },
       {
-        "Action": [
+        "Action" : [
           "ec2:DescribeNetworkInterfaces",
           "ec2:CreateNetworkInterface",
           "ec2:DeleteNetworkInterface",
@@ -60,7 +60,7 @@ resource "aws_iam_role_policy" "logs" {
           "ec2:AttachNetworkInterface"
         ],
         "Effect" : "Allow",
-        "Resource": "*",
+        "Resource" : "*",
       },
       {
         "Action" : [
@@ -106,14 +106,16 @@ resource "aws_lambda_function" "lambda_promtail" {
 
   environment {
     variables = {
-      WRITE_ADDRESS = var.write_address
-      USERNAME      = var.username
-      PASSWORD      = var.password
-      BEARER_TOKEN  = var.bearer_token
-      KEEP_STREAM   = var.keep_stream
-      BATCH_SIZE    = var.batch_size
-      EXTRA_LABELS  = var.extra_labels
-      TENANT_ID     = var.tenant_id
+      WRITE_ADDRESS   = var.write_address
+      USERNAME        = var.username
+      PASSWORD        = var.password
+      BEARER_TOKEN    = var.bearer_token
+      KEEP_STREAM     = var.keep_stream
+      BATCH_SIZE      = var.batch_size
+      EXTRA_LABELS    = var.extra_labels
+      TENANT_ID       = var.tenant_id
+      SKIP_TLS_VERIFY = var.skip_tls_verify
+      PRINT_LOG_LINE = var.print_log_line
     }
   }
 
@@ -157,7 +159,7 @@ resource "aws_lambda_permission" "allow-s3-invoke-lambda-promtail" {
 }
 
 resource "aws_kinesis_stream" "kinesis_stream" {
-  for_each          = toset(var.kinesis_stream_name)
+  for_each         = toset(var.kinesis_stream_name)
   name             = each.value
   shard_count      = 1
   retention_period = 48
diff --git a/tools/lambda-promtail/template.yaml b/tools/lambda-promtail/template.yaml
index cd32e306112b..9317443604da 100644
--- a/tools/lambda-promtail/template.yaml
+++ b/tools/lambda-promtail/template.yaml
@@ -43,6 +43,10 @@ Parameters:
     Description: Tenant ID to be added when writing logs from lambda-promtail.
     Type: String
     Default: ""
+  SkipTlsVerify:
+    Description: Determines whether to verify the TLS certificate
+    Type: String
+    Default: "false"
 
 Resources:
   LambdaPromtailRole:
@@ -91,6 +95,7 @@ Resources:
           KEEP_STREAM: !Ref KeepStream
           EXTRA_LABELS: !Ref ExtraLabels
           TENANT_ID: !Ref TenantID
+          SKIP_TLS_VERIFY: !Ref SkipTlsVerify
   LambdaPromtailVersion:
     Type: AWS::Lambda::Version
     Properties:
diff --git a/tools/lambda-promtail/testdata/albaccesslog.log.gz b/tools/lambda-promtail/testdata/albaccesslog.log.gz
new file mode 100644
index 000000000000..c17b04f0dade
Binary files /dev/null and b/tools/lambda-promtail/testdata/albaccesslog.log.gz differ
diff --git a/tools/lambda-promtail/testdata/vpcflowlog.log.gz b/tools/lambda-promtail/testdata/vpcflowlog.log.gz
new file mode 100644
index 000000000000..2a48134779fd
Binary files /dev/null and b/tools/lambda-promtail/testdata/vpcflowlog.log.gz differ
diff --git a/tools/lambda-promtail/variables.tf b/tools/lambda-promtail/variables.tf
index 4546930c53c0..6772de98e2a2 100644
--- a/tools/lambda-promtail/variables.tf
+++ b/tools/lambda-promtail/variables.tf
@@ -54,10 +54,16 @@ variable "keep_stream" {
   default     = "false"
 }
 
+variable "print_log_line" {
+  type        = string
+  description = "Determines whether we want the lambda to output the parsed log line before sending it on to promtail. Value needed to disable is the string 'false'"
+  default     = "true"
+}
+
 variable "extra_labels" {
-  type = string
+  type        = string
   description = "Comma separated list of extra labels, in the format 'name1,value1,name2,value2,...,nameN,valueN' to add to entries forwarded by lambda-promtail."
-  default = ""
+  default     = ""
 }
 
 variable "batch_size" {
@@ -84,8 +90,14 @@ variable "kms_key_arn" {
   default     = ""
 }
 
+variable "skip_tls_verify" {
+  type        = string
+  description = "Determines whether to verify the TLS certificate"
+  default     = "false"
+}
+
 variable "kinesis_stream_name" {
   type        = list(string)
   description = "Enter kinesis name if kinesis stream is configured as event source in lambda."
   default     = []
-}
\ No newline at end of file
+}
diff --git a/vendor/github.com/Masterminds/semver/v3/.golangci.yml b/vendor/github.com/Masterminds/semver/v3/.golangci.yml
index fdbdf1448c36..c87d1c4b90e8 100644
--- a/vendor/github.com/Masterminds/semver/v3/.golangci.yml
+++ b/vendor/github.com/Masterminds/semver/v3/.golangci.yml
@@ -4,23 +4,27 @@ run:
 linters:
   disable-all: true
   enable:
+    - misspell
+    - structcheck
+    - govet
+    - staticcheck
     - deadcode
-    - dupl
     - errcheck
-    - gofmt
-    - goimports
-    - golint
-    - gosimple
-    - govet
+    - varcheck
+    - unparam
     - ineffassign
-    - misspell
     - nakedret
-    - structcheck
+    - gocyclo
+    - dupl
+    - goimports
+    - revive
+    - gosec
+    - gosimple
+    - typecheck
     - unused
-    - varcheck
 
 linters-settings:
   gofmt:
     simplify: true
   dupl:
-    threshold: 400
+    threshold: 600
diff --git a/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md b/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md
index 1f90c38d260d..f12626423a3e 100644
--- a/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md
+++ b/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## 3.2.0 (2022-11-28)
+
+### Added
+
+- #190: Added text marshaling and unmarshaling
+- #167: Added JSON marshalling for constraints (thanks @SimonTheLeg)
+- #173: Implement encoding.TextMarshaler and encoding.TextUnmarshaler on Version (thanks @MarkRosemaker)
+- #179: Added New() version constructor (thanks @kazhuravlev)
+
+### Changed
+
+- #182/#183: Updated CI testing setup
+
+### Fixed
+
+- #186: Fixing issue where validation of constraint section gave false positives
+- #176: Fix constraints check with *-0 (thanks @mtt0)
+- #181: Fixed Caret operator (^) gives unexpected results when the minor version in constraint is 0 (thanks @arshchimni)
+- #161: Fixed godoc (thanks @afirth)
+
 ## 3.1.1 (2020-11-23)
 
 ### Fixed
diff --git a/vendor/github.com/Masterminds/semver/v3/constraints.go b/vendor/github.com/Masterminds/semver/v3/constraints.go
index 547613f044f2..203072e46468 100644
--- a/vendor/github.com/Masterminds/semver/v3/constraints.go
+++ b/vendor/github.com/Masterminds/semver/v3/constraints.go
@@ -134,6 +134,23 @@ func (cs Constraints) String() string {
 	return strings.Join(buf, " || ")
 }
 
+// UnmarshalText implements the encoding.TextUnmarshaler interface.
+func (cs *Constraints) UnmarshalText(text []byte) error {
+	temp, err := NewConstraint(string(text))
+	if err != nil {
+		return err
+	}
+
+	*cs = *temp
+
+	return nil
+}
+
+// MarshalText implements the encoding.TextMarshaler interface.
+func (cs Constraints) MarshalText() ([]byte, error) {
+	return []byte(cs.String()), nil
+}
+
 var constraintOps map[string]cfunc
 var constraintRegex *regexp.Regexp
 var constraintRangeRegex *regexp.Regexp
@@ -180,8 +197,13 @@ func init() {
 		ops,
 		cvRegex))
 
+	// The first time a constraint shows up will look slightly different from
+	// future times it shows up due to a leading space or comma in a given
+	// string.
 	validConstraintRegex = regexp.MustCompile(fmt.Sprintf(
-		`^(\s*(%s)\s*(%s)\s*\,?)+$`,
+		`^(\s*(%s)\s*(%s)\s*)((?:\s+|,\s*)(%s)\s*(%s)\s*)*$`,
+		ops,
+		cvRegex,
 		ops,
 		cvRegex))
 }
@@ -233,7 +255,7 @@ func parseConstraint(c string) (*constraint, error) {
 		patchDirty := false
 		dirty := false
 		if isX(m[3]) || m[3] == "" {
-			ver = "0.0.0"
+			ver = fmt.Sprintf("0.0.0%s", m[6])
 			dirty = true
 		} else if isX(strings.TrimPrefix(m[4], ".")) || m[4] == "" {
 			minorDirty = true
@@ -534,6 +556,10 @@ func constraintCaret(v *Version, c *constraint) (bool, error) {
 		}
 		return false, fmt.Errorf("%s does not have same minor version as %s. Expected minor versions to match when constraint major version is 0", v, c.orig)
 	}
+	// ^ when the minor is 0 and minor > 0 is =0.0.z
+	if c.con.Minor() == 0 && v.Minor() > 0 {
+		return false, fmt.Errorf("%s does not have same minor version as %s", v, c.orig)
+	}
 
 	// At this point the major is 0 and the minor is 0 and not dirty. The patch
 	// is not dirty so we need to check if they are equal. If they are not equal
diff --git a/vendor/github.com/Masterminds/semver/v3/doc.go b/vendor/github.com/Masterminds/semver/v3/doc.go
index 391aa46b76df..74f97caa57f8 100644
--- a/vendor/github.com/Masterminds/semver/v3/doc.go
+++ b/vendor/github.com/Masterminds/semver/v3/doc.go
@@ -3,12 +3,12 @@ Package semver provides the ability to work with Semantic Versions (http://semve
 
 Specifically it provides the ability to:
 
-    * Parse semantic versions
-    * Sort semantic versions
-    * Check if a semantic version fits within a set of constraints
-    * Optionally work with a `v` prefix
+  - Parse semantic versions
+  - Sort semantic versions
+  - Check if a semantic version fits within a set of constraints
+  - Optionally work with a `v` prefix
 
-Parsing Semantic Versions
+# Parsing Semantic Versions
 
 There are two functions that can parse semantic versions. The `StrictNewVersion`
 function only parses valid version 2 semantic versions as outlined in the
@@ -21,48 +21,48 @@ that can be sorted, compared, and used in constraints.
 When parsing a version an optional error can be returned if there is an issue
 parsing the version. For example,
 
-    v, err := semver.NewVersion("1.2.3-beta.1+b345")
+	v, err := semver.NewVersion("1.2.3-beta.1+b345")
 
 The version object has methods to get the parts of the version, compare it to
 other versions, convert the version back into a string, and get the original
 string. For more details please see the documentation
 at https://godoc.org/github.com/Masterminds/semver.
 
-Sorting Semantic Versions
+# Sorting Semantic Versions
 
 A set of versions can be sorted using the `sort` package from the standard library.
 For example,
 
-    raw := []string{"1.2.3", "1.0", "1.3", "2", "0.4.2",}
-    vs := make([]*semver.Version, len(raw))
-	for i, r := range raw {
-		v, err := semver.NewVersion(r)
-		if err != nil {
-			t.Errorf("Error parsing version: %s", err)
-		}
+	    raw := []string{"1.2.3", "1.0", "1.3", "2", "0.4.2",}
+	    vs := make([]*semver.Version, len(raw))
+		for i, r := range raw {
+			v, err := semver.NewVersion(r)
+			if err != nil {
+				t.Errorf("Error parsing version: %s", err)
+			}
 
-		vs[i] = v
-	}
+			vs[i] = v
+		}
 
-	sort.Sort(semver.Collection(vs))
+		sort.Sort(semver.Collection(vs))
 
-Checking Version Constraints and Comparing Versions
+# Checking Version Constraints and Comparing Versions
 
 There are two methods for comparing versions. One uses comparison methods on
 `Version` instances and the other is using Constraints. There are some important
 differences to notes between these two methods of comparison.
 
-1. When two versions are compared using functions such as `Compare`, `LessThan`,
-   and others it will follow the specification and always include prereleases
-   within the comparison. It will provide an answer valid with the comparison
-   spec section at https://semver.org/#spec-item-11
-2. When constraint checking is used for checks or validation it will follow a
-   different set of rules that are common for ranges with tools like npm/js
-   and Rust/Cargo. This includes considering prereleases to be invalid if the
-   ranges does not include on. If you want to have it include pre-releases a
-   simple solution is to include `-0` in your range.
-3. Constraint ranges can have some complex rules including the shorthard use of
-   ~ and ^. For more details on those see the options below.
+ 1. When two versions are compared using functions such as `Compare`, `LessThan`,
+    and others it will follow the specification and always include prereleases
+    within the comparison. It will provide an answer valid with the comparison
+    spec section at https://semver.org/#spec-item-11
+ 2. When constraint checking is used for checks or validation it will follow a
+    different set of rules that are common for ranges with tools like npm/js
+    and Rust/Cargo. This includes considering prereleases to be invalid if the
+    ranges does not include on. If you want to have it include pre-releases a
+    simple solution is to include `-0` in your range.
+ 3. Constraint ranges can have some complex rules including the shorthard use of
+    ~ and ^. For more details on those see the options below.
 
 There are differences between the two methods or checking versions because the
 comparison methods on `Version` follow the specification while comparison ranges
@@ -76,19 +76,19 @@ patters with their versions.
 Checking a version against version constraints is one of the most featureful
 parts of the package.
 
-    c, err := semver.NewConstraint(">= 1.2.3")
-    if err != nil {
-        // Handle constraint not being parsable.
-    }
+	c, err := semver.NewConstraint(">= 1.2.3")
+	if err != nil {
+	    // Handle constraint not being parsable.
+	}
 
-    v, err := semver.NewVersion("1.3")
-    if err != nil {
-        // Handle version not being parsable.
-    }
-    // Check if the version meets the constraints. The a variable will be true.
-    a := c.Check(v)
+	v, err := semver.NewVersion("1.3")
+	if err != nil {
+	    // Handle version not being parsable.
+	}
+	// Check if the version meets the constraints. The a variable will be true.
+	a := c.Check(v)
 
-Basic Comparisons
+# Basic Comparisons
 
 There are two elements to the comparisons. First, a comparison string is a list
 of comma or space separated AND comparisons. These are then separated by || (OR)
@@ -99,31 +99,31 @@ greater than or equal to 4.2.3. This can also be written as
 
 The basic comparisons are:
 
-    * `=`: equal (aliased to no operator)
-    * `!=`: not equal
-    * `>`: greater than
-    * `<`: less than
-    * `>=`: greater than or equal to
-    * `<=`: less than or equal to
+  - `=`: equal (aliased to no operator)
+  - `!=`: not equal
+  - `>`: greater than
+  - `<`: less than
+  - `>=`: greater than or equal to
+  - `<=`: less than or equal to
 
-Hyphen Range Comparisons
+# Hyphen Range Comparisons
 
 There are multiple methods to handle ranges and the first is hyphens ranges.
 These look like:
 
-    * `1.2 - 1.4.5` which is equivalent to `>= 1.2, <= 1.4.5`
-    * `2.3.4 - 4.5` which is equivalent to `>= 2.3.4 <= 4.5`
+  - `1.2 - 1.4.5` which is equivalent to `>= 1.2, <= 1.4.5`
+  - `2.3.4 - 4.5` which is equivalent to `>= 2.3.4 <= 4.5`
 
-Wildcards In Comparisons
+# Wildcards In Comparisons
 
 The `x`, `X`, and `*` characters can be used as a wildcard character. This works
 for all comparison operators. When used on the `=` operator it falls
 back to the tilde operation. For example,
 
-    * `1.2.x` is equivalent to `>= 1.2.0 < 1.3.0`
-    * `>= 1.2.x` is equivalent to `>= 1.2.0`
-    * `<= 2.x` is equivalent to `<= 3`
-    * `*` is equivalent to `>= 0.0.0`
+  - `1.2.x` is equivalent to `>= 1.2.0 < 1.3.0`
+  - `>= 1.2.x` is equivalent to `>= 1.2.0`
+  - `<= 2.x` is equivalent to `<= 3`
+  - `*` is equivalent to `>= 0.0.0`
 
 Tilde Range Comparisons (Patch)
 
@@ -131,11 +131,11 @@ The tilde (`~`) comparison operator is for patch level ranges when a minor
 version is specified and major level changes when the minor number is missing.
 For example,
 
-    * `~1.2.3` is equivalent to `>= 1.2.3 < 1.3.0`
-    * `~1` is equivalent to `>= 1, < 2`
-    * `~2.3` is equivalent to `>= 2.3 < 2.4`
-    * `~1.2.x` is equivalent to `>= 1.2.0 < 1.3.0`
-    * `~1.x` is equivalent to `>= 1 < 2`
+  - `~1.2.3` is equivalent to `>= 1.2.3 < 1.3.0`
+  - `~1` is equivalent to `>= 1, < 2`
+  - `~2.3` is equivalent to `>= 2.3 < 2.4`
+  - `~1.2.x` is equivalent to `>= 1.2.0 < 1.3.0`
+  - `~1.x` is equivalent to `>= 1 < 2`
 
 Caret Range Comparisons (Major)
 
@@ -144,41 +144,41 @@ The caret (`^`) comparison operator is for major level changes once a stable
 as the API stability level. This is useful when comparisons of API versions as a
 major change is API breaking. For example,
 
-    * `^1.2.3` is equivalent to `>= 1.2.3, < 2.0.0`
-    * `^1.2.x` is equivalent to `>= 1.2.0, < 2.0.0`
-    * `^2.3` is equivalent to `>= 2.3, < 3`
-    * `^2.x` is equivalent to `>= 2.0.0, < 3`
-    * `^0.2.3` is equivalent to `>=0.2.3 <0.3.0`
-    * `^0.2` is equivalent to `>=0.2.0 <0.3.0`
-    * `^0.0.3` is equivalent to `>=0.0.3 <0.0.4`
-    * `^0.0` is equivalent to `>=0.0.0 <0.1.0`
-    * `^0` is equivalent to `>=0.0.0 <1.0.0`
+  - `^1.2.3` is equivalent to `>= 1.2.3, < 2.0.0`
+  - `^1.2.x` is equivalent to `>= 1.2.0, < 2.0.0`
+  - `^2.3` is equivalent to `>= 2.3, < 3`
+  - `^2.x` is equivalent to `>= 2.0.0, < 3`
+  - `^0.2.3` is equivalent to `>=0.2.3 <0.3.0`
+  - `^0.2` is equivalent to `>=0.2.0 <0.3.0`
+  - `^0.0.3` is equivalent to `>=0.0.3 <0.0.4`
+  - `^0.0` is equivalent to `>=0.0.0 <0.1.0`
+  - `^0` is equivalent to `>=0.0.0 <1.0.0`
 
-Validation
+# Validation
 
 In addition to testing a version against a constraint, a version can be validated
 against a constraint. When validation fails a slice of errors containing why a
 version didn't meet the constraint is returned. For example,
 
-    c, err := semver.NewConstraint("<= 1.2.3, >= 1.4")
-    if err != nil {
-        // Handle constraint not being parseable.
-    }
-
-    v, _ := semver.NewVersion("1.3")
-    if err != nil {
-        // Handle version not being parseable.
-    }
-
-    // Validate a version against a constraint.
-    a, msgs := c.Validate(v)
-    // a is false
-    for _, m := range msgs {
-        fmt.Println(m)
-
-        // Loops over the errors which would read
-        // "1.3 is greater than 1.2.3"
-        // "1.3 is less than 1.4"
-    }
+	c, err := semver.NewConstraint("<= 1.2.3, >= 1.4")
+	if err != nil {
+	    // Handle constraint not being parseable.
+	}
+
+	v, _ := semver.NewVersion("1.3")
+	if err != nil {
+	    // Handle version not being parseable.
+	}
+
+	// Validate a version against a constraint.
+	a, msgs := c.Validate(v)
+	// a is false
+	for _, m := range msgs {
+	    fmt.Println(m)
+
+	    // Loops over the errors which would read
+	    // "1.3 is greater than 1.2.3"
+	    // "1.3 is less than 1.4"
+	}
 */
 package semver
diff --git a/vendor/github.com/Masterminds/semver/v3/version.go b/vendor/github.com/Masterminds/semver/v3/version.go
index d6b9cda3eeb7..7c4bed33474c 100644
--- a/vendor/github.com/Masterminds/semver/v3/version.go
+++ b/vendor/github.com/Masterminds/semver/v3/version.go
@@ -55,14 +55,16 @@ func init() {
 	versionRegex = regexp.MustCompile("^" + semVerRegex + "$")
 }
 
-const num string = "0123456789"
-const allowed string = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-" + num
+const (
+	num     string = "0123456789"
+	allowed string = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-" + num
+)
 
 // StrictNewVersion parses a given version and returns an instance of Version or
 // an error if unable to parse the version. Only parses valid semantic versions.
 // Performs checking that can find errors within the version.
-// If you want to coerce a version, such as 1 or 1.2, and perse that as the 1.x
-// releases of semver provided use the NewSemver() function.
+// If you want to coerce a version such as 1 or 1.2 and parse it as the 1.x
+// releases of semver did, use the NewVersion() function.
 func StrictNewVersion(v string) (*Version, error) {
 	// Parsing here does not use RegEx in order to increase performance and reduce
 	// allocations.
@@ -207,6 +209,23 @@ func NewVersion(v string) (*Version, error) {
 	return sv, nil
 }
 
+// New creates a new instance of Version with each of the parts passed in as
+// arguments instead of parsing a version string.
+func New(major, minor, patch uint64, pre, metadata string) *Version {
+	v := Version{
+		major:    major,
+		minor:    minor,
+		patch:    patch,
+		pre:      pre,
+		metadata: metadata,
+		original: "",
+	}
+
+	v.original = v.String()
+
+	return &v
+}
+
 // MustParse parses a given version and panics on error.
 func MustParse(v string) *Version {
 	sv, err := NewVersion(v)
@@ -267,7 +286,6 @@ func (v Version) Metadata() string {
 
 // originalVPrefix returns the original 'v' prefix if any.
 func (v Version) originalVPrefix() string {
-
 	// Note, only lowercase v is supported as a prefix by the parser.
 	if v.original != "" && v.original[:1] == "v" {
 		return v.original[:1]
@@ -436,6 +454,23 @@ func (v Version) MarshalJSON() ([]byte, error) {
 	return json.Marshal(v.String())
 }
 
+// UnmarshalText implements the encoding.TextUnmarshaler interface.
+func (v *Version) UnmarshalText(text []byte) error {
+	temp, err := NewVersion(string(text))
+	if err != nil {
+		return err
+	}
+
+	*v = *temp
+
+	return nil
+}
+
+// MarshalText implements the encoding.TextMarshaler interface.
+func (v Version) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
 // Scan implements the SQL.Scanner interface.
 func (v *Version) Scan(value interface{}) error {
 	var s string
@@ -470,7 +505,6 @@ func compareSegment(v, o uint64) int {
 }
 
 func comparePrerelease(v, o string) int {
-
 	// split the prelease versions by their part. The separator, per the spec,
 	// is a .
 	sparts := strings.Split(v, ".")
@@ -562,7 +596,6 @@ func comparePrePart(s, o string) int {
 		return 1
 	}
 	return -1
-
 }
 
 // Like strings.ContainsAny but does an only instead of any.
diff --git a/vendor/github.com/Masterminds/sprig/v3/CHANGELOG.md b/vendor/github.com/Masterminds/sprig/v3/CHANGELOG.md
index fcdd4e88aed4..2ce45dd4eca6 100644
--- a/vendor/github.com/Masterminds/sprig/v3/CHANGELOG.md
+++ b/vendor/github.com/Masterminds/sprig/v3/CHANGELOG.md
@@ -1,8 +1,21 @@
 # Changelog
 
+## Release 3.2.3 (2022-11-29)
+
+### Changed
+
+- Updated docs (thanks @book987 @aJetHorn @neelayu @pellizzetti @apricote @SaigyoujiYuyuko233 @AlekSi)
+- #348: Updated huandu/xstrings which fixed a snake case bug (thanks @yxxhero)
+- #353: Updated masterminds/semver which included bug fixes
+- #354: Updated golang.org/x/crypto which included bug fixes
+
+## Release 3.2.2 (2021-02-04)
+
+This is a re-release of 3.2.1 to satisfy something with the Go module system.
+
 ## Release 3.2.1 (2021-02-04)
 
-### Changed 
+### Changed
 
 - Upgraded `Masterminds/goutils` to `v1.1.1`. see the [Security Advisory](https://github.com/Masterminds/goutils/security/advisories/GHSA-xg2h-wx96-xgxr)
 
diff --git a/vendor/github.com/Masterminds/sprig/v3/README.md b/vendor/github.com/Masterminds/sprig/v3/README.md
index c37ba01c2162..3e22c60e1a01 100644
--- a/vendor/github.com/Masterminds/sprig/v3/README.md
+++ b/vendor/github.com/Masterminds/sprig/v3/README.md
@@ -17,10 +17,9 @@ JavaScript libraries, such as [underscore.js](http://underscorejs.org/).
 ## IMPORTANT NOTES
 
 Sprig leverages [mergo](https://github.com/imdario/mergo) to handle merges. In
-its v0.3.9 release there was a behavior change that impacts merging template
-functions in sprig. It is currently recommended to use v0.3.8 of that package.
-Using v0.3.9 will cause sprig tests to fail. The issue in mergo is tracked at
-https://github.com/imdario/mergo/issues/139.
+its v0.3.9 release, there was a behavior change that impacts merging template
+functions in sprig. It is currently recommended to use v0.3.10 or later of that package.
+Using v0.3.9 will cause sprig tests to fail.
 
 ## Package Versions
 
@@ -51,7 +50,7 @@ To load the Sprig `FuncMap`:
 ```go
 
 import (
-  "github.com/Masterminds/sprig"
+  "github.com/Masterminds/sprig/v3"
   "html/template"
 )
 
diff --git a/vendor/github.com/alicebob/miniredis/v2/.gitignore b/vendor/github.com/alicebob/miniredis/v2/.gitignore
index 7ba06b06ce67..8016b4be34e0 100644
--- a/vendor/github.com/alicebob/miniredis/v2/.gitignore
+++ b/vendor/github.com/alicebob/miniredis/v2/.gitignore
@@ -2,3 +2,5 @@
 /integration/dump.rdb
 *.swp
 /integration/nodes.conf
+.idea/
+miniredis.iml
diff --git a/vendor/github.com/alicebob/miniredis/v2/CHANGELOG.md b/vendor/github.com/alicebob/miniredis/v2/CHANGELOG.md
index 0c1fb87ebf24..d9700af64e9e 100644
--- a/vendor/github.com/alicebob/miniredis/v2/CHANGELOG.md
+++ b/vendor/github.com/alicebob/miniredis/v2/CHANGELOG.md
@@ -1,6 +1,32 @@
 ## Changelog
 
 
+### v2.30.0
+
+- implement redis 7.0.x (from 6.X). Main changes:
+   - test against 7.0.7
+   - update error messages
+   - support nx|xx|gt|lt options in [P]EXPIRE[AT]
+   - update how deleted items are processed in pending queues in streams
+
+
+### v2.23.1
+
+- resolve $ to latest ID in XREAD (thanks @josh-hook)
+- handle disconnect in blocking functions (thanks @jgirtakovskis)
+- fix type conversion bug in redisToLua (thanks Sandy Harvie)
+- BRPOP{LPUSH} timeout can be float since 6.0
+
+
+### v2.23.0
+
+- basic INFO support (thanks @kirill-a-belov)
+- support COUNT in SSCAN (thanks @Abdi-dd)
+- test and support Go 1.19
+- support LPOS (thanks @ianstarz)
+- support XPENDING, XGROUP {CREATECONSUMER,DESTROY,DELCONSUMER}, XINFO {CONSUMERS,GROUPS}, XCLAIM (thanks @sandyharvie)
+
+
 ### v2.22.0
 
 - set miniredis.DumpMaxLineLen to get more Dump() info (thanks @afjoseph)
diff --git a/vendor/github.com/alicebob/miniredis/v2/README.md b/vendor/github.com/alicebob/miniredis/v2/README.md
index 60072f4e0d89..24df8603c5ce 100644
--- a/vendor/github.com/alicebob/miniredis/v2/README.md
+++ b/vendor/github.com/alicebob/miniredis/v2/README.md
@@ -64,6 +64,8 @@ Implemented commands:
    - FLUSHALL
    - FLUSHDB
    - TIME -- returns time.Now() or value set by SetTime()
+   - COMMAND -- partly
+   - INFO -- partly, returns only "clients" section with one field "connected_clients"
  - String keys (complete)
    - APPEND
    - BITCOUNT
@@ -178,9 +180,15 @@ Implemented commands:
    - XACK
    - XADD
    - XAUTOCLAIM
+   - XCLAIM
    - XDEL
    - XGROUP CREATE
+   - XGROUP CREATECONSUMER
+   - XGROUP DESTROY
+   - XGROUP DELCONSUMER
    - XINFO STREAM -- partly
+   - XINFO GROUPS
+   - XINFO CONSUMERS -- partly
    - XLEN
    - XRANGE
    - XREAD
@@ -203,8 +211,6 @@ Implemented commands:
    - GEORADIUS_RO
    - GEORADIUSBYMEMBER
    - GEORADIUSBYMEMBER_RO
- - Server
-   - COMMAND -- partly
  - Cluster
    - CLUSTER SLOTS
    - CLUSTER KEYSLOT
@@ -302,7 +308,6 @@ Commands which will probably not be implemented:
     - ~~CLIENT *~~
     - ~~CONFIG *~~
     - ~~DEBUG *~~
-    - ~~INFO~~
     - ~~LASTSAVE~~
     - ~~MONITOR~~
     - ~~ROLE~~
@@ -315,7 +320,7 @@ Commands which will probably not be implemented:
 
 ## &c.
 
-Integration tests are run against Redis 6.2.6. The [./integration](./integration/) subdir
+Integration tests are run against Redis 7.0.7. The [./integration](./integration/) subdir
 compares miniredis against a real redis instance.
 
 The Redis 6 RESP3 protocol is supported. If there are problems, please open
@@ -325,5 +330,4 @@ If you want to test Redis Sentinel have a look at [minisentinel](https://github.
 
 A changelog is kept at [CHANGELOG.md](https://github.com/alicebob/miniredis/blob/master/CHANGELOG.md).
 
-[![Build Status](https://travis-ci.com/alicebob/miniredis.svg?branch=master)](https://travis-ci.com/alicebob/miniredis)
 [![Go Reference](https://pkg.go.dev/badge/github.com/alicebob/miniredis/v2.svg)](https://pkg.go.dev/github.com/alicebob/miniredis/v2)
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_cluster.go b/vendor/github.com/alicebob/miniredis/v2/cmd_cluster.go
index 083c4ecf7d72..9951f3dd3b70 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_cluster.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_cluster.go
@@ -4,13 +4,14 @@ package miniredis
 
 import (
 	"fmt"
-	"github.com/alicebob/miniredis/v2/server"
 	"strings"
+
+	"github.com/alicebob/miniredis/v2/server"
 )
 
 // commandsCluster handles some cluster operations.
 func commandsCluster(m *Miniredis) {
-	_ = m.srv.Register("CLUSTER", m.cmdCluster)
+	m.srv.Register("CLUSTER", m.cmdCluster)
 }
 
 func (m *Miniredis) cmdCluster(c *server.Peer, cmd string, args []string) {
@@ -51,14 +52,14 @@ func (m *Miniredis) cmdClusterSlots(c *server.Peer, cmd string, args []string) {
 	})
 }
 
-//CLUSTER KEYSLOT
+// CLUSTER KEYSLOT
 func (m *Miniredis) cmdClusterKeySlot(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		c.WriteInt(163)
 	})
 }
 
-//CLUSTER NODES
+// CLUSTER NODES
 func (m *Miniredis) cmdClusterNodes(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		c.WriteBulk("e7d1eecce10fd6bb5eb35b9f99a514335d9ba9ca 127.0.0.1:7000@7000 myself,master - 0 0 1 connected 0-16383")
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_command.go b/vendor/github.com/alicebob/miniredis/v2/cmd_command.go
index 59abefd382a7..d82174f2f2e7 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_command.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_command.go
@@ -4,15 +4,2042 @@ package miniredis
 
 import "github.com/alicebob/miniredis/v2/server"
 
-func commandsCommand(m *Miniredis) {
-	_ = m.srv.Register("COMMAND", m.cmdCommand)
-}
-
 func (m *Miniredis) cmdCommand(c *server.Peer, cmd string, args []string) {
 	// Got from redis 5.0.7 with
 	// echo 'COMMAND' | nc redis_addr redis_port
 	//
-	res := "*200\r\n*6\r\n$12\r\nhincrbyfloat\r\n:4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$10\r\nxreadgroup\r\n:-7\r\n*3\r\n+write\r\n+noscript\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$10\r\nsdiffstore\r\n:-3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$8\r\nlastsave\r\n:1\r\n*2\r\n+random\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nsetnx\r\n:3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\nbzpopmax\r\n:-3\r\n*3\r\n+write\r\n+noscript\r\n+fast\r\n:1\r\n:-2\r\n:1\r\n*6\r\n$12\r\npunsubscribe\r\n:-1\r\n*4\r\n+pubsub\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nxack\r\n:-4\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$10\r\npfselftest\r\n:1\r\n*1\r\n+admin\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nsubstr\r\n:4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\nsmembers\r\n:2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:1\r\n:1\r\n:1\r\n*6\r\n$11\r\nunsubscribe\r\n:-1\r\n*4\r\n+pubsub\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$11\r\nzinterstore\r\n:-4\r\n*3\r\n+write\r\n+denyoom\r\n+movablekeys\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nstrlen\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\npfmerge\r\n:-2\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$9\r\nrandomkey\r\n:1\r\n*2\r\n+readonly\r\n+random\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nlolwut\r\n:-1\r\n*1\r\n+readonly\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nrpop\r\n:2\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nhkeys\r\n:2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nclient\r\n:-2\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nmodule\r\n:-2\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\nslowlog\r\n:-2\r\n*2\r\n+admin\r\n+random\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\ngeohash\r\n:-2\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nlrange\r\n:4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nping\r\n:-1\r\n*2\r\n+stale\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$8\r\nbitcount\r\n:-2\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\npubsub\r\n:-2\r\n*4\r\n+pubsub\r\n+random\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nrole\r\n:1\r\n*3\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nhget\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nobject\r\n:-2\r\n*2\r\n+readonly\r\n+random\r\n:2\r\n:2\r\n:1\r\n*6\r\n$9\r\nzrevrange\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nhincrby\r\n:4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$9\r\nzlexcount\r\n:4\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nscard\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nappend\r\n:3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nhstrlen\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nconfig\r\n:-2\r\n*4\r\n+admin\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nhset\r\n:-4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$16\r\nzrevrangebyscore\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nincr\r\n:2\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nsetbit\r\n:4\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$9\r\nrpoplpush\r\n:3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:2\r\n:1\r\n*6\r\n$6\r\nxclaim\r\n:-6\r\n*3\r\n+write\r\n+random\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$11\r\nsinterstore\r\n:-3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$7\r\npublish\r\n:3\r\n*4\r\n+pubsub\r\n+loading\r\n+stale\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nhscan\r\n:-3\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nmulti\r\n:1\r\n*2\r\n+noscript\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$3\r\nset\r\n:-3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nlpushx\r\n:-3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$16\r\nzremrangebyscore\r\n:4\r\n*1\r\n+write\r\n:1\r\n:1\r\n:1\r\n*6\r\n$9\r\npexpireat\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nhdel\r\n:-3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$12\r\nbgrewriteaof\r\n:1\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\nmigrate\r\n:-6\r\n*3\r\n+write\r\n+random\r\n+movablekeys\r\n:0\r\n:0\r\n:0\r\n*6\r\n$9\r\nreplicaof\r\n:3\r\n*3\r\n+admin\r\n+noscript\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\ntouch\r\n:-2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nxsetid\r\n:3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nbitop\r\n:-4\r\n*2\r\n+write\r\n+denyoom\r\n:2\r\n:-1\r\n:1\r\n*6\r\n$6\r\nswapdb\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nsdiff\r\n:-2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$6\r\nlindex\r\n:3\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nwait\r\n:3\r\n*1\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nlrem\r\n:4\r\n*1\r\n+write\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nhsetnx\r\n:4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\ngetrange\r\n:4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nhlen\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\npost\r\n:-1\r\n*2\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$9\r\nsismember\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nunwatch\r\n:1\r\n*2\r\n+noscript\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nlpush\r\n:-3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nscan\r\n:-2\r\n*2\r\n+readonly\r\n+random\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nsmove\r\n:4\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:2\r\n:1\r\n*6\r\n$7\r\ncluster\r\n:-2\r\n*1\r\n+admin\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nbgsave\r\n:-1\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\ndump\r\n:2\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nlatency\r\n:-2\r\n*4\r\n+admin\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$8\r\nbzpopmin\r\n:-3\r\n*3\r\n+write\r\n+noscript\r\n+fast\r\n:1\r\n:-2\r\n:1\r\n*6\r\n$6\r\ngetbit\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nhgetall\r\n:2\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nrename\r\n:3\r\n*1\r\n+write\r\n:1\r\n:2\r\n:1\r\n*6\r\n$9\r\nsubscribe\r\n:-2\r\n*4\r\n+pubsub\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nxdel\r\n:-3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$15\r\nzremrangebyrank\r\n:4\r\n*1\r\n+write\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\ntype\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nscript\r\n:-2\r\n*1\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nhmset\r\n:-4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nsunion\r\n:-2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$4\r\nmget\r\n:-2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$10\r\nbrpoplpush\r\n:4\r\n*3\r\n+write\r\n+denyoom\r\n+noscript\r\n:1\r\n:2\r\n:1\r\n*6\r\n$6\r\ngeoadd\r\n:-5\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\ndecrby\r\n:3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\necho\r\n:2\r\n*1\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\ndbsize\r\n:1\r\n*2\r\n+readonly\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nzcard\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nselect\r\n:2\r\n*2\r\n+loading\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nsadd\r\n:-3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nhost:\r\n:-1\r\n*2\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nsscan\r\n:-3\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$12\r\ngeoradius_ro\r\n:-6\r\n*2\r\n+readonly\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nmonitor\r\n:1\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$14\r\nzremrangebylex\r\n:4\r\n*1\r\n+write\r\n:1\r\n:1\r\n:1\r\n*6\r\n$11\r\nsunionstore\r\n:-3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$5\r\nzscan\r\n:-3\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$9\r\nreadwrite\r\n:1\r\n*1\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nxgroup\r\n:-2\r\n*2\r\n+write\r\n+denyoom\r\n:2\r\n:2\r\n:1\r\n*6\r\n$5\r\nsetex\r\n:4\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nsave\r\n:1\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nhvals\r\n:2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nwatch\r\n:-2\r\n*2\r\n+noscript\r\n+fast\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$7\r\nhexists\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\ninfo\r\n:-1\r\n*3\r\n+random\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\npsync\r\n:3\r\n*3\r\n+readonly\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$11\r\nzrangebylex\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nzadd\r\n:-4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nxlen\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nauth\r\n:2\r\n*4\r\n+noscript\r\n+loading\r\n+stale\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nsrem\r\n:-3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$9\r\ngeoradius\r\n:-6\r\n*2\r\n+write\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nexec\r\n:1\r\n*2\r\n+noscript\r\n+skip_monitor\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\npfcount\r\n:-2\r\n*1\r\n+readonly\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$7\r\nzpopmin\r\n:-2\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nmove\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nxtrim\r\n:-2\r\n*3\r\n+write\r\n+random\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nasking\r\n:1\r\n*1\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\npttl\r\n:2\r\n*3\r\n+readonly\r\n+random\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$11\r\nsrandmember\r\n:-2\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\nflushall\r\n:-1\r\n*1\r\n+write\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nsort\r\n:-2\r\n*3\r\n+write\r\n+denyoom\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$3\r\ndel\r\n:-2\r\n*1\r\n+write\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$14\r\nrestore-asking\r\n:-4\r\n*3\r\n+write\r\n+denyoom\r\n+asking\r\n:1\r\n:1\r\n:1\r\n*6\r\n$10\r\npsubscribe\r\n:-2\r\n*4\r\n+pubsub\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\ndecr\r\n:2\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nincrby\r\n:3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$14\r\nzrevrangebylex\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\nbitfield\r\n:-2\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nexists\r\n:-2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$8\r\nreplconf\r\n:-1\r\n*4\r\n+admin\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\nzincrby\r\n:4\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nblpop\r\n:-3\r\n*2\r\n+write\r\n+noscript\r\n:1\r\n:-2\r\n:1\r\n*6\r\n$4\r\nlpop\r\n:2\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$3\r\nttl\r\n:2\r\n*3\r\n+readonly\r\n+random\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nxread\r\n:-4\r\n*3\r\n+readonly\r\n+noscript\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nrpush\r\n:-3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\nzrevrank\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$11\r\nincrbyfloat\r\n:3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nbrpop\r\n:-3\r\n*2\r\n+write\r\n+noscript\r\n:1\r\n:-2\r\n:1\r\n*6\r\n$4\r\nxadd\r\n:-5\r\n*4\r\n+write\r\n+denyoom\r\n+random\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$8\r\nsetrange\r\n:4\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$17\r\ngeoradiusbymember\r\n:-5\r\n*2\r\n+write\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nunlink\r\n:-2\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$8\r\nexpireat\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\ndebug\r\n:-2\r\n*2\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$20\r\ngeoradiusbymember_ro\r\n:-5\r\n*2\r\n+readonly\r\n+movablekeys\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nlset\r\n:4\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nzscore\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nllen\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\ntime\r\n:1\r\n*2\r\n+random\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$8\r\nshutdown\r\n:-1\r\n*4\r\n+admin\r\n+noscript\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\nevalsha\r\n:-3\r\n*2\r\n+noscript\r\n+movablekeys\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nzcount\r\n:4\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nmemory\r\n:-2\r\n*2\r\n+readonly\r\n+random\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nxinfo\r\n:-2\r\n*2\r\n+readonly\r\n+random\r\n:2\r\n:2\r\n:1\r\n*6\r\n$8\r\nxpending\r\n:-3\r\n*2\r\n+readonly\r\n+random\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\neval\r\n:-3\r\n*2\r\n+noscript\r\n+movablekeys\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nxrange\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nrestore\r\n:-4\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nzpopmax\r\n:-2\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nmset\r\n:-3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:-1\r\n:2\r\n*6\r\n$4\r\nspop\r\n:-2\r\n*3\r\n+write\r\n+random\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nltrim\r\n:4\r\n*1\r\n+write\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\nzrank\r\n:3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$9\r\nxrevrange\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$3\r\nget\r\n:2\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nflushdb\r\n:-1\r\n*1\r\n+write\r\n:0\r\n:0\r\n:0\r\n*6\r\n$5\r\nhmget\r\n:-3\r\n*2\r\n+readonly\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nmsetnx\r\n:-3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:-1\r\n:2\r\n*6\r\n$7\r\npersist\r\n:2\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$11\r\nzunionstore\r\n:-4\r\n*3\r\n+write\r\n+denyoom\r\n+movablekeys\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\ncommand\r\n:0\r\n*3\r\n+random\r\n+loading\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$8\r\nrenamenx\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:2\r\n:1\r\n*6\r\n$6\r\nzrange\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\npexpire\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nkeys\r\n:2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:0\r\n:0\r\n:0\r\n*6\r\n$4\r\nzrem\r\n:-3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$5\r\npfadd\r\n:-2\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\npsetex\r\n:4\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$13\r\nzrangebyscore\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$4\r\nsync\r\n:1\r\n*3\r\n+readonly\r\n+admin\r\n+noscript\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\npfdebug\r\n:-3\r\n*1\r\n+write\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\ndiscard\r\n:1\r\n*2\r\n+noscript\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$8\r\nreadonly\r\n:1\r\n*1\r\n+fast\r\n:0\r\n:0\r\n:0\r\n*6\r\n$7\r\ngeodist\r\n:-4\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\ngeopos\r\n:-2\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nbitpos\r\n:-3\r\n*1\r\n+readonly\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nsinter\r\n:-2\r\n*2\r\n+readonly\r\n+sort_for_script\r\n:1\r\n:-1\r\n:1\r\n*6\r\n$6\r\ngetset\r\n:3\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nslaveof\r\n:3\r\n*3\r\n+admin\r\n+noscript\r\n+stale\r\n:0\r\n:0\r\n:0\r\n*6\r\n$6\r\nrpushx\r\n:-3\r\n*3\r\n+write\r\n+denyoom\r\n+fast\r\n:1\r\n:1\r\n:1\r\n*6\r\n$7\r\nlinsert\r\n:5\r\n*2\r\n+write\r\n+denyoom\r\n:1\r\n:1\r\n:1\r\n*6\r\n$6\r\nexpire\r\n:3\r\n*2\r\n+write\r\n+fast\r\n:1\r\n:1\r\n:1\r\n"
+	res := `
+*200
+*6
+$12
+hincrbyfloat
+:4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$10
+xreadgroup
+:-7
+*3
++write
++noscript
++movablekeys
+:1
+:1
+:1
+*6
+$10
+sdiffstore
+:-3
+*2
++write
++denyoom
+:1
+:-1
+:1
+*6
+$8
+lastsave
+:1
+*2
++random
++fast
+:0
+:0
+:0
+*6
+$5
+setnx
+:3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$8
+bzpopmax
+:-3
+*3
++write
++noscript
++fast
+:1
+:-2
+:1
+*6
+$12
+punsubscribe
+:-1
+*4
++pubsub
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$4
+xack
+:-4
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$10
+pfselftest
+:1
+*1
++admin
+:0
+:0
+:0
+*6
+$6
+substr
+:4
+*1
++readonly
+:1
+:1
+:1
+*6
+$8
+smembers
+:2
+*2
++readonly
++sort_for_script
+:1
+:1
+:1
+*6
+$11
+unsubscribe
+:-1
+*4
++pubsub
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$11
+zinterstore
+:-4
+*3
++write
++denyoom
++movablekeys
+:0
+:0
+:0
+*6
+$6
+strlen
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$7
+pfmerge
+:-2
+*2
++write
++denyoom
+:1
+:-1
+:1
+*6
+$9
+randomkey
+:1
+*2
++readonly
++random
+:0
+:0
+:0
+*6
+$6
+lolwut
+:-1
+*1
++readonly
+:0
+:0
+:0
+*6
+$4
+rpop
+:2
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$5
+hkeys
+:2
+*2
++readonly
++sort_for_script
+:1
+:1
+:1
+*6
+$6
+client
+:-2
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$6
+module
+:-2
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$7
+slowlog
+:-2
+*2
++admin
++random
+:0
+:0
+:0
+*6
+$7
+geohash
+:-2
+*1
++readonly
+:1
+:1
+:1
+*6
+$6
+lrange
+:4
+*1
++readonly
+:1
+:1
+:1
+*6
+$4
+ping
+:-1
+*2
++stale
++fast
+:0
+:0
+:0
+*6
+$8
+bitcount
+:-2
+*1
++readonly
+:1
+:1
+:1
+*6
+$6
+pubsub
+:-2
+*4
++pubsub
++random
++loading
++stale
+:0
+:0
+:0
+*6
+$4
+role
+:1
+*3
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$4
+hget
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+object
+:-2
+*2
++readonly
++random
+:2
+:2
+:1
+*6
+$9
+zrevrange
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$7
+hincrby
+:4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$9
+zlexcount
+:4
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$5
+scard
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+append
+:3
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$7
+hstrlen
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+config
+:-2
+*4
++admin
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$4
+hset
+:-4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$16
+zrevrangebyscore
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$4
+incr
+:2
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$6
+setbit
+:4
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$9
+rpoplpush
+:3
+*2
++write
++denyoom
+:1
+:2
+:1
+*6
+$6
+xclaim
+:-6
+*3
++write
++random
++fast
+:1
+:1
+:1
+*6
+$11
+sinterstore
+:-3
+*2
++write
++denyoom
+:1
+:-1
+:1
+*6
+$7
+publish
+:3
+*4
++pubsub
++loading
++stale
++fast
+:0
+:0
+:0
+*6
+$5
+hscan
+:-3
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$5
+multi
+:1
+*2
++noscript
++fast
+:0
+:0
+:0
+*6
+$3
+set
+:-3
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$6
+lpushx
+:-3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$16
+zremrangebyscore
+:4
+*1
++write
+:1
+:1
+:1
+*6
+$9
+pexpireat
+:3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$4
+hdel
+:-3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$12
+bgrewriteaof
+:1
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$7
+migrate
+:-6
+*3
++write
++random
++movablekeys
+:0
+:0
+:0
+*6
+$9
+replicaof
+:3
+*3
++admin
++noscript
++stale
+:0
+:0
+:0
+*6
+$5
+touch
+:-2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+xsetid
+:3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$5
+bitop
+:-4
+*2
++write
++denyoom
+:2
+:-1
+:1
+*6
+$6
+swapdb
+:3
+*2
++write
++fast
+:0
+:0
+:0
+*6
+$5
+sdiff
+:-2
+*2
++readonly
++sort_for_script
+:1
+:-1
+:1
+*6
+$6
+lindex
+:3
+*1
++readonly
+:1
+:1
+:1
+*6
+$4
+wait
+:3
+*1
++noscript
+:0
+:0
+:0
+*6
+$4
+lrem
+:4
+*1
++write
+:1
+:1
+:1
+*6
+$6
+hsetnx
+:4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$8
+getrange
+:4
+*1
++readonly
+:1
+:1
+:1
+*6
+$4
+hlen
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$4
+post
+:-1
+*2
++loading
++stale
+:0
+:0
+:0
+*6
+$9
+sismember
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$7
+unwatch
+:1
+*2
++noscript
++fast
+:0
+:0
+:0
+*6
+$5
+lpush
+:-3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$4
+scan
+:-2
+*2
++readonly
++random
+:0
+:0
+:0
+*6
+$5
+smove
+:4
+*2
++write
++fast
+:1
+:2
+:1
+*6
+$7
+cluster
+:-2
+*1
++admin
+:0
+:0
+:0
+*6
+$6
+bgsave
+:-1
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$4
+dump
+:2
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$7
+latency
+:-2
+*4
++admin
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$8
+bzpopmin
+:-3
+*3
++write
++noscript
++fast
+:1
+:-2
+:1
+*6
+$6
+getbit
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$7
+hgetall
+:2
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$6
+rename
+:3
+*1
++write
+:1
+:2
+:1
+*6
+$9
+subscribe
+:-2
+*4
++pubsub
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$4
+xdel
+:-3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$15
+zremrangebyrank
+:4
+*1
++write
+:1
+:1
+:1
+*6
+$4
+type
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+script
+:-2
+*1
++noscript
+:0
+:0
+:0
+*6
+$5
+hmset
+:-4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$6
+sunion
+:-2
+*2
++readonly
++sort_for_script
+:1
+:-1
+:1
+*6
+$4
+mget
+:-2
+*2
++readonly
++fast
+:1
+:-1
+:1
+*6
+$10
+brpoplpush
+:4
+*3
++write
++denyoom
++noscript
+:1
+:2
+:1
+*6
+$6
+geoadd
+:-5
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$6
+decrby
+:3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$4
+echo
+:2
+*1
++fast
+:0
+:0
+:0
+*6
+$6
+dbsize
+:1
+*2
++readonly
++fast
+:0
+:0
+:0
+*6
+$5
+zcard
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+select
+:2
+*2
++loading
++fast
+:0
+:0
+:0
+*6
+$4
+sadd
+:-3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$5
+host:
+:-1
+*2
++loading
++stale
+:0
+:0
+:0
+*6
+$5
+sscan
+:-3
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$12
+georadius_ro
+:-6
+*2
++readonly
++movablekeys
+:1
+:1
+:1
+*6
+$7
+monitor
+:1
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$14
+zremrangebylex
+:4
+*1
++write
+:1
+:1
+:1
+*6
+$11
+sunionstore
+:-3
+*2
++write
++denyoom
+:1
+:-1
+:1
+*6
+$5
+zscan
+:-3
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$9
+readwrite
+:1
+*1
++fast
+:0
+:0
+:0
+*6
+$6
+xgroup
+:-2
+*2
++write
++denyoom
+:2
+:2
+:1
+*6
+$5
+setex
+:4
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$4
+save
+:1
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$5
+hvals
+:2
+*2
++readonly
++sort_for_script
+:1
+:1
+:1
+*6
+$5
+watch
+:-2
+*2
++noscript
++fast
+:1
+:-1
+:1
+*6
+$7
+hexists
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$4
+info
+:-1
+*3
++random
++loading
++stale
+:0
+:0
+:0
+*6
+$5
+psync
+:3
+*3
++readonly
++admin
++noscript
+:0
+:0
+:0
+*6
+$11
+zrangebylex
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$4
+zadd
+:-4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$4
+xlen
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$4
+auth
+:2
+*4
++noscript
++loading
++stale
++fast
+:0
+:0
+:0
+*6
+$4
+srem
+:-3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$9
+georadius
+:-6
+*2
++write
++movablekeys
+:1
+:1
+:1
+*6
+$4
+exec
+:1
+*2
++noscript
++skip_monitor
+:0
+:0
+:0
+*6
+$7
+pfcount
+:-2
+*1
++readonly
+:1
+:-1
+:1
+*6
+$7
+zpopmin
+:-2
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$4
+move
+:3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$5
+xtrim
+:-2
+*3
++write
++random
++fast
+:1
+:1
+:1
+*6
+$6
+asking
+:1
+*1
++fast
+:0
+:0
+:0
+*6
+$4
+pttl
+:2
+*3
++readonly
++random
++fast
+:1
+:1
+:1
+*6
+$11
+srandmember
+:-2
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$8
+flushall
+:-1
+*1
++write
+:0
+:0
+:0
+*6
+$4
+sort
+:-2
+*3
++write
++denyoom
++movablekeys
+:1
+:1
+:1
+*6
+$3
+del
+:-2
+*1
++write
+:1
+:-1
+:1
+*6
+$14
+restore-asking
+:-4
+*3
++write
++denyoom
++asking
+:1
+:1
+:1
+*6
+$10
+psubscribe
+:-2
+*4
++pubsub
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$4
+decr
+:2
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$6
+incrby
+:3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$14
+zrevrangebylex
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$8
+bitfield
+:-2
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$6
+exists
+:-2
+*2
++readonly
++fast
+:1
+:-1
+:1
+*6
+$8
+replconf
+:-1
+*4
++admin
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$7
+zincrby
+:4
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$5
+blpop
+:-3
+*2
++write
++noscript
+:1
+:-2
+:1
+*6
+$4
+lpop
+:2
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$3
+ttl
+:2
+*3
++readonly
++random
++fast
+:1
+:1
+:1
+*6
+$5
+xread
+:-4
+*3
++readonly
++noscript
++movablekeys
+:1
+:1
+:1
+*6
+$5
+rpush
+:-3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$8
+zrevrank
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$11
+incrbyfloat
+:3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$5
+brpop
+:-3
+*2
++write
++noscript
+:1
+:-2
+:1
+*6
+$4
+xadd
+:-5
+*4
++write
++denyoom
++random
++fast
+:1
+:1
+:1
+*6
+$8
+setrange
+:4
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$17
+georadiusbymember
+:-5
+*2
++write
++movablekeys
+:1
+:1
+:1
+*6
+$6
+unlink
+:-2
+*2
++write
++fast
+:1
+:-1
+:1
+*6
+$8
+expireat
+:3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$5
+debug
+:-2
+*2
++admin
++noscript
+:0
+:0
+:0
+*6
+$20
+georadiusbymember_ro
+:-5
+*2
++readonly
++movablekeys
+:1
+:1
+:1
+*6
+$4
+lset
+:4
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$6
+zscore
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$4
+llen
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$4
+time
+:1
+*2
++random
++fast
+:0
+:0
+:0
+*6
+$8
+shutdown
+:-1
+*4
++admin
++noscript
++loading
++stale
+:0
+:0
+:0
+*6
+$7
+evalsha
+:-3
+*2
++noscript
++movablekeys
+:0
+:0
+:0
+*6
+$6
+zcount
+:4
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+memory
+:-2
+*2
++readonly
++random
+:0
+:0
+:0
+*6
+$5
+xinfo
+:-2
+*2
++readonly
++random
+:2
+:2
+:1
+*6
+$8
+xpending
+:-3
+*2
++readonly
++random
+:1
+:1
+:1
+*6
+$4
+eval
+:-3
+*2
++noscript
++movablekeys
+:0
+:0
+:0
+*6
+$6
+xrange
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$7
+restore
+:-4
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$7
+zpopmax
+:-2
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$4
+mset
+:-3
+*2
++write
++denyoom
+:1
+:-1
+:2
+*6
+$4
+spop
+:-2
+*3
++write
++random
++fast
+:1
+:1
+:1
+*6
+$5
+ltrim
+:4
+*1
++write
+:1
+:1
+:1
+*6
+$5
+zrank
+:3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$9
+xrevrange
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$3
+get
+:2
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$7
+flushdb
+:-1
+*1
++write
+:0
+:0
+:0
+*6
+$5
+hmget
+:-3
+*2
++readonly
++fast
+:1
+:1
+:1
+*6
+$6
+msetnx
+:-3
+*2
++write
++denyoom
+:1
+:-1
+:2
+*6
+$7
+persist
+:2
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$11
+zunionstore
+:-4
+*3
++write
++denyoom
++movablekeys
+:0
+:0
+:0
+*6
+$7
+command
+:0
+*3
++random
++loading
++stale
+:0
+:0
+:0
+*6
+$8
+renamenx
+:3
+*2
++write
++fast
+:1
+:2
+:1
+*6
+$6
+zrange
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$7
+pexpire
+:3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$4
+keys
+:2
+*2
++readonly
++sort_for_script
+:0
+:0
+:0
+*6
+$4
+zrem
+:-3
+*2
++write
++fast
+:1
+:1
+:1
+*6
+$5
+pfadd
+:-2
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$6
+psetex
+:4
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$13
+zrangebyscore
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$4
+sync
+:1
+*3
++readonly
++admin
++noscript
+:0
+:0
+:0
+*6
+$7
+pfdebug
+:-3
+*1
++write
+:0
+:0
+:0
+*6
+$7
+discard
+:1
+*2
++noscript
++fast
+:0
+:0
+:0
+*6
+$8
+readonly
+:1
+*1
++fast
+:0
+:0
+:0
+*6
+$7
+geodist
+:-4
+*1
++readonly
+:1
+:1
+:1
+*6
+$6
+geopos
+:-2
+*1
++readonly
+:1
+:1
+:1
+*6
+$6
+bitpos
+:-3
+*1
++readonly
+:1
+:1
+:1
+*6
+$6
+sinter
+:-2
+*2
++readonly
++sort_for_script
+:1
+:-1
+:1
+*6
+$6
+getset
+:3
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$7
+slaveof
+:3
+*3
++admin
++noscript
++stale
+:0
+:0
+:0
+*6
+$6
+rpushx
+:-3
+*3
++write
++denyoom
++fast
+:1
+:1
+:1
+*6
+$7
+linsert
+:5
+*2
++write
++denyoom
+:1
+:1
+:1
+*6
+$6
+expire
+:3
+*2
++write
++fast
+:1
+:1
+:1
+	`
 
-	c.WriteRaw(res)
+	c.WriteBulk(res)
 }
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_connection.go b/vendor/github.com/alicebob/miniredis/v2/cmd_connection.go
index defbbccab9f5..1afb5cea180d 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_connection.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_connection.go
@@ -4,7 +4,6 @@ package miniredis
 
 import (
 	"fmt"
-	"strconv"
 	"strings"
 
 	"github.com/alicebob/miniredis/v2/server"
@@ -71,27 +70,34 @@ func (m *Miniredis) cmdAuth(c *server.Peer, cmd string, args []string) {
 	if m.checkPubsub(c, cmd) {
 		return
 	}
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
-	username := "default"
-	pw := args[0]
+
+	var opts = struct {
+		username string
+		password string
+	}{
+		username: "default",
+		password: args[0],
+	}
 	if len(args) == 2 {
-		username, pw = args[0], args[1]
+		opts.username, opts.password = args[0], args[1]
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		if len(m.passwords) == 0 && username == "default" {
+		if len(m.passwords) == 0 && opts.username == "default" {
 			c.WriteError("ERR AUTH <password> called without any password configured for the default user. Are you sure your configuration is correct?")
 			return
 		}
-		setPW, ok := m.passwords[username]
+		setPW, ok := m.passwords[opts.username]
 		if !ok {
 			c.WriteError("WRONGPASS invalid username-password pair")
 			return
 		}
-		if setPW != pw {
+		if setPW != opts.password {
 			c.WriteError("WRONGPASS invalid username-password pair")
 			return
 		}
@@ -109,17 +115,16 @@ func (m *Miniredis) cmdHello(c *server.Peer, cmd string, args []string) {
 	}
 
 	var opts struct {
-		version            int
-		username, password string
+		version  int
+		username string
+		password string
 	}
 
-	versionArg, args := args[0], args[1:]
-	var err error
-	opts.version, err = strconv.Atoi(versionArg)
-	if err != nil {
-		c.WriteError("ERR Protocol version is not an integer or out of range")
+	if ok := optIntErr(c, args[0], &opts.version, "ERR Protocol version is not an integer or out of range"); !ok {
 		return
 	}
+	args = args[1:]
+
 	switch opts.version {
 	case 2, 3:
 	default:
@@ -199,8 +204,9 @@ func (m *Miniredis) cmdEcho(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
+	msg := args[0]
+
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		msg := args[0]
 		c.WriteBulk(msg)
 	})
 }
@@ -212,27 +218,25 @@ func (m *Miniredis) cmdSelect(c *server.Peer, cmd string, args []string) {
 		c.WriteError(errWrongNumber(cmd))
 		return
 	}
-	if !m.handleAuth(c) {
+	if !m.isValidCMD(c, cmd) {
 		return
 	}
-	if m.checkPubsub(c, cmd) {
+
+	var opts struct {
+		id int
+	}
+	if ok := optInt(c, args[0], &opts.id); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		id, err := strconv.Atoi(args[0])
-		if err != nil {
-			c.WriteError(msgInvalidInt)
-			setDirty(c)
-			return
-		}
-		if id < 0 {
+		if opts.id < 0 {
 			c.WriteError(msgDBIndexOutOfRange)
 			setDirty(c)
 			return
 		}
 
-		ctx.selectedDB = id
+		ctx.selectedDB = opts.id
 		c.WriteOK()
 	})
 }
@@ -248,26 +252,26 @@ func (m *Miniredis) cmdSwapdb(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
+	var opts struct {
+		id1 int
+		id2 int
+	}
+
+	if ok := optIntErr(c, args[0], &opts.id1, "ERR invalid first DB index"); !ok {
+		return
+	}
+	if ok := optIntErr(c, args[1], &opts.id2, "ERR invalid second DB index"); !ok {
+		return
+	}
+
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		id1, err := strconv.Atoi(args[0])
-		if err != nil {
-			c.WriteError("ERR invalid first DB index")
-			setDirty(c)
-			return
-		}
-		id2, err := strconv.Atoi(args[1])
-		if err != nil {
-			c.WriteError("ERR invalid second DB index")
-			setDirty(c)
-			return
-		}
-		if id1 < 0 || id2 < 0 {
+		if opts.id1 < 0 || opts.id2 < 0 {
 			c.WriteError(msgDBIndexOutOfRange)
 			setDirty(c)
 			return
 		}
 
-		m.swapDB(id1, id2)
+		m.swapDB(opts.id1, opts.id2)
 
 		c.WriteOK()
 	})
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_generic.go b/vendor/github.com/alicebob/miniredis/v2/cmd_generic.go
index f9f06bfb96e1..55e208971408 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_generic.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_generic.go
@@ -3,6 +3,7 @@
 package miniredis
 
 import (
+	"fmt"
 	"sort"
 	"strconv"
 	"strings"
@@ -13,8 +14,8 @@ import (
 
 // commandsGeneric handles EXPIRE, TTL, PERSIST, &c.
 func commandsGeneric(m *Miniredis) {
+	m.srv.Register("COPY", m.cmdCopy)
 	m.srv.Register("DEL", m.cmdDel)
-	m.srv.Register("UNLINK", m.cmdDel)
 	// DUMP
 	m.srv.Register("EXISTS", m.cmdExists)
 	m.srv.Register("EXPIRE", makeCmdExpire(m, false, time.Second))
@@ -31,12 +32,12 @@ func commandsGeneric(m *Miniredis) {
 	m.srv.Register("RENAME", m.cmdRename)
 	m.srv.Register("RENAMENX", m.cmdRenamenx)
 	// RESTORE
-	// SORT
 	m.srv.Register("TOUCH", m.cmdTouch)
 	m.srv.Register("TTL", m.cmdTTL)
 	m.srv.Register("TYPE", m.cmdType)
 	m.srv.Register("SCAN", m.cmdScan)
-	m.srv.Register("COPY", m.cmdCopy)
+	// SORT
+	m.srv.Register("UNLINK", m.cmdDel)
 }
 
 // generic expire command for EXPIRE, PEXPIRE, EXPIREAT, PEXPIREAT
@@ -44,7 +45,7 @@ func commandsGeneric(m *Miniredis) {
 // converted to a duration.
 func makeCmdExpire(m *Miniredis, unix bool, d time.Duration) func(*server.Peer, string, []string) {
 	return func(c *server.Peer, cmd string, args []string) {
-		if len(args) != 2 {
+		if len(args) < 2 {
 			setDirty(c)
 			c.WriteError(errWrongNumber(cmd))
 			return
@@ -56,12 +57,44 @@ func makeCmdExpire(m *Miniredis, unix bool, d time.Duration) func(*server.Peer,
 			return
 		}
 
-		key := args[0]
-		value := args[1]
-		i, err := strconv.Atoi(value)
-		if err != nil {
+		var opts struct {
+			key   string
+			value int
+			nx    bool
+			xx    bool
+			gt    bool
+			lt    bool
+		}
+		opts.key = args[0]
+		if ok := optInt(c, args[1], &opts.value); !ok {
+			return
+		}
+		args = args[2:]
+		for len(args) > 0 {
+			switch strings.ToLower(args[0]) {
+			case "nx":
+				opts.nx = true
+			case "xx":
+				opts.xx = true
+			case "gt":
+				opts.gt = true
+			case "lt":
+				opts.lt = true
+			default:
+				setDirty(c)
+				c.WriteError(fmt.Sprintf("ERR Unsupported option %s", args[0]))
+				return
+			}
+			args = args[1:]
+		}
+		if opts.gt && opts.lt {
+			setDirty(c)
+			c.WriteError("ERR GT and LT options at the same time are not compatible")
+			return
+		}
+		if opts.nx && (opts.xx || opts.gt || opts.lt) {
 			setDirty(c)
-			c.WriteError(msgInvalidInt)
+			c.WriteError("ERR NX and XX, GT or LT options at the same time are not compatible")
 			return
 		}
 
@@ -69,17 +102,44 @@ func makeCmdExpire(m *Miniredis, unix bool, d time.Duration) func(*server.Peer,
 			db := m.db(ctx.selectedDB)
 
 			// Key must be present.
-			if _, ok := db.keys[key]; !ok {
+			if _, ok := db.keys[opts.key]; !ok {
 				c.WriteInt(0)
 				return
 			}
+
+			oldTTL, ok := db.ttl[opts.key]
+
+			var newTTL time.Duration
 			if unix {
-				db.ttl[key] = m.at(i, d)
+				newTTL = m.at(opts.value, d)
 			} else {
-				db.ttl[key] = time.Duration(i) * d
+				newTTL = time.Duration(opts.value) * d
+			}
+
+			// > NX -- Set expiry only when the key has no expiry
+			if opts.nx && ok {
+				c.WriteInt(0)
+				return
+			}
+			// > XX -- Set expiry only when the key has an existing expiry
+			if opts.xx && !ok {
+				c.WriteInt(0)
+				return
+			}
+			// > GT -- Set expiry only when the new expiry is greater than current one
+			// (no exp == infinity)
+			if opts.gt && (!ok || newTTL <= oldTTL) {
+				c.WriteInt(0)
+				return
+			}
+			// > LT -- Set expiry only when the new expiry is less than current one
+			if opts.lt && ok && newTTL > oldTTL {
+				c.WriteInt(0)
+				return
 			}
-			db.keyVersion[key]++
-			db.checkTTL(key)
+			db.ttl[opts.key] = newTTL
+			db.keyVersion[opts.key]++
+			db.checkTTL(opts.key)
 			c.WriteInt(1)
 		})
 	}
@@ -318,21 +378,23 @@ func (m *Miniredis) cmdMove(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	targetDB, err := strconv.Atoi(args[1])
-	if err != nil {
-		targetDB = 0
+	var opts struct {
+		key      string
+		targetDB int
 	}
 
+	opts.key = args[0]
+	opts.targetDB, _ = strconv.Atoi(args[1])
+
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		if ctx.selectedDB == targetDB {
+		if ctx.selectedDB == opts.targetDB {
 			c.WriteError("ERR source and destination objects are the same")
 			return
 		}
 		db := m.db(ctx.selectedDB)
-		targetDB := m.db(targetDB)
+		targetDB := m.db(opts.targetDB)
 
-		if !db.move(key, targetDB) {
+		if !db.move(opts.key, targetDB) {
 			c.WriteInt(0)
 			return
 		}
@@ -413,17 +475,23 @@ func (m *Miniredis) cmdRename(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	from, to := args[0], args[1]
+	opts := struct {
+		from string
+		to   string
+	}{
+		from: args[0],
+		to:   args[1],
+	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(from) {
+		if !db.exists(opts.from) {
 			c.WriteError(msgKeyNotFound)
 			return
 		}
 
-		db.rename(from, to)
+		db.rename(opts.from, opts.to)
 		c.WriteOK()
 	})
 }
@@ -442,22 +510,28 @@ func (m *Miniredis) cmdRenamenx(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	from, to := args[0], args[1]
+	opts := struct {
+		from string
+		to   string
+	}{
+		from: args[0],
+		to:   args[1],
+	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(from) {
+		if !db.exists(opts.from) {
 			c.WriteError(msgKeyNotFound)
 			return
 		}
 
-		if db.exists(to) {
+		if db.exists(opts.to) {
 			c.WriteInt(0)
 			return
 		}
 
-		db.rename(from, to)
+		db.rename(opts.from, opts.to)
 		c.WriteInt(1)
 	})
 }
@@ -476,22 +550,20 @@ func (m *Miniredis) cmdScan(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	cursor, err := strconv.Atoi(args[0])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidCursor)
-		return
-	}
-	args = args[1:]
-
-	// MATCH, COUNT and TYPE options
-	var (
+	var opts struct {
+		cursor    int
 		withMatch bool
 		match     string
 		withType  bool
 		_type     string
-	)
+	}
+
+	if ok := optIntErr(c, args[0], &opts.cursor, msgInvalidCursor); !ok {
+		return
+	}
+	args = args[1:]
 
+	// MATCH, COUNT and TYPE options
 	for len(args) > 0 {
 		if strings.ToLower(args[0]) == "count" {
 			// we do nothing with count
@@ -514,8 +586,8 @@ func (m *Miniredis) cmdScan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			withMatch = true
-			match, args = args[1], args[2:]
+			opts.withMatch = true
+			opts.match, args = args[1], args[2:]
 			continue
 		}
 		if strings.ToLower(args[0]) == "type" {
@@ -524,8 +596,8 @@ func (m *Miniredis) cmdScan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			withType = true
-			_type, args = strings.ToLower(args[1]), args[2:]
+			opts.withType = true
+			opts._type, args = strings.ToLower(args[1]), args[2:]
 			continue
 		}
 		setDirty(c)
@@ -537,7 +609,7 @@ func (m *Miniredis) cmdScan(c *server.Peer, cmd string, args []string) {
 		db := m.db(ctx.selectedDB)
 		// We return _all_ (matched) keys every time.
 
-		if cursor != 0 {
+		if opts.cursor != 0 {
 			// Invalid cursor.
 			c.WriteLen(2)
 			c.WriteBulk("0") // no next cursor
@@ -547,11 +619,11 @@ func (m *Miniredis) cmdScan(c *server.Peer, cmd string, args []string) {
 
 		var keys []string
 
-		if withType {
+		if opts.withType {
 			keys = make([]string, 0)
 			for k, t := range db.keys {
 				// type must be given exactly; no pattern matching is performed
-				if t == _type {
+				if t == opts._type {
 					keys = append(keys, k)
 				}
 			}
@@ -560,8 +632,8 @@ func (m *Miniredis) cmdScan(c *server.Peer, cmd string, args []string) {
 			keys = db.allKeys()
 		}
 
-		if withMatch {
-			keys, _ = matchKeys(keys, match)
+		if opts.withMatch {
+			keys, _ = matchKeys(keys, opts.match)
 		}
 
 		c.WriteLen(2)
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_geo.go b/vendor/github.com/alicebob/miniredis/v2/cmd_geo.go
index a6c1901d684a..29a92d550f8b 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_geo.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_geo.go
@@ -226,28 +226,28 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 	}
 	args = args[5:]
 
-	var (
-		withDist      = false
-		withCoord     = false
-		direction     = unsorted
-		count         = 0
-		withStore     = false
-		storeKey      = ""
-		withStoredist = false
-		storedistKey  = ""
-	)
+	var opts struct {
+		withDist      bool
+		withCoord     bool
+		direction     direction // unsorted
+		count         int
+		withStore     bool
+		storeKey      string
+		withStoredist bool
+		storedistKey  string
+	}
 	for len(args) > 0 {
 		arg := args[0]
 		args = args[1:]
 		switch strings.ToUpper(arg) {
 		case "WITHCOORD":
-			withCoord = true
+			opts.withCoord = true
 		case "WITHDIST":
-			withDist = true
+			opts.withDist = true
 		case "ASC":
-			direction = asc
+			opts.direction = asc
 		case "DESC":
-			direction = desc
+			opts.direction = desc
 		case "COUNT":
 			if len(args) == 0 {
 				setDirty(c)
@@ -266,15 +266,15 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 				return
 			}
 			args = args[1:]
-			count = n
+			opts.count = n
 		case "STORE":
 			if len(args) == 0 {
 				setDirty(c)
 				c.WriteError("ERR syntax error")
 				return
 			}
-			withStore = true
-			storeKey = args[0]
+			opts.withStore = true
+			opts.storeKey = args[0]
 			args = args[1:]
 		case "STOREDIST":
 			if len(args) == 0 {
@@ -282,8 +282,8 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 				c.WriteError("ERR syntax error")
 				return
 			}
-			withStoredist = true
-			storedistKey = args[0]
+			opts.withStoredist = true
+			opts.storedistKey = args[0]
 			args = args[1:]
 		default:
 			setDirty(c)
@@ -292,14 +292,14 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 		}
 	}
 
-	if strings.ToUpper(cmd) == "GEORADIUS_RO" && (withStore || withStoredist) {
+	if strings.ToUpper(cmd) == "GEORADIUS_RO" && (opts.withStore || opts.withStoredist) {
 		setDirty(c)
 		c.WriteError("ERR syntax error")
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		if (withStore || withStoredist) && (withDist || withCoord) {
+		if (opts.withStore || opts.withStoredist) && (opts.withDist || opts.withCoord) {
 			c.WriteError("ERR STORE option in GEORADIUS is not compatible with WITHDIST, WITHHASH and WITHCOORDS options")
 			return
 		}
@@ -310,9 +310,9 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 		matches := withinRadius(members, longitude, latitude, radius*toMeter)
 
 		// deal with ASC/DESC
-		if direction != unsorted {
+		if opts.direction != unsorted {
 			sort.Slice(matches, func(i, j int) bool {
-				if direction == desc {
+				if opts.direction == desc {
 					return matches[i].Distance > matches[j].Distance
 				}
 				return matches[i].Distance < matches[j].Distance
@@ -320,25 +320,25 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 		}
 
 		// deal with COUNT
-		if count > 0 && len(matches) > count {
-			matches = matches[:count]
+		if opts.count > 0 && len(matches) > opts.count {
+			matches = matches[:opts.count]
 		}
 
 		// deal with "STORE x"
-		if withStore {
-			db.del(storeKey, true)
+		if opts.withStore {
+			db.del(opts.storeKey, true)
 			for _, member := range matches {
-				db.ssetAdd(storeKey, member.Score, member.Name)
+				db.ssetAdd(opts.storeKey, member.Score, member.Name)
 			}
 			c.WriteInt(len(matches))
 			return
 		}
 
 		// deal with "STOREDIST x"
-		if withStoredist {
-			db.del(storedistKey, true)
+		if opts.withStoredist {
+			db.del(opts.storedistKey, true)
 			for _, member := range matches {
-				db.ssetAdd(storedistKey, member.Distance/toMeter, member.Name)
+				db.ssetAdd(opts.storedistKey, member.Distance/toMeter, member.Name)
 			}
 			c.WriteInt(len(matches))
 			return
@@ -346,24 +346,24 @@ func (m *Miniredis) cmdGeoradius(c *server.Peer, cmd string, args []string) {
 
 		c.WriteLen(len(matches))
 		for _, member := range matches {
-			if !withDist && !withCoord {
+			if !opts.withDist && !opts.withCoord {
 				c.WriteBulk(member.Name)
 				continue
 			}
 
 			len := 1
-			if withDist {
+			if opts.withDist {
 				len++
 			}
-			if withCoord {
+			if opts.withCoord {
 				len++
 			}
 			c.WriteLen(len)
 			c.WriteBulk(member.Name)
-			if withDist {
+			if opts.withDist {
 				c.WriteBulk(fmt.Sprintf("%.4f", member.Distance/toMeter))
 			}
-			if withCoord {
+			if opts.withCoord {
 				c.WriteLen(2)
 				c.WriteBulk(fmt.Sprintf("%f", member.Longitude))
 				c.WriteBulk(fmt.Sprintf("%f", member.Latitude))
@@ -386,45 +386,53 @@ func (m *Miniredis) cmdGeoradiusbymember(c *server.Peer, cmd string, args []stri
 		return
 	}
 
-	key := args[0]
-	member := args[1]
+	opts := struct {
+		key     string
+		member  string
+		radius  float64
+		toMeter float64
+
+		withDist      bool
+		withCoord     bool
+		direction     direction // unsorted
+		count         int
+		withStore     bool
+		storeKey      string
+		withStoredist bool
+		storedistKey  string
+	}{
+		key:    args[0],
+		member: args[1],
+	}
 
-	radius, err := strconv.ParseFloat(args[2], 64)
-	if err != nil || radius < 0 {
+	r, err := strconv.ParseFloat(args[2], 64)
+	if err != nil || r < 0 {
 		setDirty(c)
 		c.WriteError(errWrongNumber(cmd))
 		return
 	}
-	toMeter := parseUnit(args[3])
-	if toMeter == 0 {
+	opts.radius = r
+
+	opts.toMeter = parseUnit(args[3])
+	if opts.toMeter == 0 {
 		setDirty(c)
 		c.WriteError(errWrongNumber(cmd))
 		return
 	}
 	args = args[4:]
 
-	var (
-		withDist      = false
-		withCoord     = false
-		direction     = unsorted
-		count         = 0
-		withStore     = false
-		storeKey      = ""
-		withStoredist = false
-		storedistKey  = ""
-	)
 	for len(args) > 0 {
 		arg := args[0]
 		args = args[1:]
 		switch strings.ToUpper(arg) {
 		case "WITHCOORD":
-			withCoord = true
+			opts.withCoord = true
 		case "WITHDIST":
-			withDist = true
+			opts.withDist = true
 		case "ASC":
-			direction = asc
+			opts.direction = asc
 		case "DESC":
-			direction = desc
+			opts.direction = desc
 		case "COUNT":
 			if len(args) == 0 {
 				setDirty(c)
@@ -443,15 +451,15 @@ func (m *Miniredis) cmdGeoradiusbymember(c *server.Peer, cmd string, args []stri
 				return
 			}
 			args = args[1:]
-			count = n
+			opts.count = n
 		case "STORE":
 			if len(args) == 0 {
 				setDirty(c)
 				c.WriteError("ERR syntax error")
 				return
 			}
-			withStore = true
-			storeKey = args[0]
+			opts.withStore = true
+			opts.storeKey = args[0]
 			args = args[1:]
 		case "STOREDIST":
 			if len(args) == 0 {
@@ -459,8 +467,8 @@ func (m *Miniredis) cmdGeoradiusbymember(c *server.Peer, cmd string, args []stri
 				c.WriteError("ERR syntax error")
 				return
 			}
-			withStoredist = true
-			storedistKey = args[0]
+			opts.withStoredist = true
+			opts.storedistKey = args[0]
 			args = args[1:]
 		default:
 			setDirty(c)
@@ -469,44 +477,44 @@ func (m *Miniredis) cmdGeoradiusbymember(c *server.Peer, cmd string, args []stri
 		}
 	}
 
-	if strings.ToUpper(cmd) == "GEORADIUSBYMEMBER_RO" && (withStore || withStoredist) {
+	if strings.ToUpper(cmd) == "GEORADIUSBYMEMBER_RO" && (opts.withStore || opts.withStoredist) {
 		setDirty(c)
 		c.WriteError("ERR syntax error")
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		if (withStore || withStoredist) && (withDist || withCoord) {
+		if (opts.withStore || opts.withStoredist) && (opts.withDist || opts.withCoord) {
 			c.WriteError("ERR STORE option in GEORADIUS is not compatible with WITHDIST, WITHHASH and WITHCOORDS options")
 			return
 		}
 
 		db := m.db(ctx.selectedDB)
-		if !db.exists(key) {
+		if !db.exists(opts.key) {
 			c.WriteNull()
 			return
 		}
 
-		if db.t(key) != "zset" {
+		if db.t(opts.key) != "zset" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
 		// get position of member
-		if !db.ssetExists(key, member) {
+		if !db.ssetExists(opts.key, opts.member) {
 			c.WriteError("ERR could not decode requested zset member")
 			return
 		}
-		score := db.ssetScore(key, member)
+		score := db.ssetScore(opts.key, opts.member)
 		longitude, latitude := fromGeohash(uint64(score))
 
-		members := db.ssetElements(key)
-		matches := withinRadius(members, longitude, latitude, radius*toMeter)
+		members := db.ssetElements(opts.key)
+		matches := withinRadius(members, longitude, latitude, opts.radius*opts.toMeter)
 
 		// deal with ASC/DESC
-		if direction != unsorted {
+		if opts.direction != unsorted {
 			sort.Slice(matches, func(i, j int) bool {
-				if direction == desc {
+				if opts.direction == desc {
 					return matches[i].Distance > matches[j].Distance
 				}
 				return matches[i].Distance < matches[j].Distance
@@ -514,25 +522,25 @@ func (m *Miniredis) cmdGeoradiusbymember(c *server.Peer, cmd string, args []stri
 		}
 
 		// deal with COUNT
-		if count > 0 && len(matches) > count {
-			matches = matches[:count]
+		if opts.count > 0 && len(matches) > opts.count {
+			matches = matches[:opts.count]
 		}
 
 		// deal with "STORE x"
-		if withStore {
-			db.del(storeKey, true)
+		if opts.withStore {
+			db.del(opts.storeKey, true)
 			for _, member := range matches {
-				db.ssetAdd(storeKey, member.Score, member.Name)
+				db.ssetAdd(opts.storeKey, member.Score, member.Name)
 			}
 			c.WriteInt(len(matches))
 			return
 		}
 
 		// deal with "STOREDIST x"
-		if withStoredist {
-			db.del(storedistKey, true)
+		if opts.withStoredist {
+			db.del(opts.storedistKey, true)
 			for _, member := range matches {
-				db.ssetAdd(storedistKey, member.Distance/toMeter, member.Name)
+				db.ssetAdd(opts.storedistKey, member.Distance/opts.toMeter, member.Name)
 			}
 			c.WriteInt(len(matches))
 			return
@@ -540,24 +548,24 @@ func (m *Miniredis) cmdGeoradiusbymember(c *server.Peer, cmd string, args []stri
 
 		c.WriteLen(len(matches))
 		for _, member := range matches {
-			if !withDist && !withCoord {
+			if !opts.withDist && !opts.withCoord {
 				c.WriteBulk(member.Name)
 				continue
 			}
 
 			len := 1
-			if withDist {
+			if opts.withDist {
 				len++
 			}
-			if withCoord {
+			if opts.withCoord {
 				len++
 			}
 			c.WriteLen(len)
 			c.WriteBulk(member.Name)
-			if withDist {
-				c.WriteBulk(fmt.Sprintf("%.4f", member.Distance/toMeter))
+			if opts.withDist {
+				c.WriteBulk(fmt.Sprintf("%.4f", member.Distance/opts.toMeter))
 			}
-			if withCoord {
+			if opts.withCoord {
 				c.WriteLen(2)
 				c.WriteBulk(fmt.Sprintf("%f", member.Longitude))
 				c.WriteBulk(fmt.Sprintf("%f", member.Latitude))
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_hash.go b/vendor/github.com/alicebob/miniredis/v2/cmd_hash.go
index 142ba63e161a..09fa4522f377 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_hash.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_hash.go
@@ -77,27 +77,35 @@ func (m *Miniredis) cmdHsetnx(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, field, value := args[0], args[1], args[2]
+	opts := struct {
+		key   string
+		field string
+		value string
+	}{
+		key:   args[0],
+		field: args[1],
+		value: args[2],
+	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "hash" {
+		if t, ok := db.keys[opts.key]; ok && t != "hash" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		if _, ok := db.hashKeys[key]; !ok {
-			db.hashKeys[key] = map[string]string{}
-			db.keys[key] = "hash"
+		if _, ok := db.hashKeys[opts.key]; !ok {
+			db.hashKeys[opts.key] = map[string]string{}
+			db.keys[opts.key] = "hash"
 		}
-		_, ok := db.hashKeys[key][field]
+		_, ok := db.hashKeys[opts.key][opts.field]
 		if ok {
 			c.WriteInt(0)
 			return
 		}
-		db.hashKeys[key][field] = value
-		db.keyVersion[key]++
+		db.hashKeys[opts.key][opts.field] = opts.value
+		db.keyVersion[opts.key]++
 		c.WriteInt(1)
 	})
 }
@@ -191,12 +199,18 @@ func (m *Miniredis) cmdHdel(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, fields := args[0], args[1:]
+	opts := struct {
+		key    string
+		fields []string
+	}{
+		key:    args[0],
+		fields: args[1:],
+	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		t, ok := db.keys[key]
+		t, ok := db.keys[opts.key]
 		if !ok {
 			// No key is zero deleted
 			c.WriteInt(0)
@@ -208,19 +222,19 @@ func (m *Miniredis) cmdHdel(c *server.Peer, cmd string, args []string) {
 		}
 
 		deleted := 0
-		for _, f := range fields {
-			_, ok := db.hashKeys[key][f]
+		for _, f := range opts.fields {
+			_, ok := db.hashKeys[opts.key][f]
 			if !ok {
 				continue
 			}
-			delete(db.hashKeys[key], f)
+			delete(db.hashKeys[opts.key], f)
 			deleted++
 		}
 		c.WriteInt(deleted)
 
 		// Nothing left. Remove the whole key.
-		if len(db.hashKeys[key]) == 0 {
-			db.del(key, true)
+		if len(db.hashKeys[opts.key]) == 0 {
+			db.del(opts.key, true)
 		}
 	})
 }
@@ -239,12 +253,18 @@ func (m *Miniredis) cmdHexists(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, field := args[0], args[1]
+	opts := struct {
+		key   string
+		field string
+	}{
+		key:   args[0],
+		field: args[1],
+	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		t, ok := db.keys[key]
+		t, ok := db.keys[opts.key]
 		if !ok {
 			c.WriteInt(0)
 			return
@@ -254,7 +274,7 @@ func (m *Miniredis) cmdHexists(c *server.Peer, cmd string, args []string) {
 			return
 		}
 
-		if _, ok := db.hashKeys[key][field]; !ok {
+		if _, ok := db.hashKeys[opts.key][opts.field]; !ok {
 			c.WriteInt(0)
 			return
 		}
@@ -494,24 +514,27 @@ func (m *Miniredis) cmdHincrby(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, field, deltas := args[0], args[1], args[2]
-
-	delta, err := strconv.Atoi(deltas)
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	opts := struct {
+		key   string
+		field string
+		delta int
+	}{
+		key:   args[0],
+		field: args[1],
+	}
+	if ok := optInt(c, args[2], &opts.delta); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "hash" {
+		if t, ok := db.keys[opts.key]; ok && t != "hash" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		v, err := db.hashIncr(key, field, delta)
+		v, err := db.hashIncr(opts.key, opts.field, opts.delta)
 		if err != nil {
 			c.WriteError(err.Error())
 			return
@@ -534,24 +557,31 @@ func (m *Miniredis) cmdHincrbyfloat(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, field, deltas := args[0], args[1], args[2]
-
-	delta, _, err := big.ParseFloat(deltas, 10, 128, 0)
+	opts := struct {
+		key   string
+		field string
+		delta *big.Float
+	}{
+		key:   args[0],
+		field: args[1],
+	}
+	delta, _, err := big.ParseFloat(args[2], 10, 128, 0)
 	if err != nil {
 		setDirty(c)
 		c.WriteError(msgInvalidFloat)
 		return
 	}
+	opts.delta = delta
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "hash" {
+		if t, ok := db.keys[opts.key]; ok && t != "hash" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		v, err := db.hashIncrfloat(key, field, delta)
+		v, err := db.hashIncrfloat(opts.key, opts.field, opts.delta)
 		if err != nil {
 			c.WriteError(err.Error())
 			return
@@ -574,18 +604,20 @@ func (m *Miniredis) cmdHscan(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	cursor, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidCursor)
+	opts := struct {
+		key       string
+		cursor    int
+		withMatch bool
+		match     string
+	}{
+		key: args[0],
+	}
+	if ok := optIntErr(c, args[1], &opts.cursor, msgInvalidCursor); !ok {
 		return
 	}
 	args = args[2:]
 
 	// MATCH and COUNT options
-	var withMatch bool
-	var match string
 	for len(args) > 0 {
 		if strings.ToLower(args[0]) == "count" {
 			// we do nothing with count
@@ -609,8 +641,8 @@ func (m *Miniredis) cmdHscan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			withMatch = true
-			match, args = args[1], args[2:]
+			opts.withMatch = true
+			opts.match, args = args[1], args[2:]
 			continue
 		}
 		setDirty(c)
@@ -622,21 +654,21 @@ func (m *Miniredis) cmdHscan(c *server.Peer, cmd string, args []string) {
 		db := m.db(ctx.selectedDB)
 		// return _all_ (matched) keys every time
 
-		if cursor != 0 {
+		if opts.cursor != 0 {
 			// Invalid cursor.
 			c.WriteLen(2)
 			c.WriteBulk("0") // no next cursor
 			c.WriteLen(0)    // no elements
 			return
 		}
-		if db.exists(key) && db.t(key) != "hash" {
+		if db.exists(opts.key) && db.t(opts.key) != "hash" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
-		members := db.hashFields(key)
-		if withMatch {
-			members, _ = matchKeys(members, match)
+		members := db.hashFields(opts.key)
+		if opts.withMatch {
+			members, _ = matchKeys(members, opts.match)
 		}
 
 		c.WriteLen(2)
@@ -645,7 +677,7 @@ func (m *Miniredis) cmdHscan(c *server.Peer, cmd string, args []string) {
 		c.WriteLen(len(members) * 2)
 		for _, k := range members {
 			c.WriteBulk(k)
-			c.WriteBulk(db.hashGet(key, k))
+			c.WriteBulk(db.hashGet(opts.key, k))
 		}
 	})
 }
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_hll.go b/vendor/github.com/alicebob/miniredis/v2/cmd_hll.go
index bd2f90c83821..a7b483673e3a 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_hll.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_hll.go
@@ -52,7 +52,7 @@ func (m *Miniredis) cmdPfcount(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	keys := args[:]
+	keys := args
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_info.go b/vendor/github.com/alicebob/miniredis/v2/cmd_info.go
new file mode 100644
index 000000000000..e5984a9b2c07
--- /dev/null
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_info.go
@@ -0,0 +1,40 @@
+package miniredis
+
+import (
+	"fmt"
+
+	"github.com/alicebob/miniredis/v2/server"
+)
+
+// Command 'INFO' from https://redis.io/commands/info/
+func (m *Miniredis) cmdInfo(c *server.Peer, cmd string, args []string) {
+	if !m.isValidCMD(c, cmd) {
+		return
+	}
+
+	if len(args) > 1 {
+		setDirty(c)
+		c.WriteError(errWrongNumber(cmd))
+		return
+	}
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		const (
+			clientsSectionName    = "clients"
+			clientsSectionContent = "# Clients\nconnected_clients:%d\r\n"
+		)
+
+		var result string
+
+		for _, key := range args {
+			if key != clientsSectionName {
+				setDirty(c)
+				c.WriteError(fmt.Sprintf("section (%s) is not supported", key))
+				return
+			}
+		}
+		result = fmt.Sprintf(clientsSectionContent, m.Server().ClientsLen())
+
+		c.WriteBulk(result)
+	})
+}
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_list.go b/vendor/github.com/alicebob/miniredis/v2/cmd_list.go
index 62f9691887bf..0e74373b0173 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_list.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_list.go
@@ -23,6 +23,7 @@ func commandsList(m *Miniredis) {
 	m.srv.Register("BRPOP", m.cmdBrpop)
 	m.srv.Register("BRPOPLPUSH", m.cmdBrpoplpush)
 	m.srv.Register("LINDEX", m.cmdLindex)
+	m.srv.Register("LPOS", m.cmdLpos)
 	m.srv.Register("LINSERT", m.cmdLinsert)
 	m.srv.Register("LLEN", m.cmdLlen)
 	m.srv.Register("LPOP", m.cmdLpop)
@@ -62,28 +63,23 @@ func (m *Miniredis) cmdBXpop(c *server.Peer, cmd string, args []string, lr leftr
 		return
 	}
 
-	timeoutS := args[len(args)-1]
-	keys := args[:len(args)-1]
-
-	timeout, err := strconv.Atoi(timeoutS)
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidTimeout)
-		return
+	var opts struct {
+		keys    []string
+		timeout time.Duration
 	}
-	if timeout < 0 {
-		setDirty(c)
-		c.WriteError(msgNegTimeout)
+
+	if ok := optDuration(c, args[len(args)-1], &opts.timeout); !ok {
 		return
 	}
+	opts.keys = args[:len(args)-1]
 
 	blocking(
 		m,
 		c,
-		time.Duration(timeout)*time.Second,
+		opts.timeout,
 		func(c *server.Peer, ctx *connCtx) bool {
 			db := m.db(ctx.selectedDB)
-			for _, key := range keys {
+			for _, key := range opts.keys {
 				if !db.exists(key) {
 					continue
 				}
@@ -165,6 +161,153 @@ func (m *Miniredis) cmdLindex(c *server.Peer, cmd string, args []string) {
 	})
 }
 
+// LPOS key element [RANK rank] [COUNT num-matches] [MAXLEN len]
+func (m *Miniredis) cmdLpos(c *server.Peer, cmd string, args []string) {
+	if !m.handleAuth(c) {
+		return
+	}
+	if m.checkPubsub(c, cmd) {
+		return
+	}
+
+	if len(args) == 1 {
+		setDirty(c)
+		c.WriteError(errWrongNumber(cmd))
+		return
+	}
+
+	// Extract options from arguments if present.
+	//
+	// Redis allows duplicate options and uses the last specified.
+	// `LPOS key term RANK 1 RANK 2` is effectively the same as
+	// `LPOS key term RANK 2`
+	if len(args)%2 == 1 {
+		setDirty(c)
+		c.WriteError(msgSyntaxError)
+		return
+	}
+	rank, count := 1, 1 // Default values
+	var maxlen int      // Default value is the list length (see below)
+	var countSpecified, maxlenSpecified bool
+	if len(args) > 2 {
+		for i := 2; i < len(args); i++ {
+			if i%2 == 0 {
+				val := args[i+1]
+				var err error
+				switch strings.ToLower(args[i]) {
+				case "rank":
+					if rank, err = strconv.Atoi(val); err != nil {
+						setDirty(c)
+						c.WriteError(msgInvalidInt)
+						return
+					}
+					if rank == 0 {
+						setDirty(c)
+						c.WriteError(msgRankIsZero)
+						return
+					}
+				case "count":
+					countSpecified = true
+					if count, err = strconv.Atoi(val); err != nil || count < 0 {
+						setDirty(c)
+						c.WriteError(msgCountIsNegative)
+						return
+					}
+				case "maxlen":
+					maxlenSpecified = true
+					if maxlen, err = strconv.Atoi(val); err != nil || maxlen < 0 {
+						setDirty(c)
+						c.WriteError(msgMaxLengthIsNegative)
+						return
+					}
+				default:
+					setDirty(c)
+					c.WriteError(msgSyntaxError)
+					return
+				}
+			}
+		}
+	}
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+		key, element := args[0], args[1]
+		t, ok := db.keys[key]
+		if !ok {
+			// No such key
+			c.WriteNull()
+			return
+		}
+		if t != "list" {
+			c.WriteError(msgWrongType)
+			return
+		}
+		l := db.listKeys[key]
+
+		// RANK cannot be zero (see above).
+		// If RANK is positive search forward (left to right).
+		// If RANK is negative search backward (right to left).
+		// Iterator returns true to continue iterating.
+		iterate := func(iterator func(i int, e string) bool) {
+			comparisons := len(l)
+			// Only use max length if specified, not zero, and less than total length.
+			// When max length is specified, but is zero, this means "unlimited".
+			if maxlenSpecified && maxlen != 0 && maxlen < len(l) {
+				comparisons = maxlen
+			}
+			if rank > 0 {
+				for i := 0; i < comparisons; i++ {
+					if resume := iterator(i, l[i]); !resume {
+						return
+					}
+				}
+			} else if rank < 0 {
+				start := len(l) - 1
+				end := len(l) - comparisons
+				for i := start; i >= end; i-- {
+					if resume := iterator(i, l[i]); !resume {
+						return
+					}
+				}
+			}
+		}
+
+		var currentRank, currentCount int
+		vals := make([]int, 0, count)
+		iterate(func(i int, e string) bool {
+			if e == element {
+				currentRank++
+				// Only collect values only after surpassing the absolute value of rank.
+				if rank > 0 && currentRank < rank {
+					return true
+				}
+				if rank < 0 && currentRank < -rank {
+					return true
+				}
+				vals = append(vals, i)
+				currentCount++
+				if currentCount == count {
+					return false
+				}
+			}
+			return true
+		})
+
+		if !countSpecified && len(vals) == 0 {
+			c.WriteNull()
+			return
+		}
+		if !countSpecified && len(vals) == 1 {
+			c.WriteInt(vals[0])
+			return
+		}
+		c.WriteLen(len(vals))
+		for _, val := range vals {
+			c.WriteInt(val)
+		}
+	})
+}
+
 // LINSERT
 func (m *Miniredis) cmdLinsert(c *server.Peer, cmd string, args []string) {
 	if len(args) != 4 {
@@ -297,18 +440,14 @@ func (m *Miniredis) cmdXpop(c *server.Peer, cmd string, args []string, lr leftri
 
 	opts.key, args = args[0], args[1:]
 	if len(args) > 0 {
-		v, err := strconv.Atoi(args[0])
-		if err != nil {
-			setDirty(c)
-			c.WriteError(msgInvalidInt)
+		if ok := optInt(c, args[0], &opts.count); !ok {
 			return
 		}
-		if v < 0 {
+		if opts.count < 0 {
 			setDirty(c)
 			c.WriteError(msgOutOfRange)
 			return
 		}
-		opts.count = v
 		opts.withCount = true
 		args = args[1:]
 	}
@@ -323,6 +462,11 @@ func (m *Miniredis) cmdXpop(c *server.Peer, cmd string, args []string, lr leftri
 
 		if !db.exists(opts.key) {
 			// non-existing key is fine
+			if opts.withCount && !c.Resp3 {
+				// zero-length list in this specific case. Looks like a redis bug to me.
+				c.WriteLen(-1)
+				return
+			}
 			c.WriteNull()
 			return
 		}
@@ -342,11 +486,7 @@ func (m *Miniredis) cmdXpop(c *server.Peer, cmd string, args []string, lr leftri
 				}
 				opts.count -= 1
 			}
-			if len(popped) == 0 {
-				c.WriteLen(-1)
-			} else {
-				c.WriteStrings(popped)
-			}
+			c.WriteStrings(popped)
 			return
 		}
 
@@ -471,35 +611,35 @@ func (m *Miniredis) cmdLrange(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	start, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	opts := struct {
+		key   string
+		start int
+		end   int
+	}{
+		key: args[0],
+	}
+	if ok := optInt(c, args[1], &opts.start); !ok {
 		return
 	}
-	end, err := strconv.Atoi(args[2])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	if ok := optInt(c, args[2], &opts.end); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "list" {
+		if t, ok := db.keys[opts.key]; ok && t != "list" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		l := db.listKeys[key]
+		l := db.listKeys[opts.key]
 		if len(l) == 0 {
 			c.WriteLen(0)
 			return
 		}
 
-		rs, re := redisRange(len(l), start, end, false)
+		rs, re := redisRange(len(l), opts.start, opts.end, false)
 		c.WriteLen(re - rs)
 		for _, el := range l[rs:re] {
 			c.WriteBulk(el)
@@ -521,42 +661,44 @@ func (m *Miniredis) cmdLrem(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	count, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		count int
+		value string
+	}
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.count); !ok {
 		return
 	}
-	value := args[2]
+	opts.value = args[2]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(key) {
+		if !db.exists(opts.key) {
 			c.WriteInt(0)
 			return
 		}
-		if db.t(key) != "list" {
+		if db.t(opts.key) != "list" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		l := db.listKeys[key]
-		if count < 0 {
+		l := db.listKeys[opts.key]
+		if opts.count < 0 {
 			reverseSlice(l)
 		}
 		deleted := 0
 		newL := []string{}
 		toDelete := len(l)
-		if count < 0 {
-			toDelete = -count
+		if opts.count < 0 {
+			toDelete = -opts.count
 		}
-		if count > 0 {
-			toDelete = count
+		if opts.count > 0 {
+			toDelete = opts.count
 		}
 		for _, el := range l {
-			if el == value {
+			if el == opts.value {
 				if toDelete > 0 {
 					deleted++
 					toDelete--
@@ -565,14 +707,14 @@ func (m *Miniredis) cmdLrem(c *server.Peer, cmd string, args []string) {
 			}
 			newL = append(newL, el)
 		}
-		if count < 0 {
+		if opts.count < 0 {
 			reverseSlice(newL)
 		}
 		if len(newL) == 0 {
-			db.del(key, true)
+			db.del(opts.key, true)
 		} else {
-			db.listKeys[key] = newL
-			db.keyVersion[key]++
+			db.listKeys[opts.key] = newL
+			db.keyVersion[opts.key]++
 		}
 
 		c.WriteInt(deleted)
@@ -593,28 +735,31 @@ func (m *Miniredis) cmdLset(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	index, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		index int
+		value string
+	}
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.index); !ok {
 		return
 	}
-	value := args[2]
+	opts.value = args[2]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(key) {
+		if !db.exists(opts.key) {
 			c.WriteError(msgKeyNotFound)
 			return
 		}
-		if db.t(key) != "list" {
+		if db.t(opts.key) != "list" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		l := db.listKeys[key]
+		l := db.listKeys[opts.key]
+		index := opts.index
 		if index < 0 {
 			index = len(l) + index
 		}
@@ -622,8 +767,8 @@ func (m *Miniredis) cmdLset(c *server.Peer, cmd string, args []string) {
 			c.WriteError(msgOutOfRange)
 			return
 		}
-		l[index] = value
-		db.keyVersion[key]++
+		l[index] = opts.value
+		db.keyVersion[opts.key]++
 
 		c.WriteOK()
 	})
@@ -643,24 +788,24 @@ func (m *Miniredis) cmdLtrim(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	start, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		start int
+		end   int
+	}
+
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.start); !ok {
 		return
 	}
-	end, err := strconv.Atoi(args[2])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	if ok := optInt(c, args[2], &opts.end); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		t, ok := db.keys[key]
+		t, ok := db.keys[opts.key]
 		if !ok {
 			c.WriteOK()
 			return
@@ -670,14 +815,14 @@ func (m *Miniredis) cmdLtrim(c *server.Peer, cmd string, args []string) {
 			return
 		}
 
-		l := db.listKeys[key]
-		rs, re := redisRange(len(l), start, end, false)
+		l := db.listKeys[opts.key]
+		rs, re := redisRange(len(l), opts.start, opts.end, false)
 		l = l[rs:re]
 		if len(l) == 0 {
-			db.del(key, true)
+			db.del(opts.key, true)
 		} else {
-			db.listKeys[key] = l
-			db.keyVersion[key]++
+			db.listKeys[opts.key] = l
+			db.keyVersion[opts.key]++
 		}
 		c.WriteOK()
 	})
@@ -730,39 +875,36 @@ func (m *Miniredis) cmdBrpoplpush(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	src := args[0]
-	dst := args[1]
-	timeout, err := strconv.Atoi(args[2])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidTimeout)
-		return
+	var opts struct {
+		src     string
+		dst     string
+		timeout time.Duration
 	}
-	if timeout < 0 {
-		setDirty(c)
-		c.WriteError(msgNegTimeout)
+	opts.src = args[0]
+	opts.dst = args[1]
+	if ok := optDuration(c, args[2], &opts.timeout); !ok {
 		return
 	}
 
 	blocking(
 		m,
 		c,
-		time.Duration(timeout)*time.Second,
+		opts.timeout,
 		func(c *server.Peer, ctx *connCtx) bool {
 			db := m.db(ctx.selectedDB)
 
-			if !db.exists(src) {
+			if !db.exists(opts.src) {
 				return false
 			}
-			if db.t(src) != "list" || (db.exists(dst) && db.t(dst) != "list") {
+			if db.t(opts.src) != "list" || (db.exists(opts.dst) && db.t(opts.dst) != "list") {
 				c.WriteError(msgWrongType)
 				return true
 			}
-			if len(db.listKeys[src]) == 0 {
+			if len(db.listKeys[opts.src]) == 0 {
 				return false
 			}
-			elem := db.listPop(src)
-			db.listLpush(dst, elem)
+			elem := db.listPop(opts.src)
+			db.listLpush(opts.dst, elem)
 			c.WriteBulk(elem)
 			return true
 		},
@@ -787,34 +929,46 @@ func (m *Miniredis) cmdLmove(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	src, dst, srcDir, dstDir := args[0], args[1], strings.ToLower(args[2]), strings.ToLower(args[3])
+	opts := struct {
+		src    string
+		dst    string
+		srcDir string
+		dstDir string
+	}{
+		src:    args[0],
+		dst:    args[1],
+		srcDir: strings.ToLower(args[2]),
+		dstDir: strings.ToLower(args[3]),
+	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(src) {
+		if !db.exists(opts.src) {
 			c.WriteNull()
 			return
 		}
-		if db.t(src) != "list" || (db.exists(dst) && db.t(dst) != "list") {
+		if db.t(opts.src) != "list" || (db.exists(opts.dst) && db.t(opts.dst) != "list") {
 			c.WriteError(msgWrongType)
 			return
 		}
 		var elem string
-		if srcDir == "left" {
-			elem = db.listLpop(src)
-		} else if srcDir == "right" {
-			elem = db.listPop(src)
-		} else {
+		switch opts.srcDir {
+		case "left":
+			elem = db.listLpop(opts.src)
+		case "right":
+			elem = db.listPop(opts.src)
+		default:
 			c.WriteError(msgSyntaxError)
 			return
 		}
 
-		if dstDir == "left" {
-			db.listLpush(dst, elem)
-		} else if dstDir == "right" {
-			db.listPush(dst, elem)
-		} else {
+		switch opts.dstDir {
+		case "left":
+			db.listLpush(opts.dst, elem)
+		case "right":
+			db.listPush(opts.dst, elem)
+		default:
 			c.WriteError(msgSyntaxError)
 			return
 		}
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_pubsub.go b/vendor/github.com/alicebob/miniredis/v2/cmd_pubsub.go
index 70997be5ab19..0fc9f0de355c 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_pubsub.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_pubsub.go
@@ -29,8 +29,9 @@ func (m *Miniredis) cmdSubscribe(c *server.Peer, cmd string, args []string) {
 	if !m.handleAuth(c) {
 		return
 	}
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
@@ -53,8 +54,9 @@ func (m *Miniredis) cmdUnsubscribe(c *server.Peer, cmd string, args []string) {
 	if !m.handleAuth(c) {
 		return
 	}
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
@@ -103,8 +105,9 @@ func (m *Miniredis) cmdPsubscribe(c *server.Peer, cmd string, args []string) {
 	if !m.handleAuth(c) {
 		return
 	}
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
@@ -127,8 +130,9 @@ func (m *Miniredis) cmdPunsubscribe(c *server.Peer, cmd string, args []string) {
 	if !m.handleAuth(c) {
 		return
 	}
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
@@ -212,7 +216,9 @@ func (m *Miniredis) cmdPubSub(c *server.Peer, cmd string, args []string) {
 	case "NUMPAT":
 		argsOk = len(subargs) == 0
 	default:
-		argsOk = false
+		setDirty(c)
+		c.WriteError(fmt.Sprintf(msgFPubsubUsageSimple, subcommand))
+		return
 	}
 
 	if !argsOk {
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_scripting.go b/vendor/github.com/alicebob/miniredis/v2/cmd_scripting.go
index ef10aaef0fef..9f5ce9ef2d5b 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_scripting.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_scripting.go
@@ -23,7 +23,7 @@ func commandsScripting(m *Miniredis) {
 
 // Execute lua. Needs to run m.Lock()ed, from within withTx().
 // Returns true if the lua was OK (and hence should be cached).
-func (m *Miniredis) runLuaScript(c *server.Peer, script string, args []string) bool {
+func (m *Miniredis) runLuaScript(c *server.Peer, sha, script string, args []string) bool {
 	l := lua.NewState(lua.Options{SkipOpenLibs: true})
 	defer l.Close()
 
@@ -80,7 +80,7 @@ func (m *Miniredis) runLuaScript(c *server.Peer, script string, args []string) b
 	}
 	l.SetGlobal("ARGV", argvTable)
 
-	redisFuncs, redisConstants := mkLua(m.srv, c)
+	redisFuncs, redisConstants := mkLua(m.srv, c, sha)
 	// Register command handlers
 	l.Push(l.NewFunction(func(l *lua.LState) int {
 		mod := l.RegisterModule("redis", redisFuncs).(*lua.LTable)
@@ -117,18 +117,18 @@ func (m *Miniredis) cmdEval(c *server.Peer, cmd string, args []string) {
 	if m.checkPubsub(c, cmd) {
 		return
 	}
-
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
 	script, args := args[0], args[1:]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		ok := m.runLuaScript(c, script, args)
+		sha := sha1Hex(script)
+		ok := m.runLuaScript(c, sha, script, args)
 		if ok {
-			sha := sha1Hex(script)
 			m.scripts[sha] = script
 		}
 	})
@@ -146,8 +146,9 @@ func (m *Miniredis) cmdEvalsha(c *server.Peer, cmd string, args []string) {
 	if m.checkPubsub(c, cmd) {
 		return
 	}
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
@@ -160,7 +161,7 @@ func (m *Miniredis) cmdEvalsha(c *server.Peer, cmd string, args []string) {
 			return
 		}
 
-		m.runLuaScript(c, script, args)
+		m.runLuaScript(c, sha, script, args)
 	})
 }
 
@@ -177,28 +178,62 @@ func (m *Miniredis) cmdScript(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	if getCtx(c).nested {
-		c.WriteError(msgNotFromScripts)
+	ctx := getCtx(c)
+	if ctx.nested {
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 
-	subcmd, args := args[0], args[1:]
+	var opts struct {
+		subcmd string
+		script string
+	}
 
-	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-		switch strings.ToLower(subcmd) {
-		case "load":
-			if len(args) != 1 {
-				c.WriteError(fmt.Sprintf(msgFScriptUsage, "LOAD"))
-				return
+	opts.subcmd, args = args[0], args[1:]
+
+	switch strings.ToLower(opts.subcmd) {
+	case "load":
+		if len(args) != 1 {
+			setDirty(c)
+			c.WriteError(fmt.Sprintf(msgFScriptUsage, "LOAD"))
+			return
+		}
+		opts.script = args[0]
+	case "exists":
+		if len(args) == 0 {
+			setDirty(c)
+			c.WriteError(errWrongNumber("script|exists"))
+			return
+		}
+	case "flush":
+		if len(args) == 1 {
+			switch strings.ToUpper(args[0]) {
+			case "SYNC", "ASYNC":
+				args = args[1:]
+			default:
 			}
-			script := args[0]
+		}
+		if len(args) != 0 {
+			setDirty(c)
+			c.WriteError(msgScriptFlush)
+			return
+		}
 
-			if _, err := parse.Parse(strings.NewReader(script), "user_script"); err != nil {
+	default:
+		setDirty(c)
+		c.WriteError(fmt.Sprintf(msgFScriptUsageSimple, strings.ToUpper(opts.subcmd)))
+		return
+	}
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		switch strings.ToLower(opts.subcmd) {
+		case "load":
+			if _, err := parse.Parse(strings.NewReader(opts.script), "user_script"); err != nil {
 				c.WriteError(errLuaParseError(err))
 				return
 			}
-			sha := sha1Hex(script)
-			m.scripts[sha] = script
+			sha := sha1Hex(opts.script)
+			m.scripts[sha] = opts.script
 			c.WriteBulk(sha)
 
 		case "exists":
@@ -212,23 +247,9 @@ func (m *Miniredis) cmdScript(c *server.Peer, cmd string, args []string) {
 			}
 
 		case "flush":
-			if len(args) == 1 {
-				switch strings.ToUpper(args[0]) {
-				case "SYNC", "ASYNC":
-					args = args[1:]
-				default:
-				}
-			}
-			if len(args) != 0 {
-				c.WriteError(msgScriptFlush)
-				return
-			}
-
 			m.scripts = map[string]string{}
 			c.WriteOK()
 
-		default:
-			c.WriteError(fmt.Sprintf(msgFScriptUsage, strings.ToUpper(subcmd)))
 		}
 	})
 }
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_server.go b/vendor/github.com/alicebob/miniredis/v2/cmd_server.go
index 223651d39eb2..6e51727ba59e 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_server.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_server.go
@@ -10,9 +10,11 @@ import (
 )
 
 func commandsServer(m *Miniredis) {
+	m.srv.Register("COMMAND", m.cmdCommand)
 	m.srv.Register("DBSIZE", m.cmdDbsize)
 	m.srv.Register("FLUSHALL", m.cmdFlushall)
 	m.srv.Register("FLUSHDB", m.cmdFlushdb)
+	m.srv.Register("INFO", m.cmdInfo)
 	m.srv.Register("TIME", m.cmdTime)
 }
 
@@ -100,8 +102,8 @@ func (m *Miniredis) cmdTime(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		now := m.effectiveNow()
 		nanos := now.UnixNano()
-		seconds := nanos / 1000000000
-		microseconds := (nanos / 1000) % 1000000
+		seconds := nanos / 1_000_000_000
+		microseconds := (nanos / 1_000) % 1_000_000
 
 		c.WriteLen(2)
 		c.WriteBulk(strconv.FormatInt(seconds, 10))
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_set.go b/vendor/github.com/alicebob/miniredis/v2/cmd_set.go
index a9cdf411a0e0..65b3b6bfbbd4 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_set.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_set.go
@@ -3,6 +3,7 @@
 package miniredis
 
 import (
+	"fmt"
 	"strconv"
 	"strings"
 
@@ -609,17 +610,22 @@ func (m *Miniredis) cmdSscan(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	cursor, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidCursor)
+	var opts struct {
+		key       string
+		value     int
+		cursor    int
+		count     int
+		withMatch bool
+		match     string
+	}
+
+	opts.key = args[0]
+	if ok := optIntErr(c, args[1], &opts.cursor, msgInvalidCursor); !ok {
 		return
 	}
 	args = args[2:]
+
 	// MATCH and COUNT options
-	var withMatch bool
-	var match string
 	for len(args) > 0 {
 		if strings.ToLower(args[0]) == "count" {
 			if len(args) < 2 {
@@ -627,13 +633,18 @@ func (m *Miniredis) cmdSscan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			_, err := strconv.Atoi(args[1])
-			if err != nil {
+			count, err := strconv.Atoi(args[1])
+			if err != nil || count < 0 {
 				setDirty(c)
 				c.WriteError(msgInvalidInt)
 				return
 			}
-			// We do nothing with count.
+			if count == 0 {
+				setDirty(c)
+				c.WriteError(msgSyntaxError)
+				return
+			}
+			opts.count = count
 			args = args[2:]
 			continue
 		}
@@ -643,8 +654,8 @@ func (m *Miniredis) cmdSscan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			withMatch = true
-			match = args[1]
+			opts.withMatch = true
+			opts.match = args[1]
 			args = args[2:]
 			continue
 		}
@@ -656,29 +667,38 @@ func (m *Miniredis) cmdSscan(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 		// return _all_ (matched) keys every time
-
-		if cursor != 0 {
+		if db.exists(opts.key) && db.t(opts.key) != "set" {
+			c.WriteError(ErrWrongType.Error())
+			return
+		}
+		members := db.setMembers(opts.key)
+		if opts.withMatch {
+			members, _ = matchKeys(members, opts.match)
+		}
+		low := opts.cursor
+		high := low + opts.count
+		// validate high is correct
+		if high > len(members) || high == 0 {
+			high = len(members)
+		}
+		if opts.cursor > high {
 			// invalid cursor
 			c.WriteLen(2)
 			c.WriteBulk("0") // no next cursor
 			c.WriteLen(0)    // no elements
 			return
 		}
-		if db.exists(key) && db.t(key) != "set" {
-			c.WriteError(ErrWrongType.Error())
-			return
-		}
-
-		members := db.setMembers(key)
-		if withMatch {
-			members, _ = matchKeys(members, match)
+		cursorValue := low + opts.count
+		if cursorValue > len(members) {
+			cursorValue = 0 // no next cursor
 		}
-
+		members = members[low:high]
 		c.WriteLen(2)
-		c.WriteBulk("0") // no next cursor
+		c.WriteBulk(fmt.Sprintf("%d", cursorValue))
 		c.WriteLen(len(members))
 		for _, k := range members {
 			c.WriteBulk(k)
 		}
+
 	})
 }
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_sorted_set.go b/vendor/github.com/alicebob/miniredis/v2/cmd_sorted_set.go
index 75b540bafbe4..ab25c257c2d7 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_sorted_set.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_sorted_set.go
@@ -55,42 +55,44 @@ func (m *Miniredis) cmdZadd(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, args := args[0], args[1:]
-	var (
-		nx    = false
-		xx    = false
-		gt    = false
-		lt    = false
-		ch    = false
-		incr  = false
-		elems = map[string]float64{}
-	)
+	var opts struct {
+		key  string
+		nx   bool
+		xx   bool
+		gt   bool
+		lt   bool
+		ch   bool
+		incr bool
+	}
+	elems := map[string]float64{}
 
+	opts.key = args[0]
+	args = args[1:]
 outer:
 	for len(args) > 0 {
 		switch strings.ToUpper(args[0]) {
 		case "NX":
-			nx = true
+			opts.nx = true
 			args = args[1:]
 			continue
 		case "XX":
-			xx = true
+			opts.xx = true
 			args = args[1:]
 			continue
 		case "GT":
-			gt = true
+			opts.gt = true
 			args = args[1:]
 			continue
 		case "LT":
-			lt = true
+			opts.lt = true
 			args = args[1:]
 			continue
 		case "CH":
-			ch = true
+			opts.ch = true
 			args = args[1:]
 			continue
 		case "INCR":
-			incr = true
+			opts.incr = true
 			args = args[1:]
 			continue
 		default:
@@ -114,21 +116,21 @@ outer:
 		args = args[2:]
 	}
 
-	if xx && nx {
+	if opts.xx && opts.nx {
 		setDirty(c)
 		c.WriteError(msgXXandNX)
 		return
 	}
 
-	if gt && lt ||
-		gt && nx ||
-		lt && nx {
+	if opts.gt && opts.lt ||
+		opts.gt && opts.nx ||
+		opts.lt && opts.nx {
 		setDirty(c)
 		c.WriteError(msgGTLTandNX)
 		return
 	}
 
-	if incr && len(elems) > 1 {
+	if opts.incr && len(elems) > 1 {
 		setDirty(c)
 		c.WriteError(msgSingleElementPair)
 		return
@@ -137,22 +139,22 @@ outer:
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if db.exists(key) && db.t(key) != "zset" {
+		if db.exists(opts.key) && db.t(opts.key) != "zset" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
-		if incr {
+		if opts.incr {
 			for member, delta := range elems {
-				if nx && db.ssetExists(key, member) {
+				if opts.nx && db.ssetExists(opts.key, member) {
 					c.WriteNull()
 					return
 				}
-				if xx && !db.ssetExists(key, member) {
+				if opts.xx && !db.ssetExists(opts.key, member) {
 					c.WriteNull()
 					return
 				}
-				newScore := db.ssetIncrby(key, member, delta)
+				newScore := db.ssetIncrby(opts.key, member, delta)
 				c.WriteFloat(newScore)
 			}
 			return
@@ -160,23 +162,23 @@ outer:
 
 		res := 0
 		for member, score := range elems {
-			if nx && db.ssetExists(key, member) {
+			if opts.nx && db.ssetExists(opts.key, member) {
 				continue
 			}
-			if xx && !db.ssetExists(key, member) {
+			if opts.xx && !db.ssetExists(opts.key, member) {
 				continue
 			}
-			old := db.ssetScore(key, member)
-			if gt && score <= old {
+			old := db.ssetScore(opts.key, member)
+			if opts.gt && score <= old {
 				continue
 			}
-			if lt && score >= old {
+			if opts.lt && score >= old {
 				continue
 			}
-			if db.ssetAdd(key, score, member) {
+			if db.ssetAdd(opts.key, score, member) {
 				res++
 			} else {
-				if ch && old != score {
+				if opts.ch && old != score {
 					// if 'CH' is specified, only count changed keys
 					res++
 				}
@@ -233,14 +235,25 @@ func (m *Miniredis) cmdZcount(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	min, minIncl, err := parseFloatRange(args[1])
+	var (
+		opts struct {
+			key     string
+			min     float64
+			minIncl bool
+			max     float64
+			maxIncl bool
+		}
+		err error
+	)
+
+	opts.key = args[0]
+	opts.min, opts.minIncl, err = parseFloatRange(args[1])
 	if err != nil {
 		setDirty(c)
 		c.WriteError(msgInvalidMinMax)
 		return
 	}
-	max, maxIncl, err := parseFloatRange(args[2])
+	opts.max, opts.maxIncl, err = parseFloatRange(args[2])
 	if err != nil {
 		setDirty(c)
 		c.WriteError(msgInvalidMinMax)
@@ -250,18 +263,18 @@ func (m *Miniredis) cmdZcount(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(key) {
+		if !db.exists(opts.key) {
 			c.WriteInt(0)
 			return
 		}
 
-		if db.t(key) != "zset" {
+		if db.t(opts.key) != "zset" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
-		members := db.ssetElements(key)
-		members = withSSRange(members, min, minIncl, max, maxIncl)
+		members := db.ssetElements(opts.key)
+		members = withSSRange(members, opts.min, opts.minIncl, opts.max, opts.maxIncl)
 		c.WriteInt(len(members))
 	})
 }
@@ -280,23 +293,30 @@ func (m *Miniredis) cmdZincrby(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	delta, err := strconv.ParseFloat(args[1], 64)
+	var opts struct {
+		key    string
+		delta  float64
+		member string
+	}
+
+	opts.key = args[0]
+	d, err := strconv.ParseFloat(args[1], 64)
 	if err != nil {
 		setDirty(c)
 		c.WriteError(msgInvalidFloat)
 		return
 	}
-	member := args[2]
+	opts.delta = d
+	opts.member = args[2]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if db.exists(key) && db.t(key) != "zset" {
+		if db.exists(opts.key) && db.t(opts.key) != "zset" {
 			c.WriteError(msgWrongType)
 			return
 		}
-		newScore := db.ssetIncrby(key, member, delta)
+		newScore := db.ssetIncrby(opts.key, opts.member, opts.delta)
 		c.WriteFloat(newScore)
 	})
 }
@@ -889,37 +909,37 @@ func (m *Miniredis) cmdZremrangebyrank(c *server.Peer, cmd string, args []string
 		return
 	}
 
-	key := args[0]
-	start, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		start int
+		end   int
+	}
+
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.start); !ok {
 		return
 	}
-	end, err := strconv.Atoi(args[2])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	if ok := optInt(c, args[2], &opts.end); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(key) {
+		if !db.exists(opts.key) {
 			c.WriteInt(0)
 			return
 		}
 
-		if db.t(key) != "zset" {
+		if db.t(opts.key) != "zset" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
-		members := db.ssetMembers(key)
-		rs, re := redisRange(len(members), start, end, false)
+		members := db.ssetMembers(opts.key)
+		rs, re := redisRange(len(members), opts.start, opts.end, false)
 		for _, el := range members[rs:re] {
-			db.ssetRem(key, el)
+			db.ssetRem(opts.key, el)
 		}
 		c.WriteInt(re - rs)
 	})
@@ -939,14 +959,24 @@ func (m *Miniredis) cmdZremrangebyscore(c *server.Peer, cmd string, args []strin
 		return
 	}
 
-	key := args[0]
-	min, minIncl, err := parseFloatRange(args[1])
+	var (
+		opts struct {
+			key     string
+			min     float64
+			minIncl bool
+			max     float64
+			maxIncl bool
+		}
+		err error
+	)
+	opts.key = args[0]
+	opts.min, opts.minIncl, err = parseFloatRange(args[1])
 	if err != nil {
 		setDirty(c)
 		c.WriteError(msgInvalidMinMax)
 		return
 	}
-	max, maxIncl, err := parseFloatRange(args[2])
+	opts.max, opts.maxIncl, err = parseFloatRange(args[2])
 	if err != nil {
 		setDirty(c)
 		c.WriteError(msgInvalidMinMax)
@@ -956,21 +986,21 @@ func (m *Miniredis) cmdZremrangebyscore(c *server.Peer, cmd string, args []strin
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if !db.exists(key) {
+		if !db.exists(opts.key) {
 			c.WriteInt(0)
 			return
 		}
 
-		if db.t(key) != "zset" {
+		if db.t(opts.key) != "zset" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
-		members := db.ssetElements(key)
-		members = withSSRange(members, min, minIncl, max, maxIncl)
+		members := db.ssetElements(opts.key)
+		members = withSSRange(members, opts.min, opts.minIncl, opts.max, opts.maxIncl)
 
 		for _, el := range members {
-			db.ssetRem(key, el.member)
+			db.ssetRem(opts.key, el.member)
 		}
 		c.WriteInt(len(members))
 	})
@@ -1371,17 +1401,19 @@ func (m *Miniredis) cmdZscan(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	cursor, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidCursor)
+	var opts struct {
+		key       string
+		cursor    int
+		withMatch bool
+		match     string
+	}
+
+	opts.key = args[0]
+	if ok := optIntErr(c, args[1], &opts.cursor, msgInvalidCursor); !ok {
 		return
 	}
 	args = args[2:]
 	// MATCH and COUNT options
-	var withMatch bool
-	var match string
 	for len(args) > 0 {
 		if strings.ToLower(args[0]) == "count" {
 			if len(args) < 2 {
@@ -1389,8 +1421,7 @@ func (m *Miniredis) cmdZscan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			_, err := strconv.Atoi(args[1])
-			if err != nil {
+			if _, err := strconv.Atoi(args[1]); err != nil {
 				setDirty(c)
 				c.WriteError(msgInvalidInt)
 				return
@@ -1405,8 +1436,8 @@ func (m *Miniredis) cmdZscan(c *server.Peer, cmd string, args []string) {
 				c.WriteError(msgSyntaxError)
 				return
 			}
-			withMatch = true
-			match = args[1]
+			opts.withMatch = true
+			opts.match = args[1]
 			args = args[2:]
 			continue
 		}
@@ -1418,21 +1449,21 @@ func (m *Miniredis) cmdZscan(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 		// Paging is not implementend, all results are returned for cursor 0.
-		if cursor != 0 {
+		if opts.cursor != 0 {
 			// Invalid cursor.
 			c.WriteLen(2)
 			c.WriteBulk("0") // no next cursor
 			c.WriteLen(0)    // no elements
 			return
 		}
-		if db.exists(key) && db.t(key) != "zset" {
+		if db.exists(opts.key) && db.t(opts.key) != "zset" {
 			c.WriteError(ErrWrongType.Error())
 			return
 		}
 
-		members := db.ssetMembers(key)
-		if withMatch {
-			members, _ = matchKeys(members, match)
+		members := db.ssetMembers(opts.key)
+		if opts.withMatch {
+			members, _ = matchKeys(members, opts.match)
 		}
 
 		c.WriteLen(2)
@@ -1441,7 +1472,7 @@ func (m *Miniredis) cmdZscan(c *server.Peer, cmd string, args []string) {
 		c.WriteLen(len(members) * 2)
 		for _, k := range members {
 			c.WriteBulk(k)
-			c.WriteFloat(db.ssetScore(key, k))
+			c.WriteFloat(db.ssetScore(opts.key, k))
 		}
 	})
 }
@@ -1463,10 +1494,9 @@ func (m *Miniredis) cmdZpopmax(reverse bool) server.Cmd {
 		var err error
 		if len(args) > 1 {
 			count, err = strconv.Atoi(args[1])
-
-			if err != nil {
+			if err != nil || count < 0 {
 				setDirty(c)
-				c.WriteError(msgInvalidInt)
+				c.WriteError(msgInvalidRange)
 				return
 			}
 		}
@@ -1536,17 +1566,12 @@ func (m *Miniredis) cmdZrandmember(c *server.Peer, cmd string, args []string) {
 	args = args[1:]
 
 	if len(args) > 0 {
-		count := args[0]
-		args = args[1:]
-
-		n, err := strconv.Atoi(count)
-		if err != nil {
-			setDirty(c)
-			c.WriteError(msgInvalidInt)
+		// can be negative
+		if ok := optInt(c, args[0], &opts.count); !ok {
 			return
 		}
 		opts.withCount = true
-		opts.count = n // can be negative
+		args = args[1:]
 	}
 
 	if len(args) > 0 && strings.ToUpper(args[0]) == "WITHSCORES" {
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_stream.go b/vendor/github.com/alicebob/miniredis/v2/cmd_stream.go
index bc0991ba504c..7735a6bafd2d 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_stream.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_stream.go
@@ -28,6 +28,7 @@ func commandsStream(m *Miniredis) {
 	m.srv.Register("XPENDING", m.cmdXpending)
 	m.srv.Register("XTRIM", m.cmdXtrim)
 	m.srv.Register("XAUTOCLAIM", m.cmdXautoclaim)
+	m.srv.Register("XCLAIM", m.cmdXclaim)
 }
 
 // XADD
@@ -168,26 +169,30 @@ func (m *Miniredis) makeCmdXrange(reverse bool) server.Cmd {
 			return
 		}
 
-		var (
-			key            = args[0]
-			startKey       = args[1]
-			endKey         = args[2]
+		opts := struct {
+			key            string
+			startKey       string
 			startExclusive bool
+			endKey         string
 			endExclusive   bool
-		)
-		if strings.HasPrefix(startKey, "(") {
-			startExclusive = true
-			startKey = startKey[1:]
-			if startKey == "-" || startKey == "+" {
+		}{
+			key:      args[0],
+			startKey: args[1],
+			endKey:   args[2],
+		}
+		if strings.HasPrefix(opts.startKey, "(") {
+			opts.startExclusive = true
+			opts.startKey = opts.startKey[1:]
+			if opts.startKey == "-" || opts.startKey == "+" {
 				setDirty(c)
 				c.WriteError(msgInvalidStreamID)
 				return
 			}
 		}
-		if strings.HasPrefix(endKey, "(") {
-			endExclusive = true
-			endKey = endKey[1:]
-			if endKey == "-" || endKey == "+" {
+		if strings.HasPrefix(opts.endKey, "(") {
+			opts.endExclusive = true
+			opts.endKey = opts.endKey[1:]
+			if opts.endKey == "-" || opts.endKey == "+" {
 				setDirty(c)
 				c.WriteError(msgInvalidStreamID)
 				return
@@ -205,12 +210,12 @@ func (m *Miniredis) makeCmdXrange(reverse bool) server.Cmd {
 		}
 
 		withTx(m, c, func(c *server.Peer, ctx *connCtx) {
-			start, err := formatStreamRangeBound(startKey, true, reverse)
+			start, err := formatStreamRangeBound(opts.startKey, true, reverse)
 			if err != nil {
 				c.WriteError(msgInvalidStreamID)
 				return
 			}
-			end, err := formatStreamRangeBound(endKey, false, reverse)
+			end, err := formatStreamRangeBound(opts.endKey, false, reverse)
 			if err != nil {
 				c.WriteError(msgInvalidStreamID)
 				return
@@ -223,17 +228,17 @@ func (m *Miniredis) makeCmdXrange(reverse bool) server.Cmd {
 
 			db := m.db(ctx.selectedDB)
 
-			if !db.exists(key) {
+			if !db.exists(opts.key) {
 				c.WriteLen(0)
 				return
 			}
 
-			if db.t(key) != "stream" {
+			if db.t(opts.key) != "stream" {
 				c.WriteError(ErrWrongType.Error())
 				return
 			}
 
-			var entries = db.streamKeys[key].entries
+			var entries = db.streamKeys[opts.key].entries
 			if reverse {
 				entries = reversedStreamEntries(entries)
 			}
@@ -270,11 +275,11 @@ func (m *Miniredis) makeCmdXrange(reverse bool) server.Cmd {
 				}
 
 				// Continue if start exclusive and entry ID == start
-				if startExclusive && streamCmp(entry.ID, start) == 0 {
+				if opts.startExclusive && streamCmp(entry.ID, start) == 0 {
 					continue
 				}
 				// Continue if end exclusive and entry ID == end
-				if endExclusive && streamCmp(entry.ID, end) == 0 {
+				if opts.endExclusive && streamCmp(entry.ID, end) == 0 {
 					continue
 				}
 
@@ -296,19 +301,44 @@ func (m *Miniredis) makeCmdXrange(reverse bool) server.Cmd {
 
 // XGROUP
 func (m *Miniredis) cmdXgroup(c *server.Peer, cmd string, args []string) {
-	if (len(args) == 4 || len(args) == 5) && strings.ToUpper(args[0]) == "CREATE" {
+	if len(args) == 0 {
+		setDirty(c)
+		c.WriteError(errWrongNumber(cmd))
+		return
+	}
+
+	subCmd, args := strings.ToLower(args[0]), args[1:]
+	switch subCmd {
+	case "create":
 		m.cmdXgroupCreate(c, cmd, args)
-	} else {
-		j := strings.Join(args, " ")
-		err := fmt.Sprintf("ERR 'XGROUP %s' not supported", j)
+	case "destroy":
+		m.cmdXgroupDestroy(c, cmd, args)
+	case "createconsumer":
+		m.cmdXgroupCreateconsumer(c, cmd, args)
+	case "delconsumer":
+		m.cmdXgroupDelconsumer(c, cmd, args)
+	case "help",
+		"setid":
+		err := fmt.Sprintf("ERR 'XGROUP %s' not supported", subCmd)
 		setDirty(c)
 		c.WriteError(err)
+	default:
+		setDirty(c)
+		c.WriteError(fmt.Sprintf(
+			"ERR unknown subcommand '%s'. Try XGROUP HELP.",
+			subCmd,
+		))
 	}
 }
 
 // XGROUP CREATE
 func (m *Miniredis) cmdXgroupCreate(c *server.Peer, cmd string, args []string) {
-	stream, group, id := args[1], args[2], args[3]
+	if len(args) != 3 && len(args) != 4 {
+		setDirty(c)
+		c.WriteError(errWrongNumber("CREATE"))
+		return
+	}
+	stream, group, id := args[0], args[1], args[2]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
@@ -318,7 +348,7 @@ func (m *Miniredis) cmdXgroupCreate(c *server.Peer, cmd string, args []string) {
 			c.WriteError(err.Error())
 			return
 		}
-		if s == nil && len(args) == 5 && strings.ToUpper(args[4]) == "MKSTREAM" {
+		if s == nil && len(args) == 4 && strings.ToUpper(args[3]) == "MKSTREAM" {
 			if s, err = db.newStream(stream); err != nil {
 				c.WriteError(err.Error())
 				return
@@ -338,6 +368,124 @@ func (m *Miniredis) cmdXgroupCreate(c *server.Peer, cmd string, args []string) {
 	})
 }
 
+// XGROUP DESTROY
+func (m *Miniredis) cmdXgroupDestroy(c *server.Peer, cmd string, args []string) {
+	if len(args) != 2 {
+		setDirty(c)
+		c.WriteError(errWrongNumber("DESTROY"))
+		return
+	}
+	stream, groupName := args[0], args[1]
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+
+		s, err := db.stream(stream)
+		if err != nil {
+			c.WriteError(err.Error())
+			return
+		}
+		if s == nil {
+			c.WriteError(msgXgroupKeyNotFound)
+			return
+		}
+
+		if _, ok := s.groups[groupName]; !ok {
+			c.WriteInt(0)
+			return
+		}
+		delete(s.groups, groupName)
+		c.WriteInt(1)
+	})
+}
+
+// XGROUP CREATECONSUMER
+func (m *Miniredis) cmdXgroupCreateconsumer(c *server.Peer, cmd string, args []string) {
+	if len(args) != 3 {
+		setDirty(c)
+		c.WriteError(errWrongNumber("CREATECONSUMER"))
+		return
+	}
+	key, groupName, consumerName := args[0], args[1], args[2]
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+
+		s, err := db.stream(key)
+		if err != nil {
+			c.WriteError(err.Error())
+			return
+		}
+		if s == nil {
+			c.WriteError(msgXgroupKeyNotFound)
+			return
+		}
+
+		g, ok := s.groups[groupName]
+		if !ok {
+			err := fmt.Sprintf("NOGROUP No such consumer group '%s' for key name '%s'", groupName, key)
+			c.WriteError(err)
+			return
+		}
+
+		if _, ok = g.consumers[consumerName]; ok {
+			c.WriteInt(0)
+			return
+		}
+		g.consumers[consumerName] = &consumer{}
+		c.WriteInt(1)
+	})
+}
+
+// XGROUP DELCONSUMER
+func (m *Miniredis) cmdXgroupDelconsumer(c *server.Peer, cmd string, args []string) {
+	if len(args) != 3 {
+		setDirty(c)
+		c.WriteError(errWrongNumber("DELCONSUMER"))
+		return
+	}
+	key, groupName, consumerName := args[0], args[1], args[2]
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+
+		s, err := db.stream(key)
+		if err != nil {
+			c.WriteError(err.Error())
+			return
+		}
+		if s == nil {
+			c.WriteError(msgXgroupKeyNotFound)
+			return
+		}
+
+		g, ok := s.groups[groupName]
+		if !ok {
+			err := fmt.Sprintf("NOGROUP No such consumer group '%s' for key name '%s'", groupName, key)
+			c.WriteError(err)
+			return
+		}
+
+		consumer, ok := g.consumers[consumerName]
+		if !ok {
+			c.WriteInt(0)
+			return
+		}
+		defer delete(g.consumers, consumerName)
+
+		if consumer.numPendingEntries > 0 {
+			newPending := make([]pendingEntry, 0)
+			for _, entry := range g.pending {
+				if entry.consumer != consumerName {
+					newPending = append(newPending, entry)
+				}
+			}
+			g.pending = newPending
+		}
+		c.WriteInt(consumer.numPendingEntries)
+	})
+}
+
 // XINFO
 func (m *Miniredis) cmdXinfo(c *server.Peer, cmd string, args []string) {
 	if len(args) < 1 {
@@ -349,18 +497,21 @@ func (m *Miniredis) cmdXinfo(c *server.Peer, cmd string, args []string) {
 	switch subCmd {
 	case "STREAM":
 		m.cmdXinfoStream(c, args)
-	case "CONSUMERS", "GROUPS", "HELP":
+	case "CONSUMERS":
+		m.cmdXinfoConsumers(c, args)
+	case "GROUPS":
+		m.cmdXinfoGroups(c, args)
+	case "HELP":
 		err := fmt.Sprintf("'XINFO %s' not supported", strings.Join(args, " "))
 		setDirty(c)
 		c.WriteError(err)
 	default:
 		setDirty(c)
 		c.WriteError(fmt.Sprintf(
-			"ERR Unknown subcommand or wrong number of arguments for '%s'. Try XINFO HELP.",
+			"ERR unknown subcommand or wrong number of arguments for '%s'. Try XINFO HELP.",
 			subCmd,
 		))
 	}
-
 }
 
 // XINFO STREAM
@@ -368,10 +519,11 @@ func (m *Miniredis) cmdXinfo(c *server.Peer, cmd string, args []string) {
 func (m *Miniredis) cmdXinfoStream(c *server.Peer, args []string) {
 	if len(args) < 1 {
 		setDirty(c)
-		c.WriteError(errWrongNumber("XINFO"))
+		c.WriteError(errWrongNumber("STREAM"))
 		return
 	}
 	key := args[0]
+
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
@@ -391,6 +543,101 @@ func (m *Miniredis) cmdXinfoStream(c *server.Peer, args []string) {
 	})
 }
 
+// XINFO GROUPS
+func (m *Miniredis) cmdXinfoGroups(c *server.Peer, args []string) {
+	if len(args) != 1 {
+		setDirty(c)
+		c.WriteError(errWrongNumber("GROUPS"))
+		return
+	}
+	key := args[0]
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+
+		s, err := db.stream(key)
+		if err != nil {
+			c.WriteError(err.Error())
+			return
+		}
+		if s == nil {
+			c.WriteError(msgKeyNotFound)
+			return
+		}
+
+		c.WriteLen(len(s.groups))
+		for name, g := range s.groups {
+			c.WriteMapLen(6)
+
+			c.WriteBulk("name")
+			c.WriteBulk(name)
+			c.WriteBulk("consumers")
+			c.WriteInt(len(g.consumers))
+			c.WriteBulk("pending")
+			c.WriteInt(len(g.activePending()))
+			c.WriteBulk("last-delivered-id")
+			c.WriteBulk(g.lastID)
+			c.WriteBulk("entries-read")
+			c.WriteNull()
+			c.WriteBulk("lag")
+			c.WriteInt(len(g.stream.entries))
+		}
+	})
+}
+
+// XINFO CONSUMERS
+// Please note that this is only a partial implementation, for it does not
+// return each consumer's "idle" value, which indicates "the number of
+// milliseconds that have passed since the consumer last interacted with the
+// server."
+func (m *Miniredis) cmdXinfoConsumers(c *server.Peer, args []string) {
+	if len(args) != 2 {
+		setDirty(c)
+		c.WriteError(errWrongNumber("CONSUMERS"))
+		return
+	}
+	key := args[0]
+	groupName := args[1]
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+
+		s, err := db.stream(key)
+		if err != nil {
+			c.WriteError(err.Error())
+			return
+		}
+		if s == nil {
+			c.WriteError(msgKeyNotFound)
+			return
+		}
+
+		g, ok := s.groups[groupName]
+		if !ok {
+			err := fmt.Sprintf("NOGROUP No such consumer group '%s' for key name '%s'", groupName, key)
+			c.WriteError(err)
+			return
+		}
+
+		consumerNames := make([]string, 0)
+		for name := range g.consumers {
+			consumerNames = append(consumerNames, name)
+		}
+		sort.Strings(consumerNames)
+
+		c.WriteLen(len(consumerNames))
+		for _, name := range consumerNames {
+			c.WriteMapLen(2)
+
+			c.WriteBulk("name")
+			c.WriteBulk(name)
+
+			c.WriteBulk("pending")
+			c.WriteInt(g.consumers[name].numPendingEntries)
+		}
+	})
+}
+
 // XREADGROUP
 func (m *Miniredis) cmdXreadgroup(c *server.Peer, cmd string, args []string) {
 	// XREADGROUP GROUP group consumer STREAMS key ID
@@ -638,14 +885,16 @@ func (m *Miniredis) cmdXread(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	var opts struct {
-		count        int
-		streams      []string
-		ids          []string
-		block        bool
-		blockTimeout time.Duration
-	}
-	var err error
+	var (
+		opts struct {
+			count        int
+			streams      []string
+			ids          []string
+			block        bool
+			blockTimeout time.Duration
+		}
+		err error
+	)
 
 parsing:
 	for len(args) > 0 {
@@ -676,11 +925,14 @@ parsing:
 			}
 
 			opts.streams, opts.ids = args[0:len(args)/2], args[len(args)/2:]
-			for _, id := range opts.ids {
+			for i, id := range opts.ids {
 				if _, err := parseStreamID(id); id != `$` && err != nil {
 					setDirty(c)
 					c.WriteError(msgInvalidStreamID)
 					return
+				} else if id == "$" {
+					db := m.DB(getCtx(c).selectedDB)
+					opts.ids[i] = db.streamKeys[opts.streams[i]].lastID()
 				}
 			}
 			args = nil
@@ -797,45 +1049,61 @@ func (m *Miniredis) cmdXpending(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, group, args := args[0], args[1], args[2:]
-	summary := true
-	if len(args) > 0 && strings.ToUpper(args[0]) == "IDLE" {
-		setDirty(c)
-		c.WriteError("ERR IDLE is unsupported")
-		return
-	}
-	var (
+	var opts struct {
+		key        string
+		group      string
+		summary    bool
+		idle       time.Duration
 		start, end string
 		count      int
 		consumer   *string
-	)
+	}
+
+	opts.key, opts.group, args = args[0], args[1], args[2:]
+	opts.summary = true
 	if len(args) >= 3 {
-		summary = false
+		opts.summary = false
+
+		if strings.ToUpper(args[0]) == "IDLE" {
+			idleMs, err := strconv.ParseInt(args[1], 10, 64)
+			if err != nil {
+				setDirty(c)
+				c.WriteError(msgInvalidInt)
+				return
+			}
+			opts.idle = time.Duration(idleMs) * time.Millisecond
 
-		start_, err := formatStreamRangeBound(args[0], true, false)
+			args = args[2:]
+			if len(args) < 3 {
+				setDirty(c)
+				c.WriteError(msgSyntaxError)
+				return
+			}
+		}
+
+		var err error
+		opts.start, err = formatStreamRangeBound(args[0], true, false)
 		if err != nil {
+			setDirty(c)
 			c.WriteError(msgInvalidStreamID)
 			return
 		}
-		start = start_
-		end_, err := formatStreamRangeBound(args[1], false, false)
+		opts.end, err = formatStreamRangeBound(args[1], false, false)
 		if err != nil {
+			setDirty(c)
 			c.WriteError(msgInvalidStreamID)
 			return
 		}
-		end = end_
-		n, err := strconv.Atoi(args[2]) // negative is allowed
+		opts.count, err = strconv.Atoi(args[2]) // negative is allowed
 		if err != nil {
+			setDirty(c)
 			c.WriteError(msgInvalidInt)
 			return
 		}
-		count = n
 		args = args[3:]
 
 		if len(args) == 1 {
-			var c string
-			c, args = args[0], args[1:]
-			consumer = &c
+			opts.consumer, args = &args[0], args[1:]
 		}
 	}
 	if len(args) != 0 {
@@ -846,26 +1114,27 @@ func (m *Miniredis) cmdXpending(c *server.Peer, cmd string, args []string) {
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
-		g, err := db.streamGroup(key, group)
+		g, err := db.streamGroup(opts.key, opts.group)
 		if err != nil {
 			c.WriteError(err.Error())
 			return
 		}
 		if g == nil {
-			c.WriteError(errReadgroup(key, group).Error())
+			c.WriteError(errReadgroup(opts.key, opts.group).Error())
 			return
 		}
 
-		if summary {
+		if opts.summary {
 			writeXpendingSummary(c, *g)
 			return
 		}
-		writeXpending(m.effectiveNow(), c, *g, start, end, count, consumer)
+		writeXpending(m.effectiveNow(), c, *g, opts.idle, opts.start, opts.end, opts.count, opts.consumer)
 	})
 }
 
 func writeXpendingSummary(c *server.Peer, g streamGroup) {
-	if len(g.pending) == 0 {
+	pend := g.activePending()
+	if len(pend) == 0 {
 		c.WriteLen(4)
 		c.WriteInt(0)
 		c.WriteNull()
@@ -880,9 +1149,9 @@ func writeXpendingSummary(c *server.Peer, g streamGroup) {
 	//  - highest ID
 	//  - all consumers with > 0 pending items
 	c.WriteLen(4)
-	c.WriteInt(len(g.pending))
-	c.WriteBulk(g.pending[0].id)
-	c.WriteBulk(g.pending[len(g.pending)-1].id)
+	c.WriteInt(len(pend))
+	c.WriteBulk(pend[0].id)
+	c.WriteBulk(pend[len(pend)-1].id)
 	cons := map[string]int{}
 	for id := range g.consumers {
 		cnt := g.pendingCount(id)
@@ -907,6 +1176,7 @@ func writeXpending(
 	now time.Time,
 	c *server.Peer,
 	g streamGroup,
+	idle time.Duration,
 	start,
 	end string,
 	count int,
@@ -942,12 +1212,19 @@ func writeXpending(
 		if streamCmp(p.id, end) > 0 {
 			continue
 		}
-		res = append(res, entry{
-			id:       p.id,
-			consumer: p.consumer,
-			millis:   int(now.Sub(p.lastDelivery).Milliseconds()),
-			count:    p.deliveryCount,
-		})
+		timeSinceLastDelivery := now.Sub(p.lastDelivery)
+		if timeSinceLastDelivery >= idle {
+			res = append(res, entry{
+				id:       p.id,
+				consumer: p.consumer,
+				millis:   int(timeSinceLastDelivery.Milliseconds()),
+				count:    p.deliveryCount,
+			})
+		}
+	}
+	if len(res) == 0 {
+		c.WriteLen(-1)
+		return
 	}
 	c.WriteLen(len(res))
 	for _, e := range res {
@@ -1075,27 +1352,35 @@ func (m *Miniredis) cmdXautoclaim(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key, group, consumer := args[0], args[1], args[2]
+	var opts struct {
+		key         string
+		group       string
+		consumer    string
+		minIdleTime time.Duration
+		start       string
+		justId      bool
+		count       int
+	}
 
+	opts.key, opts.group, opts.consumer = args[0], args[1], args[2]
 	n, err := strconv.Atoi(args[3])
 	if err != nil {
 		setDirty(c)
 		c.WriteError("ERR Invalid min-idle-time argument for XAUTOCLAIM")
 		return
 	}
-	minIdleTime := time.Millisecond * time.Duration(n)
+	opts.minIdleTime = time.Millisecond * time.Duration(n)
 
 	start_, err := formatStreamRangeBound(args[4], true, false)
 	if err != nil {
 		c.WriteError(msgInvalidStreamID)
 		return
 	}
-	start := start_
+	opts.start = start_
 
 	args = args[5:]
 
-	count := 100
-	var justId bool
+	opts.count = 100
 parsing:
 	for len(args) > 0 {
 		switch strings.ToUpper(args[0]) {
@@ -1105,7 +1390,7 @@ parsing:
 				break parsing
 			}
 
-			count, err = strconv.Atoi(args[1])
+			opts.count, err = strconv.Atoi(args[1])
 			if err != nil {
 				break parsing
 			}
@@ -1113,7 +1398,7 @@ parsing:
 			args = args[2:]
 		case "JUSTID":
 			args = args[1:]
-			justId = true
+			opts.justId = true
 		default:
 			err = errors.New(msgSyntaxError)
 			break parsing
@@ -1128,18 +1413,18 @@ parsing:
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
-		g, err := db.streamGroup(key, group)
+		g, err := db.streamGroup(opts.key, opts.group)
 		if err != nil {
 			c.WriteError(err.Error())
 			return
 		}
 		if g == nil {
-			c.WriteError(errReadgroup(key, group).Error())
+			c.WriteError(errReadgroup(opts.key, opts.group).Error())
 			return
 		}
 
-		nextCallId, entries := xautoclaim(m.effectiveNow(), *g, minIdleTime, start, count, consumer)
-		writeXautoclaim(c, nextCallId, entries, justId)
+		nextCallId, entries := xautoclaim(m.effectiveNow(), *g, opts.minIdleTime, opts.start, opts.count, opts.consumer)
+		writeXautoclaim(c, nextCallId, entries, opts.justId)
 	})
 }
 
@@ -1162,8 +1447,13 @@ func xautoclaim(
 		if minIdleTime > 0 && now.Before(p.lastDelivery.Add(minIdleTime)) {
 			continue
 		}
-		g.consumers[consumerID] = consumer{}
+
+		prevConsumerID := p.consumer
+		if _, ok := g.consumers[consumerID]; !ok {
+			g.consumers[consumerID] = &consumer{}
+		}
 		p.consumer = consumerID
+
 		_, entry := g.stream.get(p.id)
 		// not found. Weird?
 		if entry == nil {
@@ -1172,8 +1462,13 @@ func xautoclaim(
 			// (Introduced in Redis 7.0)
 			continue
 		}
+
 		p.deliveryCount += 1
 		p.lastDelivery = now
+
+		g.consumers[prevConsumerID].numPendingEntries--
+		g.consumers[consumerID].numPendingEntries++
+
 		msgs[i] = p
 		res = append(res, *entry)
 
@@ -1188,7 +1483,7 @@ func xautoclaim(
 }
 
 func writeXautoclaim(c *server.Peer, nextCallId string, res []StreamEntry, justId bool) {
-	c.WriteLen(2)
+	c.WriteLen(3)
 	c.WriteBulk(nextCallId)
 	c.WriteLen(len(res))
 	for _, entry := range res {
@@ -1204,6 +1499,199 @@ func writeXautoclaim(c *server.Peer, nextCallId string, res []StreamEntry, justI
 			c.WriteBulk(v)
 		}
 	}
+	// TODO: see "Redis 7" note
+	c.WriteLen(0)
+}
+
+// XCLAIM
+func (m *Miniredis) cmdXclaim(c *server.Peer, cmd string, args []string) {
+	if len(args) < 5 {
+		setDirty(c)
+		c.WriteError(errWrongNumber(cmd))
+		return
+	}
+
+	var opts struct {
+		key             string
+		groupName       string
+		consumerName    string
+		minIdleTime     time.Duration
+		newLastDelivery time.Time
+		ids             []string
+		retryCount      *int
+		force           bool
+		justId          bool
+	}
+
+	opts.key, opts.groupName, opts.consumerName = args[0], args[1], args[2]
+
+	minIdleTimeMillis, err := strconv.Atoi(args[3])
+	if err != nil {
+		setDirty(c)
+		c.WriteError("ERR Invalid min-idle-time argument for XCLAIM")
+		return
+	}
+	opts.minIdleTime = time.Millisecond * time.Duration(minIdleTimeMillis)
+
+	opts.newLastDelivery = m.effectiveNow()
+	opts.ids = append(opts.ids, args[4])
+
+	args = args[5:]
+	for len(args) > 0 {
+		arg := strings.ToUpper(args[0])
+		if arg == "IDLE" ||
+			arg == "TIME" ||
+			arg == "RETRYCOUNT" ||
+			arg == "FORCE" ||
+			arg == "JUSTID" {
+			break
+		}
+		opts.ids = append(opts.ids, arg)
+		args = args[1:]
+	}
+
+	for len(args) > 0 {
+		arg := strings.ToUpper(args[0])
+		switch arg {
+		case "IDLE":
+			idleMs, err := strconv.ParseInt(args[1], 10, 64)
+			if err != nil {
+				setDirty(c)
+				c.WriteError("ERR Invalid IDLE option argument for XCLAIM")
+				return
+			}
+			if idleMs < 0 {
+				idleMs = 0
+			}
+			opts.newLastDelivery = m.effectiveNow().Add(time.Millisecond * time.Duration(-idleMs))
+			args = args[2:]
+		case "TIME":
+			timeMs, err := strconv.ParseInt(args[1], 10, 64)
+			if err != nil {
+				setDirty(c)
+				c.WriteError("ERR Invalid TIME option argument for XCLAIM")
+				return
+			}
+			opts.newLastDelivery = unixMilli(timeMs)
+			args = args[2:]
+		case "RETRYCOUNT":
+			retryCount, err := strconv.Atoi(args[1])
+			if err != nil {
+				setDirty(c)
+				c.WriteError("ERR Invalid RETRYCOUNT option argument for XCLAIM")
+				return
+			}
+			opts.retryCount = &retryCount
+			args = args[2:]
+		case "FORCE":
+			opts.force = true
+			args = args[1:]
+		case "JUSTID":
+			opts.justId = true
+			args = args[1:]
+		default:
+			setDirty(c)
+			c.WriteError(fmt.Sprintf("ERR Unrecognized XCLAIM option '%s'", args[0]))
+			return
+		}
+	}
+
+	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
+		db := m.db(ctx.selectedDB)
+
+		g, err := db.streamGroup(opts.key, opts.groupName)
+		if err != nil {
+			c.WriteError(err.Error())
+			return
+		}
+		if g == nil {
+			c.WriteError(errReadgroup(opts.key, opts.groupName).Error())
+			return
+		}
+
+		claimedEntryIDs := m.xclaim(g, opts.consumerName, opts.minIdleTime, opts.newLastDelivery, opts.ids, opts.retryCount, opts.force)
+		writeXclaim(c, g.stream, claimedEntryIDs, opts.justId)
+	})
+}
+
+func (m *Miniredis) xclaim(
+	group *streamGroup,
+	consumerName string,
+	minIdleTime time.Duration,
+	newLastDelivery time.Time,
+	ids []string,
+	retryCount *int,
+	force bool,
+) (claimedEntryIDs []string) {
+	for _, id := range ids {
+		pelPos, pelEntry := group.searchPending(id)
+		if pelEntry == nil {
+			if !force {
+				continue
+			}
+
+			if pelPos < len(group.pending) {
+				group.pending = append(group.pending[:pelPos+1], group.pending[pelPos:]...)
+			} else {
+				group.pending = append(group.pending, pendingEntry{})
+			}
+			pelEntry = &group.pending[pelPos]
+
+			*pelEntry = pendingEntry{
+				id:            id,
+				consumer:      consumerName,
+				deliveryCount: 1,
+			}
+		} else {
+			group.consumers[pelEntry.consumer].numPendingEntries--
+			pelEntry.consumer = consumerName
+		}
+
+		if retryCount != nil {
+			pelEntry.deliveryCount = *retryCount
+		} else {
+			pelEntry.deliveryCount++
+		}
+		pelEntry.lastDelivery = newLastDelivery
+
+		// redis7: don't report entries which are deleted by now
+		if _, e := group.stream.get(id); e == nil {
+			continue
+		}
+
+		claimedEntryIDs = append(claimedEntryIDs, id)
+	}
+	if len(claimedEntryIDs) == 0 {
+		return
+	}
+
+	if _, ok := group.consumers[consumerName]; !ok {
+		group.consumers[consumerName] = &consumer{}
+	}
+	consumer := group.consumers[consumerName]
+	consumer.numPendingEntries += len(claimedEntryIDs)
+
+	return
+}
+
+func writeXclaim(c *server.Peer, stream *streamKey, claimedEntryIDs []string, justId bool) {
+	c.WriteLen(len(claimedEntryIDs))
+	for _, id := range claimedEntryIDs {
+		if justId {
+			c.WriteBulk(id)
+			continue
+		}
+
+		_, entry := stream.get(id)
+		if entry == nil {
+			c.WriteNull()
+			continue
+		}
+
+		c.WriteLen(2)
+		c.WriteBulk(entry.ID)
+		c.WriteStrings(entry.Values)
+	}
 }
 
 func parseBlock(cmd string, args []string, block *bool, timeout *time.Duration) error {
@@ -1221,3 +1709,8 @@ func parseBlock(cmd string, args []string, block *bool, timeout *time.Duration)
 	(*timeout) = time.Millisecond * time.Duration(ms)
 	return nil
 }
+
+// taken from Go's time package. Can be dropped if miniredis supports >= 1.17
+func unixMilli(msec int64) time.Time {
+	return time.Unix(msec/1e3, (msec%1e3)*1e6)
+}
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_string.go b/vendor/github.com/alicebob/miniredis/v2/cmd_string.go
index 29c2c22734b4..cec9d48343c6 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_string.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_string.go
@@ -227,26 +227,29 @@ func (m *Miniredis) cmdPsetex(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	ttl, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		ttl   int
+		value string
+	}
+
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.ttl); !ok {
 		return
 	}
-	if ttl <= 0 {
+	if opts.ttl <= 0 {
 		setDirty(c)
 		c.WriteError(msgInvalidPSETEXTime)
 		return
 	}
-	value := args[2]
+	opts.value = args[2]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		db.del(key, true) // Clear any existing keys.
-		db.stringSet(key, value)
-		db.ttl[key] = time.Duration(ttl) * time.Millisecond
+		db.del(opts.key, true) // Clear any existing keys.
+		db.stringSet(opts.key, opts.value)
+		db.ttl[opts.key] = time.Duration(opts.ttl) * time.Millisecond
 		c.WriteOK()
 	})
 }
@@ -634,23 +637,24 @@ func (m *Miniredis) cmdIncrby(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	delta, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		delta int
+	}
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.delta); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "string" {
+		if t, ok := db.keys[opts.key]; ok && t != "string" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		v, err := db.stringIncr(key, delta)
+		v, err := db.stringIncr(opts.key, opts.delta)
 		if err != nil {
 			c.WriteError(err.Error())
 			return
@@ -746,23 +750,24 @@ func (m *Miniredis) cmdDecrby(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	delta, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		delta int
+	}
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.delta); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "string" {
+		if t, ok := db.keys[opts.key]; ok && t != "string" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		v, err := db.stringIncr(key, -delta)
+		v, err := db.stringIncr(opts.key, -opts.delta)
 		if err != nil {
 			c.WriteError(err.Error())
 			return
@@ -845,30 +850,29 @@ func (m *Miniredis) cmdGetrange(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	start, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		start int
+		end   int
+	}
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.start); !ok {
 		return
 	}
-	end, err := strconv.Atoi(args[2])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	if ok := optInt(c, args[2], &opts.end); !ok {
 		return
 	}
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "string" {
+		if t, ok := db.keys[opts.key]; ok && t != "string" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		v := db.stringKeys[key]
-		c.WriteBulk(withRange(v, start, end))
+		v := db.stringKeys[opts.key]
+		c.WriteBulk(withRange(v, opts.start, opts.end))
 	})
 }
 
@@ -886,36 +890,39 @@ func (m *Miniredis) cmdSetrange(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	pos, err := strconv.Atoi(args[1])
-	if err != nil {
-		setDirty(c)
-		c.WriteError(msgInvalidInt)
+	var opts struct {
+		key   string
+		pos   int
+		subst string
+	}
+	opts.key = args[0]
+	if ok := optInt(c, args[1], &opts.pos); !ok {
 		return
 	}
-	if pos < 0 {
+	if opts.pos < 0 {
 		setDirty(c)
 		c.WriteError("ERR offset is out of range")
 		return
 	}
-	subst := args[2]
+	opts.subst = args[2]
 
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "string" {
+		if t, ok := db.keys[opts.key]; ok && t != "string" {
 			c.WriteError(msgWrongType)
 			return
 		}
 
-		v := []byte(db.stringKeys[key])
-		if len(v) < pos+len(subst) {
-			newV := make([]byte, pos+len(subst))
+		v := []byte(db.stringKeys[opts.key])
+		end := opts.pos + len(opts.subst)
+		if len(v) < end {
+			newV := make([]byte, end)
 			copy(newV, v)
 			v = newV
 		}
-		copy(v[pos:pos+len(subst)], subst)
-		db.stringSet(key, string(v))
+		copy(v[opts.pos:end], opts.subst)
+		db.stringSet(opts.key, string(v))
 		c.WriteInt(len(v))
 	})
 }
@@ -935,28 +942,20 @@ func (m *Miniredis) cmdBitcount(c *server.Peer, cmd string, args []string) {
 	}
 
 	var opts struct {
-		useRange   bool
-		start, end int
-		key        string
+		useRange bool
+		start    int
+		end      int
+		key      string
 	}
 	opts.key, args = args[0], args[1:]
 	if len(args) >= 2 {
 		opts.useRange = true
-		var err error
-		n, err := strconv.Atoi(args[0])
-		if err != nil {
-			setDirty(c)
-			c.WriteError(msgInvalidInt)
+		if ok := optInt(c, args[0], &opts.start); !ok {
 			return
 		}
-		opts.start = n
-		n, err = strconv.Atoi(args[1])
-		if err != nil {
-			setDirty(c)
-			c.WriteError(msgInvalidInt)
+		if ok := optInt(c, args[1], &opts.end); !ok {
 			return
 		}
-		opts.end = n
 		args = args[2:]
 	}
 
@@ -1001,25 +1000,28 @@ func (m *Miniredis) cmdBitop(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	var (
-		op     = strings.ToUpper(args[0])
-		target = args[1]
-		input  = args[2:]
-	)
+	var opts struct {
+		op     string
+		target string
+		input  []string
+	}
+	opts.op = strings.ToUpper(args[0])
+	opts.target = args[1]
+	opts.input = args[2:]
 
 	// 'op' is tested when the transaction is executed.
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		switch op {
+		switch opts.op {
 		case "AND", "OR", "XOR":
-			first := input[0]
+			first := opts.input[0]
 			if t, ok := db.keys[first]; ok && t != "string" {
 				c.WriteError(msgWrongType)
 				return
 			}
 			res := []byte(db.stringKeys[first])
-			for _, vk := range input[1:] {
+			for _, vk := range opts.input[1:] {
 				if t, ok := db.keys[vk]; ok && t != "string" {
 					c.WriteError(msgWrongType)
 					return
@@ -1029,23 +1031,23 @@ func (m *Miniredis) cmdBitop(c *server.Peer, cmd string, args []string) {
 					"AND": func(a, b byte) byte { return a & b },
 					"OR":  func(a, b byte) byte { return a | b },
 					"XOR": func(a, b byte) byte { return a ^ b },
-				}[op]
+				}[opts.op]
 				res = sliceBinOp(cb, res, []byte(v))
 			}
-			db.del(target, false) // Keep TTL
+			db.del(opts.target, false) // Keep TTL
 			if len(res) == 0 {
-				db.del(target, true)
+				db.del(opts.target, true)
 			} else {
-				db.stringSet(target, string(res))
+				db.stringSet(opts.target, string(res))
 			}
 			c.WriteInt(len(res))
 		case "NOT":
 			// NOT only takes a single argument.
-			if len(input) != 1 {
+			if len(opts.input) != 1 {
 				c.WriteError("ERR BITOP NOT must be called with a single source key.")
 				return
 			}
-			key := input[0]
+			key := opts.input[0]
 			if t, ok := db.keys[key]; ok && t != "string" {
 				c.WriteError(msgWrongType)
 				return
@@ -1054,11 +1056,11 @@ func (m *Miniredis) cmdBitop(c *server.Peer, cmd string, args []string) {
 			for i := range value {
 				value[i] = ^value[i]
 			}
-			db.del(target, false) // Keep TTL
+			db.del(opts.target, false) // Keep TTL
 			if len(value) == 0 {
-				db.del(target, true)
+				db.del(opts.target, true)
 			} else {
-				db.stringSet(target, string(value))
+				db.stringSet(opts.target, string(value))
 			}
 			c.WriteInt(len(value))
 		default:
@@ -1182,9 +1184,15 @@ func (m *Miniredis) cmdGetbit(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	bit, err := strconv.Atoi(args[1])
-	if err != nil {
+	var opts struct {
+		key string
+		bit int
+	}
+	opts.key = args[0]
+	if ok := optIntErr(c, args[1], &opts.bit, "ERR bit offset is not an integer or out of range"); !ok {
+		return
+	}
+	if opts.bit < 0 {
 		setDirty(c)
 		c.WriteError("ERR bit offset is not an integer or out of range")
 		return
@@ -1193,13 +1201,13 @@ func (m *Miniredis) cmdGetbit(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "string" {
+		if t, ok := db.keys[opts.key]; ok && t != "string" {
 			c.WriteError(msgWrongType)
 			return
 		}
-		value := db.stringKeys[key]
+		value := db.stringKeys[opts.key]
 
-		ourByteNr := bit / 8
+		ourByteNr := opts.bit / 8
 		var ourByte byte
 		if ourByteNr > len(value)-1 {
 			ourByte = '\x00'
@@ -1207,7 +1215,7 @@ func (m *Miniredis) cmdGetbit(c *server.Peer, cmd string, args []string) {
 			ourByte = value[ourByteNr]
 		}
 		res := 0
-		if toBits(ourByte)[bit%8] {
+		if toBits(ourByte)[opts.bit%8] {
 			res = 1
 		}
 		c.WriteInt(res)
@@ -1228,15 +1236,24 @@ func (m *Miniredis) cmdSetbit(c *server.Peer, cmd string, args []string) {
 		return
 	}
 
-	key := args[0]
-	bit, err := strconv.Atoi(args[1])
-	if err != nil || bit < 0 {
+	var opts struct {
+		key    string
+		bit    int
+		newBit int
+	}
+	opts.key = args[0]
+	if ok := optIntErr(c, args[1], &opts.bit, "ERR bit offset is not an integer or out of range"); !ok {
+		return
+	}
+	if opts.bit < 0 {
 		setDirty(c)
 		c.WriteError("ERR bit offset is not an integer or out of range")
 		return
 	}
-	newBit, err := strconv.Atoi(args[2])
-	if err != nil || (newBit != 0 && newBit != 1) {
+	if ok := optIntErr(c, args[2], &opts.newBit, "ERR bit is not an integer or out of range"); !ok {
+		return
+	}
+	if opts.newBit != 0 && opts.newBit != 1 {
 		setDirty(c)
 		c.WriteError("ERR bit is not an integer or out of range")
 		return
@@ -1245,14 +1262,14 @@ func (m *Miniredis) cmdSetbit(c *server.Peer, cmd string, args []string) {
 	withTx(m, c, func(c *server.Peer, ctx *connCtx) {
 		db := m.db(ctx.selectedDB)
 
-		if t, ok := db.keys[key]; ok && t != "string" {
+		if t, ok := db.keys[opts.key]; ok && t != "string" {
 			c.WriteError(msgWrongType)
 			return
 		}
-		value := []byte(db.stringKeys[key])
+		value := []byte(db.stringKeys[opts.key])
 
-		ourByteNr := bit / 8
-		ourBitNr := bit % 8
+		ourByteNr := opts.bit / 8
+		ourBitNr := opts.bit % 8
 		if ourByteNr > len(value)-1 {
 			// Too short. Expand.
 			newValue := make([]byte, ourByteNr+1)
@@ -1263,12 +1280,12 @@ func (m *Miniredis) cmdSetbit(c *server.Peer, cmd string, args []string) {
 		if toBits(value[ourByteNr])[ourBitNr] {
 			old = 1
 		}
-		if newBit == 0 {
+		if opts.newBit == 0 {
 			value[ourByteNr] &^= 1 << uint8(7-ourBitNr)
 		} else {
 			value[ourByteNr] |= 1 << uint8(7-ourBitNr)
 		}
-		db.stringSet(key, string(value))
+		db.stringSet(opts.key, string(value))
 
 		c.WriteInt(old)
 	})
diff --git a/vendor/github.com/alicebob/miniredis/v2/cmd_transactions.go b/vendor/github.com/alicebob/miniredis/v2/cmd_transactions.go
index 9cbcaf3b3c81..94729e004112 100644
--- a/vendor/github.com/alicebob/miniredis/v2/cmd_transactions.go
+++ b/vendor/github.com/alicebob/miniredis/v2/cmd_transactions.go
@@ -30,7 +30,7 @@ func (m *Miniredis) cmdMulti(c *server.Peer, cmd string, args []string) {
 
 	ctx := getCtx(c)
 	if ctx.nested {
-		c.WriteError(msgNotFromScripts)
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 	if inTx(ctx) {
@@ -59,7 +59,7 @@ func (m *Miniredis) cmdExec(c *server.Peer, cmd string, args []string) {
 
 	ctx := getCtx(c)
 	if ctx.nested {
-		c.WriteError(msgNotFromScripts)
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 	if !inTx(ctx) {
@@ -137,7 +137,7 @@ func (m *Miniredis) cmdWatch(c *server.Peer, cmd string, args []string) {
 
 	ctx := getCtx(c)
 	if ctx.nested {
-		c.WriteError(msgNotFromScripts)
+		c.WriteError(msgNotFromScripts(ctx.nestedSHA))
 		return
 	}
 	if inTx(ctx) {
diff --git a/vendor/github.com/alicebob/miniredis/v2/geo.go b/vendor/github.com/alicebob/miniredis/v2/geo.go
index bc8e929270b7..3028a1670103 100644
--- a/vendor/github.com/alicebob/miniredis/v2/geo.go
+++ b/vendor/github.com/alicebob/miniredis/v2/geo.go
@@ -21,12 +21,10 @@ func hsin(theta float64) float64 {
 }
 
 // distance function returns the distance (in meters) between two points of
-//     a given longitude and latitude relatively accurately (using a spherical
-//     approximation of the Earth) through the Haversin Distance Formula for
-//     great arc distance on a sphere with accuracy for small distances
-//
+// a given longitude and latitude relatively accurately (using a spherical
+// approximation of the Earth) through the Haversin Distance Formula for
+// great arc distance on a sphere with accuracy for small distances
 // point coordinates are supplied in degrees and converted into rad. in the func
-//
 // distance returned is meters
 // http://en.wikipedia.org/wiki/Haversine_formula
 // Source: https://gist.github.com/cdipaolo/d3f8db3848278b49db68
diff --git a/vendor/github.com/alicebob/miniredis/v2/lua.go b/vendor/github.com/alicebob/miniredis/v2/lua.go
index 42222dce8e3a..da705676d613 100644
--- a/vendor/github.com/alicebob/miniredis/v2/lua.go
+++ b/vendor/github.com/alicebob/miniredis/v2/lua.go
@@ -18,7 +18,7 @@ var luaRedisConstants = map[string]lua.LValue{
 	"LOG_WARNING": lua.LNumber(3),
 }
 
-func mkLua(srv *server.Server, c *server.Peer) (map[string]lua.LGFunction, map[string]lua.LValue) {
+func mkLua(srv *server.Server, c *server.Peer, sha string) (map[string]lua.LGFunction, map[string]lua.LValue) {
 	mkCall := func(failFast bool) func(l *lua.LState) int {
 		// one server.Ctx for a single Lua run
 		pCtx := &connCtx{}
@@ -26,12 +26,13 @@ func mkLua(srv *server.Server, c *server.Peer) (map[string]lua.LGFunction, map[s
 			pCtx.authenticated = true
 		}
 		pCtx.nested = true
+		pCtx.nestedSHA = sha
 		pCtx.selectedDB = getCtx(c).selectedDB
 
 		return func(l *lua.LState) int {
 			top := l.GetTop()
 			if top == 0 {
-				l.Error(lua.LString("Please specify at least one argument for redis.call()"), 1)
+				l.Error(lua.LString(fmt.Sprintf("Please specify at least one argument for this redis lib call script: %s, &c.", sha)), 1)
 				return 0
 			}
 			var args []string
@@ -42,12 +43,12 @@ func mkLua(srv *server.Server, c *server.Peer) (map[string]lua.LGFunction, map[s
 				case lua.LString:
 					args = append(args, string(a))
 				default:
-					l.Error(lua.LString("Lua redis() command arguments must be strings or integers"), 1)
+					l.Error(lua.LString(fmt.Sprintf("Lua redis lib command arguments must be strings or integers script: %s, &c.", sha)), 1)
 					return 0
 				}
 			}
 			if len(args) == 0 {
-				l.Error(lua.LString(msgNotFromScripts), 1)
+				l.Error(lua.LString(msgNotFromScripts(sha)), 1)
 				return 0
 			}
 
@@ -63,7 +64,7 @@ func mkLua(srv *server.Server, c *server.Peer) (map[string]lua.LGFunction, map[s
 				if failFast {
 					// call() mode
 					if strings.Contains(err.Error(), "ERR unknown command") {
-						l.Error(lua.LString("Unknown Redis command called from Lua script"), 1)
+						l.Error(lua.LString(fmt.Sprintf("Unknown Redis command called from script script: %s, &c.", sha)), 1)
 					} else {
 						l.Error(lua.LString(err.Error()), 1)
 					}
@@ -112,7 +113,7 @@ func mkLua(srv *server.Server, c *server.Peer) (map[string]lua.LGFunction, map[s
 				return 0
 			}
 			res := &lua.LTable{}
-			res.RawSetString("err", lua.LString(msg))
+			res.RawSetString("err", lua.LString("ERR "+msg))
 			l.Push(res)
 			return 1
 		},
@@ -217,6 +218,8 @@ func redisToLua(l *lua.LState, res []interface{}) *lua.LTable {
 			v = lua.LFalse
 		} else {
 			switch et := e.(type) {
+			case int:
+				v = lua.LNumber(et)
 			case int64:
 				v = lua.LNumber(et)
 			case []uint8:
diff --git a/vendor/github.com/alicebob/miniredis/v2/miniredis.go b/vendor/github.com/alicebob/miniredis/v2/miniredis.go
index 697dec0652d0..4eb7cb60c8ba 100644
--- a/vendor/github.com/alicebob/miniredis/v2/miniredis.go
+++ b/vendor/github.com/alicebob/miniredis/v2/miniredis.go
@@ -13,7 +13,6 @@
 //
 // For direct use you can select a Redis database with either `s.Select(12);
 // s.Get("foo")` or `s.DB(12).Get("foo")`.
-//
 package miniredis
 
 import (
@@ -77,6 +76,7 @@ type dbKey struct {
 }
 
 // connCtx has all state for a single connection.
+// (this struct was named before context.Context existed)
 type connCtx struct {
 	selectedDB       int            // selected DB
 	authenticated    bool           // auth enabled and a valid AUTH seen
@@ -85,6 +85,7 @@ type connCtx struct {
 	watch            map[dbKey]uint // WATCHed keys
 	subscriber       *Subscriber    // client is in PUBSUB mode if not nil
 	nested           bool           // this is called via Lua
+	nestedSHA        string         // set to the SHA of the nesting function
 }
 
 // NewMiniRedis makes a new, non-started, Miniredis object.
@@ -194,7 +195,6 @@ func (m *Miniredis) start(s *server.Server) error {
 	commandsScripting(m)
 	commandsGeo(m)
 	commandsCluster(m)
-	commandsCommand(m)
 	commandsHll(m)
 
 	return nil
@@ -347,9 +347,9 @@ func (m *Miniredis) Server() *server.Server {
 // Dump limits the maximum length of each key:value to "DumpMaxLineLen" characters.
 // To increase that, call something like:
 //
-//	    miniredis.DumpMaxLineLen = 1024
-//      mr, _ = miniredis.Run()
-// 		mr.Dump()
+//	miniredis.DumpMaxLineLen = 1024
+//	mr, _ = miniredis.Run()
+//	mr.Dump()
 func (m *Miniredis) Dump() string {
 	m.Lock()
 	defer m.Unlock()
@@ -419,8 +419,10 @@ func (m *Miniredis) SetTime(t time.Time) {
 }
 
 // make every command return this message. For example:
-//   LOADING Redis is loading the dataset in memory
-//   MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'.
+//
+//	LOADING Redis is loading the dataset in memory
+//	MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'.
+//
 // Clear it with an empty string. Don't add newlines.
 func (m *Miniredis) SetError(msg string) {
 	cb := server.Hook(nil)
@@ -433,6 +435,18 @@ func (m *Miniredis) SetError(msg string) {
 	m.srv.SetPreHook(cb)
 }
 
+// isValidCMD returns true if command is valid and can be executed.
+func (m *Miniredis) isValidCMD(c *server.Peer, cmd string) bool {
+	if !m.handleAuth(c) {
+		return false
+	}
+	if m.checkPubsub(c, cmd) {
+		return false
+	}
+
+	return true
+}
+
 // handleAuth returns false if connection has no access. It sends the reply.
 func (m *Miniredis) handleAuth(c *server.Peer) bool {
 	if getCtx(c).nested {
diff --git a/vendor/github.com/alicebob/miniredis/v2/opts.go b/vendor/github.com/alicebob/miniredis/v2/opts.go
index 016d26820002..de91386015dc 100644
--- a/vendor/github.com/alicebob/miniredis/v2/opts.go
+++ b/vendor/github.com/alicebob/miniredis/v2/opts.go
@@ -1,7 +1,9 @@
 package miniredis
 
 import (
+	"math"
 	"strconv"
+	"time"
 
 	"github.com/alicebob/miniredis/v2/server"
 )
@@ -10,12 +12,33 @@ import (
 // Writes "invalid integer" error to c if it's not a valid integer. Returns
 // whether or not things were okay.
 func optInt(c *server.Peer, src string, dest *int) bool {
+	return optIntErr(c, src, dest, msgInvalidInt)
+}
+
+func optIntErr(c *server.Peer, src string, dest *int, errMsg string) bool {
 	n, err := strconv.Atoi(src)
 	if err != nil {
 		setDirty(c)
-		c.WriteError(msgInvalidInt)
+		c.WriteError(errMsg)
 		return false
 	}
 	*dest = n
 	return true
 }
+
+func optDuration(c *server.Peer, src string, dest *time.Duration) bool {
+	n, err := strconv.ParseFloat(src, 64)
+	if err != nil {
+		setDirty(c)
+		c.WriteError(msgInvalidTimeout)
+		return false
+	}
+	if n < 0 || math.IsInf(n, 0) {
+		setDirty(c)
+		c.WriteError(msgNegTimeout)
+		return false
+	}
+
+	*dest = time.Duration(n*1_000_000) * time.Microsecond
+	return true
+}
diff --git a/vendor/github.com/alicebob/miniredis/v2/redis.go b/vendor/github.com/alicebob/miniredis/v2/redis.go
index d4a0cd8d4414..5cfca355121e 100644
--- a/vendor/github.com/alicebob/miniredis/v2/redis.go
+++ b/vendor/github.com/alicebob/miniredis/v2/redis.go
@@ -20,6 +20,7 @@ const (
 	msgInvalidMinMax        = "ERR min or max is not a float"
 	msgInvalidRangeItem     = "ERR min or max not valid string range item"
 	msgInvalidTimeout       = "ERR timeout is not a float or out of range"
+	msgInvalidRange         = "ERR value is out of range, must be positive"
 	msgSyntaxError          = "ERR syntax error"
 	msgKeyNotFound          = "ERR no such key"
 	msgOutOfRange           = "ERR index out of range"
@@ -31,8 +32,10 @@ const (
 	msgInvalidPSETEXTime    = "ERR invalid expire time in psetex"
 	msgInvalidKeysNumber    = "ERR Number of keys can't be greater than number of args"
 	msgNegativeKeysNumber   = "ERR Number of keys can't be negative"
-	msgFScriptUsage         = "ERR Unknown subcommand or wrong number of arguments for '%s'. Try SCRIPT HELP."
-	msgFPubsubUsage         = "ERR Unknown subcommand or wrong number of arguments for '%s'. Try PUBSUB HELP."
+	msgFScriptUsage         = "ERR unknown subcommand or wrong number of arguments for '%s'. Try SCRIPT HELP."
+	msgFScriptUsageSimple   = "ERR unknown subcommand '%s'. Try SCRIPT HELP."
+	msgFPubsubUsage         = "ERR unknown subcommand or wrong number of arguments for '%s'. Try PUBSUB HELP."
+	msgFPubsubUsageSimple   = "ERR unknown subcommand '%s'. Try PUBSUB HELP."
 	msgScriptFlush          = "ERR SCRIPT FLUSH only support SYNC|ASYNC option"
 	msgSingleElementPair    = "ERR INCR option supports a single increment-element pair"
 	msgGTLTandNX            = "ERR GT, LT, and/or NX options at the same time are not compatible"
@@ -41,7 +44,6 @@ const (
 	msgStreamIDZero         = "ERR The ID specified in XADD must be greater than 0-0"
 	msgNoScriptFound        = "NOSCRIPT No matching script. Please use EVAL."
 	msgUnsupportedUnit      = "ERR unsupported unit provided. please use m, km, ft, mi"
-	msgNotFromScripts       = "This Redis command is not allowed from scripts"
 	msgXreadUnbalanced      = "ERR Unbalanced XREAD list of streams: for each stream key an ID or '$' must be specified."
 	msgXgroupKeyNotFound    = "ERR The XGROUP subcommand requires the key to exist. Note that for CREATE you may want to use the MKSTREAM option to create an empty stream automatically."
 	msgXtrimInvalidStrategy = "ERR unsupported XTRIM strategy. Please use MAXLEN, MINID"
@@ -49,6 +51,9 @@ const (
 	msgXtrimInvalidLimit    = "ERR syntax error, LIMIT cannot be used without the special ~ option"
 	msgDBIndexOutOfRange    = "ERR DB index is out of range"
 	msgLimitCombination     = "ERR syntax error, LIMIT is only supported in combination with either BYSCORE or BYLEX"
+	msgRankIsZero           = "ERR RANK can't be zero: use 1 to start from the first match, 2 from the second ... or use negative to start from the end of the list"
+	msgCountIsNegative      = "ERR COUNT can't be negative"
+	msgMaxLengthIsNegative  = "ERR MAXLEN can't be negative"
 )
 
 func errWrongNumber(cmd string) string {
@@ -67,6 +72,10 @@ func errXreadgroup(key, group string) error {
 	return fmt.Errorf("NOGROUP No such key '%s' or consumer group '%s' in XREADGROUP with GROUP option", key, group)
 }
 
+func msgNotFromScripts(sha string) string {
+	return fmt.Sprintf("This Redis command is not allowed from script script: %s, &c", sha)
+}
+
 // withTx wraps the non-argument-checking part of command handling code in
 // transaction logic.
 func withTx(
@@ -134,14 +143,19 @@ func blocking(
 	m.Lock()
 	defer m.Unlock()
 	for {
-		done := cb(c, ctx)
-		if done {
+		if c.Closed() {
 			return
 		}
 
 		if m.Ctx.Err() != nil {
 			return
 		}
+
+		done := cb(c, ctx)
+		if done {
+			return
+		}
+
 		if timedOut {
 			onTimeout(c)
 			return
diff --git a/vendor/github.com/alicebob/miniredis/v2/server/server.go b/vendor/github.com/alicebob/miniredis/v2/server/server.go
index 60e391f22bd9..ee4f04c2186e 100644
--- a/vendor/github.com/alicebob/miniredis/v2/server/server.go
+++ b/vendor/github.com/alicebob/miniredis/v2/server/server.go
@@ -158,24 +158,34 @@ func (s *Server) servePeer(c net.Conn) {
 	peer := &Peer{
 		w: bufio.NewWriter(c),
 	}
+
 	defer func() {
 		for _, f := range peer.onDisconnect {
 			f()
 		}
 	}()
 
-	for {
-		args, err := readArray(r)
-		if err != nil {
-			return
+	readCh := make(chan []string)
+
+	go func() {
+		defer close(readCh)
+
+		for {
+			args, err := readArray(r)
+			if err != nil {
+				peer.Close()
+				return
+			}
+
+			readCh <- args
 		}
+	}()
+
+	for args := range readCh {
 		s.Dispatch(peer, args)
 		peer.Flush()
 
-		s.mu.Lock()
-		closed := peer.closed
-		s.mu.Unlock()
-		if closed {
+		if peer.Closed() {
 			c.Close()
 		}
 	}
@@ -259,6 +269,13 @@ func (c *Peer) Close() {
 	c.closed = true
 }
 
+// Return true if the peer connection closed.
+func (c *Peer) Closed() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.closed
+}
+
 // Register a function to execute on disconnect. There can be multiple
 // functions registered.
 func (c *Peer) OnDisconnect(f func()) {
diff --git a/vendor/github.com/alicebob/miniredis/v2/stream.go b/vendor/github.com/alicebob/miniredis/v2/stream.go
index 574f9016dcfd..f59820d55ce2 100644
--- a/vendor/github.com/alicebob/miniredis/v2/stream.go
+++ b/vendor/github.com/alicebob/miniredis/v2/stream.go
@@ -9,6 +9,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -17,6 +18,7 @@ type streamKey struct {
 	entries         []StreamEntry
 	groups          map[string]*streamGroup
 	lastAllocatedID string
+	mu              sync.Mutex
 }
 
 // a StreamEntry is an entry in a stream. The ID is always of the form
@@ -31,10 +33,11 @@ type streamGroup struct {
 	stream    *streamKey
 	lastID    string
 	pending   []pendingEntry
-	consumers map[string]consumer
+	consumers map[string]*consumer
 }
 
 type consumer struct {
+	numPendingEntries int
 	// TODO: "last seen" timestamp
 }
 
@@ -51,6 +54,7 @@ func newStreamKey() *streamKey {
 	}
 }
 
+// generateID doesn't lock the mutex
 func (s *streamKey) generateID(now time.Time) string {
 	ts := uint64(now.UnixNano()) / 1_000_000
 
@@ -60,7 +64,7 @@ func (s *streamKey) generateID(now time.Time) string {
 		next = fmt.Sprintf("%d-%d", last[0], last[1]+1)
 	}
 
-	lastID := s.lastID()
+	lastID := s.lastIDUnlocked()
 	if streamCmp(lastID, next) >= 0 {
 		last, _ := parseStreamID(lastID)
 		next = fmt.Sprintf("%d-%d", last[0], last[1]+1)
@@ -70,7 +74,16 @@ func (s *streamKey) generateID(now time.Time) string {
 	return next
 }
 
+// lastID locks the mutex
 func (s *streamKey) lastID() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.lastIDUnlocked()
+}
+
+// lastID doesn't lock the mutex
+func (s *streamKey) lastIDUnlocked() string {
 	if len(s.entries) == 0 {
 		return "0-0"
 	}
@@ -79,6 +92,9 @@ func (s *streamKey) lastID() string {
 }
 
 func (s *streamKey) copy() *streamKey {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	cpy := &streamKey{
 		entries: s.entries,
 	}
@@ -193,17 +209,20 @@ func reversedStreamEntries(o []StreamEntry) []StreamEntry {
 }
 
 func (s *streamKey) createGroup(group, id string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	if _, ok := s.groups[group]; ok {
 		return errors.New("BUSYGROUP Consumer Group name already exists")
 	}
 
 	if id == "$" {
-		id = s.lastID()
+		id = s.lastIDUnlocked()
 	}
 	s.groups[group] = &streamGroup{
 		stream:    s,
 		lastID:    id,
-		consumers: map[string]consumer{},
+		consumers: map[string]*consumer{},
 	}
 	return nil
 }
@@ -212,6 +231,9 @@ func (s *streamKey) createGroup(group, id string) error {
 // If id is empty or "*" the ID will be generated automatically.
 // `values` should have an even length.
 func (s *streamKey) add(entryID string, values []string, now time.Time) (string, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	if entryID == "" || entryID == "*" {
 		entryID = s.generateID(now)
 	}
@@ -223,7 +245,7 @@ func (s *streamKey) add(entryID string, values []string, now time.Time) (string,
 	if entryID == "0-0" {
 		return "", errors.New(msgStreamIDZero)
 	}
-	if streamCmp(s.lastID(), entryID) != -1 {
+	if streamCmp(s.lastIDUnlocked(), entryID) != -1 {
 		return "", errors.New(msgStreamIDTooSmall)
 	}
 
@@ -235,6 +257,9 @@ func (s *streamKey) add(entryID string, values []string, now time.Time) (string,
 }
 
 func (s *streamKey) trim(n int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	if len(s.entries) > n {
 		s.entries = s.entries[len(s.entries)-n:]
 	}
@@ -242,6 +267,9 @@ func (s *streamKey) trim(n int) {
 
 // all entries after "id"
 func (s *streamKey) after(id string) []StreamEntry {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	pos := sort.Search(len(s.entries), func(i int) bool {
 		return streamCmp(id, s.entries[i].ID) < 0
 	})
@@ -251,6 +279,9 @@ func (s *streamKey) after(id string) []StreamEntry {
 // get a stream entry by ID
 // Also returns the position in the entries slice, if found.
 func (s *streamKey) get(id string) (int, *StreamEntry) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	pos := sort.Search(len(s.entries), func(i int) bool {
 		return streamCmp(id, s.entries[i].ID) <= 0
 	})
@@ -279,16 +310,39 @@ func (g *streamGroup) readGroup(
 		}
 
 		if !noack {
+			shouldAppend := len(g.pending) == 0
 			for _, msg := range msgs {
-				g.pending = append(g.pending, pendingEntry{
+				if !shouldAppend {
+					shouldAppend = streamCmp(msg.ID, g.pending[len(g.pending)-1].id) == 1
+				}
+
+				var entry *pendingEntry
+				if shouldAppend {
+					g.pending = append(g.pending, pendingEntry{})
+					entry = &g.pending[len(g.pending)-1]
+				} else {
+					var pos int
+					pos, entry = g.searchPending(msg.ID)
+					if entry == nil {
+						g.pending = append(g.pending[:pos+1], g.pending[pos:]...)
+						entry = &g.pending[pos]
+					} else {
+						g.consumers[entry.consumer].numPendingEntries--
+					}
+				}
+
+				*entry = pendingEntry{
 					id:            msg.ID,
 					consumer:      consumerID,
 					deliveryCount: 1,
 					lastDelivery:  now,
-				})
+				}
 			}
 		}
-		g.consumers[consumerID] = consumer{}
+		if _, ok := g.consumers[consumerID]; !ok {
+			g.consumers[consumerID] = &consumer{}
+		}
+		g.consumers[consumerID].numPendingEntries += len(msgs)
 		g.lastID = msgs[len(msgs)-1].ID
 		return msgs
 	}
@@ -314,6 +368,16 @@ func (g *streamGroup) readGroup(
 	return res
 }
 
+func (g *streamGroup) searchPending(id string) (int, *pendingEntry) {
+	pos := sort.Search(len(g.pending), func(i int) bool {
+		return streamCmp(id, g.pending[i].id) <= 0
+	})
+	if pos >= len(g.pending) || g.pending[pos].id != id {
+		return pos, nil
+	}
+	return pos, &g.pending[pos]
+}
+
 func (g *streamGroup) ack(ids []string) (int, error) {
 	count := 0
 	for _, id := range ids {
@@ -321,14 +385,19 @@ func (g *streamGroup) ack(ids []string) (int, error) {
 			return 0, errors.New(msgInvalidStreamID)
 		}
 
-		pos := sort.Search(len(g.pending), func(i int) bool {
-			return streamCmp(id, g.pending[i].id) <= 0
-		})
-		if len(g.pending) <= pos || g.pending[pos].id != id {
+		pos, entry := g.searchPending(id)
+		if entry == nil {
 			continue
 		}
 
+		consumer := g.consumers[entry.consumer]
+		consumer.numPendingEntries--
+
 		g.pending = append(g.pending[:pos], g.pending[pos+1:]...)
+		// don't count deleted entries
+		if _, e := g.stream.get(id); e == nil {
+			continue
+		}
 		count++
 	}
 	return count, nil
@@ -361,7 +430,7 @@ func (g *streamGroup) pendingAfter(id string) []pendingEntry {
 
 func (g *streamGroup) pendingCount(consumer string) int {
 	n := 0
-	for _, p := range g.pending {
+	for _, p := range g.activePending() {
 		if p.consumer == consumer {
 			n++
 		}
@@ -369,10 +438,25 @@ func (g *streamGroup) pendingCount(consumer string) int {
 	return n
 }
 
+// pending entries without the entries deleted from the group
+func (g *streamGroup) activePending() []pendingEntry {
+	var pe []pendingEntry
+	for _, p := range g.pending {
+		// drop deleted ones
+		if _, e := g.stream.get(p.id); e == nil {
+			continue
+		}
+		p := p
+		pe = append(pe, p)
+	}
+	return pe
+}
+
 func (g *streamGroup) copy() *streamGroup {
-	cns := map[string]consumer{}
+	cns := map[string]*consumer{}
 	for k, v := range g.consumers {
-		cns[k] = v
+		c := *v
+		cns[k] = &c
 	}
 	return &streamGroup{
 		// don't copy stream
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
index 8bc65154c368..521b3219800f 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -23,13 +23,16 @@ const (
 	ApNortheast2RegionID = "ap-northeast-2" // Asia Pacific (Seoul).
 	ApNortheast3RegionID = "ap-northeast-3" // Asia Pacific (Osaka).
 	ApSouth1RegionID     = "ap-south-1"     // Asia Pacific (Mumbai).
+	ApSouth2RegionID     = "ap-south-2"     // Asia Pacific (Hyderabad).
 	ApSoutheast1RegionID = "ap-southeast-1" // Asia Pacific (Singapore).
 	ApSoutheast2RegionID = "ap-southeast-2" // Asia Pacific (Sydney).
 	ApSoutheast3RegionID = "ap-southeast-3" // Asia Pacific (Jakarta).
 	CaCentral1RegionID   = "ca-central-1"   // Canada (Central).
 	EuCentral1RegionID   = "eu-central-1"   // Europe (Frankfurt).
+	EuCentral2RegionID   = "eu-central-2"   // Europe (Zurich).
 	EuNorth1RegionID     = "eu-north-1"     // Europe (Stockholm).
 	EuSouth1RegionID     = "eu-south-1"     // Europe (Milan).
+	EuSouth2RegionID     = "eu-south-2"     // Europe (Spain).
 	EuWest1RegionID      = "eu-west-1"      // Europe (Ireland).
 	EuWest2RegionID      = "eu-west-2"      // Europe (London).
 	EuWest3RegionID      = "eu-west-3"      // Europe (Paris).
@@ -157,6 +160,9 @@ var awsPartition = partition{
 		"ap-south-1": region{
 			Description: "Asia Pacific (Mumbai)",
 		},
+		"ap-south-2": region{
+			Description: "Asia Pacific (Hyderabad)",
+		},
 		"ap-southeast-1": region{
 			Description: "Asia Pacific (Singapore)",
 		},
@@ -172,12 +178,18 @@ var awsPartition = partition{
 		"eu-central-1": region{
 			Description: "Europe (Frankfurt)",
 		},
+		"eu-central-2": region{
+			Description: "Europe (Zurich)",
+		},
 		"eu-north-1": region{
 			Description: "Europe (Stockholm)",
 		},
 		"eu-south-1": region{
 			Description: "Europe (Milan)",
 		},
+		"eu-south-2": region{
+			Description: "Europe (Spain)",
+		},
 		"eu-west-1": region{
 			Description: "Europe (Ireland)",
 		},
@@ -237,6 +249,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -258,12 +273,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -399,6 +420,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -429,12 +453,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -633,6 +663,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -897,6 +930,25 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"aoss": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"api.detective": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{
@@ -1084,6 +1136,14 @@ var awsPartition = partition{
 						Region: "ap-south-1",
 					},
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{
+					Hostname: "api.ecr.ap-south-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-south-2",
+					},
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{
@@ -1196,6 +1256,14 @@ var awsPartition = partition{
 						Region: "eu-central-1",
 					},
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "api.ecr.eu-central-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-2",
+					},
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{
@@ -1212,6 +1280,14 @@ var awsPartition = partition{
 						Region: "eu-south-1",
 					},
 				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{
+					Hostname: "api.ecr.eu-south-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-south-2",
+					},
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{
@@ -1402,6 +1478,26 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"api.ecr-public": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{
+					Hostname: "api.ecr-public.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{
+					Hostname: "api.ecr-public.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
 		"api.elastic-inference": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -1976,6 +2072,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -1997,12 +2096,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -2158,6 +2263,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -2173,12 +2281,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -2355,6 +2469,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -2370,12 +2487,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -3042,56 +3165,183 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"arc-zonal-shift": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"athena": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
 					Region: "af-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "af-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.af-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-northeast-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-northeast-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-northeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-northeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-southeast-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-southeast-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-southeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ca-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-north-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-west-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-west-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-3",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-west-3.api.aws",
+				},
 				endpointKey{
 					Region: "fips-us-east-1",
 				}: endpoint{
@@ -3131,12 +3381,30 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.me-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "sa-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.sa-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.us-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-east-1",
 					Variant: fipsVariant,
@@ -3146,6 +3414,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.us-east-2.api.aws",
+				},
 				endpointKey{
 					Region:  "us-east-2",
 					Variant: fipsVariant,
@@ -3155,6 +3429,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.us-west-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-west-1",
 					Variant: fipsVariant,
@@ -3164,6 +3444,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.us-west-2.api.aws",
+				},
 				endpointKey{
 					Region:  "us-west-2",
 					Variant: fipsVariant,
@@ -3237,6 +3523,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -3252,12 +3541,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -3926,6 +4221,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -3947,12 +4245,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -4105,6 +4409,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -4120,12 +4427,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -4374,6 +4687,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -4389,12 +4705,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -4660,6 +4982,17 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"codecatalyst": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "aws-global",
+				}: endpoint{
+					Hostname: "codecatalyst.global.api.aws",
+				},
+			},
+		},
 		"codecommit": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -4831,6 +5164,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -4846,12 +5182,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -5290,6 +5632,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -5390,6 +5735,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -5868,6 +6216,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -5883,12 +6234,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -6791,6 +7148,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -7007,6 +7367,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -7022,12 +7385,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -7195,6 +7564,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -7235,6 +7607,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -7277,12 +7652,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -7662,6 +8043,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -7731,6 +8115,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -7761,12 +8148,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -7969,6 +8362,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -8044,6 +8440,9 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "ec2.ap-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -8065,12 +8464,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -8222,6 +8627,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -8237,12 +8645,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -8454,6 +8868,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -8518,6 +8935,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -8533,12 +8953,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -9213,6 +9639,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -9228,12 +9657,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -9352,6 +9787,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -9375,12 +9813,18 @@ var awsPartition = partition{
 				}: endpoint{
 					SSLCommonName: "{service}.{region}.{dnsSuffix}",
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -9536,6 +9980,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -9895,6 +10342,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -9910,12 +10360,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -10037,6 +10493,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -10052,12 +10511,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -10323,6 +10788,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -11253,6 +11721,9 @@ var awsPartition = partition{
 		},
 		"gamesparks": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -12159,6 +12630,7 @@ var awsPartition = partition{
 					CredentialScope: credentialScope{
 						Region: "us-east-1",
 					},
+					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "ingest-fips-us-east-2",
@@ -12167,6 +12639,7 @@ var awsPartition = partition{
 					CredentialScope: credentialScope{
 						Region: "us-east-2",
 					},
+					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "ingest-fips-us-west-2",
@@ -12175,6 +12648,61 @@ var awsPartition = partition{
 					CredentialScope: credentialScope{
 						Region: "us-west-2",
 					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "ingest-us-east-1",
+				}: endpoint{
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region:  "ingest-us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ingest.timestream-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "ingest-us-east-2",
+				}: endpoint{
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region:  "ingest-us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ingest.timestream-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "ingest-us-west-2",
+				}: endpoint{
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region:  "ingest-us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ingest.timestream-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "us-east-1",
@@ -12801,6 +13329,16 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"iotroborunner": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+			},
+		},
 		"iotsecuredtunneling": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{},
@@ -13396,6 +13934,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -13411,12 +13952,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -13750,6 +14297,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kms-fips.ap-south-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "ap-south-2-fips",
 				}: endpoint{
@@ -13849,6 +14405,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kms-fips.eu-central-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-central-2-fips",
 				}: endpoint{
@@ -13894,6 +14459,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kms-fips.eu-south-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-south-2-fips",
 				}: endpoint{
@@ -14268,6 +14842,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "lambda.ap-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lambda.ap-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -14313,6 +14896,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "lambda.eu-central-1.api.aws",
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lambda.eu-central-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -14331,6 +14923,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "lambda.eu-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lambda.eu-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -14397,6 +14998,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lambda.me-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -14800,6 +15407,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -14815,12 +15425,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -14984,6 +15600,15 @@ var awsPartition = partition{
 		},
 		"m2": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
@@ -14996,6 +15621,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
@@ -15733,12 +16364,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "fips",
 				}: endpoint{
@@ -15816,6 +16453,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -15831,12 +16471,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -16156,6 +16802,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -16171,12 +16820,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -16586,9 +17241,6 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -16741,6 +17393,88 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"oam": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"oidc": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -17275,6 +18009,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -17290,12 +18027,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -17354,7 +18097,21 @@ var awsPartition = partition{
 				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
-				}: endpoint{},
+				}: endpoint{
+					Hostname: "pinpoint.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "pinpoint-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -17364,6 +18121,15 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "pinpoint-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-east-1",
 				}: endpoint{
@@ -17444,6 +18210,79 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"pipes": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"polly": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -17785,9 +18624,27 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -18131,12 +18988,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -18258,6 +19121,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -18288,12 +19154,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -18650,6 +19522,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -18671,12 +19546,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -19132,6 +20013,126 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"resource-explorer-2": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.aws",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.aws",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.af-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-northeast-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-northeast-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-northeast-3.api.aws",
+				},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-south-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-southeast-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-southeast-2.api.aws",
+				},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ca-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.eu-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.eu-central-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.eu-north-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.eu-west-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.eu-west-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{
+					Hostname: "resource-explorer-2.eu-west-3.api.aws",
+				},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.sa-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.us-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.us-east-2.api.aws",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.us-west-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{
+					Hostname: "resource-explorer-2.us-west-2.api.aws",
+				},
+			},
+		},
 		"resource-groups": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -19218,6 +20219,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -19849,6 +20853,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "s3.dualstack.ap-south-1.amazonaws.com",
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "s3.dualstack.ap-south-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{
@@ -19923,6 +20936,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "s3.dualstack.eu-central-1.amazonaws.com",
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "s3.dualstack.eu-central-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -19941,6 +20963,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "s3.dualstack.eu-south-1.amazonaws.com",
 				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "s3.dualstack.eu-south-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{
@@ -20780,6 +21811,13 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"sagemaker-geospatial": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"savingsplans": service{
 			PartitionEndpoint: "aws-global",
 			IsRegionalized:    boxedFalse,
@@ -20794,6 +21832,37 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"scheduler": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"schemas": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -20905,6 +21974,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -20935,12 +22007,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -21163,6 +22241,31 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"securitylake": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"serverlessrepo": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{
@@ -21907,6 +23010,34 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"simspaceweaver": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"sms": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -22397,6 +23528,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -22412,12 +23546,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -22536,6 +23676,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -22551,12 +23694,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -22672,6 +23821,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -22693,12 +23845,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -22933,6 +24091,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -22948,12 +24109,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -23120,6 +24287,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -23228,6 +24398,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -23243,12 +24416,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -23311,6 +24490,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -23334,12 +24516,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -23478,6 +24666,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -23493,12 +24684,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -23611,6 +24808,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -23626,12 +24826,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -23744,6 +24950,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -23759,12 +24968,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -24233,6 +25448,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -24451,6 +25669,67 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"voice-chime": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "fips.voice-chime.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-1-fips",
+				}: endpoint{
+					Hostname: "fips.voice-chime.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "fips.voice-chime.us-west-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2-fips",
+				}: endpoint{
+					Hostname: "fips.voice-chime.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+			},
+		},
 		"voiceid": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -24462,22 +25741,46 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "voiceid-fips.ca-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "voiceid-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-east-1",
 				}: endpoint{
-
+					Hostname: "voiceid-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "fips-us-west-2",
 				}: endpoint{
-
+					Hostname: "voiceid-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
@@ -24486,14 +25789,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region:  "us-east-1",
 					Variant: fipsVariant,
-				}: endpoint{},
+				}: endpoint{
+					Hostname: "voiceid-fips.us-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
 				endpointKey{
 					Region:  "us-west-2",
 					Variant: fipsVariant,
-				}: endpoint{},
+				}: endpoint{
+					Hostname: "voiceid-fips.us-west-2.amazonaws.com",
+				},
 			},
 		},
 		"waf": service{
@@ -26022,6 +27329,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -26037,12 +27347,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -26359,9 +27675,21 @@ var awscnPartition = partition{
 				endpointKey{
 					Region: "cn-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.cn-north-1.api.amazonwebservices.com.cn",
+				},
 				endpointKey{
 					Region: "cn-northwest-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-northwest-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
 			},
 		},
 		"autoscaling": service{
@@ -27308,6 +28636,31 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"resource-explorer-2": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.amazonwebservices.com.cn",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.amazonwebservices.com.cn",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.cn-north-1.api.amazonwebservices.com.cn",
+				},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
+			},
+		},
 		"resource-groups": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -28454,6 +29807,12 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
@@ -28463,6 +29822,12 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.us-gov-west-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
@@ -30340,6 +31705,13 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"ingest.timestream": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+			},
+		},
 		"inspector": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -31475,6 +32847,31 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"resource-explorer-2": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.aws",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.aws",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.us-gov-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.us-gov-west-1.api.aws",
+				},
+			},
+		},
 		"resource-groups": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{},
@@ -33388,6 +34785,15 @@ var awsisoPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "fips-us-iso-west-1",
+				}: endpoint{
+					Hostname: "elasticfilesystem-fips.us-iso-west-1.c2s.ic.gov",
+					CredentialScope: credentialScope{
+						Region: "us-iso-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-iso-east-1",
 				}: endpoint{},
@@ -33397,6 +34803,15 @@ var awsisoPartition = partition{
 				}: endpoint{
 					Hostname: "elasticfilesystem-fips.us-iso-east-1.c2s.ic.gov",
 				},
+				endpointKey{
+					Region: "us-iso-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-iso-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "elasticfilesystem-fips.us-iso-west-1.c2s.ic.gov",
+				},
 			},
 		},
 		"elasticloadbalancing": service{
@@ -33448,6 +34863,9 @@ var awsisoPartition = partition{
 				endpointKey{
 					Region: "us-iso-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "us-iso-west-1",
+				}: endpoint{},
 			},
 		},
 		"glacier": service{
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/version.go b/vendor/github.com/aws/aws-sdk-go/aws/version.go
index 0df464d83bf9..ee4c2d9e987e 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/version.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.44.128"
+const SDKVersion = "1.44.156"
diff --git a/vendor/github.com/aws/aws-sdk-go/service/dynamodb/api.go b/vendor/github.com/aws/aws-sdk-go/service/dynamodb/api.go
index 244e075f5c78..c7727107eb8d 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/dynamodb/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/dynamodb/api.go
@@ -413,7 +413,10 @@ func (c *DynamoDB) BatchWriteItemRequest(input *BatchWriteItemInput) (req *reque
 // in DynamoDB's JSON format for the API call. For more details on this distinction,
 // see Naming Rules and Data Types (https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.NamingRulesDataTypes.html).
 //
-// BatchWriteItem cannot update items. To update items, use the UpdateItem action.
+// BatchWriteItem cannot update items. If you perform a BatchWriteItem operation
+// on an existing item, that item's values will be overwritten by the operation
+// and it will appear like it was updated. To update items, we recommend you
+// use the UpdateItem action.
 //
 // The individual PutItem and DeleteItem operations specified in BatchWriteItem
 // are atomic; however BatchWriteItem as a whole is not. If any requested operations
@@ -659,14 +662,17 @@ func (c *DynamoDB) CreateBackupRequest(input *CreateBackupInput) (req *request.R
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -820,14 +826,17 @@ func (c *DynamoDB) CreateGlobalTableRequest(input *CreateGlobalTableInput) (req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -966,14 +975,17 @@ func (c *DynamoDB) CreateTableRequest(input *CreateTableInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -1093,14 +1105,17 @@ func (c *DynamoDB) DeleteBackupRequest(input *DeleteBackupInput) (req *request.R
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -1381,14 +1396,17 @@ func (c *DynamoDB) DeleteTableRequest(input *DeleteTableInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -1936,14 +1954,17 @@ func (c *DynamoDB) DescribeExportRequest(input *DescribeExportInput) (req *reque
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -2938,14 +2959,17 @@ func (c *DynamoDB) DisableKinesisStreamingDestinationRequest(input *DisableKines
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -3068,14 +3092,17 @@ func (c *DynamoDB) EnableKinesisStreamingDestinationRequest(input *EnableKinesis
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -3496,14 +3523,17 @@ func (c *DynamoDB) ExportTableToPointInTimeRequest(input *ExportTableToPointInTi
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -3728,14 +3758,17 @@ func (c *DynamoDB) ImportTableRequest(input *ImportTableInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -4081,14 +4114,17 @@ func (c *DynamoDB) ListExportsRequest(input *ListExportsInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -4337,14 +4373,17 @@ func (c *DynamoDB) ListImportsRequest(input *ListImportsInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -4772,7 +4811,6 @@ func (c *DynamoDB) PutItemRequest(input *PutItemInput) (req *request.Request, ou
 // using the ReturnValues parameter.
 //
 // When you add an item, the primary key attributes are the only required attributes.
-// Attribute values cannot be null.
 //
 // Empty String and Binary attribute values are allowed. Attribute values of
 // type String and Binary must have a length greater than zero if the attribute
@@ -5190,14 +5228,17 @@ func (c *DynamoDB) RestoreTableFromBackupRequest(input *RestoreTableFromBackupIn
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -5354,14 +5395,17 @@ func (c *DynamoDB) RestoreTableToPointInTimeRequest(input *RestoreTableToPointIn
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -5691,14 +5735,17 @@ func (c *DynamoDB) TagResourceRequest(input *TagResourceInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -6319,14 +6366,17 @@ func (c *DynamoDB) UntagResourceRequest(input *UntagResourceInput) (req *request
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -6804,14 +6854,17 @@ func (c *DynamoDB) UpdateGlobalTableSettingsRequest(input *UpdateGlobalTableSett
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -7089,14 +7142,17 @@ func (c *DynamoDB) UpdateTableRequest(input *UpdateTableInput) (req *request.Req
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -7194,14 +7250,17 @@ func (c *DynamoDB) UpdateTableReplicaAutoScalingRequest(input *UpdateTableReplic
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
+//
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -7348,14 +7407,17 @@ func (c *DynamoDB) UpdateTimeToLiveRequest(input *UpdateTimeToLiveInput) (req *r
 //   - LimitExceededException
 //     There is no limit to the number of daily on-demand backups that can be taken.
 //
-//     Up to 500 simultaneous table operations are allowed per account. These operations
-//     include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-//     and RestoreTableToPointInTime.
+//     For most purposes, up to 500 simultaneous table operations are allowed per
+//     account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+//     RestoreTableFromBackup, and RestoreTableToPointInTime.
+//
+//     When you are creating a table with one or more secondary indexes, you can
+//     have up to 250 such requests running at a time. However, if the table or
+//     index specifications are complex, then DynamoDB might temporarily reduce
+//     the number of concurrent operations.
 //
-//     The only exception is when you are creating a table with one or more secondary
-//     indexes. You can have up to 250 such requests running at a time; however,
-//     if the table or index specifications are complex, DynamoDB might temporarily
-//     reduce the number of concurrent operations.
+//     When importing into DynamoDB, up to 50 simultaneous import table operations
+//     are allowed per account.
 //
 //     There is a soft account quota of 2,500 tables.
 //
@@ -9240,8 +9302,8 @@ type BatchWriteItemOutput struct {
 
 	// A map of tables and requests against those tables that were not processed.
 	// The UnprocessedItems value is in the same form as RequestItems, so you can
-	// provide this value directly to a subsequent BatchGetItem operation. For more
-	// information, see RequestItems in the Request Parameters section.
+	// provide this value directly to a subsequent BatchWriteItem operation. For
+	// more information, see RequestItems in the Request Parameters section.
 	//
 	// Each UnprocessedItems entry consists of a table name and, for that table,
 	// a list of operations to perform (DeleteRequest or PutRequest).
@@ -9302,7 +9364,12 @@ func (s *BatchWriteItemOutput) SetUnprocessedItems(v map[string][]*WriteRequest)
 	return s
 }
 
-// Contains the details for the read/write capacity mode.
+// Contains the details for the read/write capacity mode. This page talks about
+// PROVISIONED and PAY_PER_REQUEST billing modes. For more information about
+// these modes, see Read/write capacity mode (https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCapacityMode.html).
+//
+// You may need to switch to on-demand mode at least once in order to return
+// a BillingModeSummary response.
 type BillingModeSummary struct {
 	_ struct{} `type:"structure"`
 
@@ -16855,14 +16922,17 @@ func (s *KinesisDataStreamDestination) SetStreamArn(v string) *KinesisDataStream
 
 // There is no limit to the number of daily on-demand backups that can be taken.
 //
-// Up to 500 simultaneous table operations are allowed per account. These operations
-// include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-// and RestoreTableToPointInTime.
+// For most purposes, up to 500 simultaneous table operations are allowed per
+// account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+// RestoreTableFromBackup, and RestoreTableToPointInTime.
 //
-// The only exception is when you are creating a table with one or more secondary
-// indexes. You can have up to 250 such requests running at a time; however,
-// if the table or index specifications are complex, DynamoDB might temporarily
-// reduce the number of concurrent operations.
+// When you are creating a table with one or more secondary indexes, you can
+// have up to 250 such requests running at a time. However, if the table or
+// index specifications are complex, then DynamoDB might temporarily reduce
+// the number of concurrent operations.
+//
+// When importing into DynamoDB, up to 50 simultaneous import table operations
+// are allowed per account.
 //
 // There is a soft account quota of 2,500 tables.
 type LimitExceededException struct {
@@ -20065,7 +20135,8 @@ type ReplicaGlobalSecondaryIndexAutoScalingDescription struct {
 	//
 	//    * CREATING - The index is being created.
 	//
-	//    * UPDATING - The index is being updated.
+	//    * UPDATING - The table/index configuration is being updated. The table/index
+	//    remains available for data operations when UPDATING
 	//
 	//    * DELETING - The index is being deleted.
 	//
@@ -22945,7 +23016,8 @@ type TableDescription struct {
 	//
 	//    * CREATING - The table is being created.
 	//
-	//    * UPDATING - The table is being updated.
+	//    * UPDATING - The table/index configuration is being updated. The table/index
+	//    remains available for data operations when UPDATING.
 	//
 	//    * DELETING - The table is being deleted.
 	//
diff --git a/vendor/github.com/aws/aws-sdk-go/service/dynamodb/errors.go b/vendor/github.com/aws/aws-sdk-go/service/dynamodb/errors.go
index 9bd2107c60cf..9f7baf88f6bc 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/dynamodb/errors.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/dynamodb/errors.go
@@ -122,14 +122,17 @@ const (
 	//
 	// There is no limit to the number of daily on-demand backups that can be taken.
 	//
-	// Up to 500 simultaneous table operations are allowed per account. These operations
-	// include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup,
-	// and RestoreTableToPointInTime.
-	//
-	// The only exception is when you are creating a table with one or more secondary
-	// indexes. You can have up to 250 such requests running at a time; however,
-	// if the table or index specifications are complex, DynamoDB might temporarily
-	// reduce the number of concurrent operations.
+	// For most purposes, up to 500 simultaneous table operations are allowed per
+	// account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive,
+	// RestoreTableFromBackup, and RestoreTableToPointInTime.
+	//
+	// When you are creating a table with one or more secondary indexes, you can
+	// have up to 250 such requests running at a time. However, if the table or
+	// index specifications are complex, then DynamoDB might temporarily reduce
+	// the number of concurrent operations.
+	//
+	// When importing into DynamoDB, up to 50 simultaneous import table operations
+	// are allowed per account.
 	//
 	// There is a soft account quota of 2,500 tables.
 	ErrCodeLimitExceededException = "LimitExceededException"
diff --git a/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go b/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go
index 3797b053156e..0dc5143c8456 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go
@@ -2450,6 +2450,81 @@ func (c *EC2) AttachNetworkInterfaceWithContext(ctx aws.Context, input *AttachNe
 	return out, req.Send()
 }
 
+const opAttachVerifiedAccessTrustProvider = "AttachVerifiedAccessTrustProvider"
+
+// AttachVerifiedAccessTrustProviderRequest generates a "aws/request.Request" representing the
+// client's request for the AttachVerifiedAccessTrustProvider operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See AttachVerifiedAccessTrustProvider for more information on using the AttachVerifiedAccessTrustProvider
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the AttachVerifiedAccessTrustProviderRequest method.
+//	req, resp := client.AttachVerifiedAccessTrustProviderRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/AttachVerifiedAccessTrustProvider
+func (c *EC2) AttachVerifiedAccessTrustProviderRequest(input *AttachVerifiedAccessTrustProviderInput) (req *request.Request, output *AttachVerifiedAccessTrustProviderOutput) {
+	op := &request.Operation{
+		Name:       opAttachVerifiedAccessTrustProvider,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &AttachVerifiedAccessTrustProviderInput{}
+	}
+
+	output = &AttachVerifiedAccessTrustProviderOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// AttachVerifiedAccessTrustProvider API operation for Amazon Elastic Compute Cloud.
+//
+// A trust provider is a third-party entity that creates, maintains, and manages
+// identity information for users and devices. One or more trust providers can
+// be attached to an Amazon Web Services Verified Access instance.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation AttachVerifiedAccessTrustProvider for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/AttachVerifiedAccessTrustProvider
+func (c *EC2) AttachVerifiedAccessTrustProvider(input *AttachVerifiedAccessTrustProviderInput) (*AttachVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.AttachVerifiedAccessTrustProviderRequest(input)
+	return out, req.Send()
+}
+
+// AttachVerifiedAccessTrustProviderWithContext is the same as AttachVerifiedAccessTrustProvider with the addition of
+// the ability to pass a context and additional request options.
+//
+// See AttachVerifiedAccessTrustProvider for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) AttachVerifiedAccessTrustProviderWithContext(ctx aws.Context, input *AttachVerifiedAccessTrustProviderInput, opts ...request.Option) (*AttachVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.AttachVerifiedAccessTrustProviderRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opAttachVolume = "AttachVolume"
 
 // AttachVolumeRequest generates a "aws/request.Request" representing the
@@ -3356,6 +3431,82 @@ func (c *EC2) CancelExportTaskWithContext(ctx aws.Context, input *CancelExportTa
 	return out, req.Send()
 }
 
+const opCancelImageLaunchPermission = "CancelImageLaunchPermission"
+
+// CancelImageLaunchPermissionRequest generates a "aws/request.Request" representing the
+// client's request for the CancelImageLaunchPermission operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See CancelImageLaunchPermission for more information on using the CancelImageLaunchPermission
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the CancelImageLaunchPermissionRequest method.
+//	req, resp := client.CancelImageLaunchPermissionRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CancelImageLaunchPermission
+func (c *EC2) CancelImageLaunchPermissionRequest(input *CancelImageLaunchPermissionInput) (req *request.Request, output *CancelImageLaunchPermissionOutput) {
+	op := &request.Operation{
+		Name:       opCancelImageLaunchPermission,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &CancelImageLaunchPermissionInput{}
+	}
+
+	output = &CancelImageLaunchPermissionOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// CancelImageLaunchPermission API operation for Amazon Elastic Compute Cloud.
+//
+// Removes your Amazon Web Services account from the launch permissions for
+// the specified AMI. For more information, see Cancel having an AMI shared
+// with your Amazon Web Services account (https://docs.aws.amazon.com/) in the
+// Amazon Elastic Compute Cloud User Guide.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation CancelImageLaunchPermission for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CancelImageLaunchPermission
+func (c *EC2) CancelImageLaunchPermission(input *CancelImageLaunchPermissionInput) (*CancelImageLaunchPermissionOutput, error) {
+	req, out := c.CancelImageLaunchPermissionRequest(input)
+	return out, req.Send()
+}
+
+// CancelImageLaunchPermissionWithContext is the same as CancelImageLaunchPermission with the addition of
+// the ability to pass a context and additional request options.
+//
+// See CancelImageLaunchPermission for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) CancelImageLaunchPermissionWithContext(ctx aws.Context, input *CancelImageLaunchPermissionInput, opts ...request.Option) (*CancelImageLaunchPermissionOutput, error) {
+	req, out := c.CancelImageLaunchPermissionRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opCancelImportTask = "CancelImportTask"
 
 // CancelImportTaskRequest generates a "aws/request.Request" representing the
@@ -3875,7 +4026,7 @@ func (c *EC2) CopyImageRequest(input *CopyImageInput) (req *request.Request, out
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // For more information about the prerequisites and limits when copying an AMI,
-// see Copying an AMI (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html)
+// see Copy an AMI (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html)
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -5299,7 +5450,7 @@ func (c *EC2) CreateImageRequest(input *CreateImageInput) (req *request.Request,
 // from this new AMI, the instance automatically launches with those additional
 // volumes.
 //
-// For more information, see Creating Amazon EBS-Backed Linux AMIs (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html)
+// For more information, see Create an Amazon EBS-backed Linux AMI (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html)
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -7228,7 +7379,7 @@ func (c *EC2) CreateReplaceRootVolumeTaskRequest(input *CreateReplaceRootVolumeT
 // to a specific snapshot taken from the original root volume, or that is restored
 // from an AMI that has the same key characteristics as that of the instance.
 //
-// For more information, see Replace a root volume (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-restoring-volume.html#replace-root)
+// For more information, see Replace a root volume (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replace-root.html)
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -9487,6 +9638,311 @@ func (c *EC2) CreateTransitGatewayVpcAttachmentWithContext(ctx aws.Context, inpu
 	return out, req.Send()
 }
 
+const opCreateVerifiedAccessEndpoint = "CreateVerifiedAccessEndpoint"
+
+// CreateVerifiedAccessEndpointRequest generates a "aws/request.Request" representing the
+// client's request for the CreateVerifiedAccessEndpoint operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See CreateVerifiedAccessEndpoint for more information on using the CreateVerifiedAccessEndpoint
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the CreateVerifiedAccessEndpointRequest method.
+//	req, resp := client.CreateVerifiedAccessEndpointRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessEndpoint
+func (c *EC2) CreateVerifiedAccessEndpointRequest(input *CreateVerifiedAccessEndpointInput) (req *request.Request, output *CreateVerifiedAccessEndpointOutput) {
+	op := &request.Operation{
+		Name:       opCreateVerifiedAccessEndpoint,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &CreateVerifiedAccessEndpointInput{}
+	}
+
+	output = &CreateVerifiedAccessEndpointOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// CreateVerifiedAccessEndpoint API operation for Amazon Elastic Compute Cloud.
+//
+// An Amazon Web Services Verified Access endpoint is where you define your
+// application along with an optional endpoint-level access policy.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation CreateVerifiedAccessEndpoint for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessEndpoint
+func (c *EC2) CreateVerifiedAccessEndpoint(input *CreateVerifiedAccessEndpointInput) (*CreateVerifiedAccessEndpointOutput, error) {
+	req, out := c.CreateVerifiedAccessEndpointRequest(input)
+	return out, req.Send()
+}
+
+// CreateVerifiedAccessEndpointWithContext is the same as CreateVerifiedAccessEndpoint with the addition of
+// the ability to pass a context and additional request options.
+//
+// See CreateVerifiedAccessEndpoint for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) CreateVerifiedAccessEndpointWithContext(ctx aws.Context, input *CreateVerifiedAccessEndpointInput, opts ...request.Option) (*CreateVerifiedAccessEndpointOutput, error) {
+	req, out := c.CreateVerifiedAccessEndpointRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opCreateVerifiedAccessGroup = "CreateVerifiedAccessGroup"
+
+// CreateVerifiedAccessGroupRequest generates a "aws/request.Request" representing the
+// client's request for the CreateVerifiedAccessGroup operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See CreateVerifiedAccessGroup for more information on using the CreateVerifiedAccessGroup
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the CreateVerifiedAccessGroupRequest method.
+//	req, resp := client.CreateVerifiedAccessGroupRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessGroup
+func (c *EC2) CreateVerifiedAccessGroupRequest(input *CreateVerifiedAccessGroupInput) (req *request.Request, output *CreateVerifiedAccessGroupOutput) {
+	op := &request.Operation{
+		Name:       opCreateVerifiedAccessGroup,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &CreateVerifiedAccessGroupInput{}
+	}
+
+	output = &CreateVerifiedAccessGroupOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// CreateVerifiedAccessGroup API operation for Amazon Elastic Compute Cloud.
+//
+// An Amazon Web Services Verified Access group is a collection of Amazon Web
+// Services Verified Access endpoints who's associated applications have similar
+// security requirements. Each instance within an Amazon Web Services Verified
+// Access group shares an Amazon Web Services Verified Access policy. For example,
+// you can group all Amazon Web Services Verified Access instances associated
+// with “sales” applications together and use one common Amazon Web Services
+// Verified Access policy.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation CreateVerifiedAccessGroup for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessGroup
+func (c *EC2) CreateVerifiedAccessGroup(input *CreateVerifiedAccessGroupInput) (*CreateVerifiedAccessGroupOutput, error) {
+	req, out := c.CreateVerifiedAccessGroupRequest(input)
+	return out, req.Send()
+}
+
+// CreateVerifiedAccessGroupWithContext is the same as CreateVerifiedAccessGroup with the addition of
+// the ability to pass a context and additional request options.
+//
+// See CreateVerifiedAccessGroup for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) CreateVerifiedAccessGroupWithContext(ctx aws.Context, input *CreateVerifiedAccessGroupInput, opts ...request.Option) (*CreateVerifiedAccessGroupOutput, error) {
+	req, out := c.CreateVerifiedAccessGroupRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opCreateVerifiedAccessInstance = "CreateVerifiedAccessInstance"
+
+// CreateVerifiedAccessInstanceRequest generates a "aws/request.Request" representing the
+// client's request for the CreateVerifiedAccessInstance operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See CreateVerifiedAccessInstance for more information on using the CreateVerifiedAccessInstance
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the CreateVerifiedAccessInstanceRequest method.
+//	req, resp := client.CreateVerifiedAccessInstanceRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessInstance
+func (c *EC2) CreateVerifiedAccessInstanceRequest(input *CreateVerifiedAccessInstanceInput) (req *request.Request, output *CreateVerifiedAccessInstanceOutput) {
+	op := &request.Operation{
+		Name:       opCreateVerifiedAccessInstance,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &CreateVerifiedAccessInstanceInput{}
+	}
+
+	output = &CreateVerifiedAccessInstanceOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// CreateVerifiedAccessInstance API operation for Amazon Elastic Compute Cloud.
+//
+// An Amazon Web Services Verified Access instance is a regional entity that
+// evaluates application requests and grants access only when your security
+// requirements are met.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation CreateVerifiedAccessInstance for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessInstance
+func (c *EC2) CreateVerifiedAccessInstance(input *CreateVerifiedAccessInstanceInput) (*CreateVerifiedAccessInstanceOutput, error) {
+	req, out := c.CreateVerifiedAccessInstanceRequest(input)
+	return out, req.Send()
+}
+
+// CreateVerifiedAccessInstanceWithContext is the same as CreateVerifiedAccessInstance with the addition of
+// the ability to pass a context and additional request options.
+//
+// See CreateVerifiedAccessInstance for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) CreateVerifiedAccessInstanceWithContext(ctx aws.Context, input *CreateVerifiedAccessInstanceInput, opts ...request.Option) (*CreateVerifiedAccessInstanceOutput, error) {
+	req, out := c.CreateVerifiedAccessInstanceRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opCreateVerifiedAccessTrustProvider = "CreateVerifiedAccessTrustProvider"
+
+// CreateVerifiedAccessTrustProviderRequest generates a "aws/request.Request" representing the
+// client's request for the CreateVerifiedAccessTrustProvider operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See CreateVerifiedAccessTrustProvider for more information on using the CreateVerifiedAccessTrustProvider
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the CreateVerifiedAccessTrustProviderRequest method.
+//	req, resp := client.CreateVerifiedAccessTrustProviderRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessTrustProvider
+func (c *EC2) CreateVerifiedAccessTrustProviderRequest(input *CreateVerifiedAccessTrustProviderInput) (req *request.Request, output *CreateVerifiedAccessTrustProviderOutput) {
+	op := &request.Operation{
+		Name:       opCreateVerifiedAccessTrustProvider,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &CreateVerifiedAccessTrustProviderInput{}
+	}
+
+	output = &CreateVerifiedAccessTrustProviderOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// CreateVerifiedAccessTrustProvider API operation for Amazon Elastic Compute Cloud.
+//
+// A trust provider is a third-party entity that creates, maintains, and manages
+// identity information for users and devices. When an application request is
+// made, the identity information sent by the trust provider will be evaluated
+// by Amazon Web Services Verified Access, before allowing or denying the application
+// request.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation CreateVerifiedAccessTrustProvider for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/CreateVerifiedAccessTrustProvider
+func (c *EC2) CreateVerifiedAccessTrustProvider(input *CreateVerifiedAccessTrustProviderInput) (*CreateVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.CreateVerifiedAccessTrustProviderRequest(input)
+	return out, req.Send()
+}
+
+// CreateVerifiedAccessTrustProviderWithContext is the same as CreateVerifiedAccessTrustProvider with the addition of
+// the ability to pass a context and additional request options.
+//
+// See CreateVerifiedAccessTrustProvider for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) CreateVerifiedAccessTrustProviderWithContext(ctx aws.Context, input *CreateVerifiedAccessTrustProviderInput, opts ...request.Option) (*CreateVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.CreateVerifiedAccessTrustProviderRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opCreateVolume = "CreateVolume"
 
 // CreateVolumeRequest generates a "aws/request.Request" representing the
@@ -14688,6 +15144,298 @@ func (c *EC2) DeleteTransitGatewayVpcAttachmentWithContext(ctx aws.Context, inpu
 	return out, req.Send()
 }
 
+const opDeleteVerifiedAccessEndpoint = "DeleteVerifiedAccessEndpoint"
+
+// DeleteVerifiedAccessEndpointRequest generates a "aws/request.Request" representing the
+// client's request for the DeleteVerifiedAccessEndpoint operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DeleteVerifiedAccessEndpoint for more information on using the DeleteVerifiedAccessEndpoint
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DeleteVerifiedAccessEndpointRequest method.
+//	req, resp := client.DeleteVerifiedAccessEndpointRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessEndpoint
+func (c *EC2) DeleteVerifiedAccessEndpointRequest(input *DeleteVerifiedAccessEndpointInput) (req *request.Request, output *DeleteVerifiedAccessEndpointOutput) {
+	op := &request.Operation{
+		Name:       opDeleteVerifiedAccessEndpoint,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &DeleteVerifiedAccessEndpointInput{}
+	}
+
+	output = &DeleteVerifiedAccessEndpointOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DeleteVerifiedAccessEndpoint API operation for Amazon Elastic Compute Cloud.
+//
+// Delete an Amazon Web Services Verified Access endpoint.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DeleteVerifiedAccessEndpoint for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessEndpoint
+func (c *EC2) DeleteVerifiedAccessEndpoint(input *DeleteVerifiedAccessEndpointInput) (*DeleteVerifiedAccessEndpointOutput, error) {
+	req, out := c.DeleteVerifiedAccessEndpointRequest(input)
+	return out, req.Send()
+}
+
+// DeleteVerifiedAccessEndpointWithContext is the same as DeleteVerifiedAccessEndpoint with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DeleteVerifiedAccessEndpoint for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DeleteVerifiedAccessEndpointWithContext(ctx aws.Context, input *DeleteVerifiedAccessEndpointInput, opts ...request.Option) (*DeleteVerifiedAccessEndpointOutput, error) {
+	req, out := c.DeleteVerifiedAccessEndpointRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opDeleteVerifiedAccessGroup = "DeleteVerifiedAccessGroup"
+
+// DeleteVerifiedAccessGroupRequest generates a "aws/request.Request" representing the
+// client's request for the DeleteVerifiedAccessGroup operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DeleteVerifiedAccessGroup for more information on using the DeleteVerifiedAccessGroup
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DeleteVerifiedAccessGroupRequest method.
+//	req, resp := client.DeleteVerifiedAccessGroupRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessGroup
+func (c *EC2) DeleteVerifiedAccessGroupRequest(input *DeleteVerifiedAccessGroupInput) (req *request.Request, output *DeleteVerifiedAccessGroupOutput) {
+	op := &request.Operation{
+		Name:       opDeleteVerifiedAccessGroup,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &DeleteVerifiedAccessGroupInput{}
+	}
+
+	output = &DeleteVerifiedAccessGroupOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DeleteVerifiedAccessGroup API operation for Amazon Elastic Compute Cloud.
+//
+// Delete an Amazon Web Services Verified Access group.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DeleteVerifiedAccessGroup for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessGroup
+func (c *EC2) DeleteVerifiedAccessGroup(input *DeleteVerifiedAccessGroupInput) (*DeleteVerifiedAccessGroupOutput, error) {
+	req, out := c.DeleteVerifiedAccessGroupRequest(input)
+	return out, req.Send()
+}
+
+// DeleteVerifiedAccessGroupWithContext is the same as DeleteVerifiedAccessGroup with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DeleteVerifiedAccessGroup for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DeleteVerifiedAccessGroupWithContext(ctx aws.Context, input *DeleteVerifiedAccessGroupInput, opts ...request.Option) (*DeleteVerifiedAccessGroupOutput, error) {
+	req, out := c.DeleteVerifiedAccessGroupRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opDeleteVerifiedAccessInstance = "DeleteVerifiedAccessInstance"
+
+// DeleteVerifiedAccessInstanceRequest generates a "aws/request.Request" representing the
+// client's request for the DeleteVerifiedAccessInstance operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DeleteVerifiedAccessInstance for more information on using the DeleteVerifiedAccessInstance
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DeleteVerifiedAccessInstanceRequest method.
+//	req, resp := client.DeleteVerifiedAccessInstanceRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessInstance
+func (c *EC2) DeleteVerifiedAccessInstanceRequest(input *DeleteVerifiedAccessInstanceInput) (req *request.Request, output *DeleteVerifiedAccessInstanceOutput) {
+	op := &request.Operation{
+		Name:       opDeleteVerifiedAccessInstance,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &DeleteVerifiedAccessInstanceInput{}
+	}
+
+	output = &DeleteVerifiedAccessInstanceOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DeleteVerifiedAccessInstance API operation for Amazon Elastic Compute Cloud.
+//
+// Delete an Amazon Web Services Verified Access instance.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DeleteVerifiedAccessInstance for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessInstance
+func (c *EC2) DeleteVerifiedAccessInstance(input *DeleteVerifiedAccessInstanceInput) (*DeleteVerifiedAccessInstanceOutput, error) {
+	req, out := c.DeleteVerifiedAccessInstanceRequest(input)
+	return out, req.Send()
+}
+
+// DeleteVerifiedAccessInstanceWithContext is the same as DeleteVerifiedAccessInstance with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DeleteVerifiedAccessInstance for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DeleteVerifiedAccessInstanceWithContext(ctx aws.Context, input *DeleteVerifiedAccessInstanceInput, opts ...request.Option) (*DeleteVerifiedAccessInstanceOutput, error) {
+	req, out := c.DeleteVerifiedAccessInstanceRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opDeleteVerifiedAccessTrustProvider = "DeleteVerifiedAccessTrustProvider"
+
+// DeleteVerifiedAccessTrustProviderRequest generates a "aws/request.Request" representing the
+// client's request for the DeleteVerifiedAccessTrustProvider operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DeleteVerifiedAccessTrustProvider for more information on using the DeleteVerifiedAccessTrustProvider
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DeleteVerifiedAccessTrustProviderRequest method.
+//	req, resp := client.DeleteVerifiedAccessTrustProviderRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessTrustProvider
+func (c *EC2) DeleteVerifiedAccessTrustProviderRequest(input *DeleteVerifiedAccessTrustProviderInput) (req *request.Request, output *DeleteVerifiedAccessTrustProviderOutput) {
+	op := &request.Operation{
+		Name:       opDeleteVerifiedAccessTrustProvider,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &DeleteVerifiedAccessTrustProviderInput{}
+	}
+
+	output = &DeleteVerifiedAccessTrustProviderOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DeleteVerifiedAccessTrustProvider API operation for Amazon Elastic Compute Cloud.
+//
+// Delete an Amazon Web Services Verified Access trust provider.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DeleteVerifiedAccessTrustProvider for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DeleteVerifiedAccessTrustProvider
+func (c *EC2) DeleteVerifiedAccessTrustProvider(input *DeleteVerifiedAccessTrustProviderInput) (*DeleteVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.DeleteVerifiedAccessTrustProviderRequest(input)
+	return out, req.Send()
+}
+
+// DeleteVerifiedAccessTrustProviderWithContext is the same as DeleteVerifiedAccessTrustProvider with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DeleteVerifiedAccessTrustProvider for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DeleteVerifiedAccessTrustProviderWithContext(ctx aws.Context, input *DeleteVerifiedAccessTrustProviderInput, opts ...request.Option) (*DeleteVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.DeleteVerifiedAccessTrustProviderRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opDeleteVolume = "DeleteVolume"
 
 // DeleteVolumeRequest generates a "aws/request.Request" representing the
@@ -16552,6 +17300,136 @@ func (c *EC2) DescribeAvailabilityZonesWithContext(ctx aws.Context, input *Descr
 	return out, req.Send()
 }
 
+const opDescribeAwsNetworkPerformanceMetricSubscriptions = "DescribeAwsNetworkPerformanceMetricSubscriptions"
+
+// DescribeAwsNetworkPerformanceMetricSubscriptionsRequest generates a "aws/request.Request" representing the
+// client's request for the DescribeAwsNetworkPerformanceMetricSubscriptions operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DescribeAwsNetworkPerformanceMetricSubscriptions for more information on using the DescribeAwsNetworkPerformanceMetricSubscriptions
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DescribeAwsNetworkPerformanceMetricSubscriptionsRequest method.
+//	req, resp := client.DescribeAwsNetworkPerformanceMetricSubscriptionsRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeAwsNetworkPerformanceMetricSubscriptions
+func (c *EC2) DescribeAwsNetworkPerformanceMetricSubscriptionsRequest(input *DescribeAwsNetworkPerformanceMetricSubscriptionsInput) (req *request.Request, output *DescribeAwsNetworkPerformanceMetricSubscriptionsOutput) {
+	op := &request.Operation{
+		Name:       opDescribeAwsNetworkPerformanceMetricSubscriptions,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &DescribeAwsNetworkPerformanceMetricSubscriptionsInput{}
+	}
+
+	output = &DescribeAwsNetworkPerformanceMetricSubscriptionsOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DescribeAwsNetworkPerformanceMetricSubscriptions API operation for Amazon Elastic Compute Cloud.
+//
+// Describes the current Infrastructure Performance metric subscriptions.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DescribeAwsNetworkPerformanceMetricSubscriptions for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeAwsNetworkPerformanceMetricSubscriptions
+func (c *EC2) DescribeAwsNetworkPerformanceMetricSubscriptions(input *DescribeAwsNetworkPerformanceMetricSubscriptionsInput) (*DescribeAwsNetworkPerformanceMetricSubscriptionsOutput, error) {
+	req, out := c.DescribeAwsNetworkPerformanceMetricSubscriptionsRequest(input)
+	return out, req.Send()
+}
+
+// DescribeAwsNetworkPerformanceMetricSubscriptionsWithContext is the same as DescribeAwsNetworkPerformanceMetricSubscriptions with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DescribeAwsNetworkPerformanceMetricSubscriptions for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeAwsNetworkPerformanceMetricSubscriptionsWithContext(ctx aws.Context, input *DescribeAwsNetworkPerformanceMetricSubscriptionsInput, opts ...request.Option) (*DescribeAwsNetworkPerformanceMetricSubscriptionsOutput, error) {
+	req, out := c.DescribeAwsNetworkPerformanceMetricSubscriptionsRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// DescribeAwsNetworkPerformanceMetricSubscriptionsPages iterates over the pages of a DescribeAwsNetworkPerformanceMetricSubscriptions operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See DescribeAwsNetworkPerformanceMetricSubscriptions method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a DescribeAwsNetworkPerformanceMetricSubscriptions operation.
+//	pageNum := 0
+//	err := client.DescribeAwsNetworkPerformanceMetricSubscriptionsPages(params,
+//	    func(page *ec2.DescribeAwsNetworkPerformanceMetricSubscriptionsOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) DescribeAwsNetworkPerformanceMetricSubscriptionsPages(input *DescribeAwsNetworkPerformanceMetricSubscriptionsInput, fn func(*DescribeAwsNetworkPerformanceMetricSubscriptionsOutput, bool) bool) error {
+	return c.DescribeAwsNetworkPerformanceMetricSubscriptionsPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// DescribeAwsNetworkPerformanceMetricSubscriptionsPagesWithContext same as DescribeAwsNetworkPerformanceMetricSubscriptionsPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeAwsNetworkPerformanceMetricSubscriptionsPagesWithContext(ctx aws.Context, input *DescribeAwsNetworkPerformanceMetricSubscriptionsInput, fn func(*DescribeAwsNetworkPerformanceMetricSubscriptionsOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *DescribeAwsNetworkPerformanceMetricSubscriptionsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeAwsNetworkPerformanceMetricSubscriptionsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*DescribeAwsNetworkPerformanceMetricSubscriptionsOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
 const opDescribeBundleTasks = "DescribeBundleTasks"
 
 // DescribeBundleTasksRequest generates a "aws/request.Request" representing the
@@ -25566,7 +26444,7 @@ func (c *EC2) DescribeReplaceRootVolumeTasksRequest(input *DescribeReplaceRootVo
 // DescribeReplaceRootVolumeTasks API operation for Amazon Elastic Compute Cloud.
 //
 // Describes a root volume replacement task. For more information, see Replace
-// a root volume (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-restoring-volume.html#replace-root)
+// a root volume (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replace-root.html)
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -27432,7 +28310,7 @@ func (c *EC2) DescribeSpotFleetRequestHistoryRequest(input *DescribeSpotFleetReq
 // recorded event. Spot Fleet events are available for 48 hours.
 //
 // For more information, see Monitor fleet events using Amazon EventBridge (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/fleet-monitor.html)
-// in the Amazon EC2 User Guide for Linux Instances.
+// in the Amazon EC2 User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -30253,6 +31131,657 @@ func (c *EC2) DescribeTrunkInterfaceAssociationsPagesWithContext(ctx aws.Context
 	return p.Err()
 }
 
+const opDescribeVerifiedAccessEndpoints = "DescribeVerifiedAccessEndpoints"
+
+// DescribeVerifiedAccessEndpointsRequest generates a "aws/request.Request" representing the
+// client's request for the DescribeVerifiedAccessEndpoints operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DescribeVerifiedAccessEndpoints for more information on using the DescribeVerifiedAccessEndpoints
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DescribeVerifiedAccessEndpointsRequest method.
+//	req, resp := client.DescribeVerifiedAccessEndpointsRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessEndpoints
+func (c *EC2) DescribeVerifiedAccessEndpointsRequest(input *DescribeVerifiedAccessEndpointsInput) (req *request.Request, output *DescribeVerifiedAccessEndpointsOutput) {
+	op := &request.Operation{
+		Name:       opDescribeVerifiedAccessEndpoints,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &DescribeVerifiedAccessEndpointsInput{}
+	}
+
+	output = &DescribeVerifiedAccessEndpointsOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DescribeVerifiedAccessEndpoints API operation for Amazon Elastic Compute Cloud.
+//
+// Describe Amazon Web Services Verified Access endpoints.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DescribeVerifiedAccessEndpoints for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessEndpoints
+func (c *EC2) DescribeVerifiedAccessEndpoints(input *DescribeVerifiedAccessEndpointsInput) (*DescribeVerifiedAccessEndpointsOutput, error) {
+	req, out := c.DescribeVerifiedAccessEndpointsRequest(input)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessEndpointsWithContext is the same as DescribeVerifiedAccessEndpoints with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DescribeVerifiedAccessEndpoints for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessEndpointsWithContext(ctx aws.Context, input *DescribeVerifiedAccessEndpointsInput, opts ...request.Option) (*DescribeVerifiedAccessEndpointsOutput, error) {
+	req, out := c.DescribeVerifiedAccessEndpointsRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessEndpointsPages iterates over the pages of a DescribeVerifiedAccessEndpoints operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See DescribeVerifiedAccessEndpoints method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a DescribeVerifiedAccessEndpoints operation.
+//	pageNum := 0
+//	err := client.DescribeVerifiedAccessEndpointsPages(params,
+//	    func(page *ec2.DescribeVerifiedAccessEndpointsOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) DescribeVerifiedAccessEndpointsPages(input *DescribeVerifiedAccessEndpointsInput, fn func(*DescribeVerifiedAccessEndpointsOutput, bool) bool) error {
+	return c.DescribeVerifiedAccessEndpointsPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// DescribeVerifiedAccessEndpointsPagesWithContext same as DescribeVerifiedAccessEndpointsPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessEndpointsPagesWithContext(ctx aws.Context, input *DescribeVerifiedAccessEndpointsInput, fn func(*DescribeVerifiedAccessEndpointsOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *DescribeVerifiedAccessEndpointsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeVerifiedAccessEndpointsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*DescribeVerifiedAccessEndpointsOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
+const opDescribeVerifiedAccessGroups = "DescribeVerifiedAccessGroups"
+
+// DescribeVerifiedAccessGroupsRequest generates a "aws/request.Request" representing the
+// client's request for the DescribeVerifiedAccessGroups operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DescribeVerifiedAccessGroups for more information on using the DescribeVerifiedAccessGroups
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DescribeVerifiedAccessGroupsRequest method.
+//	req, resp := client.DescribeVerifiedAccessGroupsRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessGroups
+func (c *EC2) DescribeVerifiedAccessGroupsRequest(input *DescribeVerifiedAccessGroupsInput) (req *request.Request, output *DescribeVerifiedAccessGroupsOutput) {
+	op := &request.Operation{
+		Name:       opDescribeVerifiedAccessGroups,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &DescribeVerifiedAccessGroupsInput{}
+	}
+
+	output = &DescribeVerifiedAccessGroupsOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DescribeVerifiedAccessGroups API operation for Amazon Elastic Compute Cloud.
+//
+// Describe details of existing Verified Access groups.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DescribeVerifiedAccessGroups for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessGroups
+func (c *EC2) DescribeVerifiedAccessGroups(input *DescribeVerifiedAccessGroupsInput) (*DescribeVerifiedAccessGroupsOutput, error) {
+	req, out := c.DescribeVerifiedAccessGroupsRequest(input)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessGroupsWithContext is the same as DescribeVerifiedAccessGroups with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DescribeVerifiedAccessGroups for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessGroupsWithContext(ctx aws.Context, input *DescribeVerifiedAccessGroupsInput, opts ...request.Option) (*DescribeVerifiedAccessGroupsOutput, error) {
+	req, out := c.DescribeVerifiedAccessGroupsRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessGroupsPages iterates over the pages of a DescribeVerifiedAccessGroups operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See DescribeVerifiedAccessGroups method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a DescribeVerifiedAccessGroups operation.
+//	pageNum := 0
+//	err := client.DescribeVerifiedAccessGroupsPages(params,
+//	    func(page *ec2.DescribeVerifiedAccessGroupsOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) DescribeVerifiedAccessGroupsPages(input *DescribeVerifiedAccessGroupsInput, fn func(*DescribeVerifiedAccessGroupsOutput, bool) bool) error {
+	return c.DescribeVerifiedAccessGroupsPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// DescribeVerifiedAccessGroupsPagesWithContext same as DescribeVerifiedAccessGroupsPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessGroupsPagesWithContext(ctx aws.Context, input *DescribeVerifiedAccessGroupsInput, fn func(*DescribeVerifiedAccessGroupsOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *DescribeVerifiedAccessGroupsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeVerifiedAccessGroupsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*DescribeVerifiedAccessGroupsOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
+const opDescribeVerifiedAccessInstanceLoggingConfigurations = "DescribeVerifiedAccessInstanceLoggingConfigurations"
+
+// DescribeVerifiedAccessInstanceLoggingConfigurationsRequest generates a "aws/request.Request" representing the
+// client's request for the DescribeVerifiedAccessInstanceLoggingConfigurations operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DescribeVerifiedAccessInstanceLoggingConfigurations for more information on using the DescribeVerifiedAccessInstanceLoggingConfigurations
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DescribeVerifiedAccessInstanceLoggingConfigurationsRequest method.
+//	req, resp := client.DescribeVerifiedAccessInstanceLoggingConfigurationsRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessInstanceLoggingConfigurations
+func (c *EC2) DescribeVerifiedAccessInstanceLoggingConfigurationsRequest(input *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) (req *request.Request, output *DescribeVerifiedAccessInstanceLoggingConfigurationsOutput) {
+	op := &request.Operation{
+		Name:       opDescribeVerifiedAccessInstanceLoggingConfigurations,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &DescribeVerifiedAccessInstanceLoggingConfigurationsInput{}
+	}
+
+	output = &DescribeVerifiedAccessInstanceLoggingConfigurationsOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DescribeVerifiedAccessInstanceLoggingConfigurations API operation for Amazon Elastic Compute Cloud.
+//
+// Describes the current logging configuration for the Amazon Web Services Verified
+// Access instances.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DescribeVerifiedAccessInstanceLoggingConfigurations for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessInstanceLoggingConfigurations
+func (c *EC2) DescribeVerifiedAccessInstanceLoggingConfigurations(input *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) (*DescribeVerifiedAccessInstanceLoggingConfigurationsOutput, error) {
+	req, out := c.DescribeVerifiedAccessInstanceLoggingConfigurationsRequest(input)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessInstanceLoggingConfigurationsWithContext is the same as DescribeVerifiedAccessInstanceLoggingConfigurations with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DescribeVerifiedAccessInstanceLoggingConfigurations for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessInstanceLoggingConfigurationsWithContext(ctx aws.Context, input *DescribeVerifiedAccessInstanceLoggingConfigurationsInput, opts ...request.Option) (*DescribeVerifiedAccessInstanceLoggingConfigurationsOutput, error) {
+	req, out := c.DescribeVerifiedAccessInstanceLoggingConfigurationsRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessInstanceLoggingConfigurationsPages iterates over the pages of a DescribeVerifiedAccessInstanceLoggingConfigurations operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See DescribeVerifiedAccessInstanceLoggingConfigurations method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a DescribeVerifiedAccessInstanceLoggingConfigurations operation.
+//	pageNum := 0
+//	err := client.DescribeVerifiedAccessInstanceLoggingConfigurationsPages(params,
+//	    func(page *ec2.DescribeVerifiedAccessInstanceLoggingConfigurationsOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) DescribeVerifiedAccessInstanceLoggingConfigurationsPages(input *DescribeVerifiedAccessInstanceLoggingConfigurationsInput, fn func(*DescribeVerifiedAccessInstanceLoggingConfigurationsOutput, bool) bool) error {
+	return c.DescribeVerifiedAccessInstanceLoggingConfigurationsPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// DescribeVerifiedAccessInstanceLoggingConfigurationsPagesWithContext same as DescribeVerifiedAccessInstanceLoggingConfigurationsPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessInstanceLoggingConfigurationsPagesWithContext(ctx aws.Context, input *DescribeVerifiedAccessInstanceLoggingConfigurationsInput, fn func(*DescribeVerifiedAccessInstanceLoggingConfigurationsOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *DescribeVerifiedAccessInstanceLoggingConfigurationsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeVerifiedAccessInstanceLoggingConfigurationsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*DescribeVerifiedAccessInstanceLoggingConfigurationsOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
+const opDescribeVerifiedAccessInstances = "DescribeVerifiedAccessInstances"
+
+// DescribeVerifiedAccessInstancesRequest generates a "aws/request.Request" representing the
+// client's request for the DescribeVerifiedAccessInstances operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DescribeVerifiedAccessInstances for more information on using the DescribeVerifiedAccessInstances
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DescribeVerifiedAccessInstancesRequest method.
+//	req, resp := client.DescribeVerifiedAccessInstancesRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessInstances
+func (c *EC2) DescribeVerifiedAccessInstancesRequest(input *DescribeVerifiedAccessInstancesInput) (req *request.Request, output *DescribeVerifiedAccessInstancesOutput) {
+	op := &request.Operation{
+		Name:       opDescribeVerifiedAccessInstances,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &DescribeVerifiedAccessInstancesInput{}
+	}
+
+	output = &DescribeVerifiedAccessInstancesOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DescribeVerifiedAccessInstances API operation for Amazon Elastic Compute Cloud.
+//
+// Describe Verified Access instances.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DescribeVerifiedAccessInstances for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessInstances
+func (c *EC2) DescribeVerifiedAccessInstances(input *DescribeVerifiedAccessInstancesInput) (*DescribeVerifiedAccessInstancesOutput, error) {
+	req, out := c.DescribeVerifiedAccessInstancesRequest(input)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessInstancesWithContext is the same as DescribeVerifiedAccessInstances with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DescribeVerifiedAccessInstances for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessInstancesWithContext(ctx aws.Context, input *DescribeVerifiedAccessInstancesInput, opts ...request.Option) (*DescribeVerifiedAccessInstancesOutput, error) {
+	req, out := c.DescribeVerifiedAccessInstancesRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessInstancesPages iterates over the pages of a DescribeVerifiedAccessInstances operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See DescribeVerifiedAccessInstances method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a DescribeVerifiedAccessInstances operation.
+//	pageNum := 0
+//	err := client.DescribeVerifiedAccessInstancesPages(params,
+//	    func(page *ec2.DescribeVerifiedAccessInstancesOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) DescribeVerifiedAccessInstancesPages(input *DescribeVerifiedAccessInstancesInput, fn func(*DescribeVerifiedAccessInstancesOutput, bool) bool) error {
+	return c.DescribeVerifiedAccessInstancesPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// DescribeVerifiedAccessInstancesPagesWithContext same as DescribeVerifiedAccessInstancesPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessInstancesPagesWithContext(ctx aws.Context, input *DescribeVerifiedAccessInstancesInput, fn func(*DescribeVerifiedAccessInstancesOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *DescribeVerifiedAccessInstancesInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeVerifiedAccessInstancesRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*DescribeVerifiedAccessInstancesOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
+const opDescribeVerifiedAccessTrustProviders = "DescribeVerifiedAccessTrustProviders"
+
+// DescribeVerifiedAccessTrustProvidersRequest generates a "aws/request.Request" representing the
+// client's request for the DescribeVerifiedAccessTrustProviders operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DescribeVerifiedAccessTrustProviders for more information on using the DescribeVerifiedAccessTrustProviders
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DescribeVerifiedAccessTrustProvidersRequest method.
+//	req, resp := client.DescribeVerifiedAccessTrustProvidersRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessTrustProviders
+func (c *EC2) DescribeVerifiedAccessTrustProvidersRequest(input *DescribeVerifiedAccessTrustProvidersInput) (req *request.Request, output *DescribeVerifiedAccessTrustProvidersOutput) {
+	op := &request.Operation{
+		Name:       opDescribeVerifiedAccessTrustProviders,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &DescribeVerifiedAccessTrustProvidersInput{}
+	}
+
+	output = &DescribeVerifiedAccessTrustProvidersOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DescribeVerifiedAccessTrustProviders API operation for Amazon Elastic Compute Cloud.
+//
+// Describe details of existing Verified Access trust providers.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DescribeVerifiedAccessTrustProviders for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVerifiedAccessTrustProviders
+func (c *EC2) DescribeVerifiedAccessTrustProviders(input *DescribeVerifiedAccessTrustProvidersInput) (*DescribeVerifiedAccessTrustProvidersOutput, error) {
+	req, out := c.DescribeVerifiedAccessTrustProvidersRequest(input)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessTrustProvidersWithContext is the same as DescribeVerifiedAccessTrustProviders with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DescribeVerifiedAccessTrustProviders for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessTrustProvidersWithContext(ctx aws.Context, input *DescribeVerifiedAccessTrustProvidersInput, opts ...request.Option) (*DescribeVerifiedAccessTrustProvidersOutput, error) {
+	req, out := c.DescribeVerifiedAccessTrustProvidersRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// DescribeVerifiedAccessTrustProvidersPages iterates over the pages of a DescribeVerifiedAccessTrustProviders operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See DescribeVerifiedAccessTrustProviders method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a DescribeVerifiedAccessTrustProviders operation.
+//	pageNum := 0
+//	err := client.DescribeVerifiedAccessTrustProvidersPages(params,
+//	    func(page *ec2.DescribeVerifiedAccessTrustProvidersOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) DescribeVerifiedAccessTrustProvidersPages(input *DescribeVerifiedAccessTrustProvidersInput, fn func(*DescribeVerifiedAccessTrustProvidersOutput, bool) bool) error {
+	return c.DescribeVerifiedAccessTrustProvidersPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// DescribeVerifiedAccessTrustProvidersPagesWithContext same as DescribeVerifiedAccessTrustProvidersPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DescribeVerifiedAccessTrustProvidersPagesWithContext(ctx aws.Context, input *DescribeVerifiedAccessTrustProvidersInput, fn func(*DescribeVerifiedAccessTrustProvidersOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *DescribeVerifiedAccessTrustProvidersInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeVerifiedAccessTrustProvidersRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*DescribeVerifiedAccessTrustProvidersOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
 const opDescribeVolumeAttribute = "DescribeVolumeAttribute"
 
 // DescribeVolumeAttributeRequest generates a "aws/request.Request" representing the
@@ -32441,6 +33970,79 @@ func (c *EC2) DetachNetworkInterfaceWithContext(ctx aws.Context, input *DetachNe
 	return out, req.Send()
 }
 
+const opDetachVerifiedAccessTrustProvider = "DetachVerifiedAccessTrustProvider"
+
+// DetachVerifiedAccessTrustProviderRequest generates a "aws/request.Request" representing the
+// client's request for the DetachVerifiedAccessTrustProvider operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DetachVerifiedAccessTrustProvider for more information on using the DetachVerifiedAccessTrustProvider
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DetachVerifiedAccessTrustProviderRequest method.
+//	req, resp := client.DetachVerifiedAccessTrustProviderRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DetachVerifiedAccessTrustProvider
+func (c *EC2) DetachVerifiedAccessTrustProviderRequest(input *DetachVerifiedAccessTrustProviderInput) (req *request.Request, output *DetachVerifiedAccessTrustProviderOutput) {
+	op := &request.Operation{
+		Name:       opDetachVerifiedAccessTrustProvider,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &DetachVerifiedAccessTrustProviderInput{}
+	}
+
+	output = &DetachVerifiedAccessTrustProviderOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DetachVerifiedAccessTrustProvider API operation for Amazon Elastic Compute Cloud.
+//
+// Detach a trust provider from an Amazon Web Services Verified Access instance.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DetachVerifiedAccessTrustProvider for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DetachVerifiedAccessTrustProvider
+func (c *EC2) DetachVerifiedAccessTrustProvider(input *DetachVerifiedAccessTrustProviderInput) (*DetachVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.DetachVerifiedAccessTrustProviderRequest(input)
+	return out, req.Send()
+}
+
+// DetachVerifiedAccessTrustProviderWithContext is the same as DetachVerifiedAccessTrustProvider with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DetachVerifiedAccessTrustProvider for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DetachVerifiedAccessTrustProviderWithContext(ctx aws.Context, input *DetachVerifiedAccessTrustProviderInput, opts ...request.Option) (*DetachVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.DetachVerifiedAccessTrustProviderRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opDetachVolume = "DetachVolume"
 
 // DetachVolumeRequest generates a "aws/request.Request" representing the
@@ -32683,6 +34285,79 @@ func (c *EC2) DisableAddressTransferWithContext(ctx aws.Context, input *DisableA
 	return out, req.Send()
 }
 
+const opDisableAwsNetworkPerformanceMetricSubscription = "DisableAwsNetworkPerformanceMetricSubscription"
+
+// DisableAwsNetworkPerformanceMetricSubscriptionRequest generates a "aws/request.Request" representing the
+// client's request for the DisableAwsNetworkPerformanceMetricSubscription operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DisableAwsNetworkPerformanceMetricSubscription for more information on using the DisableAwsNetworkPerformanceMetricSubscription
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the DisableAwsNetworkPerformanceMetricSubscriptionRequest method.
+//	req, resp := client.DisableAwsNetworkPerformanceMetricSubscriptionRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DisableAwsNetworkPerformanceMetricSubscription
+func (c *EC2) DisableAwsNetworkPerformanceMetricSubscriptionRequest(input *DisableAwsNetworkPerformanceMetricSubscriptionInput) (req *request.Request, output *DisableAwsNetworkPerformanceMetricSubscriptionOutput) {
+	op := &request.Operation{
+		Name:       opDisableAwsNetworkPerformanceMetricSubscription,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &DisableAwsNetworkPerformanceMetricSubscriptionInput{}
+	}
+
+	output = &DisableAwsNetworkPerformanceMetricSubscriptionOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// DisableAwsNetworkPerformanceMetricSubscription API operation for Amazon Elastic Compute Cloud.
+//
+// Disables Infrastructure Performance metric subscriptions.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation DisableAwsNetworkPerformanceMetricSubscription for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DisableAwsNetworkPerformanceMetricSubscription
+func (c *EC2) DisableAwsNetworkPerformanceMetricSubscription(input *DisableAwsNetworkPerformanceMetricSubscriptionInput) (*DisableAwsNetworkPerformanceMetricSubscriptionOutput, error) {
+	req, out := c.DisableAwsNetworkPerformanceMetricSubscriptionRequest(input)
+	return out, req.Send()
+}
+
+// DisableAwsNetworkPerformanceMetricSubscriptionWithContext is the same as DisableAwsNetworkPerformanceMetricSubscription with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DisableAwsNetworkPerformanceMetricSubscription for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) DisableAwsNetworkPerformanceMetricSubscriptionWithContext(ctx aws.Context, input *DisableAwsNetworkPerformanceMetricSubscriptionInput, opts ...request.Option) (*DisableAwsNetworkPerformanceMetricSubscriptionOutput, error) {
+	req, out := c.DisableAwsNetworkPerformanceMetricSubscriptionRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opDisableEbsEncryptionByDefault = "DisableEbsEncryptionByDefault"
 
 // DisableEbsEncryptionByDefaultRequest generates a "aws/request.Request" representing the
@@ -34457,6 +36132,79 @@ func (c *EC2) EnableAddressTransferWithContext(ctx aws.Context, input *EnableAdd
 	return out, req.Send()
 }
 
+const opEnableAwsNetworkPerformanceMetricSubscription = "EnableAwsNetworkPerformanceMetricSubscription"
+
+// EnableAwsNetworkPerformanceMetricSubscriptionRequest generates a "aws/request.Request" representing the
+// client's request for the EnableAwsNetworkPerformanceMetricSubscription operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See EnableAwsNetworkPerformanceMetricSubscription for more information on using the EnableAwsNetworkPerformanceMetricSubscription
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the EnableAwsNetworkPerformanceMetricSubscriptionRequest method.
+//	req, resp := client.EnableAwsNetworkPerformanceMetricSubscriptionRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/EnableAwsNetworkPerformanceMetricSubscription
+func (c *EC2) EnableAwsNetworkPerformanceMetricSubscriptionRequest(input *EnableAwsNetworkPerformanceMetricSubscriptionInput) (req *request.Request, output *EnableAwsNetworkPerformanceMetricSubscriptionOutput) {
+	op := &request.Operation{
+		Name:       opEnableAwsNetworkPerformanceMetricSubscription,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &EnableAwsNetworkPerformanceMetricSubscriptionInput{}
+	}
+
+	output = &EnableAwsNetworkPerformanceMetricSubscriptionOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// EnableAwsNetworkPerformanceMetricSubscription API operation for Amazon Elastic Compute Cloud.
+//
+// Enables Infrastructure Performance subscriptions.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation EnableAwsNetworkPerformanceMetricSubscription for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/EnableAwsNetworkPerformanceMetricSubscription
+func (c *EC2) EnableAwsNetworkPerformanceMetricSubscription(input *EnableAwsNetworkPerformanceMetricSubscriptionInput) (*EnableAwsNetworkPerformanceMetricSubscriptionOutput, error) {
+	req, out := c.EnableAwsNetworkPerformanceMetricSubscriptionRequest(input)
+	return out, req.Send()
+}
+
+// EnableAwsNetworkPerformanceMetricSubscriptionWithContext is the same as EnableAwsNetworkPerformanceMetricSubscription with the addition of
+// the ability to pass a context and additional request options.
+//
+// See EnableAwsNetworkPerformanceMetricSubscription for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) EnableAwsNetworkPerformanceMetricSubscriptionWithContext(ctx aws.Context, input *EnableAwsNetworkPerformanceMetricSubscriptionInput, opts ...request.Option) (*EnableAwsNetworkPerformanceMetricSubscriptionOutput, error) {
+	req, out := c.EnableAwsNetworkPerformanceMetricSubscriptionRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opEnableEbsEncryptionByDefault = "EnableEbsEncryptionByDefault"
 
 // EnableEbsEncryptionByDefaultRequest generates a "aws/request.Request" representing the
@@ -34859,6 +36607,84 @@ func (c *EC2) EnableIpamOrganizationAdminAccountWithContext(ctx aws.Context, inp
 	return out, req.Send()
 }
 
+const opEnableReachabilityAnalyzerOrganizationSharing = "EnableReachabilityAnalyzerOrganizationSharing"
+
+// EnableReachabilityAnalyzerOrganizationSharingRequest generates a "aws/request.Request" representing the
+// client's request for the EnableReachabilityAnalyzerOrganizationSharing operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See EnableReachabilityAnalyzerOrganizationSharing for more information on using the EnableReachabilityAnalyzerOrganizationSharing
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the EnableReachabilityAnalyzerOrganizationSharingRequest method.
+//	req, resp := client.EnableReachabilityAnalyzerOrganizationSharingRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/EnableReachabilityAnalyzerOrganizationSharing
+func (c *EC2) EnableReachabilityAnalyzerOrganizationSharingRequest(input *EnableReachabilityAnalyzerOrganizationSharingInput) (req *request.Request, output *EnableReachabilityAnalyzerOrganizationSharingOutput) {
+	op := &request.Operation{
+		Name:       opEnableReachabilityAnalyzerOrganizationSharing,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &EnableReachabilityAnalyzerOrganizationSharingInput{}
+	}
+
+	output = &EnableReachabilityAnalyzerOrganizationSharingOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// EnableReachabilityAnalyzerOrganizationSharing API operation for Amazon Elastic Compute Cloud.
+//
+// Establishes a trust relationship between Reachability Analyzer and Organizations.
+// This operation must be performed by the management account for the organization.
+//
+// After you establish a trust relationship, a user in the management account
+// or a delegated administrator account can run a cross-account analysis using
+// resources from the member accounts.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation EnableReachabilityAnalyzerOrganizationSharing for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/EnableReachabilityAnalyzerOrganizationSharing
+func (c *EC2) EnableReachabilityAnalyzerOrganizationSharing(input *EnableReachabilityAnalyzerOrganizationSharingInput) (*EnableReachabilityAnalyzerOrganizationSharingOutput, error) {
+	req, out := c.EnableReachabilityAnalyzerOrganizationSharingRequest(input)
+	return out, req.Send()
+}
+
+// EnableReachabilityAnalyzerOrganizationSharingWithContext is the same as EnableReachabilityAnalyzerOrganizationSharing with the addition of
+// the ability to pass a context and additional request options.
+//
+// See EnableReachabilityAnalyzerOrganizationSharing for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) EnableReachabilityAnalyzerOrganizationSharingWithContext(ctx aws.Context, input *EnableReachabilityAnalyzerOrganizationSharingInput, opts ...request.Option) (*EnableReachabilityAnalyzerOrganizationSharingOutput, error) {
+	req, out := c.EnableReachabilityAnalyzerOrganizationSharingRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opEnableSerialConsoleAccess = "EnableSerialConsoleAccess"
 
 // EnableSerialConsoleAccessRequest generates a "aws/request.Request" representing the
@@ -35840,6 +37666,136 @@ func (c *EC2) GetAssociatedIpv6PoolCidrsPagesWithContext(ctx aws.Context, input
 	return p.Err()
 }
 
+const opGetAwsNetworkPerformanceData = "GetAwsNetworkPerformanceData"
+
+// GetAwsNetworkPerformanceDataRequest generates a "aws/request.Request" representing the
+// client's request for the GetAwsNetworkPerformanceData operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetAwsNetworkPerformanceData for more information on using the GetAwsNetworkPerformanceData
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the GetAwsNetworkPerformanceDataRequest method.
+//	req, resp := client.GetAwsNetworkPerformanceDataRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/GetAwsNetworkPerformanceData
+func (c *EC2) GetAwsNetworkPerformanceDataRequest(input *GetAwsNetworkPerformanceDataInput) (req *request.Request, output *GetAwsNetworkPerformanceDataOutput) {
+	op := &request.Operation{
+		Name:       opGetAwsNetworkPerformanceData,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+		Paginator: &request.Paginator{
+			InputTokens:     []string{"NextToken"},
+			OutputTokens:    []string{"NextToken"},
+			LimitToken:      "MaxResults",
+			TruncationToken: "",
+		},
+	}
+
+	if input == nil {
+		input = &GetAwsNetworkPerformanceDataInput{}
+	}
+
+	output = &GetAwsNetworkPerformanceDataOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// GetAwsNetworkPerformanceData API operation for Amazon Elastic Compute Cloud.
+//
+// Gets network performance data.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation GetAwsNetworkPerformanceData for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/GetAwsNetworkPerformanceData
+func (c *EC2) GetAwsNetworkPerformanceData(input *GetAwsNetworkPerformanceDataInput) (*GetAwsNetworkPerformanceDataOutput, error) {
+	req, out := c.GetAwsNetworkPerformanceDataRequest(input)
+	return out, req.Send()
+}
+
+// GetAwsNetworkPerformanceDataWithContext is the same as GetAwsNetworkPerformanceData with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetAwsNetworkPerformanceData for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) GetAwsNetworkPerformanceDataWithContext(ctx aws.Context, input *GetAwsNetworkPerformanceDataInput, opts ...request.Option) (*GetAwsNetworkPerformanceDataOutput, error) {
+	req, out := c.GetAwsNetworkPerformanceDataRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+// GetAwsNetworkPerformanceDataPages iterates over the pages of a GetAwsNetworkPerformanceData operation,
+// calling the "fn" function with the response data for each page. To stop
+// iterating, return false from the fn function.
+//
+// See GetAwsNetworkPerformanceData method for more information on how to use this operation.
+//
+// Note: This operation can generate multiple requests to a service.
+//
+//	// Example iterating over at most 3 pages of a GetAwsNetworkPerformanceData operation.
+//	pageNum := 0
+//	err := client.GetAwsNetworkPerformanceDataPages(params,
+//	    func(page *ec2.GetAwsNetworkPerformanceDataOutput, lastPage bool) bool {
+//	        pageNum++
+//	        fmt.Println(page)
+//	        return pageNum <= 3
+//	    })
+func (c *EC2) GetAwsNetworkPerformanceDataPages(input *GetAwsNetworkPerformanceDataInput, fn func(*GetAwsNetworkPerformanceDataOutput, bool) bool) error {
+	return c.GetAwsNetworkPerformanceDataPagesWithContext(aws.BackgroundContext(), input, fn)
+}
+
+// GetAwsNetworkPerformanceDataPagesWithContext same as GetAwsNetworkPerformanceDataPages except
+// it takes a Context and allows setting request options on the pages.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) GetAwsNetworkPerformanceDataPagesWithContext(ctx aws.Context, input *GetAwsNetworkPerformanceDataInput, fn func(*GetAwsNetworkPerformanceDataOutput, bool) bool, opts ...request.Option) error {
+	p := request.Pagination{
+		NewRequest: func() (*request.Request, error) {
+			var inCpy *GetAwsNetworkPerformanceDataInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.GetAwsNetworkPerformanceDataRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+
+	for p.Next() {
+		if !fn(p.Page().(*GetAwsNetworkPerformanceDataOutput), !p.HasNextPage()) {
+			break
+		}
+	}
+
+	return p.Err()
+}
+
 const opGetCapacityReservationUsage = "GetCapacityReservationUsage"
 
 // GetCapacityReservationUsageRequest generates a "aws/request.Request" representing the
@@ -39232,6 +41188,152 @@ func (c *EC2) GetTransitGatewayRouteTablePropagationsPagesWithContext(ctx aws.Co
 	return p.Err()
 }
 
+const opGetVerifiedAccessEndpointPolicy = "GetVerifiedAccessEndpointPolicy"
+
+// GetVerifiedAccessEndpointPolicyRequest generates a "aws/request.Request" representing the
+// client's request for the GetVerifiedAccessEndpointPolicy operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetVerifiedAccessEndpointPolicy for more information on using the GetVerifiedAccessEndpointPolicy
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the GetVerifiedAccessEndpointPolicyRequest method.
+//	req, resp := client.GetVerifiedAccessEndpointPolicyRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/GetVerifiedAccessEndpointPolicy
+func (c *EC2) GetVerifiedAccessEndpointPolicyRequest(input *GetVerifiedAccessEndpointPolicyInput) (req *request.Request, output *GetVerifiedAccessEndpointPolicyOutput) {
+	op := &request.Operation{
+		Name:       opGetVerifiedAccessEndpointPolicy,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &GetVerifiedAccessEndpointPolicyInput{}
+	}
+
+	output = &GetVerifiedAccessEndpointPolicyOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// GetVerifiedAccessEndpointPolicy API operation for Amazon Elastic Compute Cloud.
+//
+// Get the Verified Access policy associated with the endpoint.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation GetVerifiedAccessEndpointPolicy for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/GetVerifiedAccessEndpointPolicy
+func (c *EC2) GetVerifiedAccessEndpointPolicy(input *GetVerifiedAccessEndpointPolicyInput) (*GetVerifiedAccessEndpointPolicyOutput, error) {
+	req, out := c.GetVerifiedAccessEndpointPolicyRequest(input)
+	return out, req.Send()
+}
+
+// GetVerifiedAccessEndpointPolicyWithContext is the same as GetVerifiedAccessEndpointPolicy with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetVerifiedAccessEndpointPolicy for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) GetVerifiedAccessEndpointPolicyWithContext(ctx aws.Context, input *GetVerifiedAccessEndpointPolicyInput, opts ...request.Option) (*GetVerifiedAccessEndpointPolicyOutput, error) {
+	req, out := c.GetVerifiedAccessEndpointPolicyRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opGetVerifiedAccessGroupPolicy = "GetVerifiedAccessGroupPolicy"
+
+// GetVerifiedAccessGroupPolicyRequest generates a "aws/request.Request" representing the
+// client's request for the GetVerifiedAccessGroupPolicy operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetVerifiedAccessGroupPolicy for more information on using the GetVerifiedAccessGroupPolicy
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the GetVerifiedAccessGroupPolicyRequest method.
+//	req, resp := client.GetVerifiedAccessGroupPolicyRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/GetVerifiedAccessGroupPolicy
+func (c *EC2) GetVerifiedAccessGroupPolicyRequest(input *GetVerifiedAccessGroupPolicyInput) (req *request.Request, output *GetVerifiedAccessGroupPolicyOutput) {
+	op := &request.Operation{
+		Name:       opGetVerifiedAccessGroupPolicy,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &GetVerifiedAccessGroupPolicyInput{}
+	}
+
+	output = &GetVerifiedAccessGroupPolicyOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// GetVerifiedAccessGroupPolicy API operation for Amazon Elastic Compute Cloud.
+//
+// Shows the contents of the Verified Access policy associated with the group.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation GetVerifiedAccessGroupPolicy for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/GetVerifiedAccessGroupPolicy
+func (c *EC2) GetVerifiedAccessGroupPolicy(input *GetVerifiedAccessGroupPolicyInput) (*GetVerifiedAccessGroupPolicyOutput, error) {
+	req, out := c.GetVerifiedAccessGroupPolicyRequest(input)
+	return out, req.Send()
+}
+
+// GetVerifiedAccessGroupPolicyWithContext is the same as GetVerifiedAccessGroupPolicy with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetVerifiedAccessGroupPolicy for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) GetVerifiedAccessGroupPolicyWithContext(ctx aws.Context, input *GetVerifiedAccessGroupPolicyInput, opts ...request.Option) (*GetVerifiedAccessGroupPolicyOutput, error) {
+	req, out := c.GetVerifiedAccessGroupPolicyRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opGetVpnConnectionDeviceSampleConfiguration = "GetVpnConnectionDeviceSampleConfiguration"
 
 // GetVpnConnectionDeviceSampleConfigurationRequest generates a "aws/request.Request" representing the
@@ -43566,6 +45668,519 @@ func (c *EC2) ModifyTransitGatewayVpcAttachmentWithContext(ctx aws.Context, inpu
 	return out, req.Send()
 }
 
+const opModifyVerifiedAccessEndpoint = "ModifyVerifiedAccessEndpoint"
+
+// ModifyVerifiedAccessEndpointRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessEndpoint operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessEndpoint for more information on using the ModifyVerifiedAccessEndpoint
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessEndpointRequest method.
+//	req, resp := client.ModifyVerifiedAccessEndpointRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessEndpoint
+func (c *EC2) ModifyVerifiedAccessEndpointRequest(input *ModifyVerifiedAccessEndpointInput) (req *request.Request, output *ModifyVerifiedAccessEndpointOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessEndpoint,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessEndpointInput{}
+	}
+
+	output = &ModifyVerifiedAccessEndpointOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessEndpoint API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the configuration of an Amazon Web Services Verified Access endpoint.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessEndpoint for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessEndpoint
+func (c *EC2) ModifyVerifiedAccessEndpoint(input *ModifyVerifiedAccessEndpointInput) (*ModifyVerifiedAccessEndpointOutput, error) {
+	req, out := c.ModifyVerifiedAccessEndpointRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessEndpointWithContext is the same as ModifyVerifiedAccessEndpoint with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessEndpoint for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessEndpointWithContext(ctx aws.Context, input *ModifyVerifiedAccessEndpointInput, opts ...request.Option) (*ModifyVerifiedAccessEndpointOutput, error) {
+	req, out := c.ModifyVerifiedAccessEndpointRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opModifyVerifiedAccessEndpointPolicy = "ModifyVerifiedAccessEndpointPolicy"
+
+// ModifyVerifiedAccessEndpointPolicyRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessEndpointPolicy operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessEndpointPolicy for more information on using the ModifyVerifiedAccessEndpointPolicy
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessEndpointPolicyRequest method.
+//	req, resp := client.ModifyVerifiedAccessEndpointPolicyRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessEndpointPolicy
+func (c *EC2) ModifyVerifiedAccessEndpointPolicyRequest(input *ModifyVerifiedAccessEndpointPolicyInput) (req *request.Request, output *ModifyVerifiedAccessEndpointPolicyOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessEndpointPolicy,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessEndpointPolicyInput{}
+	}
+
+	output = &ModifyVerifiedAccessEndpointPolicyOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessEndpointPolicy API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the specified Verified Access endpoint policy.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessEndpointPolicy for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessEndpointPolicy
+func (c *EC2) ModifyVerifiedAccessEndpointPolicy(input *ModifyVerifiedAccessEndpointPolicyInput) (*ModifyVerifiedAccessEndpointPolicyOutput, error) {
+	req, out := c.ModifyVerifiedAccessEndpointPolicyRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessEndpointPolicyWithContext is the same as ModifyVerifiedAccessEndpointPolicy with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessEndpointPolicy for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessEndpointPolicyWithContext(ctx aws.Context, input *ModifyVerifiedAccessEndpointPolicyInput, opts ...request.Option) (*ModifyVerifiedAccessEndpointPolicyOutput, error) {
+	req, out := c.ModifyVerifiedAccessEndpointPolicyRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opModifyVerifiedAccessGroup = "ModifyVerifiedAccessGroup"
+
+// ModifyVerifiedAccessGroupRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessGroup operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessGroup for more information on using the ModifyVerifiedAccessGroup
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessGroupRequest method.
+//	req, resp := client.ModifyVerifiedAccessGroupRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessGroup
+func (c *EC2) ModifyVerifiedAccessGroupRequest(input *ModifyVerifiedAccessGroupInput) (req *request.Request, output *ModifyVerifiedAccessGroupOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessGroup,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessGroupInput{}
+	}
+
+	output = &ModifyVerifiedAccessGroupOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessGroup API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the specified Verified Access group configuration.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessGroup for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessGroup
+func (c *EC2) ModifyVerifiedAccessGroup(input *ModifyVerifiedAccessGroupInput) (*ModifyVerifiedAccessGroupOutput, error) {
+	req, out := c.ModifyVerifiedAccessGroupRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessGroupWithContext is the same as ModifyVerifiedAccessGroup with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessGroup for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessGroupWithContext(ctx aws.Context, input *ModifyVerifiedAccessGroupInput, opts ...request.Option) (*ModifyVerifiedAccessGroupOutput, error) {
+	req, out := c.ModifyVerifiedAccessGroupRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opModifyVerifiedAccessGroupPolicy = "ModifyVerifiedAccessGroupPolicy"
+
+// ModifyVerifiedAccessGroupPolicyRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessGroupPolicy operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessGroupPolicy for more information on using the ModifyVerifiedAccessGroupPolicy
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessGroupPolicyRequest method.
+//	req, resp := client.ModifyVerifiedAccessGroupPolicyRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessGroupPolicy
+func (c *EC2) ModifyVerifiedAccessGroupPolicyRequest(input *ModifyVerifiedAccessGroupPolicyInput) (req *request.Request, output *ModifyVerifiedAccessGroupPolicyOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessGroupPolicy,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessGroupPolicyInput{}
+	}
+
+	output = &ModifyVerifiedAccessGroupPolicyOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessGroupPolicy API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the specified Verified Access group policy.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessGroupPolicy for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessGroupPolicy
+func (c *EC2) ModifyVerifiedAccessGroupPolicy(input *ModifyVerifiedAccessGroupPolicyInput) (*ModifyVerifiedAccessGroupPolicyOutput, error) {
+	req, out := c.ModifyVerifiedAccessGroupPolicyRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessGroupPolicyWithContext is the same as ModifyVerifiedAccessGroupPolicy with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessGroupPolicy for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessGroupPolicyWithContext(ctx aws.Context, input *ModifyVerifiedAccessGroupPolicyInput, opts ...request.Option) (*ModifyVerifiedAccessGroupPolicyOutput, error) {
+	req, out := c.ModifyVerifiedAccessGroupPolicyRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opModifyVerifiedAccessInstance = "ModifyVerifiedAccessInstance"
+
+// ModifyVerifiedAccessInstanceRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessInstance operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessInstance for more information on using the ModifyVerifiedAccessInstance
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessInstanceRequest method.
+//	req, resp := client.ModifyVerifiedAccessInstanceRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessInstance
+func (c *EC2) ModifyVerifiedAccessInstanceRequest(input *ModifyVerifiedAccessInstanceInput) (req *request.Request, output *ModifyVerifiedAccessInstanceOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessInstance,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessInstanceInput{}
+	}
+
+	output = &ModifyVerifiedAccessInstanceOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessInstance API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the configuration of the specified Verified Access instance.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessInstance for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessInstance
+func (c *EC2) ModifyVerifiedAccessInstance(input *ModifyVerifiedAccessInstanceInput) (*ModifyVerifiedAccessInstanceOutput, error) {
+	req, out := c.ModifyVerifiedAccessInstanceRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessInstanceWithContext is the same as ModifyVerifiedAccessInstance with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessInstance for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessInstanceWithContext(ctx aws.Context, input *ModifyVerifiedAccessInstanceInput, opts ...request.Option) (*ModifyVerifiedAccessInstanceOutput, error) {
+	req, out := c.ModifyVerifiedAccessInstanceRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opModifyVerifiedAccessInstanceLoggingConfiguration = "ModifyVerifiedAccessInstanceLoggingConfiguration"
+
+// ModifyVerifiedAccessInstanceLoggingConfigurationRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessInstanceLoggingConfiguration operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessInstanceLoggingConfiguration for more information on using the ModifyVerifiedAccessInstanceLoggingConfiguration
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessInstanceLoggingConfigurationRequest method.
+//	req, resp := client.ModifyVerifiedAccessInstanceLoggingConfigurationRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessInstanceLoggingConfiguration
+func (c *EC2) ModifyVerifiedAccessInstanceLoggingConfigurationRequest(input *ModifyVerifiedAccessInstanceLoggingConfigurationInput) (req *request.Request, output *ModifyVerifiedAccessInstanceLoggingConfigurationOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessInstanceLoggingConfiguration,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessInstanceLoggingConfigurationInput{}
+	}
+
+	output = &ModifyVerifiedAccessInstanceLoggingConfigurationOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessInstanceLoggingConfiguration API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the logging configuration for the specified Amazon Web Services
+// Verified Access instance.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessInstanceLoggingConfiguration for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessInstanceLoggingConfiguration
+func (c *EC2) ModifyVerifiedAccessInstanceLoggingConfiguration(input *ModifyVerifiedAccessInstanceLoggingConfigurationInput) (*ModifyVerifiedAccessInstanceLoggingConfigurationOutput, error) {
+	req, out := c.ModifyVerifiedAccessInstanceLoggingConfigurationRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessInstanceLoggingConfigurationWithContext is the same as ModifyVerifiedAccessInstanceLoggingConfiguration with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessInstanceLoggingConfiguration for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessInstanceLoggingConfigurationWithContext(ctx aws.Context, input *ModifyVerifiedAccessInstanceLoggingConfigurationInput, opts ...request.Option) (*ModifyVerifiedAccessInstanceLoggingConfigurationOutput, error) {
+	req, out := c.ModifyVerifiedAccessInstanceLoggingConfigurationRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
+const opModifyVerifiedAccessTrustProvider = "ModifyVerifiedAccessTrustProvider"
+
+// ModifyVerifiedAccessTrustProviderRequest generates a "aws/request.Request" representing the
+// client's request for the ModifyVerifiedAccessTrustProvider operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See ModifyVerifiedAccessTrustProvider for more information on using the ModifyVerifiedAccessTrustProvider
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//	// Example sending a request using the ModifyVerifiedAccessTrustProviderRequest method.
+//	req, resp := client.ModifyVerifiedAccessTrustProviderRequest(params)
+//
+//	err := req.Send()
+//	if err == nil { // resp is now filled
+//	    fmt.Println(resp)
+//	}
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessTrustProvider
+func (c *EC2) ModifyVerifiedAccessTrustProviderRequest(input *ModifyVerifiedAccessTrustProviderInput) (req *request.Request, output *ModifyVerifiedAccessTrustProviderOutput) {
+	op := &request.Operation{
+		Name:       opModifyVerifiedAccessTrustProvider,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &ModifyVerifiedAccessTrustProviderInput{}
+	}
+
+	output = &ModifyVerifiedAccessTrustProviderOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// ModifyVerifiedAccessTrustProvider API operation for Amazon Elastic Compute Cloud.
+//
+// Modifies the configuration of the specified Amazon Web Services Verified
+// Access trust provider.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Elastic Compute Cloud's
+// API operation ModifyVerifiedAccessTrustProvider for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVerifiedAccessTrustProvider
+func (c *EC2) ModifyVerifiedAccessTrustProvider(input *ModifyVerifiedAccessTrustProviderInput) (*ModifyVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.ModifyVerifiedAccessTrustProviderRequest(input)
+	return out, req.Send()
+}
+
+// ModifyVerifiedAccessTrustProviderWithContext is the same as ModifyVerifiedAccessTrustProvider with the addition of
+// the ability to pass a context and additional request options.
+//
+// See ModifyVerifiedAccessTrustProvider for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *EC2) ModifyVerifiedAccessTrustProviderWithContext(ctx aws.Context, input *ModifyVerifiedAccessTrustProviderInput, opts ...request.Option) (*ModifyVerifiedAccessTrustProviderOutput, error) {
+	req, out := c.ModifyVerifiedAccessTrustProviderRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opModifyVolume = "ModifyVolume"
 
 // ModifyVolumeRequest generates a "aws/request.Request" representing the
@@ -45591,7 +48206,7 @@ func (c *EC2) RegisterImageRequest(input *RegisterImageInput) (req *request.Requ
 //
 // Registers an AMI. When you're creating an AMI, this is the final step you
 // must complete before you can launch an instance from the AMI. For more information
-// about creating AMIs, see Creating your own AMIs (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami.html)
+// about creating AMIs, see Create your own AMI (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami.html)
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // For Amazon EBS-backed instances, CreateImage creates and registers the AMI
@@ -45640,7 +48255,7 @@ func (c *EC2) RegisterImageRequest(input *RegisterImageInput) (req *request.Requ
 // a Reserved Instance without the matching billing product code, the Reserved
 // Instance will not be applied to the On-Demand Instance. For information about
 // how to obtain the platform details and billing information of an AMI, see
-// Understanding AMI billing (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-billing-info.html)
+// Understand AMI billing information (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-billing-info.html)
 // in the Amazon Elastic Compute Cloud User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -47157,12 +49772,12 @@ func (c *EC2) RequestSpotFleetRequest(input *RequestSpotFleetInput) (req *reques
 // only the spot-fleet-request and instance resource types are supported.
 //
 // For more information, see Spot Fleet requests (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet-requests.html)
-// in the Amazon EC2 User Guide for Linux Instances.
+// in the Amazon EC2 User Guide.
 //
 // We strongly discourage using the RequestSpotFleet API because it is a legacy
 // API with no planned investment. For options for requesting Spot Instances,
 // see Which is the best Spot request method to use? (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-best-practices.html#which-spot-request-method-to-use)
-// in the Amazon EC2 User Guide for Linux Instances.
+// in the Amazon EC2 User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -50645,7 +53260,7 @@ func (s *AcceptTransitGatewayMulticastDomainAssociationsInput) SetTransitGateway
 type AcceptTransitGatewayMulticastDomainAssociationsOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes the multicast domain associations.
+	// Information about the multicast domain associations.
 	Associations *TransitGatewayMulticastDomainAssociations `locationName:"associations" type:"structure"`
 }
 
@@ -55485,6 +58100,10 @@ type AttachNetworkInterfaceInput struct {
 	// it is UnauthorizedOperation.
 	DryRun *bool `locationName:"dryRun" type:"boolean"`
 
+	// Configures ENA Express for the network interface that this action attaches
+	// to the instance.
+	EnaSrdSpecification *EnaSrdSpecification `type:"structure"`
+
 	// The ID of the instance.
 	//
 	// InstanceId is a required field
@@ -55550,6 +58169,12 @@ func (s *AttachNetworkInterfaceInput) SetDryRun(v bool) *AttachNetworkInterfaceI
 	return s
 }
 
+// SetEnaSrdSpecification sets the EnaSrdSpecification field's value.
+func (s *AttachNetworkInterfaceInput) SetEnaSrdSpecification(v *EnaSrdSpecification) *AttachNetworkInterfaceInput {
+	s.EnaSrdSpecification = v
+	return s
+}
+
 // SetInstanceId sets the InstanceId field's value.
 func (s *AttachNetworkInterfaceInput) SetInstanceId(v string) *AttachNetworkInterfaceInput {
 	s.InstanceId = &v
@@ -55609,6 +58234,129 @@ func (s *AttachNetworkInterfaceOutput) SetNetworkCardIndex(v int64) *AttachNetwo
 	return s
 }
 
+type AttachVerifiedAccessTrustProviderInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	//
+	// VerifiedAccessInstanceId is a required field
+	VerifiedAccessInstanceId *string `type:"string" required:"true"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	//
+	// VerifiedAccessTrustProviderId is a required field
+	VerifiedAccessTrustProviderId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachVerifiedAccessTrustProviderInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachVerifiedAccessTrustProviderInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *AttachVerifiedAccessTrustProviderInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "AttachVerifiedAccessTrustProviderInput"}
+	if s.VerifiedAccessInstanceId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessInstanceId"))
+	}
+	if s.VerifiedAccessTrustProviderId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessTrustProviderId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *AttachVerifiedAccessTrustProviderInput) SetClientToken(v string) *AttachVerifiedAccessTrustProviderInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *AttachVerifiedAccessTrustProviderInput) SetDryRun(v bool) *AttachVerifiedAccessTrustProviderInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *AttachVerifiedAccessTrustProviderInput) SetVerifiedAccessInstanceId(v string) *AttachVerifiedAccessTrustProviderInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderId sets the VerifiedAccessTrustProviderId field's value.
+func (s *AttachVerifiedAccessTrustProviderInput) SetVerifiedAccessTrustProviderId(v string) *AttachVerifiedAccessTrustProviderInput {
+	s.VerifiedAccessTrustProviderId = &v
+	return s
+}
+
+type AttachVerifiedAccessTrustProviderOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstance *VerifiedAccessInstance `locationName:"verifiedAccessInstance" type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	VerifiedAccessTrustProvider *VerifiedAccessTrustProvider `locationName:"verifiedAccessTrustProvider" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachVerifiedAccessTrustProviderOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachVerifiedAccessTrustProviderOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessInstance sets the VerifiedAccessInstance field's value.
+func (s *AttachVerifiedAccessTrustProviderOutput) SetVerifiedAccessInstance(v *VerifiedAccessInstance) *AttachVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessInstance = v
+	return s
+}
+
+// SetVerifiedAccessTrustProvider sets the VerifiedAccessTrustProvider field's value.
+func (s *AttachVerifiedAccessTrustProviderOutput) SetVerifiedAccessTrustProvider(v *VerifiedAccessTrustProvider) *AttachVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessTrustProvider = v
+	return s
+}
+
 type AttachVolumeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -55801,6 +58549,83 @@ func (s *AttachVpnGatewayOutput) SetVpcAttachment(v *VpcAttachment) *AttachVpnGa
 	return s
 }
 
+// Describes the ENA Express configuration for the network interface that's
+// attached to the instance.
+type AttachmentEnaSrdSpecification struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether ENA Express is enabled for the network interface that's
+	// attached to the instance.
+	EnaSrdEnabled *bool `locationName:"enaSrdEnabled" type:"boolean"`
+
+	// ENA Express configuration for UDP network traffic.
+	EnaSrdUdpSpecification *AttachmentEnaSrdUdpSpecification `locationName:"enaSrdUdpSpecification" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachmentEnaSrdSpecification) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachmentEnaSrdSpecification) GoString() string {
+	return s.String()
+}
+
+// SetEnaSrdEnabled sets the EnaSrdEnabled field's value.
+func (s *AttachmentEnaSrdSpecification) SetEnaSrdEnabled(v bool) *AttachmentEnaSrdSpecification {
+	s.EnaSrdEnabled = &v
+	return s
+}
+
+// SetEnaSrdUdpSpecification sets the EnaSrdUdpSpecification field's value.
+func (s *AttachmentEnaSrdSpecification) SetEnaSrdUdpSpecification(v *AttachmentEnaSrdUdpSpecification) *AttachmentEnaSrdSpecification {
+	s.EnaSrdUdpSpecification = v
+	return s
+}
+
+// Describes the ENA Express configuration for UDP traffic on the network interface
+// that's attached to the instance.
+type AttachmentEnaSrdUdpSpecification struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether UDP traffic to and from the instance uses ENA Express.
+	// To specify this setting, you must first enable ENA Express.
+	EnaSrdUdpEnabled *bool `locationName:"enaSrdUdpEnabled" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachmentEnaSrdUdpSpecification) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s AttachmentEnaSrdUdpSpecification) GoString() string {
+	return s.String()
+}
+
+// SetEnaSrdUdpEnabled sets the EnaSrdUdpEnabled field's value.
+func (s *AttachmentEnaSrdUdpSpecification) SetEnaSrdUdpEnabled(v bool) *AttachmentEnaSrdUdpSpecification {
+	s.EnaSrdUdpEnabled = &v
+	return s
+}
+
 // Describes a value for a resource attribute that is a Boolean value.
 type AttributeBooleanValue struct {
 	_ struct{} `type:"structure"`
@@ -57662,6 +60487,95 @@ func (s CancelExportTaskOutput) GoString() string {
 	return s.String()
 }
 
+type CancelImageLaunchPermissionInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the AMI that was shared with your Amazon Web Services account.
+	//
+	// ImageId is a required field
+	ImageId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CancelImageLaunchPermissionInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CancelImageLaunchPermissionInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *CancelImageLaunchPermissionInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "CancelImageLaunchPermissionInput"}
+	if s.ImageId == nil {
+		invalidParams.Add(request.NewErrParamRequired("ImageId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *CancelImageLaunchPermissionInput) SetDryRun(v bool) *CancelImageLaunchPermissionInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetImageId sets the ImageId field's value.
+func (s *CancelImageLaunchPermissionInput) SetImageId(v string) *CancelImageLaunchPermissionInput {
+	s.ImageId = &v
+	return s
+}
+
+type CancelImageLaunchPermissionOutput struct {
+	_ struct{} `type:"structure"`
+
+	// Returns true if the request succeeds; otherwise, it returns an error.
+	Return *bool `locationName:"return" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CancelImageLaunchPermissionOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CancelImageLaunchPermissionOutput) GoString() string {
+	return s.String()
+}
+
+// SetReturn sets the Return field's value.
+func (s *CancelImageLaunchPermissionOutput) SetReturn(v bool) *CancelImageLaunchPermissionOutput {
+	s.Return = &v
+	return s
+}
+
 type CancelImportTaskInput struct {
 	_ struct{} `type:"structure"`
 
@@ -61478,6 +64392,19 @@ type CopyImageInput struct {
 	// in the Amazon EC2 API Reference.
 	ClientToken *string `type:"string"`
 
+	// Indicates whether to include your user-defined AMI tags when copying the
+	// AMI.
+	//
+	// The following tags will not be copied:
+	//
+	//    * System tags (prefixed with aws:)
+	//
+	//    * For public and shared AMIs, user-defined tags that are attached by other
+	//    Amazon Web Services accounts
+	//
+	// Default: Your user-defined AMI tags are not copied.
+	CopyImageTags *bool `type:"boolean"`
+
 	// A description for the new AMI in the destination Region.
 	Description *string `type:"string"`
 
@@ -61487,8 +64414,8 @@ type CopyImageInput struct {
 	// You cannot copy an AMI from an Outpost to a Region, from one Outpost to another,
 	// or within the same Outpost.
 	//
-	// For more information, see Copying AMIs from an Amazon Web Services Region
-	// to an Outpost (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshots-outposts.html#copy-amis)
+	// For more information, see Copy AMIs from an Amazon Web Services Region to
+	// an Outpost (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshots-outposts.html#copy-amis)
 	// in the Amazon Elastic Compute Cloud User Guide.
 	DestinationOutpostArn *string `type:"string"`
 
@@ -61502,7 +64429,7 @@ type CopyImageInput struct {
 	// encrypted. You can encrypt a copy of an unencrypted snapshot, but you cannot
 	// create an unencrypted copy of an encrypted snapshot. The default KMS key
 	// for Amazon EBS is used unless you specify a non-default Key Management Service
-	// (KMS) KMS key using KmsKeyId. For more information, see Amazon EBS Encryption
+	// (KMS) KMS key using KmsKeyId. For more information, see Amazon EBS encryption
 	// (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)
 	// in the Amazon Elastic Compute Cloud User Guide.
 	Encrypted *bool `locationName:"encrypted" type:"boolean"`
@@ -61590,6 +64517,12 @@ func (s *CopyImageInput) SetClientToken(v string) *CopyImageInput {
 	return s
 }
 
+// SetCopyImageTags sets the CopyImageTags field's value.
+func (s *CopyImageInput) SetCopyImageTags(v bool) *CopyImageInput {
+	s.CopyImageTags = &v
+	return s
+}
+
 // SetDescription sets the Description field's value.
 func (s *CopyImageInput) SetDescription(v string) *CopyImageInput {
 	s.Description = &v
@@ -63285,7 +66218,7 @@ func (s *CreateCoipPoolInput) SetTagSpecifications(v []*TagSpecification) *Creat
 type CreateCoipPoolOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a customer-owned address pool.
+	// Information about the CoIP address pool.
 	CoipPool *CoipPool `locationName:"coipPool" type:"structure"`
 }
 
@@ -64304,10 +67237,12 @@ type CreateFlowLogsInput struct {
 	LogDestinationType *string `type:"string" enum:"LogDestinationType"`
 
 	// The fields to include in the flow log record. List the fields in the order
-	// in which they should appear. For more information about the available fields,
-	// see Flow log records (https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-log-records).
-	// If you omit this parameter, the flow log is created using the default format.
-	// If you specify this parameter, you must include at least one field.
+	// in which they should appear. If you omit this parameter, the flow log is
+	// created using the default format. If you specify this parameter, you must
+	// include at least one field. For more information about the available fields,
+	// see Flow log records (https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-log-records)
+	// in the Amazon VPC User Guide or Transit Gateway Flow Log records (https://docs.aws.amazon.com/vpc/latest/tgw/tgw-flow-logs.html#flow-log-records)
+	// in the Amazon Web Services Transit Gateway Guide.
 	//
 	// Specify the fields using the ${field-id} format, separated by spaces. For
 	// the CLI, surround this parameter value with single quotes on Linux or double
@@ -64321,8 +67256,9 @@ type CreateFlowLogsInput struct {
 	LogGroupName *string `type:"string"`
 
 	// The maximum interval of time during which a flow of packets is captured and
-	// aggregated into a flow log record. You can specify 60 seconds (1 minute)
-	// or 600 seconds (10 minutes).
+	// aggregated into a flow log record. The possible values are 60 seconds (1
+	// minute) or 600 seconds (10 minutes). This parameter must be 60 seconds for
+	// transit gateway resource types.
 	//
 	// When a network interface is attached to a Nitro-based instance (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances),
 	// the aggregation interval is always 60 seconds or less, regardless of the
@@ -64334,7 +67270,8 @@ type CreateFlowLogsInput struct {
 	// The IDs of the resources to monitor. For example, if the resource type is
 	// VPC, specify the IDs of the VPCs.
 	//
-	// Constraints: Maximum of 1000 resources
+	// Constraints: Maximum of 25 for transit gateway resource types. Maximum of
+	// 1000 for the other resource types.
 	//
 	// ResourceIds is a required field
 	ResourceIds []*string `locationName:"ResourceId" locationNameList:"item" type:"list" required:"true"`
@@ -64348,7 +67285,8 @@ type CreateFlowLogsInput struct {
 	TagSpecifications []*TagSpecification `locationName:"TagSpecification" locationNameList:"item" type:"list"`
 
 	// The type of traffic to monitor (accepted traffic, rejected traffic, or all
-	// traffic).
+	// traffic). This parameter is not supported for transit gateway resource types.
+	// It is required for the other resource types.
 	TrafficType *string `type:"string" enum:"TrafficType"`
 }
 
@@ -66336,7 +69274,7 @@ func (s *CreateLocalGatewayRouteTableInput) SetTagSpecifications(v []*TagSpecifi
 type CreateLocalGatewayRouteTableOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a local gateway route table.
+	// Information about the local gateway route table.
 	LocalGatewayRouteTable *LocalGatewayRouteTable `locationName:"localGatewayRouteTable" type:"structure"`
 }
 
@@ -66449,8 +69387,7 @@ func (s *CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociationInput) SetT
 type CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociationOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes an association between a local gateway route table and a virtual
-	// interface group.
+	// Information about the local gateway route table virtual interface group association.
 	LocalGatewayRouteTableVirtualInterfaceGroupAssociation *LocalGatewayRouteTableVirtualInterfaceGroupAssociation `locationName:"localGatewayRouteTableVirtualInterfaceGroupAssociation" type:"structure"`
 }
 
@@ -66776,6 +69713,10 @@ type CreateNatGatewayInput struct {
 	// it is UnauthorizedOperation.
 	DryRun *bool `type:"boolean"`
 
+	// The private IPv4 address to assign to the NAT gateway. If you don't provide
+	// an address, a private IPv4 address will be automatically assigned.
+	PrivateIpAddress *string `type:"string"`
+
 	// The subnet in which to create the NAT gateway.
 	//
 	// SubnetId is a required field
@@ -66840,6 +69781,12 @@ func (s *CreateNatGatewayInput) SetDryRun(v bool) *CreateNatGatewayInput {
 	return s
 }
 
+// SetPrivateIpAddress sets the PrivateIpAddress field's value.
+func (s *CreateNatGatewayInput) SetPrivateIpAddress(v string) *CreateNatGatewayInput {
+	s.PrivateIpAddress = &v
+	return s
+}
+
 // SetSubnetId sets the SubnetId field's value.
 func (s *CreateNatGatewayInput) SetSubnetId(v string) *CreateNatGatewayInput {
 	s.SubnetId = &v
@@ -67938,7 +70885,7 @@ func (s *CreatePlacementGroupInput) SetTagSpecifications(v []*TagSpecification)
 type CreatePlacementGroupOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a placement group.
+	// Information about the placement group.
 	PlacementGroup *PlacementGroup `locationName:"placementGroup" type:"structure"`
 }
 
@@ -71939,6 +74886,891 @@ func (s *CreateTransitGatewayVpcAttachmentRequestOptions) SetIpv6Support(v strin
 	return s
 }
 
+// Options for a network interface-type endpoint.
+type CreateVerifiedAccessEndpointEniOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the network interface.
+	NetworkInterfaceId *string `type:"string"`
+
+	// The IP port number.
+	Port *int64 `min:"1" type:"integer"`
+
+	// The IP protocol.
+	Protocol *string `type:"string" enum:"VerifiedAccessEndpointProtocol"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointEniOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointEniOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *CreateVerifiedAccessEndpointEniOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "CreateVerifiedAccessEndpointEniOptions"}
+	if s.Port != nil && *s.Port < 1 {
+		invalidParams.Add(request.NewErrParamMinValue("Port", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetNetworkInterfaceId sets the NetworkInterfaceId field's value.
+func (s *CreateVerifiedAccessEndpointEniOptions) SetNetworkInterfaceId(v string) *CreateVerifiedAccessEndpointEniOptions {
+	s.NetworkInterfaceId = &v
+	return s
+}
+
+// SetPort sets the Port field's value.
+func (s *CreateVerifiedAccessEndpointEniOptions) SetPort(v int64) *CreateVerifiedAccessEndpointEniOptions {
+	s.Port = &v
+	return s
+}
+
+// SetProtocol sets the Protocol field's value.
+func (s *CreateVerifiedAccessEndpointEniOptions) SetProtocol(v string) *CreateVerifiedAccessEndpointEniOptions {
+	s.Protocol = &v
+	return s
+}
+
+type CreateVerifiedAccessEndpointInput struct {
+	_ struct{} `type:"structure"`
+
+	// The DNS name for users to reach your application.
+	//
+	// ApplicationDomain is a required field
+	ApplicationDomain *string `type:"string" required:"true"`
+
+	// The Amazon Web Services network component Verified Access attaches to.
+	//
+	// AttachmentType is a required field
+	AttachmentType *string `type:"string" required:"true" enum:"VerifiedAccessEndpointAttachmentType"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access endpoint.
+	Description *string `type:"string"`
+
+	// The ARN of the public TLS/SSL certificate in Amazon Web Services Certificate
+	// Manager to associate with the endpoint. The CN in the certificate must match
+	// the DNS name your end users will use to reach your application.
+	//
+	// DomainCertificateArn is a required field
+	DomainCertificateArn *string `type:"string" required:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// A custom identifier that gets prepended to a DNS name that is generated for
+	// the endpoint.
+	//
+	// EndpointDomainPrefix is a required field
+	EndpointDomainPrefix *string `type:"string" required:"true"`
+
+	// The type of Amazon Web Services Verified Access endpoint to create.
+	//
+	// EndpointType is a required field
+	EndpointType *string `type:"string" required:"true" enum:"VerifiedAccessEndpointType"`
+
+	// The load balancer details if creating the Amazon Web Services Verified Access
+	// endpoint as load-balancertype.
+	LoadBalancerOptions *CreateVerifiedAccessEndpointLoadBalancerOptions `type:"structure"`
+
+	// The network interface details if creating the Amazon Web Services Verified
+	// Access endpoint as network-interfacetype.
+	NetworkInterfaceOptions *CreateVerifiedAccessEndpointEniOptions `type:"structure"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `type:"string"`
+
+	// The Amazon EC2 security groups to associate with the Amazon Web Services
+	// Verified Access endpoint.
+	SecurityGroupIds []*string `locationName:"SecurityGroupId" locationNameList:"item" type:"list"`
+
+	// The tags to assign to the Amazon Web Services Verified Access endpoint.
+	TagSpecifications []*TagSpecification `locationName:"TagSpecification" locationNameList:"item" type:"list"`
+
+	// The ID of the Verified Access group to associate the endpoint with.
+	//
+	// VerifiedAccessGroupId is a required field
+	VerifiedAccessGroupId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *CreateVerifiedAccessEndpointInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "CreateVerifiedAccessEndpointInput"}
+	if s.ApplicationDomain == nil {
+		invalidParams.Add(request.NewErrParamRequired("ApplicationDomain"))
+	}
+	if s.AttachmentType == nil {
+		invalidParams.Add(request.NewErrParamRequired("AttachmentType"))
+	}
+	if s.DomainCertificateArn == nil {
+		invalidParams.Add(request.NewErrParamRequired("DomainCertificateArn"))
+	}
+	if s.EndpointDomainPrefix == nil {
+		invalidParams.Add(request.NewErrParamRequired("EndpointDomainPrefix"))
+	}
+	if s.EndpointType == nil {
+		invalidParams.Add(request.NewErrParamRequired("EndpointType"))
+	}
+	if s.VerifiedAccessGroupId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessGroupId"))
+	}
+	if s.LoadBalancerOptions != nil {
+		if err := s.LoadBalancerOptions.Validate(); err != nil {
+			invalidParams.AddNested("LoadBalancerOptions", err.(request.ErrInvalidParams))
+		}
+	}
+	if s.NetworkInterfaceOptions != nil {
+		if err := s.NetworkInterfaceOptions.Validate(); err != nil {
+			invalidParams.AddNested("NetworkInterfaceOptions", err.(request.ErrInvalidParams))
+		}
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetApplicationDomain sets the ApplicationDomain field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetApplicationDomain(v string) *CreateVerifiedAccessEndpointInput {
+	s.ApplicationDomain = &v
+	return s
+}
+
+// SetAttachmentType sets the AttachmentType field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetAttachmentType(v string) *CreateVerifiedAccessEndpointInput {
+	s.AttachmentType = &v
+	return s
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetClientToken(v string) *CreateVerifiedAccessEndpointInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetDescription(v string) *CreateVerifiedAccessEndpointInput {
+	s.Description = &v
+	return s
+}
+
+// SetDomainCertificateArn sets the DomainCertificateArn field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetDomainCertificateArn(v string) *CreateVerifiedAccessEndpointInput {
+	s.DomainCertificateArn = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetDryRun(v bool) *CreateVerifiedAccessEndpointInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetEndpointDomainPrefix sets the EndpointDomainPrefix field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetEndpointDomainPrefix(v string) *CreateVerifiedAccessEndpointInput {
+	s.EndpointDomainPrefix = &v
+	return s
+}
+
+// SetEndpointType sets the EndpointType field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetEndpointType(v string) *CreateVerifiedAccessEndpointInput {
+	s.EndpointType = &v
+	return s
+}
+
+// SetLoadBalancerOptions sets the LoadBalancerOptions field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetLoadBalancerOptions(v *CreateVerifiedAccessEndpointLoadBalancerOptions) *CreateVerifiedAccessEndpointInput {
+	s.LoadBalancerOptions = v
+	return s
+}
+
+// SetNetworkInterfaceOptions sets the NetworkInterfaceOptions field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetNetworkInterfaceOptions(v *CreateVerifiedAccessEndpointEniOptions) *CreateVerifiedAccessEndpointInput {
+	s.NetworkInterfaceOptions = v
+	return s
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetPolicyDocument(v string) *CreateVerifiedAccessEndpointInput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetSecurityGroupIds sets the SecurityGroupIds field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetSecurityGroupIds(v []*string) *CreateVerifiedAccessEndpointInput {
+	s.SecurityGroupIds = v
+	return s
+}
+
+// SetTagSpecifications sets the TagSpecifications field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetTagSpecifications(v []*TagSpecification) *CreateVerifiedAccessEndpointInput {
+	s.TagSpecifications = v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *CreateVerifiedAccessEndpointInput) SetVerifiedAccessGroupId(v string) *CreateVerifiedAccessEndpointInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+// Describes a load balancer when creating an Amazon Web Services Verified Access
+// endpoint using the load-balancer type.
+type CreateVerifiedAccessEndpointLoadBalancerOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ARN of the load balancer.
+	LoadBalancerArn *string `type:"string"`
+
+	// The IP port number.
+	Port *int64 `min:"1" type:"integer"`
+
+	// The IP protocol.
+	Protocol *string `type:"string" enum:"VerifiedAccessEndpointProtocol"`
+
+	// The IDs of the subnets.
+	SubnetIds []*string `locationName:"SubnetId" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointLoadBalancerOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointLoadBalancerOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *CreateVerifiedAccessEndpointLoadBalancerOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "CreateVerifiedAccessEndpointLoadBalancerOptions"}
+	if s.Port != nil && *s.Port < 1 {
+		invalidParams.Add(request.NewErrParamMinValue("Port", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetLoadBalancerArn sets the LoadBalancerArn field's value.
+func (s *CreateVerifiedAccessEndpointLoadBalancerOptions) SetLoadBalancerArn(v string) *CreateVerifiedAccessEndpointLoadBalancerOptions {
+	s.LoadBalancerArn = &v
+	return s
+}
+
+// SetPort sets the Port field's value.
+func (s *CreateVerifiedAccessEndpointLoadBalancerOptions) SetPort(v int64) *CreateVerifiedAccessEndpointLoadBalancerOptions {
+	s.Port = &v
+	return s
+}
+
+// SetProtocol sets the Protocol field's value.
+func (s *CreateVerifiedAccessEndpointLoadBalancerOptions) SetProtocol(v string) *CreateVerifiedAccessEndpointLoadBalancerOptions {
+	s.Protocol = &v
+	return s
+}
+
+// SetSubnetIds sets the SubnetIds field's value.
+func (s *CreateVerifiedAccessEndpointLoadBalancerOptions) SetSubnetIds(v []*string) *CreateVerifiedAccessEndpointLoadBalancerOptions {
+	s.SubnetIds = v
+	return s
+}
+
+type CreateVerifiedAccessEndpointOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	VerifiedAccessEndpoint *VerifiedAccessEndpoint `locationName:"verifiedAccessEndpoint" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessEndpointOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessEndpoint sets the VerifiedAccessEndpoint field's value.
+func (s *CreateVerifiedAccessEndpointOutput) SetVerifiedAccessEndpoint(v *VerifiedAccessEndpoint) *CreateVerifiedAccessEndpointOutput {
+	s.VerifiedAccessEndpoint = v
+	return s
+}
+
+type CreateVerifiedAccessGroupInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access group.
+	Description *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `type:"string"`
+
+	// The tags to assign to the Amazon Web Services Verified Access group.
+	TagSpecifications []*TagSpecification `locationName:"TagSpecification" locationNameList:"item" type:"list"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	//
+	// VerifiedAccessInstanceId is a required field
+	VerifiedAccessInstanceId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessGroupInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessGroupInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *CreateVerifiedAccessGroupInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "CreateVerifiedAccessGroupInput"}
+	if s.VerifiedAccessInstanceId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessInstanceId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *CreateVerifiedAccessGroupInput) SetClientToken(v string) *CreateVerifiedAccessGroupInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *CreateVerifiedAccessGroupInput) SetDescription(v string) *CreateVerifiedAccessGroupInput {
+	s.Description = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *CreateVerifiedAccessGroupInput) SetDryRun(v bool) *CreateVerifiedAccessGroupInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *CreateVerifiedAccessGroupInput) SetPolicyDocument(v string) *CreateVerifiedAccessGroupInput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetTagSpecifications sets the TagSpecifications field's value.
+func (s *CreateVerifiedAccessGroupInput) SetTagSpecifications(v []*TagSpecification) *CreateVerifiedAccessGroupInput {
+	s.TagSpecifications = v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *CreateVerifiedAccessGroupInput) SetVerifiedAccessInstanceId(v string) *CreateVerifiedAccessGroupInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type CreateVerifiedAccessGroupOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Verified Access group.
+	VerifiedAccessGroup *VerifiedAccessGroup `locationName:"verifiedAccessGroup" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessGroupOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessGroupOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessGroup sets the VerifiedAccessGroup field's value.
+func (s *CreateVerifiedAccessGroupOutput) SetVerifiedAccessGroup(v *VerifiedAccessGroup) *CreateVerifiedAccessGroupOutput {
+	s.VerifiedAccessGroup = v
+	return s
+}
+
+type CreateVerifiedAccessInstanceInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access instance.
+	Description *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The tags to assign to the Amazon Web Services Verified Access instance.
+	TagSpecifications []*TagSpecification `locationName:"TagSpecification" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessInstanceInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessInstanceInput) GoString() string {
+	return s.String()
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *CreateVerifiedAccessInstanceInput) SetClientToken(v string) *CreateVerifiedAccessInstanceInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *CreateVerifiedAccessInstanceInput) SetDescription(v string) *CreateVerifiedAccessInstanceInput {
+	s.Description = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *CreateVerifiedAccessInstanceInput) SetDryRun(v bool) *CreateVerifiedAccessInstanceInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetTagSpecifications sets the TagSpecifications field's value.
+func (s *CreateVerifiedAccessInstanceInput) SetTagSpecifications(v []*TagSpecification) *CreateVerifiedAccessInstanceInput {
+	s.TagSpecifications = v
+	return s
+}
+
+type CreateVerifiedAccessInstanceOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstance *VerifiedAccessInstance `locationName:"verifiedAccessInstance" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessInstanceOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessInstanceOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessInstance sets the VerifiedAccessInstance field's value.
+func (s *CreateVerifiedAccessInstanceOutput) SetVerifiedAccessInstance(v *VerifiedAccessInstance) *CreateVerifiedAccessInstanceOutput {
+	s.VerifiedAccessInstance = v
+	return s
+}
+
+// Options for a device-identity type trust provider.
+type CreateVerifiedAccessTrustProviderDeviceOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the tenant application with the device-identity provider.
+	TenantId *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderDeviceOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderDeviceOptions) GoString() string {
+	return s.String()
+}
+
+// SetTenantId sets the TenantId field's value.
+func (s *CreateVerifiedAccessTrustProviderDeviceOptions) SetTenantId(v string) *CreateVerifiedAccessTrustProviderDeviceOptions {
+	s.TenantId = &v
+	return s
+}
+
+type CreateVerifiedAccessTrustProviderInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access trust provider.
+	Description *string `type:"string"`
+
+	// The options for device identity based trust providers.
+	DeviceOptions *CreateVerifiedAccessTrustProviderDeviceOptions `type:"structure"`
+
+	// The type of device-based trust provider.
+	DeviceTrustProviderType *string `type:"string" enum:"DeviceTrustProviderType"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The OpenID Connect details for an oidc-type, user-identity based trust provider.
+	OidcOptions *CreateVerifiedAccessTrustProviderOidcOptions `type:"structure"`
+
+	// The identifier to be used when working with policy rules.
+	//
+	// PolicyReferenceName is a required field
+	PolicyReferenceName *string `type:"string" required:"true"`
+
+	// The tags to assign to the Amazon Web Services Verified Access trust provider.
+	TagSpecifications []*TagSpecification `locationName:"TagSpecification" locationNameList:"item" type:"list"`
+
+	// The type of trust provider can be either user or device-based.
+	//
+	// TrustProviderType is a required field
+	TrustProviderType *string `type:"string" required:"true" enum:"TrustProviderType"`
+
+	// The type of user-based trust provider.
+	UserTrustProviderType *string `type:"string" enum:"UserTrustProviderType"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *CreateVerifiedAccessTrustProviderInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "CreateVerifiedAccessTrustProviderInput"}
+	if s.PolicyReferenceName == nil {
+		invalidParams.Add(request.NewErrParamRequired("PolicyReferenceName"))
+	}
+	if s.TrustProviderType == nil {
+		invalidParams.Add(request.NewErrParamRequired("TrustProviderType"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetClientToken(v string) *CreateVerifiedAccessTrustProviderInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetDescription(v string) *CreateVerifiedAccessTrustProviderInput {
+	s.Description = &v
+	return s
+}
+
+// SetDeviceOptions sets the DeviceOptions field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetDeviceOptions(v *CreateVerifiedAccessTrustProviderDeviceOptions) *CreateVerifiedAccessTrustProviderInput {
+	s.DeviceOptions = v
+	return s
+}
+
+// SetDeviceTrustProviderType sets the DeviceTrustProviderType field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetDeviceTrustProviderType(v string) *CreateVerifiedAccessTrustProviderInput {
+	s.DeviceTrustProviderType = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetDryRun(v bool) *CreateVerifiedAccessTrustProviderInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetOidcOptions sets the OidcOptions field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetOidcOptions(v *CreateVerifiedAccessTrustProviderOidcOptions) *CreateVerifiedAccessTrustProviderInput {
+	s.OidcOptions = v
+	return s
+}
+
+// SetPolicyReferenceName sets the PolicyReferenceName field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetPolicyReferenceName(v string) *CreateVerifiedAccessTrustProviderInput {
+	s.PolicyReferenceName = &v
+	return s
+}
+
+// SetTagSpecifications sets the TagSpecifications field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetTagSpecifications(v []*TagSpecification) *CreateVerifiedAccessTrustProviderInput {
+	s.TagSpecifications = v
+	return s
+}
+
+// SetTrustProviderType sets the TrustProviderType field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetTrustProviderType(v string) *CreateVerifiedAccessTrustProviderInput {
+	s.TrustProviderType = &v
+	return s
+}
+
+// SetUserTrustProviderType sets the UserTrustProviderType field's value.
+func (s *CreateVerifiedAccessTrustProviderInput) SetUserTrustProviderType(v string) *CreateVerifiedAccessTrustProviderInput {
+	s.UserTrustProviderType = &v
+	return s
+}
+
+// Options for an OIDC-based, user-identity type trust provider.
+type CreateVerifiedAccessTrustProviderOidcOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The OIDC authorization endpoint.
+	AuthorizationEndpoint *string `type:"string"`
+
+	// The client identifier.
+	ClientId *string `type:"string"`
+
+	// The client secret.
+	ClientSecret *string `type:"string"`
+
+	// The OIDC issuer.
+	Issuer *string `type:"string"`
+
+	// OpenID Connect (OIDC) scopes are used by an application during authentication
+	// to authorize access to a user's details. Each scope returns a specific set
+	// of user attributes.
+	Scope *string `type:"string"`
+
+	// The OIDC token endpoint.
+	TokenEndpoint *string `type:"string"`
+
+	// The OIDC user info endpoint.
+	UserInfoEndpoint *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderOidcOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderOidcOptions) GoString() string {
+	return s.String()
+}
+
+// SetAuthorizationEndpoint sets the AuthorizationEndpoint field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetAuthorizationEndpoint(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.AuthorizationEndpoint = &v
+	return s
+}
+
+// SetClientId sets the ClientId field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetClientId(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.ClientId = &v
+	return s
+}
+
+// SetClientSecret sets the ClientSecret field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetClientSecret(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.ClientSecret = &v
+	return s
+}
+
+// SetIssuer sets the Issuer field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetIssuer(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.Issuer = &v
+	return s
+}
+
+// SetScope sets the Scope field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetScope(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.Scope = &v
+	return s
+}
+
+// SetTokenEndpoint sets the TokenEndpoint field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetTokenEndpoint(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.TokenEndpoint = &v
+	return s
+}
+
+// SetUserInfoEndpoint sets the UserInfoEndpoint field's value.
+func (s *CreateVerifiedAccessTrustProviderOidcOptions) SetUserInfoEndpoint(v string) *CreateVerifiedAccessTrustProviderOidcOptions {
+	s.UserInfoEndpoint = &v
+	return s
+}
+
+type CreateVerifiedAccessTrustProviderOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	VerifiedAccessTrustProvider *VerifiedAccessTrustProvider `locationName:"verifiedAccessTrustProvider" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s CreateVerifiedAccessTrustProviderOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessTrustProvider sets the VerifiedAccessTrustProvider field's value.
+func (s *CreateVerifiedAccessTrustProviderOutput) SetVerifiedAccessTrustProvider(v *VerifiedAccessTrustProvider) *CreateVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessTrustProvider = v
+	return s
+}
+
 type CreateVolumeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -73612,6 +77444,182 @@ func (s *CustomerGateway) SetType(v string) *CustomerGateway {
 	return s
 }
 
+// A query used for retrieving network health data.
+type DataQuery struct {
+	_ struct{} `type:"structure"`
+
+	// The Region or Availability Zone that's the target for the data query. For
+	// example, eu-north-1.
+	Destination *string `type:"string"`
+
+	// A user-defined ID associated with a data query that's returned in the dataResponse
+	// identifying the query. For example, if you set the Id to MyQuery01in the
+	// query, the dataResponse identifies the query as MyQuery01.
+	Id *string `type:"string"`
+
+	// The aggregation metric used for the data query. Currently only aggregation-latency
+	// is supported, indicating network latency.
+	Metric *string `type:"string" enum:"MetricType"`
+
+	// The aggregation period used for the data query.
+	Period *string `type:"string" enum:"PeriodType"`
+
+	// The Region or Availability Zone that's the source for the data query. For
+	// example, us-east-1.
+	Source *string `type:"string"`
+
+	// Metric data aggregations over specified periods of time. The following are
+	// the supported Infrastructure Performance statistics:
+	//
+	//    * p50 - The median value of the metric aggregated over a specified start
+	//    and end time. For example, a metric of five_minutes is the median of all
+	//    the data points gathered within those five minutes.
+	Statistic *string `type:"string" enum:"StatisticType"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DataQuery) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DataQuery) GoString() string {
+	return s.String()
+}
+
+// SetDestination sets the Destination field's value.
+func (s *DataQuery) SetDestination(v string) *DataQuery {
+	s.Destination = &v
+	return s
+}
+
+// SetId sets the Id field's value.
+func (s *DataQuery) SetId(v string) *DataQuery {
+	s.Id = &v
+	return s
+}
+
+// SetMetric sets the Metric field's value.
+func (s *DataQuery) SetMetric(v string) *DataQuery {
+	s.Metric = &v
+	return s
+}
+
+// SetPeriod sets the Period field's value.
+func (s *DataQuery) SetPeriod(v string) *DataQuery {
+	s.Period = &v
+	return s
+}
+
+// SetSource sets the Source field's value.
+func (s *DataQuery) SetSource(v string) *DataQuery {
+	s.Source = &v
+	return s
+}
+
+// SetStatistic sets the Statistic field's value.
+func (s *DataQuery) SetStatistic(v string) *DataQuery {
+	s.Statistic = &v
+	return s
+}
+
+// The response to a DataQuery.
+type DataResponse struct {
+	_ struct{} `type:"structure"`
+
+	// The Region or Availability Zone that's the destination for the data query.
+	// For example, eu-west-1.
+	Destination *string `locationName:"destination" type:"string"`
+
+	// The ID passed in the DataQuery.
+	Id *string `locationName:"id" type:"string"`
+
+	// The metric used for the network performance request. Currently only aggregate-latency
+	// is supported, showing network latency during a specified period.
+	Metric *string `locationName:"metric" type:"string" enum:"MetricType"`
+
+	// A list of MetricPoint objects.
+	MetricPoints []*MetricPoint `locationName:"metricPointSet" locationNameList:"item" type:"list"`
+
+	// The period used for the network performance request.
+	Period *string `locationName:"period" type:"string" enum:"PeriodType"`
+
+	// The Region or Availability Zone that's the source for the data query. For
+	// example, us-east-1.
+	Source *string `locationName:"source" type:"string"`
+
+	// The statistic used for the network performance request.
+	Statistic *string `locationName:"statistic" type:"string" enum:"StatisticType"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DataResponse) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DataResponse) GoString() string {
+	return s.String()
+}
+
+// SetDestination sets the Destination field's value.
+func (s *DataResponse) SetDestination(v string) *DataResponse {
+	s.Destination = &v
+	return s
+}
+
+// SetId sets the Id field's value.
+func (s *DataResponse) SetId(v string) *DataResponse {
+	s.Id = &v
+	return s
+}
+
+// SetMetric sets the Metric field's value.
+func (s *DataResponse) SetMetric(v string) *DataResponse {
+	s.Metric = &v
+	return s
+}
+
+// SetMetricPoints sets the MetricPoints field's value.
+func (s *DataResponse) SetMetricPoints(v []*MetricPoint) *DataResponse {
+	s.MetricPoints = v
+	return s
+}
+
+// SetPeriod sets the Period field's value.
+func (s *DataResponse) SetPeriod(v string) *DataResponse {
+	s.Period = &v
+	return s
+}
+
+// SetSource sets the Source field's value.
+func (s *DataResponse) SetSource(v string) *DataResponse {
+	s.Source = &v
+	return s
+}
+
+// SetStatistic sets the Statistic field's value.
+func (s *DataResponse) SetStatistic(v string) *DataResponse {
+	s.Statistic = &v
+	return s
+}
+
 type DeleteCarrierGatewayInput struct {
 	_ struct{} `type:"structure"`
 
@@ -74066,7 +78074,7 @@ func (s *DeleteCoipPoolInput) SetDryRun(v bool) *DeleteCoipPoolInput {
 type DeleteCoipPoolOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a customer-owned address pool.
+	// Information about the CoIP address pool.
 	CoipPool *CoipPool `locationName:"coipPool" type:"structure"`
 }
 
@@ -75820,7 +79828,7 @@ func (s *DeleteLocalGatewayRouteTableInput) SetLocalGatewayRouteTableId(v string
 type DeleteLocalGatewayRouteTableOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a local gateway route table.
+	// Information about the local gateway route table.
 	LocalGatewayRouteTable *LocalGatewayRouteTable `locationName:"localGatewayRouteTable" type:"structure"`
 }
 
@@ -75909,8 +79917,7 @@ func (s *DeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociationInput) SetL
 type DeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociationOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes an association between a local gateway route table and a virtual
-	// interface group.
+	// Information about the association.
 	LocalGatewayRouteTableVirtualInterfaceGroupAssociation *LocalGatewayRouteTableVirtualInterfaceGroupAssociation `locationName:"localGatewayRouteTableVirtualInterfaceGroupAssociation" type:"structure"`
 }
 
@@ -79279,6 +83286,406 @@ func (s *DeleteTransitGatewayVpcAttachmentOutput) SetTransitGatewayVpcAttachment
 	return s
 }
 
+type DeleteVerifiedAccessEndpointInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	//
+	// VerifiedAccessEndpointId is a required field
+	VerifiedAccessEndpointId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessEndpointInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessEndpointInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DeleteVerifiedAccessEndpointInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DeleteVerifiedAccessEndpointInput"}
+	if s.VerifiedAccessEndpointId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessEndpointId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *DeleteVerifiedAccessEndpointInput) SetClientToken(v string) *DeleteVerifiedAccessEndpointInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DeleteVerifiedAccessEndpointInput) SetDryRun(v bool) *DeleteVerifiedAccessEndpointInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessEndpointId sets the VerifiedAccessEndpointId field's value.
+func (s *DeleteVerifiedAccessEndpointInput) SetVerifiedAccessEndpointId(v string) *DeleteVerifiedAccessEndpointInput {
+	s.VerifiedAccessEndpointId = &v
+	return s
+}
+
+type DeleteVerifiedAccessEndpointOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	VerifiedAccessEndpoint *VerifiedAccessEndpoint `locationName:"verifiedAccessEndpoint" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessEndpointOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessEndpointOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessEndpoint sets the VerifiedAccessEndpoint field's value.
+func (s *DeleteVerifiedAccessEndpointOutput) SetVerifiedAccessEndpoint(v *VerifiedAccessEndpoint) *DeleteVerifiedAccessEndpointOutput {
+	s.VerifiedAccessEndpoint = v
+	return s
+}
+
+type DeleteVerifiedAccessGroupInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	//
+	// VerifiedAccessGroupId is a required field
+	VerifiedAccessGroupId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessGroupInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessGroupInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DeleteVerifiedAccessGroupInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DeleteVerifiedAccessGroupInput"}
+	if s.VerifiedAccessGroupId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessGroupId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *DeleteVerifiedAccessGroupInput) SetClientToken(v string) *DeleteVerifiedAccessGroupInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DeleteVerifiedAccessGroupInput) SetDryRun(v bool) *DeleteVerifiedAccessGroupInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *DeleteVerifiedAccessGroupInput) SetVerifiedAccessGroupId(v string) *DeleteVerifiedAccessGroupInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+type DeleteVerifiedAccessGroupOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	VerifiedAccessGroup *VerifiedAccessGroup `locationName:"verifiedAccessGroup" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessGroupOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessGroupOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessGroup sets the VerifiedAccessGroup field's value.
+func (s *DeleteVerifiedAccessGroupOutput) SetVerifiedAccessGroup(v *VerifiedAccessGroup) *DeleteVerifiedAccessGroupOutput {
+	s.VerifiedAccessGroup = v
+	return s
+}
+
+type DeleteVerifiedAccessInstanceInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	//
+	// VerifiedAccessInstanceId is a required field
+	VerifiedAccessInstanceId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessInstanceInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessInstanceInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DeleteVerifiedAccessInstanceInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DeleteVerifiedAccessInstanceInput"}
+	if s.VerifiedAccessInstanceId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessInstanceId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *DeleteVerifiedAccessInstanceInput) SetClientToken(v string) *DeleteVerifiedAccessInstanceInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DeleteVerifiedAccessInstanceInput) SetDryRun(v bool) *DeleteVerifiedAccessInstanceInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *DeleteVerifiedAccessInstanceInput) SetVerifiedAccessInstanceId(v string) *DeleteVerifiedAccessInstanceInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type DeleteVerifiedAccessInstanceOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstance *VerifiedAccessInstance `locationName:"verifiedAccessInstance" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessInstanceOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessInstanceOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessInstance sets the VerifiedAccessInstance field's value.
+func (s *DeleteVerifiedAccessInstanceOutput) SetVerifiedAccessInstance(v *VerifiedAccessInstance) *DeleteVerifiedAccessInstanceOutput {
+	s.VerifiedAccessInstance = v
+	return s
+}
+
+type DeleteVerifiedAccessTrustProviderInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	//
+	// VerifiedAccessTrustProviderId is a required field
+	VerifiedAccessTrustProviderId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessTrustProviderInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessTrustProviderInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DeleteVerifiedAccessTrustProviderInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DeleteVerifiedAccessTrustProviderInput"}
+	if s.VerifiedAccessTrustProviderId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessTrustProviderId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *DeleteVerifiedAccessTrustProviderInput) SetClientToken(v string) *DeleteVerifiedAccessTrustProviderInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DeleteVerifiedAccessTrustProviderInput) SetDryRun(v bool) *DeleteVerifiedAccessTrustProviderInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderId sets the VerifiedAccessTrustProviderId field's value.
+func (s *DeleteVerifiedAccessTrustProviderInput) SetVerifiedAccessTrustProviderId(v string) *DeleteVerifiedAccessTrustProviderInput {
+	s.VerifiedAccessTrustProviderId = &v
+	return s
+}
+
+type DeleteVerifiedAccessTrustProviderOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	VerifiedAccessTrustProvider *VerifiedAccessTrustProvider `locationName:"verifiedAccessTrustProvider" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessTrustProviderOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeleteVerifiedAccessTrustProviderOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessTrustProvider sets the VerifiedAccessTrustProvider field's value.
+func (s *DeleteVerifiedAccessTrustProviderOutput) SetVerifiedAccessTrustProvider(v *VerifiedAccessTrustProvider) *DeleteVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessTrustProvider = v
+	return s
+}
+
 type DeleteVolumeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -81382,6 +85789,109 @@ func (s *DescribeAvailabilityZonesOutput) SetAvailabilityZones(v []*Availability
 	return s
 }
 
+type DescribeAwsNetworkPerformanceMetricSubscriptionsInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// One or more filters.
+	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeAwsNetworkPerformanceMetricSubscriptionsInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeAwsNetworkPerformanceMetricSubscriptionsInput) GoString() string {
+	return s.String()
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DescribeAwsNetworkPerformanceMetricSubscriptionsInput) SetDryRun(v bool) *DescribeAwsNetworkPerformanceMetricSubscriptionsInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetFilters sets the Filters field's value.
+func (s *DescribeAwsNetworkPerformanceMetricSubscriptionsInput) SetFilters(v []*Filter) *DescribeAwsNetworkPerformanceMetricSubscriptionsInput {
+	s.Filters = v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *DescribeAwsNetworkPerformanceMetricSubscriptionsInput) SetMaxResults(v int64) *DescribeAwsNetworkPerformanceMetricSubscriptionsInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeAwsNetworkPerformanceMetricSubscriptionsInput) SetNextToken(v string) *DescribeAwsNetworkPerformanceMetricSubscriptionsInput {
+	s.NextToken = &v
+	return s
+}
+
+type DescribeAwsNetworkPerformanceMetricSubscriptionsOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+
+	// Describes the current Infrastructure Performance subscriptions.
+	Subscriptions []*Subscription `locationName:"subscriptionSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeAwsNetworkPerformanceMetricSubscriptionsOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeAwsNetworkPerformanceMetricSubscriptionsOutput) GoString() string {
+	return s.String()
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeAwsNetworkPerformanceMetricSubscriptionsOutput) SetNextToken(v string) *DescribeAwsNetworkPerformanceMetricSubscriptionsOutput {
+	s.NextToken = &v
+	return s
+}
+
+// SetSubscriptions sets the Subscriptions field's value.
+func (s *DescribeAwsNetworkPerformanceMetricSubscriptionsOutput) SetSubscriptions(v []*Subscription) *DescribeAwsNetworkPerformanceMetricSubscriptionsOutput {
+	s.Subscriptions = v
+	return s
+}
+
 type DescribeBundleTasksInput struct {
 	_ struct{} `type:"structure"`
 
@@ -86283,7 +90793,7 @@ type DescribeImagesInput struct {
 	//    * owner-id - The Amazon Web Services account ID of the owner. We recommend
 	//    that you use the Owner request parameter instead of this filter.
 	//
-	//    * platform - The platform. To only list Windows-based AMIs, use windows.
+	//    * platform - The platform. The only supported value is windows.
 	//
 	//    * product-code - The product code.
 	//
@@ -97933,6 +102443,659 @@ func (s *DescribeTrunkInterfaceAssociationsOutput) SetNextToken(v string) *Descr
 	return s
 }
 
+type DescribeVerifiedAccessEndpointsInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// One or more filters. Filter names and values are case-sensitive.
+	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `min:"5" type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	VerifiedAccessEndpointIds []*string `locationName:"VerifiedAccessEndpointId" locationNameList:"item" type:"list"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	VerifiedAccessGroupId *string `type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessEndpointsInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessEndpointsInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DescribeVerifiedAccessEndpointsInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DescribeVerifiedAccessEndpointsInput"}
+	if s.MaxResults != nil && *s.MaxResults < 5 {
+		invalidParams.Add(request.NewErrParamMinValue("MaxResults", 5))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetDryRun(v bool) *DescribeVerifiedAccessEndpointsInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetFilters sets the Filters field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetFilters(v []*Filter) *DescribeVerifiedAccessEndpointsInput {
+	s.Filters = v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetMaxResults(v int64) *DescribeVerifiedAccessEndpointsInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetNextToken(v string) *DescribeVerifiedAccessEndpointsInput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessEndpointIds sets the VerifiedAccessEndpointIds field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetVerifiedAccessEndpointIds(v []*string) *DescribeVerifiedAccessEndpointsInput {
+	s.VerifiedAccessEndpointIds = v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetVerifiedAccessGroupId(v string) *DescribeVerifiedAccessEndpointsInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *DescribeVerifiedAccessEndpointsInput) SetVerifiedAccessInstanceId(v string) *DescribeVerifiedAccessEndpointsInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type DescribeVerifiedAccessEndpointsOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	VerifiedAccessEndpoints []*VerifiedAccessEndpoint `locationName:"verifiedAccessEndpointSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessEndpointsOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessEndpointsOutput) GoString() string {
+	return s.String()
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessEndpointsOutput) SetNextToken(v string) *DescribeVerifiedAccessEndpointsOutput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessEndpoints sets the VerifiedAccessEndpoints field's value.
+func (s *DescribeVerifiedAccessEndpointsOutput) SetVerifiedAccessEndpoints(v []*VerifiedAccessEndpoint) *DescribeVerifiedAccessEndpointsOutput {
+	s.VerifiedAccessEndpoints = v
+	return s
+}
+
+type DescribeVerifiedAccessGroupsInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// One or more filters. Filter names and values are case-sensitive.
+	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `min:"5" type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access groups.
+	VerifiedAccessGroupIds []*string `locationName:"VerifiedAccessGroupId" locationNameList:"item" type:"list"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessGroupsInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessGroupsInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DescribeVerifiedAccessGroupsInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DescribeVerifiedAccessGroupsInput"}
+	if s.MaxResults != nil && *s.MaxResults < 5 {
+		invalidParams.Add(request.NewErrParamMinValue("MaxResults", 5))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DescribeVerifiedAccessGroupsInput) SetDryRun(v bool) *DescribeVerifiedAccessGroupsInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetFilters sets the Filters field's value.
+func (s *DescribeVerifiedAccessGroupsInput) SetFilters(v []*Filter) *DescribeVerifiedAccessGroupsInput {
+	s.Filters = v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *DescribeVerifiedAccessGroupsInput) SetMaxResults(v int64) *DescribeVerifiedAccessGroupsInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessGroupsInput) SetNextToken(v string) *DescribeVerifiedAccessGroupsInput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessGroupIds sets the VerifiedAccessGroupIds field's value.
+func (s *DescribeVerifiedAccessGroupsInput) SetVerifiedAccessGroupIds(v []*string) *DescribeVerifiedAccessGroupsInput {
+	s.VerifiedAccessGroupIds = v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *DescribeVerifiedAccessGroupsInput) SetVerifiedAccessInstanceId(v string) *DescribeVerifiedAccessGroupsInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type DescribeVerifiedAccessGroupsOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+
+	// The ID of the Verified Access group.
+	VerifiedAccessGroups []*VerifiedAccessGroup `locationName:"verifiedAccessGroupSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessGroupsOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessGroupsOutput) GoString() string {
+	return s.String()
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessGroupsOutput) SetNextToken(v string) *DescribeVerifiedAccessGroupsOutput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessGroups sets the VerifiedAccessGroups field's value.
+func (s *DescribeVerifiedAccessGroupsOutput) SetVerifiedAccessGroups(v []*VerifiedAccessGroup) *DescribeVerifiedAccessGroupsOutput {
+	s.VerifiedAccessGroups = v
+	return s
+}
+
+type DescribeVerifiedAccessInstanceLoggingConfigurationsInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// One or more filters. Filter names and values are case-sensitive.
+	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `min:"1" type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+
+	// The IDs of the Amazon Web Services Verified Access instances.
+	VerifiedAccessInstanceIds []*string `locationName:"VerifiedAccessInstanceId" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstanceLoggingConfigurationsInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstanceLoggingConfigurationsInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DescribeVerifiedAccessInstanceLoggingConfigurationsInput"}
+	if s.MaxResults != nil && *s.MaxResults < 1 {
+		invalidParams.Add(request.NewErrParamMinValue("MaxResults", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) SetDryRun(v bool) *DescribeVerifiedAccessInstanceLoggingConfigurationsInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetFilters sets the Filters field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) SetFilters(v []*Filter) *DescribeVerifiedAccessInstanceLoggingConfigurationsInput {
+	s.Filters = v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) SetMaxResults(v int64) *DescribeVerifiedAccessInstanceLoggingConfigurationsInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) SetNextToken(v string) *DescribeVerifiedAccessInstanceLoggingConfigurationsInput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceIds sets the VerifiedAccessInstanceIds field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsInput) SetVerifiedAccessInstanceIds(v []*string) *DescribeVerifiedAccessInstanceLoggingConfigurationsInput {
+	s.VerifiedAccessInstanceIds = v
+	return s
+}
+
+type DescribeVerifiedAccessInstanceLoggingConfigurationsOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The current logging configuration for the Amazon Web Services Verified Access
+	// instances.
+	LoggingConfigurations []*VerifiedAccessInstanceLoggingConfiguration `locationName:"loggingConfigurationSet" locationNameList:"item" type:"list"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstanceLoggingConfigurationsOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstanceLoggingConfigurationsOutput) GoString() string {
+	return s.String()
+}
+
+// SetLoggingConfigurations sets the LoggingConfigurations field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsOutput) SetLoggingConfigurations(v []*VerifiedAccessInstanceLoggingConfiguration) *DescribeVerifiedAccessInstanceLoggingConfigurationsOutput {
+	s.LoggingConfigurations = v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessInstanceLoggingConfigurationsOutput) SetNextToken(v string) *DescribeVerifiedAccessInstanceLoggingConfigurationsOutput {
+	s.NextToken = &v
+	return s
+}
+
+type DescribeVerifiedAccessInstancesInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// One or more filters. Filter names and values are case-sensitive.
+	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `min:"5" type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+
+	// The IDs of the Amazon Web Services Verified Access instances.
+	VerifiedAccessInstanceIds []*string `locationName:"VerifiedAccessInstanceId" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstancesInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstancesInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DescribeVerifiedAccessInstancesInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DescribeVerifiedAccessInstancesInput"}
+	if s.MaxResults != nil && *s.MaxResults < 5 {
+		invalidParams.Add(request.NewErrParamMinValue("MaxResults", 5))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DescribeVerifiedAccessInstancesInput) SetDryRun(v bool) *DescribeVerifiedAccessInstancesInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetFilters sets the Filters field's value.
+func (s *DescribeVerifiedAccessInstancesInput) SetFilters(v []*Filter) *DescribeVerifiedAccessInstancesInput {
+	s.Filters = v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *DescribeVerifiedAccessInstancesInput) SetMaxResults(v int64) *DescribeVerifiedAccessInstancesInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessInstancesInput) SetNextToken(v string) *DescribeVerifiedAccessInstancesInput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceIds sets the VerifiedAccessInstanceIds field's value.
+func (s *DescribeVerifiedAccessInstancesInput) SetVerifiedAccessInstanceIds(v []*string) *DescribeVerifiedAccessInstancesInput {
+	s.VerifiedAccessInstanceIds = v
+	return s
+}
+
+type DescribeVerifiedAccessInstancesOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+
+	// The IDs of the Amazon Web Services Verified Access instances.
+	VerifiedAccessInstances []*VerifiedAccessInstance `locationName:"verifiedAccessInstanceSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstancesOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessInstancesOutput) GoString() string {
+	return s.String()
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessInstancesOutput) SetNextToken(v string) *DescribeVerifiedAccessInstancesOutput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessInstances sets the VerifiedAccessInstances field's value.
+func (s *DescribeVerifiedAccessInstancesOutput) SetVerifiedAccessInstances(v []*VerifiedAccessInstance) *DescribeVerifiedAccessInstancesOutput {
+	s.VerifiedAccessInstances = v
+	return s
+}
+
+type DescribeVerifiedAccessTrustProvidersInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// One or more filters. Filter names and values are case-sensitive.
+	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `min:"5" type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+
+	// The IDs of the Amazon Web Services Verified Access trust providers.
+	VerifiedAccessTrustProviderIds []*string `locationName:"VerifiedAccessTrustProviderId" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessTrustProvidersInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessTrustProvidersInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DescribeVerifiedAccessTrustProvidersInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DescribeVerifiedAccessTrustProvidersInput"}
+	if s.MaxResults != nil && *s.MaxResults < 5 {
+		invalidParams.Add(request.NewErrParamMinValue("MaxResults", 5))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DescribeVerifiedAccessTrustProvidersInput) SetDryRun(v bool) *DescribeVerifiedAccessTrustProvidersInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetFilters sets the Filters field's value.
+func (s *DescribeVerifiedAccessTrustProvidersInput) SetFilters(v []*Filter) *DescribeVerifiedAccessTrustProvidersInput {
+	s.Filters = v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *DescribeVerifiedAccessTrustProvidersInput) SetMaxResults(v int64) *DescribeVerifiedAccessTrustProvidersInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessTrustProvidersInput) SetNextToken(v string) *DescribeVerifiedAccessTrustProvidersInput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderIds sets the VerifiedAccessTrustProviderIds field's value.
+func (s *DescribeVerifiedAccessTrustProvidersInput) SetVerifiedAccessTrustProviderIds(v []*string) *DescribeVerifiedAccessTrustProvidersInput {
+	s.VerifiedAccessTrustProviderIds = v
+	return s
+}
+
+type DescribeVerifiedAccessTrustProvidersOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+
+	// The IDs of the Amazon Web Services Verified Access trust providers.
+	VerifiedAccessTrustProviders []*VerifiedAccessTrustProvider `locationName:"verifiedAccessTrustProviderSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessTrustProvidersOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DescribeVerifiedAccessTrustProvidersOutput) GoString() string {
+	return s.String()
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *DescribeVerifiedAccessTrustProvidersOutput) SetNextToken(v string) *DescribeVerifiedAccessTrustProvidersOutput {
+	s.NextToken = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviders sets the VerifiedAccessTrustProviders field's value.
+func (s *DescribeVerifiedAccessTrustProvidersOutput) SetVerifiedAccessTrustProviders(v []*VerifiedAccessTrustProvider) *DescribeVerifiedAccessTrustProvidersOutput {
+	s.VerifiedAccessTrustProviders = v
+	return s
+}
+
 type DescribeVolumeAttributeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -99377,9 +104540,12 @@ type DescribeVpcEndpointServicesInput struct {
 
 	// One or more filters.
 	//
+	//    * owner - The ID or alias of the Amazon Web Services account that owns
+	//    the service.
+	//
 	//    * service-name - The name of the service.
 	//
-	//    * service-type - The type of service (Interface | Gateway).
+	//    * service-type - The type of service (Interface | Gateway | GatewayLoadBalancer).
 	//
 	//    * supported-ip-address-types - The IP address type (ipv4 | ipv6).
 	//
@@ -99524,16 +104690,6 @@ type DescribeVpcEndpointsInput struct {
 	//
 	//    * service-name - The name of the service.
 	//
-	//    * vpc-id - The ID of the VPC in which the endpoint resides.
-	//
-	//    * vpc-endpoint-id - The ID of the endpoint.
-	//
-	//    * vpc-endpoint-state - The state of the endpoint (pendingAcceptance |
-	//    pending | available | deleting | deleted | rejected | failed).
-	//
-	//    * vpc-endpoint-type - The type of VPC endpoint (Interface | Gateway |
-	//    GatewayLoadBalancer).
-	//
 	//    * tag:<key> - The key/value combination of a tag assigned to the resource.
 	//    Use the tag key in the filter name and the tag value as the filter value.
 	//    For example, to find all resources that have a tag with the key Owner
@@ -99543,6 +104699,16 @@ type DescribeVpcEndpointsInput struct {
 	//    * tag-key - The key of a tag assigned to the resource. Use this filter
 	//    to find all resources assigned a tag with a specific key, regardless of
 	//    the tag value.
+	//
+	//    * vpc-id - The ID of the VPC in which the endpoint resides.
+	//
+	//    * vpc-endpoint-id - The ID of the endpoint.
+	//
+	//    * vpc-endpoint-state - The state of the endpoint (pendingAcceptance |
+	//    pending | available | deleting | deleted | rejected | failed).
+	//
+	//    * vpc-endpoint-type - The type of VPC endpoint (Interface | Gateway |
+	//    GatewayLoadBalancer).
 	Filters []*Filter `locationName:"Filter" locationNameList:"Filter" type:"list"`
 
 	// The maximum number of items to return for this request. The request returns
@@ -100631,6 +105797,129 @@ func (s DetachNetworkInterfaceOutput) GoString() string {
 	return s.String()
 }
 
+type DetachVerifiedAccessTrustProviderInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	//
+	// VerifiedAccessInstanceId is a required field
+	VerifiedAccessInstanceId *string `type:"string" required:"true"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	//
+	// VerifiedAccessTrustProviderId is a required field
+	VerifiedAccessTrustProviderId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DetachVerifiedAccessTrustProviderInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DetachVerifiedAccessTrustProviderInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DetachVerifiedAccessTrustProviderInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "DetachVerifiedAccessTrustProviderInput"}
+	if s.VerifiedAccessInstanceId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessInstanceId"))
+	}
+	if s.VerifiedAccessTrustProviderId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessTrustProviderId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *DetachVerifiedAccessTrustProviderInput) SetClientToken(v string) *DetachVerifiedAccessTrustProviderInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DetachVerifiedAccessTrustProviderInput) SetDryRun(v bool) *DetachVerifiedAccessTrustProviderInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *DetachVerifiedAccessTrustProviderInput) SetVerifiedAccessInstanceId(v string) *DetachVerifiedAccessTrustProviderInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderId sets the VerifiedAccessTrustProviderId field's value.
+func (s *DetachVerifiedAccessTrustProviderInput) SetVerifiedAccessTrustProviderId(v string) *DetachVerifiedAccessTrustProviderInput {
+	s.VerifiedAccessTrustProviderId = &v
+	return s
+}
+
+type DetachVerifiedAccessTrustProviderOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstance *VerifiedAccessInstance `locationName:"verifiedAccessInstance" type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	VerifiedAccessTrustProvider *VerifiedAccessTrustProvider `locationName:"verifiedAccessTrustProvider" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DetachVerifiedAccessTrustProviderOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DetachVerifiedAccessTrustProviderOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessInstance sets the VerifiedAccessInstance field's value.
+func (s *DetachVerifiedAccessTrustProviderOutput) SetVerifiedAccessInstance(v *VerifiedAccessInstance) *DetachVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessInstance = v
+	return s
+}
+
+// SetVerifiedAccessTrustProvider sets the VerifiedAccessTrustProvider field's value.
+func (s *DetachVerifiedAccessTrustProviderOutput) SetVerifiedAccessTrustProvider(v *VerifiedAccessTrustProvider) *DetachVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessTrustProvider = v
+	return s
+}
+
 type DetachVolumeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -100818,6 +106107,39 @@ func (s DetachVpnGatewayOutput) GoString() string {
 	return s.String()
 }
 
+// Options for an Amazon Web Services Verified Access device-identity based
+// trust provider.
+type DeviceOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the tenant application with the device-identity provider.
+	TenantId *string `locationName:"tenantId" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeviceOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DeviceOptions) GoString() string {
+	return s.String()
+}
+
+// SetTenantId sets the TenantId field's value.
+func (s *DeviceOptions) SetTenantId(v string) *DeviceOptions {
+	s.TenantId = &v
+	return s
+}
+
 // Describes a DHCP configuration option.
 type DhcpConfiguration struct {
 	_ struct{} `type:"structure"`
@@ -101071,6 +106393,109 @@ func (s *DisableAddressTransferOutput) SetAddressTransfer(v *AddressTransfer) *D
 	return s
 }
 
+type DisableAwsNetworkPerformanceMetricSubscriptionInput struct {
+	_ struct{} `type:"structure"`
+
+	// The target Region or Availability Zone that the metric subscription is disabled
+	// for. For example, eu-north-1.
+	Destination *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The metric used for the disabled subscription.
+	Metric *string `type:"string" enum:"MetricType"`
+
+	// The source Region or Availability Zone that the metric subscription is disabled
+	// for. For example, us-east-1.
+	Source *string `type:"string"`
+
+	// The statistic used for the disabled subscription.
+	Statistic *string `type:"string" enum:"StatisticType"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DisableAwsNetworkPerformanceMetricSubscriptionInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DisableAwsNetworkPerformanceMetricSubscriptionInput) GoString() string {
+	return s.String()
+}
+
+// SetDestination sets the Destination field's value.
+func (s *DisableAwsNetworkPerformanceMetricSubscriptionInput) SetDestination(v string) *DisableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Destination = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *DisableAwsNetworkPerformanceMetricSubscriptionInput) SetDryRun(v bool) *DisableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetMetric sets the Metric field's value.
+func (s *DisableAwsNetworkPerformanceMetricSubscriptionInput) SetMetric(v string) *DisableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Metric = &v
+	return s
+}
+
+// SetSource sets the Source field's value.
+func (s *DisableAwsNetworkPerformanceMetricSubscriptionInput) SetSource(v string) *DisableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Source = &v
+	return s
+}
+
+// SetStatistic sets the Statistic field's value.
+func (s *DisableAwsNetworkPerformanceMetricSubscriptionInput) SetStatistic(v string) *DisableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Statistic = &v
+	return s
+}
+
+type DisableAwsNetworkPerformanceMetricSubscriptionOutput struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether the unsubscribe action was successful.
+	Output *bool `locationName:"output" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DisableAwsNetworkPerformanceMetricSubscriptionOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DisableAwsNetworkPerformanceMetricSubscriptionOutput) GoString() string {
+	return s.String()
+}
+
+// SetOutput sets the Output field's value.
+func (s *DisableAwsNetworkPerformanceMetricSubscriptionOutput) SetOutput(v bool) *DisableAwsNetworkPerformanceMetricSubscriptionOutput {
+	s.Output = &v
+	return s
+}
+
 type DisableEbsEncryptionByDefaultInput struct {
 	_ struct{} `type:"structure"`
 
@@ -104747,6 +110172,96 @@ func (s *ElasticInferenceAcceleratorAssociation) SetElasticInferenceAcceleratorA
 	return s
 }
 
+// ENA Express uses Amazon Web Services Scalable Reliable Datagram (SRD) technology
+// to increase the maximum bandwidth used per stream and minimize tail latency
+// of network traffic between EC2 instances. With ENA Express, you can communicate
+// between two EC2 instances in the same subnet within the same account, or
+// in different accounts. Both sending and receiving instances must have ENA
+// Express enabled.
+//
+// To improve the reliability of network packet delivery, ENA Express reorders
+// network packets on the receiving end by default. However, some UDP-based
+// applications are designed to handle network packets that are out of order
+// to reduce the overhead for packet delivery at the network layer. When ENA
+// Express is enabled, you can specify whether UDP network traffic uses it.
+type EnaSrdSpecification struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether ENA Express is enabled for the network interface.
+	EnaSrdEnabled *bool `type:"boolean"`
+
+	// Configures ENA Express for UDP network traffic.
+	EnaSrdUdpSpecification *EnaSrdUdpSpecification `type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnaSrdSpecification) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnaSrdSpecification) GoString() string {
+	return s.String()
+}
+
+// SetEnaSrdEnabled sets the EnaSrdEnabled field's value.
+func (s *EnaSrdSpecification) SetEnaSrdEnabled(v bool) *EnaSrdSpecification {
+	s.EnaSrdEnabled = &v
+	return s
+}
+
+// SetEnaSrdUdpSpecification sets the EnaSrdUdpSpecification field's value.
+func (s *EnaSrdSpecification) SetEnaSrdUdpSpecification(v *EnaSrdUdpSpecification) *EnaSrdSpecification {
+	s.EnaSrdUdpSpecification = v
+	return s
+}
+
+// ENA Express is compatible with both TCP and UDP transport protocols. When
+// it’s enabled, TCP traffic automatically uses it. However, some UDP-based
+// applications are designed to handle network packets that are out of order,
+// without a need for retransmission, such as live video broadcasting or other
+// near-real-time applications. For UDP traffic, you can specify whether to
+// use ENA Express, based on your application environment needs.
+type EnaSrdUdpSpecification struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether UDP traffic uses ENA Express. To specify this setting,
+	// you must first enable ENA Express.
+	EnaSrdUdpEnabled *bool `type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnaSrdUdpSpecification) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnaSrdUdpSpecification) GoString() string {
+	return s.String()
+}
+
+// SetEnaSrdUdpEnabled sets the EnaSrdUdpEnabled field's value.
+func (s *EnaSrdUdpSpecification) SetEnaSrdUdpEnabled(v bool) *EnaSrdUdpSpecification {
+	s.EnaSrdUdpEnabled = &v
+	return s
+}
+
 type EnableAddressTransferInput struct {
 	_ struct{} `type:"structure"`
 
@@ -104850,6 +110365,109 @@ func (s *EnableAddressTransferOutput) SetAddressTransfer(v *AddressTransfer) *En
 	return s
 }
 
+type EnableAwsNetworkPerformanceMetricSubscriptionInput struct {
+	_ struct{} `type:"structure"`
+
+	// The target Region or Availability Zone that the metric subscription is enabled
+	// for. For example, eu-west-1.
+	Destination *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The metric used for the enabled subscription.
+	Metric *string `type:"string" enum:"MetricType"`
+
+	// The source Region or Availability Zone that the metric subscription is enabled
+	// for. For example, us-east-1.
+	Source *string `type:"string"`
+
+	// The statistic used for the enabled subscription.
+	Statistic *string `type:"string" enum:"StatisticType"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableAwsNetworkPerformanceMetricSubscriptionInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableAwsNetworkPerformanceMetricSubscriptionInput) GoString() string {
+	return s.String()
+}
+
+// SetDestination sets the Destination field's value.
+func (s *EnableAwsNetworkPerformanceMetricSubscriptionInput) SetDestination(v string) *EnableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Destination = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *EnableAwsNetworkPerformanceMetricSubscriptionInput) SetDryRun(v bool) *EnableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetMetric sets the Metric field's value.
+func (s *EnableAwsNetworkPerformanceMetricSubscriptionInput) SetMetric(v string) *EnableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Metric = &v
+	return s
+}
+
+// SetSource sets the Source field's value.
+func (s *EnableAwsNetworkPerformanceMetricSubscriptionInput) SetSource(v string) *EnableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Source = &v
+	return s
+}
+
+// SetStatistic sets the Statistic field's value.
+func (s *EnableAwsNetworkPerformanceMetricSubscriptionInput) SetStatistic(v string) *EnableAwsNetworkPerformanceMetricSubscriptionInput {
+	s.Statistic = &v
+	return s
+}
+
+type EnableAwsNetworkPerformanceMetricSubscriptionOutput struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether the subscribe action was successful.
+	Output *bool `locationName:"output" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableAwsNetworkPerformanceMetricSubscriptionOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableAwsNetworkPerformanceMetricSubscriptionOutput) GoString() string {
+	return s.String()
+}
+
+// SetOutput sets the Output field's value.
+func (s *EnableAwsNetworkPerformanceMetricSubscriptionOutput) SetOutput(v bool) *EnableAwsNetworkPerformanceMetricSubscriptionOutput {
+	s.Output = &v
+	return s
+}
+
 type EnableEbsEncryptionByDefaultInput struct {
 	_ struct{} `type:"structure"`
 
@@ -105507,7 +111125,8 @@ type EnableImageDeprecationInput struct {
 	// the seconds to the nearest minute.
 	//
 	// You can’t specify a date in the past. The upper limit for DeprecateAt is
-	// 10 years from now.
+	// 10 years from now, except for public AMIs, where the upper limit is 2 years
+	// from the creation date.
 	//
 	// DeprecateAt is a required field
 	DeprecateAt *time.Time `type:"timestamp" required:"true"`
@@ -105696,6 +111315,71 @@ func (s *EnableIpamOrganizationAdminAccountOutput) SetSuccess(v bool) *EnableIpa
 	return s
 }
 
+type EnableReachabilityAnalyzerOrganizationSharingInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableReachabilityAnalyzerOrganizationSharingInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableReachabilityAnalyzerOrganizationSharingInput) GoString() string {
+	return s.String()
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *EnableReachabilityAnalyzerOrganizationSharingInput) SetDryRun(v bool) *EnableReachabilityAnalyzerOrganizationSharingInput {
+	s.DryRun = &v
+	return s
+}
+
+type EnableReachabilityAnalyzerOrganizationSharingOutput struct {
+	_ struct{} `type:"structure"`
+
+	// Returns true if the request succeeds; otherwise, returns an error.
+	ReturnValue *bool `locationName:"returnValue" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableReachabilityAnalyzerOrganizationSharingOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s EnableReachabilityAnalyzerOrganizationSharingOutput) GoString() string {
+	return s.String()
+}
+
+// SetReturnValue sets the ReturnValue field's value.
+func (s *EnableReachabilityAnalyzerOrganizationSharingOutput) SetReturnValue(v bool) *EnableReachabilityAnalyzerOrganizationSharingOutput {
+	s.ReturnValue = &v
+	return s
+}
+
 type EnableSerialConsoleAccessInput struct {
 	_ struct{} `type:"structure"`
 
@@ -109037,7 +114721,7 @@ func (s *FleetLaunchTemplateOverridesRequest) SetWeightedCapacity(v float64) *Fl
 //
 // For information about launch templates, see Launch an instance from a launch
 // template (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html)
-// in the Amazon EC2 User Guide for Linux Instances.
+// in the Amazon EC2 User Guide.
 type FleetLaunchTemplateSpecification struct {
 	_ struct{} `type:"structure"`
 
@@ -110184,6 +115868,129 @@ func (s *GetAssociatedIpv6PoolCidrsOutput) SetNextToken(v string) *GetAssociated
 	return s
 }
 
+type GetAwsNetworkPerformanceDataInput struct {
+	_ struct{} `type:"structure"`
+
+	// A list of network performance data queries.
+	DataQueries []*DataQuery `locationName:"DataQuery" type:"list"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ending time for the performance data request. The end time must be formatted
+	// as yyyy-mm-ddThh:mm:ss. For example, 2022-06-12T12:00:00.000Z.
+	EndTime *time.Time `type:"timestamp"`
+
+	// The maximum number of results to return with a single call. To retrieve the
+	// remaining results, make another call with the returned nextToken value.
+	MaxResults *int64 `type:"integer"`
+
+	// The token for the next page of results.
+	NextToken *string `type:"string"`
+
+	// The starting time for the performance data request. The starting time must
+	// be formatted as yyyy-mm-ddThh:mm:ss. For example, 2022-06-10T12:00:00.000Z.
+	StartTime *time.Time `type:"timestamp"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetAwsNetworkPerformanceDataInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetAwsNetworkPerformanceDataInput) GoString() string {
+	return s.String()
+}
+
+// SetDataQueries sets the DataQueries field's value.
+func (s *GetAwsNetworkPerformanceDataInput) SetDataQueries(v []*DataQuery) *GetAwsNetworkPerformanceDataInput {
+	s.DataQueries = v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *GetAwsNetworkPerformanceDataInput) SetDryRun(v bool) *GetAwsNetworkPerformanceDataInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetEndTime sets the EndTime field's value.
+func (s *GetAwsNetworkPerformanceDataInput) SetEndTime(v time.Time) *GetAwsNetworkPerformanceDataInput {
+	s.EndTime = &v
+	return s
+}
+
+// SetMaxResults sets the MaxResults field's value.
+func (s *GetAwsNetworkPerformanceDataInput) SetMaxResults(v int64) *GetAwsNetworkPerformanceDataInput {
+	s.MaxResults = &v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *GetAwsNetworkPerformanceDataInput) SetNextToken(v string) *GetAwsNetworkPerformanceDataInput {
+	s.NextToken = &v
+	return s
+}
+
+// SetStartTime sets the StartTime field's value.
+func (s *GetAwsNetworkPerformanceDataInput) SetStartTime(v time.Time) *GetAwsNetworkPerformanceDataInput {
+	s.StartTime = &v
+	return s
+}
+
+type GetAwsNetworkPerformanceDataOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The list of data responses.
+	DataResponses []*DataResponse `locationName:"dataResponseSet" locationNameList:"item" type:"list"`
+
+	// The token to use to retrieve the next page of results. This value is null
+	// when there are no more results to return.
+	NextToken *string `locationName:"nextToken" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetAwsNetworkPerformanceDataOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetAwsNetworkPerformanceDataOutput) GoString() string {
+	return s.String()
+}
+
+// SetDataResponses sets the DataResponses field's value.
+func (s *GetAwsNetworkPerformanceDataOutput) SetDataResponses(v []*DataResponse) *GetAwsNetworkPerformanceDataOutput {
+	s.DataResponses = v
+	return s
+}
+
+// SetNextToken sets the NextToken field's value.
+func (s *GetAwsNetworkPerformanceDataOutput) SetNextToken(v string) *GetAwsNetworkPerformanceDataOutput {
+	s.NextToken = &v
+	return s
+}
+
 type GetCapacityReservationUsageInput struct {
 	_ struct{} `type:"structure"`
 
@@ -114420,6 +120227,202 @@ func (s *GetTransitGatewayRouteTablePropagationsOutput) SetTransitGatewayRouteTa
 	return s
 }
 
+type GetVerifiedAccessEndpointPolicyInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	//
+	// VerifiedAccessEndpointId is a required field
+	VerifiedAccessEndpointId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessEndpointPolicyInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessEndpointPolicyInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetVerifiedAccessEndpointPolicyInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "GetVerifiedAccessEndpointPolicyInput"}
+	if s.VerifiedAccessEndpointId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessEndpointId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *GetVerifiedAccessEndpointPolicyInput) SetDryRun(v bool) *GetVerifiedAccessEndpointPolicyInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessEndpointId sets the VerifiedAccessEndpointId field's value.
+func (s *GetVerifiedAccessEndpointPolicyInput) SetVerifiedAccessEndpointId(v string) *GetVerifiedAccessEndpointPolicyInput {
+	s.VerifiedAccessEndpointId = &v
+	return s
+}
+
+type GetVerifiedAccessEndpointPolicyOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `locationName:"policyDocument" type:"string"`
+
+	// The status of the Verified Access policy.
+	PolicyEnabled *bool `locationName:"policyEnabled" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessEndpointPolicyOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessEndpointPolicyOutput) GoString() string {
+	return s.String()
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *GetVerifiedAccessEndpointPolicyOutput) SetPolicyDocument(v string) *GetVerifiedAccessEndpointPolicyOutput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetPolicyEnabled sets the PolicyEnabled field's value.
+func (s *GetVerifiedAccessEndpointPolicyOutput) SetPolicyEnabled(v bool) *GetVerifiedAccessEndpointPolicyOutput {
+	s.PolicyEnabled = &v
+	return s
+}
+
+type GetVerifiedAccessGroupPolicyInput struct {
+	_ struct{} `type:"structure"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	//
+	// VerifiedAccessGroupId is a required field
+	VerifiedAccessGroupId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessGroupPolicyInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessGroupPolicyInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetVerifiedAccessGroupPolicyInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "GetVerifiedAccessGroupPolicyInput"}
+	if s.VerifiedAccessGroupId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessGroupId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *GetVerifiedAccessGroupPolicyInput) SetDryRun(v bool) *GetVerifiedAccessGroupPolicyInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *GetVerifiedAccessGroupPolicyInput) SetVerifiedAccessGroupId(v string) *GetVerifiedAccessGroupPolicyInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+type GetVerifiedAccessGroupPolicyOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `locationName:"policyDocument" type:"string"`
+
+	// The status of the Verified Access policy.
+	PolicyEnabled *bool `locationName:"policyEnabled" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessGroupPolicyOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s GetVerifiedAccessGroupPolicyOutput) GoString() string {
+	return s.String()
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *GetVerifiedAccessGroupPolicyOutput) SetPolicyDocument(v string) *GetVerifiedAccessGroupPolicyOutput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetPolicyEnabled sets the PolicyEnabled field's value.
+func (s *GetVerifiedAccessGroupPolicyOutput) SetPolicyEnabled(v bool) *GetVerifiedAccessGroupPolicyOutput {
+	s.PolicyEnabled = &v
+	return s
+}
+
 type GetVpnConnectionDeviceSampleConfigurationInput struct {
 	_ struct{} `type:"structure"`
 
@@ -115938,7 +121941,7 @@ type Image struct {
 	Platform *string `locationName:"platform" type:"string" enum:"PlatformValues"`
 
 	// The platform details associated with the billing code of the AMI. For more
-	// information, see Understanding AMI billing (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-billing-info.html)
+	// information, see Understand AMI billing information (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-billing-info.html)
 	// in the Amazon Elastic Compute Cloud User Guide.
 	PlatformDetails *string `locationName:"platformDetails" type:"string"`
 
@@ -120611,6 +126614,16 @@ func (s *InstancePrivateIpAddress) SetPrivateIpAddress(v string) *InstancePrivat
 // all of the specified attributes. If you specify multiple values for an attribute,
 // you get instance types that satisfy any of the specified values.
 //
+// To limit the list of instance types from which Amazon EC2 can identify matching
+// instance types, you can use one of the following parameters, but not both
+// in the same request:
+//
+//   - AllowedInstanceTypes - The instance types to include in the list. All
+//     other instance types are ignored, even if they match your specified attributes.
+//
+//   - ExcludedInstanceTypes - The instance types to exclude from the list,
+//     even if they match your specified attributes.
+//
 // You must specify VCpuCount and MemoryMiB. All other attributes are optional.
 // Any unspecified optional attribute is set to its default.
 //
@@ -120683,6 +126696,23 @@ type InstanceRequirements struct {
 	// Default: Any accelerator type
 	AcceleratorTypes []*string `locationName:"acceleratorTypeSet" locationNameList:"item" type:"list" enum:"AcceleratorType"`
 
+	// The instance types to apply your specified attributes against. All other
+	// instance types are ignored, even if they match your specified attributes.
+	//
+	// You can use strings with one or more wild cards, represented by an asterisk
+	// (*), to allow an instance type, size, or generation. The following are examples:
+	// m5.8xlarge, c5*.*, m5a.*, r*, *3*.
+	//
+	// For example, if you specify c5*,Amazon EC2 will allow the entire C5 instance
+	// family, which includes all C5a and C5n instance types. If you specify m5a.*,
+	// Amazon EC2 will allow all the M5a instance types, but not the M5n instance
+	// types.
+	//
+	// If you specify AllowedInstanceTypes, you can't specify ExcludedInstanceTypes.
+	//
+	// Default: All instance types
+	AllowedInstanceTypes []*string `locationName:"allowedInstanceTypeSet" locationNameList:"item" type:"list"`
+
 	// Indicates whether bare metal instance types must be included, excluded, or
 	// required.
 	//
@@ -120740,6 +126770,8 @@ type InstanceRequirements struct {
 	// Amazon EC2 will exclude all the M5a instance types, but not the M5n instance
 	// types.
 	//
+	// If you specify ExcludedInstanceTypes, you can't specify AllowedInstanceTypes.
+	//
 	// Default: No excluded instance types
 	ExcludedInstanceTypes []*string `locationName:"excludedInstanceTypeSet" locationNameList:"item" type:"list"`
 
@@ -120787,6 +126819,12 @@ type InstanceRequirements struct {
 	// The minimum and maximum amount of memory, in MiB.
 	MemoryMiB *MemoryMiB `locationName:"memoryMiB" type:"structure"`
 
+	// The minimum and maximum amount of network bandwidth, in gigabits per second
+	// (Gbps).
+	//
+	// Default: No minimum or maximum limits
+	NetworkBandwidthGbps *NetworkBandwidthGbps `locationName:"networkBandwidthGbps" type:"structure"`
+
 	// The minimum and maximum number of network interfaces.
 	//
 	// Default: No minimum or maximum limits
@@ -120896,6 +126934,12 @@ func (s *InstanceRequirements) SetAcceleratorTypes(v []*string) *InstanceRequire
 	return s
 }
 
+// SetAllowedInstanceTypes sets the AllowedInstanceTypes field's value.
+func (s *InstanceRequirements) SetAllowedInstanceTypes(v []*string) *InstanceRequirements {
+	s.AllowedInstanceTypes = v
+	return s
+}
+
 // SetBareMetal sets the BareMetal field's value.
 func (s *InstanceRequirements) SetBareMetal(v string) *InstanceRequirements {
 	s.BareMetal = &v
@@ -120956,6 +127000,12 @@ func (s *InstanceRequirements) SetMemoryMiB(v *MemoryMiB) *InstanceRequirements
 	return s
 }
 
+// SetNetworkBandwidthGbps sets the NetworkBandwidthGbps field's value.
+func (s *InstanceRequirements) SetNetworkBandwidthGbps(v *NetworkBandwidthGbps) *InstanceRequirements {
+	s.NetworkBandwidthGbps = v
+	return s
+}
+
 // SetNetworkInterfaceCount sets the NetworkInterfaceCount field's value.
 func (s *InstanceRequirements) SetNetworkInterfaceCount(v *NetworkInterfaceCount) *InstanceRequirements {
 	s.NetworkInterfaceCount = v
@@ -120999,6 +127049,16 @@ func (s *InstanceRequirements) SetVCpuCount(v *VCpuCountRange) *InstanceRequirem
 // all of the specified attributes. If you specify multiple values for an attribute,
 // you get instance types that satisfy any of the specified values.
 //
+// To limit the list of instance types from which Amazon EC2 can identify matching
+// instance types, you can use one of the following parameters, but not both
+// in the same request:
+//
+//   - AllowedInstanceTypes - The instance types to include in the list. All
+//     other instance types are ignored, even if they match your specified attributes.
+//
+//   - ExcludedInstanceTypes - The instance types to exclude from the list,
+//     even if they match your specified attributes.
+//
 // You must specify VCpuCount and MemoryMiB. All other attributes are optional.
 // Any unspecified optional attribute is set to its default.
 //
@@ -121071,6 +127131,23 @@ type InstanceRequirementsRequest struct {
 	// Default: Any accelerator type
 	AcceleratorTypes []*string `locationName:"AcceleratorType" locationNameList:"item" type:"list" enum:"AcceleratorType"`
 
+	// The instance types to apply your specified attributes against. All other
+	// instance types are ignored, even if they match your specified attributes.
+	//
+	// You can use strings with one or more wild cards, represented by an asterisk
+	// (*), to allow an instance type, size, or generation. The following are examples:
+	// m5.8xlarge, c5*.*, m5a.*, r*, *3*.
+	//
+	// For example, if you specify c5*,Amazon EC2 will allow the entire C5 instance
+	// family, which includes all C5a and C5n instance types. If you specify m5a.*,
+	// Amazon EC2 will allow all the M5a instance types, but not the M5n instance
+	// types.
+	//
+	// If you specify AllowedInstanceTypes, you can't specify ExcludedInstanceTypes.
+	//
+	// Default: All instance types
+	AllowedInstanceTypes []*string `locationName:"AllowedInstanceType" locationNameList:"item" type:"list"`
+
 	// Indicates whether bare metal instance types must be included, excluded, or
 	// required.
 	//
@@ -121128,6 +127205,8 @@ type InstanceRequirementsRequest struct {
 	// Amazon EC2 will exclude all the M5a instance types, but not the M5n instance
 	// types.
 	//
+	// If you specify ExcludedInstanceTypes, you can't specify AllowedInstanceTypes.
+	//
 	// Default: No excluded instance types
 	ExcludedInstanceTypes []*string `locationName:"ExcludedInstanceType" locationNameList:"item" type:"list"`
 
@@ -121177,6 +127256,12 @@ type InstanceRequirementsRequest struct {
 	// MemoryMiB is a required field
 	MemoryMiB *MemoryMiBRequest `type:"structure" required:"true"`
 
+	// The minimum and maximum amount of network bandwidth, in gigabits per second
+	// (Gbps).
+	//
+	// Default: No minimum or maximum limits
+	NetworkBandwidthGbps *NetworkBandwidthGbpsRequest `type:"structure"`
+
 	// The minimum and maximum number of network interfaces.
 	//
 	// Default: No minimum or maximum limits
@@ -121314,6 +127399,12 @@ func (s *InstanceRequirementsRequest) SetAcceleratorTypes(v []*string) *Instance
 	return s
 }
 
+// SetAllowedInstanceTypes sets the AllowedInstanceTypes field's value.
+func (s *InstanceRequirementsRequest) SetAllowedInstanceTypes(v []*string) *InstanceRequirementsRequest {
+	s.AllowedInstanceTypes = v
+	return s
+}
+
 // SetBareMetal sets the BareMetal field's value.
 func (s *InstanceRequirementsRequest) SetBareMetal(v string) *InstanceRequirementsRequest {
 	s.BareMetal = &v
@@ -121374,6 +127465,12 @@ func (s *InstanceRequirementsRequest) SetMemoryMiB(v *MemoryMiBRequest) *Instanc
 	return s
 }
 
+// SetNetworkBandwidthGbps sets the NetworkBandwidthGbps field's value.
+func (s *InstanceRequirementsRequest) SetNetworkBandwidthGbps(v *NetworkBandwidthGbpsRequest) *InstanceRequirementsRequest {
+	s.NetworkBandwidthGbps = v
+	return s
+}
+
 // SetNetworkInterfaceCount sets the NetworkInterfaceCount field's value.
 func (s *InstanceRequirementsRequest) SetNetworkInterfaceCount(v *NetworkInterfaceCountRequest) *InstanceRequirementsRequest {
 	s.NetworkInterfaceCount = v
@@ -126640,6 +132737,10 @@ type LaunchTemplatePlacement struct {
 	// The Availability Zone of the instance.
 	AvailabilityZone *string `locationName:"availabilityZone" type:"string"`
 
+	// The Group ID of the placement group. You must specify the Placement Group
+	// Group ID to launch an instance in a shared placement group.
+	GroupId *string `locationName:"groupId" type:"string"`
+
 	// The name of the placement group for the instance.
 	GroupName *string `locationName:"groupName" type:"string"`
 
@@ -126691,6 +132792,12 @@ func (s *LaunchTemplatePlacement) SetAvailabilityZone(v string) *LaunchTemplateP
 	return s
 }
 
+// SetGroupId sets the GroupId field's value.
+func (s *LaunchTemplatePlacement) SetGroupId(v string) *LaunchTemplatePlacement {
+	s.GroupId = &v
+	return s
+}
+
 // SetGroupName sets the GroupName field's value.
 func (s *LaunchTemplatePlacement) SetGroupName(v string) *LaunchTemplatePlacement {
 	s.GroupName = &v
@@ -126737,6 +132844,10 @@ type LaunchTemplatePlacementRequest struct {
 	// The Availability Zone for the instance.
 	AvailabilityZone *string `type:"string"`
 
+	// The Group Id of a placement group. You must specify the Placement Group Group
+	// Id to launch an instance in a shared placement group.
+	GroupId *string `type:"string"`
+
 	// The name of the placement group for the instance.
 	GroupName *string `type:"string"`
 
@@ -126790,6 +132901,12 @@ func (s *LaunchTemplatePlacementRequest) SetAvailabilityZone(v string) *LaunchTe
 	return s
 }
 
+// SetGroupId sets the GroupId field's value.
+func (s *LaunchTemplatePlacementRequest) SetGroupId(v string) *LaunchTemplatePlacementRequest {
+	s.GroupId = &v
+	return s
+}
+
 // SetGroupName sets the GroupName field's value.
 func (s *LaunchTemplatePlacementRequest) SetGroupName(v string) *LaunchTemplatePlacementRequest {
 	s.GroupName = &v
@@ -128103,7 +134220,7 @@ type LocalGatewayRouteTable struct {
 	// The state of the local gateway route table.
 	State *string `locationName:"state" type:"string"`
 
-	// Describes a state change.
+	// Information about the state change.
 	StateReason *StateReason `locationName:"stateReason" type:"structure"`
 
 	// The tags assigned to the local gateway route table.
@@ -128883,6 +135000,69 @@ func (s *MemoryMiBRequest) SetMin(v int64) *MemoryMiBRequest {
 	return s
 }
 
+// Indicates whether the network was healthy or unhealthy at a particular point.
+// The value is aggregated from the startDate to the endDate. Currently only
+// five_minutes is supported.
+type MetricPoint struct {
+	_ struct{} `type:"structure"`
+
+	// The end date for the metric point. The ending time must be formatted as yyyy-mm-ddThh:mm:ss.
+	// For example, 2022-06-12T12:00:00.000Z.
+	EndDate *time.Time `locationName:"endDate" type:"timestamp"`
+
+	// The start date for the metric point. The starting date for the metric point.
+	// The starting time must be formatted as yyyy-mm-ddThh:mm:ss. For example,
+	// 2022-06-10T12:00:00.000Z.
+	StartDate *time.Time `locationName:"startDate" type:"timestamp"`
+
+	// The status of the metric point.
+	Status *string `locationName:"status" type:"string"`
+
+	Value *float64 `locationName:"value" type:"float"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s MetricPoint) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s MetricPoint) GoString() string {
+	return s.String()
+}
+
+// SetEndDate sets the EndDate field's value.
+func (s *MetricPoint) SetEndDate(v time.Time) *MetricPoint {
+	s.EndDate = &v
+	return s
+}
+
+// SetStartDate sets the StartDate field's value.
+func (s *MetricPoint) SetStartDate(v time.Time) *MetricPoint {
+	s.StartDate = &v
+	return s
+}
+
+// SetStatus sets the Status field's value.
+func (s *MetricPoint) SetStatus(v string) *MetricPoint {
+	s.Status = &v
+	return s
+}
+
+// SetValue sets the Value field's value.
+func (s *MetricPoint) SetValue(v float64) *MetricPoint {
+	s.Value = &v
+	return s
+}
+
 type ModifyAddressAttributeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -131199,7 +137379,7 @@ func (s *ModifyInstanceEventStartTimeInput) SetNotBefore(v time.Time) *ModifyIns
 type ModifyInstanceEventStartTimeOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a scheduled event for an instance.
+	// Information about the event.
 	Event *InstanceStatusEvent `locationName:"event" type:"structure"`
 }
 
@@ -131644,6 +137824,10 @@ type ModifyInstancePlacementInput struct {
 	// The affinity setting for the instance.
 	Affinity *string `locationName:"affinity" type:"string" enum:"Affinity"`
 
+	// The Group Id of a placement group. You must specify the Placement Group Group
+	// Id to launch an instance in a shared placement group.
+	GroupId *string `type:"string"`
+
 	// The name of the placement group in which to place the instance. For spread
 	// placement groups, the instance must have a tenancy of default. For cluster
 	// and partition placement groups, the instance must have a tenancy of default
@@ -131712,6 +137896,12 @@ func (s *ModifyInstancePlacementInput) SetAffinity(v string) *ModifyInstancePlac
 	return s
 }
 
+// SetGroupId sets the GroupId field's value.
+func (s *ModifyInstancePlacementInput) SetGroupId(v string) *ModifyInstancePlacementInput {
+	s.GroupId = &v
+	return s
+}
+
 // SetGroupName sets the GroupName field's value.
 func (s *ModifyInstancePlacementInput) SetGroupName(v string) *ModifyInstancePlacementInput {
 	s.GroupName = &v
@@ -132553,7 +138743,7 @@ func (s *ModifyLocalGatewayRouteInput) SetNetworkInterfaceId(v string) *ModifyLo
 type ModifyLocalGatewayRouteOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a route for a local gateway route table.
+	// Information about the local gateway route table.
 	Route *LocalGatewayRoute `locationName:"route" type:"structure"`
 }
 
@@ -132745,7 +138935,7 @@ func (s *ModifyManagedPrefixListOutput) SetPrefixList(v *ManagedPrefixList) *Mod
 type ModifyNetworkInterfaceAttributeInput struct {
 	_ struct{} `type:"structure"`
 
-	// Information about the interface attachment. If modifying the 'delete on termination'
+	// Information about the interface attachment. If modifying the delete on termination
 	// attribute, you must specify the ID of the interface attachment.
 	Attachment *NetworkInterfaceAttachmentChanges `locationName:"attachment" type:"structure"`
 
@@ -132758,6 +138948,10 @@ type ModifyNetworkInterfaceAttributeInput struct {
 	// it is UnauthorizedOperation.
 	DryRun *bool `locationName:"dryRun" type:"boolean"`
 
+	// Updates the ENA Express configuration for the network interface that’s
+	// attached to the instance.
+	EnaSrdSpecification *EnaSrdSpecification `type:"structure"`
+
 	// Changes the security groups for the network interface. The new set of groups
 	// you specify replaces the current set. You must specify at least one group,
 	// even if it's just the default security group in the VPC. You must specify
@@ -132827,6 +139021,12 @@ func (s *ModifyNetworkInterfaceAttributeInput) SetDryRun(v bool) *ModifyNetworkI
 	return s
 }
 
+// SetEnaSrdSpecification sets the EnaSrdSpecification field's value.
+func (s *ModifyNetworkInterfaceAttributeInput) SetEnaSrdSpecification(v *EnaSrdSpecification) *ModifyNetworkInterfaceAttributeInput {
+	s.EnaSrdSpecification = v
+	return s
+}
+
 // SetGroups sets the Groups field's value.
 func (s *ModifyNetworkInterfaceAttributeInput) SetGroups(v []*string) *ModifyNetworkInterfaceAttributeInput {
 	s.Groups = v
@@ -134392,7 +140592,7 @@ func (s *ModifyTransitGatewayOptions) SetVpnEcmpSupport(v string) *ModifyTransit
 type ModifyTransitGatewayOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a transit gateway.
+	// Information about the transit gateway.
 	TransitGateway *TransitGateway `locationName:"transitGateway" type:"structure"`
 }
 
@@ -134710,6 +140910,1033 @@ func (s *ModifyTransitGatewayVpcAttachmentRequestOptions) SetIpv6Support(v strin
 	return s
 }
 
+// Options for a network-interface type Verified Access endpoint.
+type ModifyVerifiedAccessEndpointEniOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The IP port number.
+	Port *int64 `min:"1" type:"integer"`
+
+	// The IP protocol.
+	Protocol *string `type:"string" enum:"VerifiedAccessEndpointProtocol"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointEniOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointEniOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessEndpointEniOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessEndpointEniOptions"}
+	if s.Port != nil && *s.Port < 1 {
+		invalidParams.Add(request.NewErrParamMinValue("Port", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetPort sets the Port field's value.
+func (s *ModifyVerifiedAccessEndpointEniOptions) SetPort(v int64) *ModifyVerifiedAccessEndpointEniOptions {
+	s.Port = &v
+	return s
+}
+
+// SetProtocol sets the Protocol field's value.
+func (s *ModifyVerifiedAccessEndpointEniOptions) SetProtocol(v string) *ModifyVerifiedAccessEndpointEniOptions {
+	s.Protocol = &v
+	return s
+}
+
+type ModifyVerifiedAccessEndpointInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access endpoint.
+	Description *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The load balancer details if creating the Amazon Web Services Verified Access
+	// endpoint as load-balancertype.
+	LoadBalancerOptions *ModifyVerifiedAccessEndpointLoadBalancerOptions `type:"structure"`
+
+	// The network interface options.
+	NetworkInterfaceOptions *ModifyVerifiedAccessEndpointEniOptions `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	//
+	// VerifiedAccessEndpointId is a required field
+	VerifiedAccessEndpointId *string `type:"string" required:"true"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	VerifiedAccessGroupId *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessEndpointInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessEndpointInput"}
+	if s.VerifiedAccessEndpointId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessEndpointId"))
+	}
+	if s.LoadBalancerOptions != nil {
+		if err := s.LoadBalancerOptions.Validate(); err != nil {
+			invalidParams.AddNested("LoadBalancerOptions", err.(request.ErrInvalidParams))
+		}
+	}
+	if s.NetworkInterfaceOptions != nil {
+		if err := s.NetworkInterfaceOptions.Validate(); err != nil {
+			invalidParams.AddNested("NetworkInterfaceOptions", err.(request.ErrInvalidParams))
+		}
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetClientToken(v string) *ModifyVerifiedAccessEndpointInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetDescription(v string) *ModifyVerifiedAccessEndpointInput {
+	s.Description = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetDryRun(v bool) *ModifyVerifiedAccessEndpointInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetLoadBalancerOptions sets the LoadBalancerOptions field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetLoadBalancerOptions(v *ModifyVerifiedAccessEndpointLoadBalancerOptions) *ModifyVerifiedAccessEndpointInput {
+	s.LoadBalancerOptions = v
+	return s
+}
+
+// SetNetworkInterfaceOptions sets the NetworkInterfaceOptions field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetNetworkInterfaceOptions(v *ModifyVerifiedAccessEndpointEniOptions) *ModifyVerifiedAccessEndpointInput {
+	s.NetworkInterfaceOptions = v
+	return s
+}
+
+// SetVerifiedAccessEndpointId sets the VerifiedAccessEndpointId field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetVerifiedAccessEndpointId(v string) *ModifyVerifiedAccessEndpointInput {
+	s.VerifiedAccessEndpointId = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *ModifyVerifiedAccessEndpointInput) SetVerifiedAccessGroupId(v string) *ModifyVerifiedAccessEndpointInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+// Describes a load balancer when creating an Amazon Web Services Verified Access
+// endpoint using the load-balancer type.
+type ModifyVerifiedAccessEndpointLoadBalancerOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The IP port number.
+	Port *int64 `min:"1" type:"integer"`
+
+	// The IP protocol.
+	Protocol *string `type:"string" enum:"VerifiedAccessEndpointProtocol"`
+
+	// The IDs of the subnets.
+	SubnetIds []*string `locationName:"SubnetId" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointLoadBalancerOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointLoadBalancerOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessEndpointLoadBalancerOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessEndpointLoadBalancerOptions"}
+	if s.Port != nil && *s.Port < 1 {
+		invalidParams.Add(request.NewErrParamMinValue("Port", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetPort sets the Port field's value.
+func (s *ModifyVerifiedAccessEndpointLoadBalancerOptions) SetPort(v int64) *ModifyVerifiedAccessEndpointLoadBalancerOptions {
+	s.Port = &v
+	return s
+}
+
+// SetProtocol sets the Protocol field's value.
+func (s *ModifyVerifiedAccessEndpointLoadBalancerOptions) SetProtocol(v string) *ModifyVerifiedAccessEndpointLoadBalancerOptions {
+	s.Protocol = &v
+	return s
+}
+
+// SetSubnetIds sets the SubnetIds field's value.
+func (s *ModifyVerifiedAccessEndpointLoadBalancerOptions) SetSubnetIds(v []*string) *ModifyVerifiedAccessEndpointLoadBalancerOptions {
+	s.SubnetIds = v
+	return s
+}
+
+type ModifyVerifiedAccessEndpointOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The Amazon Web Services Verified Access endpoint details.
+	VerifiedAccessEndpoint *VerifiedAccessEndpoint `locationName:"verifiedAccessEndpoint" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessEndpoint sets the VerifiedAccessEndpoint field's value.
+func (s *ModifyVerifiedAccessEndpointOutput) SetVerifiedAccessEndpoint(v *VerifiedAccessEndpoint) *ModifyVerifiedAccessEndpointOutput {
+	s.VerifiedAccessEndpoint = v
+	return s
+}
+
+type ModifyVerifiedAccessEndpointPolicyInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `type:"string"`
+
+	// The status of the Verified Access policy.
+	//
+	// PolicyEnabled is a required field
+	PolicyEnabled *bool `type:"boolean" required:"true"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	//
+	// VerifiedAccessEndpointId is a required field
+	VerifiedAccessEndpointId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointPolicyInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointPolicyInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessEndpointPolicyInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessEndpointPolicyInput"}
+	if s.PolicyEnabled == nil {
+		invalidParams.Add(request.NewErrParamRequired("PolicyEnabled"))
+	}
+	if s.VerifiedAccessEndpointId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessEndpointId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyInput) SetClientToken(v string) *ModifyVerifiedAccessEndpointPolicyInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyInput) SetDryRun(v bool) *ModifyVerifiedAccessEndpointPolicyInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyInput) SetPolicyDocument(v string) *ModifyVerifiedAccessEndpointPolicyInput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetPolicyEnabled sets the PolicyEnabled field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyInput) SetPolicyEnabled(v bool) *ModifyVerifiedAccessEndpointPolicyInput {
+	s.PolicyEnabled = &v
+	return s
+}
+
+// SetVerifiedAccessEndpointId sets the VerifiedAccessEndpointId field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyInput) SetVerifiedAccessEndpointId(v string) *ModifyVerifiedAccessEndpointPolicyInput {
+	s.VerifiedAccessEndpointId = &v
+	return s
+}
+
+type ModifyVerifiedAccessEndpointPolicyOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `locationName:"policyDocument" type:"string"`
+
+	// The status of the Verified Access policy.
+	PolicyEnabled *bool `locationName:"policyEnabled" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointPolicyOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessEndpointPolicyOutput) GoString() string {
+	return s.String()
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyOutput) SetPolicyDocument(v string) *ModifyVerifiedAccessEndpointPolicyOutput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetPolicyEnabled sets the PolicyEnabled field's value.
+func (s *ModifyVerifiedAccessEndpointPolicyOutput) SetPolicyEnabled(v bool) *ModifyVerifiedAccessEndpointPolicyOutput {
+	s.PolicyEnabled = &v
+	return s
+}
+
+type ModifyVerifiedAccessGroupInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access group.
+	Description *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	//
+	// VerifiedAccessGroupId is a required field
+	VerifiedAccessGroupId *string `type:"string" required:"true"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessGroupInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessGroupInput"}
+	if s.VerifiedAccessGroupId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessGroupId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessGroupInput) SetClientToken(v string) *ModifyVerifiedAccessGroupInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *ModifyVerifiedAccessGroupInput) SetDescription(v string) *ModifyVerifiedAccessGroupInput {
+	s.Description = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessGroupInput) SetDryRun(v bool) *ModifyVerifiedAccessGroupInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *ModifyVerifiedAccessGroupInput) SetVerifiedAccessGroupId(v string) *ModifyVerifiedAccessGroupInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *ModifyVerifiedAccessGroupInput) SetVerifiedAccessInstanceId(v string) *ModifyVerifiedAccessGroupInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type ModifyVerifiedAccessGroupOutput struct {
+	_ struct{} `type:"structure"`
+
+	// Details of Amazon Web Services Verified Access group.
+	VerifiedAccessGroup *VerifiedAccessGroup `locationName:"verifiedAccessGroup" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessGroup sets the VerifiedAccessGroup field's value.
+func (s *ModifyVerifiedAccessGroupOutput) SetVerifiedAccessGroup(v *VerifiedAccessGroup) *ModifyVerifiedAccessGroupOutput {
+	s.VerifiedAccessGroup = v
+	return s
+}
+
+type ModifyVerifiedAccessGroupPolicyInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `type:"string"`
+
+	// The status of the Verified Access policy.
+	//
+	// PolicyEnabled is a required field
+	PolicyEnabled *bool `type:"boolean" required:"true"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	//
+	// VerifiedAccessGroupId is a required field
+	VerifiedAccessGroupId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupPolicyInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupPolicyInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessGroupPolicyInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessGroupPolicyInput"}
+	if s.PolicyEnabled == nil {
+		invalidParams.Add(request.NewErrParamRequired("PolicyEnabled"))
+	}
+	if s.VerifiedAccessGroupId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessGroupId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessGroupPolicyInput) SetClientToken(v string) *ModifyVerifiedAccessGroupPolicyInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessGroupPolicyInput) SetDryRun(v bool) *ModifyVerifiedAccessGroupPolicyInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *ModifyVerifiedAccessGroupPolicyInput) SetPolicyDocument(v string) *ModifyVerifiedAccessGroupPolicyInput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetPolicyEnabled sets the PolicyEnabled field's value.
+func (s *ModifyVerifiedAccessGroupPolicyInput) SetPolicyEnabled(v bool) *ModifyVerifiedAccessGroupPolicyInput {
+	s.PolicyEnabled = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *ModifyVerifiedAccessGroupPolicyInput) SetVerifiedAccessGroupId(v string) *ModifyVerifiedAccessGroupPolicyInput {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+type ModifyVerifiedAccessGroupPolicyOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The Amazon Web Services Verified Access policy document.
+	PolicyDocument *string `locationName:"policyDocument" type:"string"`
+
+	// The status of the Verified Access policy.
+	PolicyEnabled *bool `locationName:"policyEnabled" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupPolicyOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessGroupPolicyOutput) GoString() string {
+	return s.String()
+}
+
+// SetPolicyDocument sets the PolicyDocument field's value.
+func (s *ModifyVerifiedAccessGroupPolicyOutput) SetPolicyDocument(v string) *ModifyVerifiedAccessGroupPolicyOutput {
+	s.PolicyDocument = &v
+	return s
+}
+
+// SetPolicyEnabled sets the PolicyEnabled field's value.
+func (s *ModifyVerifiedAccessGroupPolicyOutput) SetPolicyEnabled(v bool) *ModifyVerifiedAccessGroupPolicyOutput {
+	s.PolicyEnabled = &v
+	return s
+}
+
+type ModifyVerifiedAccessInstanceInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access instance.
+	Description *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	//
+	// VerifiedAccessInstanceId is a required field
+	VerifiedAccessInstanceId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessInstanceInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessInstanceInput"}
+	if s.VerifiedAccessInstanceId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessInstanceId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessInstanceInput) SetClientToken(v string) *ModifyVerifiedAccessInstanceInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *ModifyVerifiedAccessInstanceInput) SetDescription(v string) *ModifyVerifiedAccessInstanceInput {
+	s.Description = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessInstanceInput) SetDryRun(v bool) *ModifyVerifiedAccessInstanceInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *ModifyVerifiedAccessInstanceInput) SetVerifiedAccessInstanceId(v string) *ModifyVerifiedAccessInstanceInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type ModifyVerifiedAccessInstanceLoggingConfigurationInput struct {
+	_ struct{} `type:"structure"`
+
+	// The configuration options for Amazon Web Services Verified Access instances.
+	//
+	// AccessLogs is a required field
+	AccessLogs *VerifiedAccessLogOptions `type:"structure" required:"true"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	//
+	// VerifiedAccessInstanceId is a required field
+	VerifiedAccessInstanceId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceLoggingConfigurationInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceLoggingConfigurationInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessInstanceLoggingConfigurationInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessInstanceLoggingConfigurationInput"}
+	if s.AccessLogs == nil {
+		invalidParams.Add(request.NewErrParamRequired("AccessLogs"))
+	}
+	if s.VerifiedAccessInstanceId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessInstanceId"))
+	}
+	if s.AccessLogs != nil {
+		if err := s.AccessLogs.Validate(); err != nil {
+			invalidParams.AddNested("AccessLogs", err.(request.ErrInvalidParams))
+		}
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetAccessLogs sets the AccessLogs field's value.
+func (s *ModifyVerifiedAccessInstanceLoggingConfigurationInput) SetAccessLogs(v *VerifiedAccessLogOptions) *ModifyVerifiedAccessInstanceLoggingConfigurationInput {
+	s.AccessLogs = v
+	return s
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessInstanceLoggingConfigurationInput) SetClientToken(v string) *ModifyVerifiedAccessInstanceLoggingConfigurationInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessInstanceLoggingConfigurationInput) SetDryRun(v bool) *ModifyVerifiedAccessInstanceLoggingConfigurationInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *ModifyVerifiedAccessInstanceLoggingConfigurationInput) SetVerifiedAccessInstanceId(v string) *ModifyVerifiedAccessInstanceLoggingConfigurationInput {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+type ModifyVerifiedAccessInstanceLoggingConfigurationOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The logging configuration for Amazon Web Services Verified Access instance.
+	LoggingConfiguration *VerifiedAccessInstanceLoggingConfiguration `locationName:"loggingConfiguration" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceLoggingConfigurationOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceLoggingConfigurationOutput) GoString() string {
+	return s.String()
+}
+
+// SetLoggingConfiguration sets the LoggingConfiguration field's value.
+func (s *ModifyVerifiedAccessInstanceLoggingConfigurationOutput) SetLoggingConfiguration(v *VerifiedAccessInstanceLoggingConfiguration) *ModifyVerifiedAccessInstanceLoggingConfigurationOutput {
+	s.LoggingConfiguration = v
+	return s
+}
+
+type ModifyVerifiedAccessInstanceOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstance *VerifiedAccessInstance `locationName:"verifiedAccessInstance" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessInstanceOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessInstance sets the VerifiedAccessInstance field's value.
+func (s *ModifyVerifiedAccessInstanceOutput) SetVerifiedAccessInstance(v *VerifiedAccessInstance) *ModifyVerifiedAccessInstanceOutput {
+	s.VerifiedAccessInstance = v
+	return s
+}
+
+type ModifyVerifiedAccessTrustProviderInput struct {
+	_ struct{} `type:"structure"`
+
+	// A unique, case-sensitive token that you provide to ensure idempotency of
+	// your modification request. For more information, see Ensuring Idempotency
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
+	ClientToken *string `type:"string" idempotencyToken:"true"`
+
+	// A description for the Amazon Web Services Verified Access trust provider.
+	Description *string `type:"string"`
+
+	// Checks whether you have the required permissions for the action, without
+	// actually making the request, and provides an error response. If you have
+	// the required permissions, the error response is DryRunOperation. Otherwise,
+	// it is UnauthorizedOperation.
+	DryRun *bool `type:"boolean"`
+
+	// The OpenID Connect details for an oidc-type, user-identity based trust provider.
+	OidcOptions *ModifyVerifiedAccessTrustProviderOidcOptions `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	//
+	// VerifiedAccessTrustProviderId is a required field
+	VerifiedAccessTrustProviderId *string `type:"string" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessTrustProviderInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessTrustProviderInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ModifyVerifiedAccessTrustProviderInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ModifyVerifiedAccessTrustProviderInput"}
+	if s.VerifiedAccessTrustProviderId == nil {
+		invalidParams.Add(request.NewErrParamRequired("VerifiedAccessTrustProviderId"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetClientToken sets the ClientToken field's value.
+func (s *ModifyVerifiedAccessTrustProviderInput) SetClientToken(v string) *ModifyVerifiedAccessTrustProviderInput {
+	s.ClientToken = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *ModifyVerifiedAccessTrustProviderInput) SetDescription(v string) *ModifyVerifiedAccessTrustProviderInput {
+	s.Description = &v
+	return s
+}
+
+// SetDryRun sets the DryRun field's value.
+func (s *ModifyVerifiedAccessTrustProviderInput) SetDryRun(v bool) *ModifyVerifiedAccessTrustProviderInput {
+	s.DryRun = &v
+	return s
+}
+
+// SetOidcOptions sets the OidcOptions field's value.
+func (s *ModifyVerifiedAccessTrustProviderInput) SetOidcOptions(v *ModifyVerifiedAccessTrustProviderOidcOptions) *ModifyVerifiedAccessTrustProviderInput {
+	s.OidcOptions = v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderId sets the VerifiedAccessTrustProviderId field's value.
+func (s *ModifyVerifiedAccessTrustProviderInput) SetVerifiedAccessTrustProviderId(v string) *ModifyVerifiedAccessTrustProviderInput {
+	s.VerifiedAccessTrustProviderId = &v
+	return s
+}
+
+// OpenID Connect options for an oidc-type, user-identity based trust provider.
+type ModifyVerifiedAccessTrustProviderOidcOptions struct {
+	_ struct{} `type:"structure"`
+
+	// OpenID Connect (OIDC) scopes are used by an application during authentication
+	// to authorize access to a user's details. Each scope returns a specific set
+	// of user attributes.
+	Scope *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessTrustProviderOidcOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessTrustProviderOidcOptions) GoString() string {
+	return s.String()
+}
+
+// SetScope sets the Scope field's value.
+func (s *ModifyVerifiedAccessTrustProviderOidcOptions) SetScope(v string) *ModifyVerifiedAccessTrustProviderOidcOptions {
+	s.Scope = &v
+	return s
+}
+
+type ModifyVerifiedAccessTrustProviderOutput struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	VerifiedAccessTrustProvider *VerifiedAccessTrustProvider `locationName:"verifiedAccessTrustProvider" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessTrustProviderOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s ModifyVerifiedAccessTrustProviderOutput) GoString() string {
+	return s.String()
+}
+
+// SetVerifiedAccessTrustProvider sets the VerifiedAccessTrustProvider field's value.
+func (s *ModifyVerifiedAccessTrustProviderOutput) SetVerifiedAccessTrustProvider(v *VerifiedAccessTrustProvider) *ModifyVerifiedAccessTrustProviderOutput {
+	s.VerifiedAccessTrustProvider = v
+	return s
+}
+
 type ModifyVolumeAttributeInput struct {
 	_ struct{} `type:"structure"`
 
@@ -136194,7 +143421,7 @@ func (s *ModifyVpnConnectionOptionsInput) SetVpnConnectionId(v string) *ModifyVp
 type ModifyVpnConnectionOptionsOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a VPN connection.
+	// Information about the VPN connection.
 	VpnConnection *VpnConnection `locationName:"vpnConnection" type:"structure"`
 }
 
@@ -136225,7 +143452,7 @@ func (s *ModifyVpnConnectionOptionsOutput) SetVpnConnection(v *VpnConnection) *M
 type ModifyVpnConnectionOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a VPN connection.
+	// Information about the VPN connection.
 	VpnConnection *VpnConnection `locationName:"vpnConnection" type:"structure"`
 }
 
@@ -136328,7 +143555,7 @@ func (s *ModifyVpnTunnelCertificateInput) SetVpnTunnelOutsideIpAddress(v string)
 type ModifyVpnTunnelCertificateOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a VPN connection.
+	// Information about the VPN connection.
 	VpnConnection *VpnConnection `locationName:"vpnConnection" type:"structure"`
 }
 
@@ -136445,7 +143672,7 @@ func (s *ModifyVpnTunnelOptionsInput) SetVpnTunnelOutsideIpAddress(v string) *Mo
 type ModifyVpnTunnelOptionsOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes a VPN connection.
+	// Information about the VPN connection.
 	VpnConnection *VpnConnection `locationName:"vpnConnection" type:"structure"`
 }
 
@@ -137603,6 +144830,108 @@ func (s *NetworkAclEntry) SetRuleNumber(v int64) *NetworkAclEntry {
 	return s
 }
 
+// The minimum and maximum amount of network bandwidth, in gigabits per second
+// (Gbps).
+//
+// Setting the minimum bandwidth does not guarantee that your instance will
+// achieve the minimum bandwidth. Amazon EC2 will identify instance types that
+// support the specified minimum bandwidth, but the actual bandwidth of your
+// instance might go below the specified minimum at times. For more information,
+// see Available instance bandwidth (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html#available-instance-bandwidth)
+// in the Amazon EC2 User Guide.
+type NetworkBandwidthGbps struct {
+	_ struct{} `type:"structure"`
+
+	// The maximum amount of network bandwidth, in Gbps. If this parameter is not
+	// specified, there is no maximum limit.
+	Max *float64 `locationName:"max" type:"double"`
+
+	// The minimum amount of network bandwidth, in Gbps. If this parameter is not
+	// specified, there is no minimum limit.
+	Min *float64 `locationName:"min" type:"double"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s NetworkBandwidthGbps) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s NetworkBandwidthGbps) GoString() string {
+	return s.String()
+}
+
+// SetMax sets the Max field's value.
+func (s *NetworkBandwidthGbps) SetMax(v float64) *NetworkBandwidthGbps {
+	s.Max = &v
+	return s
+}
+
+// SetMin sets the Min field's value.
+func (s *NetworkBandwidthGbps) SetMin(v float64) *NetworkBandwidthGbps {
+	s.Min = &v
+	return s
+}
+
+// The minimum and maximum amount of network bandwidth, in gigabits per second
+// (Gbps).
+//
+// Setting the minimum bandwidth does not guarantee that your instance will
+// achieve the minimum bandwidth. Amazon EC2 will identify instance types that
+// support the specified minimum bandwidth, but the actual bandwidth of your
+// instance might go below the specified minimum at times. For more information,
+// see Available instance bandwidth (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html#available-instance-bandwidth)
+// in the Amazon EC2 User Guide.
+type NetworkBandwidthGbpsRequest struct {
+	_ struct{} `type:"structure"`
+
+	// The maximum amount of network bandwidth, in Gbps. To specify no maximum limit,
+	// omit this parameter.
+	Max *float64 `type:"double"`
+
+	// The minimum amount of network bandwidth, in Gbps. To specify no minimum limit,
+	// omit this parameter.
+	Min *float64 `type:"double"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s NetworkBandwidthGbpsRequest) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s NetworkBandwidthGbpsRequest) GoString() string {
+	return s.String()
+}
+
+// SetMax sets the Max field's value.
+func (s *NetworkBandwidthGbpsRequest) SetMax(v float64) *NetworkBandwidthGbpsRequest {
+	s.Max = &v
+	return s
+}
+
+// SetMin sets the Min field's value.
+func (s *NetworkBandwidthGbpsRequest) SetMin(v float64) *NetworkBandwidthGbpsRequest {
+	s.Min = &v
+	return s
+}
+
 // Describes the network card support of the instance type.
 type NetworkCardInfo struct {
 	_ struct{} `type:"structure"`
@@ -137666,6 +144995,12 @@ type NetworkInfo struct {
 	// Indicates whether Elastic Fabric Adapter (EFA) is supported.
 	EfaSupported *bool `locationName:"efaSupported" type:"boolean"`
 
+	// Indicates whether the instance type supports ENA Express. ENA Express uses
+	// Amazon Web Services Scalable Reliable Datagram (SRD) technology to increase
+	// the maximum bandwidth used per stream and minimize tail latency of network
+	// traffic between EC2 instances.
+	EnaSrdSupported *bool `locationName:"enaSrdSupported" type:"boolean"`
+
 	// Indicates whether Elastic Network Adapter (ENA) is supported.
 	EnaSupport *string `locationName:"enaSupport" type:"string" enum:"EnaSupport"`
 
@@ -137732,6 +145067,12 @@ func (s *NetworkInfo) SetEfaSupported(v bool) *NetworkInfo {
 	return s
 }
 
+// SetEnaSrdSupported sets the EnaSrdSupported field's value.
+func (s *NetworkInfo) SetEnaSrdSupported(v bool) *NetworkInfo {
+	s.EnaSrdSupported = &v
+	return s
+}
+
 // SetEnaSupport sets the EnaSupport field's value.
 func (s *NetworkInfo) SetEnaSupport(v string) *NetworkInfo {
 	s.EnaSupport = &v
@@ -138030,6 +145371,9 @@ func (s *NetworkInsightsAccessScopeContent) SetNetworkInsightsAccessScopeId(v st
 type NetworkInsightsAnalysis struct {
 	_ struct{} `type:"structure"`
 
+	// The member accounts that contain resources that the path can traverse.
+	AdditionalAccounts []*string `locationName:"additionalAccountSet" locationNameList:"item" type:"list"`
+
 	// Potential intermediate components.
 	AlternatePathHints []*AlternatePathHint `locationName:"alternatePathHintSet" locationNameList:"item" type:"list"`
 
@@ -138068,6 +145412,9 @@ type NetworkInsightsAnalysis struct {
 	// The status message, if the status is failed.
 	StatusMessage *string `locationName:"statusMessage" type:"string"`
 
+	// Potential intermediate accounts.
+	SuggestedAccounts []*string `locationName:"suggestedAccountSet" locationNameList:"item" type:"list"`
+
 	// The tags.
 	Tags []*Tag `locationName:"tagSet" locationNameList:"item" type:"list"`
 
@@ -138093,6 +145440,12 @@ func (s NetworkInsightsAnalysis) GoString() string {
 	return s.String()
 }
 
+// SetAdditionalAccounts sets the AdditionalAccounts field's value.
+func (s *NetworkInsightsAnalysis) SetAdditionalAccounts(v []*string) *NetworkInsightsAnalysis {
+	s.AdditionalAccounts = v
+	return s
+}
+
 // SetAlternatePathHints sets the AlternatePathHints field's value.
 func (s *NetworkInsightsAnalysis) SetAlternatePathHints(v []*AlternatePathHint) *NetworkInsightsAnalysis {
 	s.AlternatePathHints = v
@@ -138165,6 +145518,12 @@ func (s *NetworkInsightsAnalysis) SetStatusMessage(v string) *NetworkInsightsAna
 	return s
 }
 
+// SetSuggestedAccounts sets the SuggestedAccounts field's value.
+func (s *NetworkInsightsAnalysis) SetSuggestedAccounts(v []*string) *NetworkInsightsAnalysis {
+	s.SuggestedAccounts = v
+	return s
+}
+
 // SetTags sets the Tags field's value.
 func (s *NetworkInsightsAnalysis) SetTags(v []*Tag) *NetworkInsightsAnalysis {
 	s.Tags = v
@@ -138187,6 +145546,9 @@ type NetworkInsightsPath struct {
 	// The Amazon Web Services resource that is the destination of the path.
 	Destination *string `locationName:"destination" type:"string"`
 
+	// The Amazon Resource Name (ARN) of the destination.
+	DestinationArn *string `locationName:"destinationArn" min:"1" type:"string"`
+
 	// The IP address of the Amazon Web Services resource that is the destination
 	// of the path.
 	DestinationIp *string `locationName:"destinationIp" type:"string"`
@@ -138206,6 +145568,9 @@ type NetworkInsightsPath struct {
 	// The Amazon Web Services resource that is the source of the path.
 	Source *string `locationName:"source" type:"string"`
 
+	// The Amazon Resource Name (ARN) of the source.
+	SourceArn *string `locationName:"sourceArn" min:"1" type:"string"`
+
 	// The IP address of the Amazon Web Services resource that is the source of
 	// the path.
 	SourceIp *string `locationName:"sourceIp" type:"string"`
@@ -138244,6 +145609,12 @@ func (s *NetworkInsightsPath) SetDestination(v string) *NetworkInsightsPath {
 	return s
 }
 
+// SetDestinationArn sets the DestinationArn field's value.
+func (s *NetworkInsightsPath) SetDestinationArn(v string) *NetworkInsightsPath {
+	s.DestinationArn = &v
+	return s
+}
+
 // SetDestinationIp sets the DestinationIp field's value.
 func (s *NetworkInsightsPath) SetDestinationIp(v string) *NetworkInsightsPath {
 	s.DestinationIp = &v
@@ -138280,6 +145651,12 @@ func (s *NetworkInsightsPath) SetSource(v string) *NetworkInsightsPath {
 	return s
 }
 
+// SetSourceArn sets the SourceArn field's value.
+func (s *NetworkInsightsPath) SetSourceArn(v string) *NetworkInsightsPath {
+	s.SourceArn = &v
+	return s
+}
+
 // SetSourceIp sets the SourceIp field's value.
 func (s *NetworkInsightsPath) SetSourceIp(v string) *NetworkInsightsPath {
 	s.SourceIp = &v
@@ -138662,6 +146039,10 @@ type NetworkInterfaceAttachment struct {
 	// The device index of the network interface attachment on the instance.
 	DeviceIndex *int64 `locationName:"deviceIndex" type:"integer"`
 
+	// Configures ENA Express for the network interface that this action attaches
+	// to the instance.
+	EnaSrdSpecification *AttachmentEnaSrdSpecification `locationName:"enaSrdSpecification" type:"structure"`
+
 	// The ID of the instance.
 	InstanceId *string `locationName:"instanceId" type:"string"`
 
@@ -138717,6 +146098,12 @@ func (s *NetworkInterfaceAttachment) SetDeviceIndex(v int64) *NetworkInterfaceAt
 	return s
 }
 
+// SetEnaSrdSpecification sets the EnaSrdSpecification field's value.
+func (s *NetworkInterfaceAttachment) SetEnaSrdSpecification(v *AttachmentEnaSrdSpecification) *NetworkInterfaceAttachment {
+	s.EnaSrdSpecification = v
+	return s
+}
+
 // SetInstanceId sets the InstanceId field's value.
 func (s *NetworkInterfaceAttachment) SetInstanceId(v string) *NetworkInterfaceAttachment {
 	s.InstanceId = &v
@@ -139117,6 +146504,92 @@ func (s *NewDhcpConfiguration) SetValues(v []*string) *NewDhcpConfiguration {
 	return s
 }
 
+// Options for OIDC-based, user-identity type trust provider.
+type OidcOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The OIDC authorization endpoint.
+	AuthorizationEndpoint *string `locationName:"authorizationEndpoint" type:"string"`
+
+	// The client identifier.
+	ClientId *string `locationName:"clientId" type:"string"`
+
+	// The client secret.
+	ClientSecret *string `locationName:"clientSecret" type:"string"`
+
+	// The OIDC issuer.
+	Issuer *string `locationName:"issuer" type:"string"`
+
+	// The OpenID Connect (OIDC) scope specified.
+	Scope *string `locationName:"scope" type:"string"`
+
+	// The OIDC token endpoint.
+	TokenEndpoint *string `locationName:"tokenEndpoint" type:"string"`
+
+	// The OIDC user info endpoint.
+	UserInfoEndpoint *string `locationName:"userInfoEndpoint" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s OidcOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s OidcOptions) GoString() string {
+	return s.String()
+}
+
+// SetAuthorizationEndpoint sets the AuthorizationEndpoint field's value.
+func (s *OidcOptions) SetAuthorizationEndpoint(v string) *OidcOptions {
+	s.AuthorizationEndpoint = &v
+	return s
+}
+
+// SetClientId sets the ClientId field's value.
+func (s *OidcOptions) SetClientId(v string) *OidcOptions {
+	s.ClientId = &v
+	return s
+}
+
+// SetClientSecret sets the ClientSecret field's value.
+func (s *OidcOptions) SetClientSecret(v string) *OidcOptions {
+	s.ClientSecret = &v
+	return s
+}
+
+// SetIssuer sets the Issuer field's value.
+func (s *OidcOptions) SetIssuer(v string) *OidcOptions {
+	s.Issuer = &v
+	return s
+}
+
+// SetScope sets the Scope field's value.
+func (s *OidcOptions) SetScope(v string) *OidcOptions {
+	s.Scope = &v
+	return s
+}
+
+// SetTokenEndpoint sets the TokenEndpoint field's value.
+func (s *OidcOptions) SetTokenEndpoint(v string) *OidcOptions {
+	s.TokenEndpoint = &v
+	return s
+}
+
+// SetUserInfoEndpoint sets the UserInfoEndpoint field's value.
+func (s *OidcOptions) SetUserInfoEndpoint(v string) *OidcOptions {
+	s.UserInfoEndpoint = &v
+	return s
+}
+
 // Describes the configuration of On-Demand Instances in an EC2 Fleet.
 type OnDemandOptions struct {
 	_ struct{} `type:"structure"`
@@ -140415,11 +147888,10 @@ func (s *Phase2IntegrityAlgorithmsRequestListValue) SetValue(v string) *Phase2In
 type Placement struct {
 	_ struct{} `type:"structure"`
 
-	// The affinity setting for the instance on the Dedicated Host. This parameter
-	// is not supported for the ImportInstance (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html)
-	// command.
+	// The affinity setting for the instance on the Dedicated Host.
 	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// This parameter is not supported for CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet)
+	// or ImportInstance (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html).
 	Affinity *string `locationName:"affinity" type:"string"`
 
 	// The Availability Zone of the instance.
@@ -140427,46 +147899,46 @@ type Placement struct {
 	// If not specified, an Availability Zone will be automatically chosen for you
 	// based on the load balancing criteria for the Region.
 	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// This parameter is not supported for CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
 	AvailabilityZone *string `locationName:"availabilityZone" type:"string"`
 
-	// The name of the placement group the instance is in.
+	// The ID of the placement group that the instance is in. If you specify GroupId,
+	// you can't specify GroupName.
+	GroupId *string `locationName:"groupId" type:"string"`
+
+	// The name of the placement group that the instance is in. If you specify GroupName,
+	// you can't specify GroupId.
 	GroupName *string `locationName:"groupName" type:"string"`
 
-	// The ID of the Dedicated Host on which the instance resides. This parameter
-	// is not supported for the ImportInstance (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html)
-	// command.
+	// The ID of the Dedicated Host on which the instance resides.
 	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// This parameter is not supported for CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet)
+	// or ImportInstance (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html).
 	HostId *string `locationName:"hostId" type:"string"`
 
-	// The ARN of the host resource group in which to launch the instances. If you
-	// specify a host resource group ARN, omit the Tenancy parameter or set it to
-	// host.
+	// The ARN of the host resource group in which to launch the instances.
 	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// If you specify this parameter, either omit the Tenancy parameter or set it
+	// to host.
+	//
+	// This parameter is not supported for CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
 	HostResourceGroupArn *string `locationName:"hostResourceGroupArn" type:"string"`
 
 	// The number of the partition that the instance is in. Valid only if the placement
 	// group strategy is set to partition.
 	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// This parameter is not supported for CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
 	PartitionNumber *int64 `locationName:"partitionNumber" type:"integer"`
 
 	// Reserved for future use.
-	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
 	SpreadDomain *string `locationName:"spreadDomain" type:"string"`
 
 	// The tenancy of the instance (if the instance is running in a VPC). An instance
-	// with a tenancy of dedicated runs on single-tenant hardware. The host tenancy
-	// is not supported for the ImportInstance (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html)
-	// command.
-	//
-	// This parameter is not supported by CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// with a tenancy of dedicated runs on single-tenant hardware.
 	//
-	// T3 instances that use the unlimited CPU credit option do not support host
-	// tenancy.
+	// This parameter is not supported for CreateFleet (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet).
+	// The host tenancy is not supported for ImportInstance (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html)
+	// or for T3 instances that are configured for the unlimited CPU credit option.
 	Tenancy *string `locationName:"tenancy" type:"string" enum:"Tenancy"`
 }
 
@@ -140500,6 +147972,12 @@ func (s *Placement) SetAvailabilityZone(v string) *Placement {
 	return s
 }
 
+// SetGroupId sets the GroupId field's value.
+func (s *Placement) SetGroupId(v string) *Placement {
+	s.GroupId = &v
+	return s
+}
+
 // SetGroupName sets the GroupName field's value.
 func (s *Placement) SetGroupName(v string) *Placement {
 	s.GroupName = &v
@@ -143683,7 +151161,7 @@ func (s *RejectTransitGatewayMulticastDomainAssociationsInput) SetTransitGateway
 type RejectTransitGatewayMulticastDomainAssociationsOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Describes the multicast domain associations.
+	// Information about the multicast domain associations.
 	Associations *TransitGatewayMulticastDomainAssociations `locationName:"associations" type:"structure"`
 }
 
@@ -151003,8 +158481,8 @@ type S3Storage struct {
 	_ struct{} `type:"structure"`
 
 	// The access key ID of the owner of the bucket. Before you specify a value
-	// for your access key ID, review and follow the guidance in Best Practices
-	// for Managing Amazon Web Services Access Keys (https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html).
+	// for your access key ID, review and follow the guidance in Best practices
+	// for managing Amazon Web Services access keys (https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html).
 	AWSAccessKeyId *string `type:"string"`
 
 	// The bucket in which to store the AMI. You can specify a bucket that you already
@@ -155008,29 +162486,46 @@ type SpotFleetRequestConfigData struct {
 	// The strategy that determines how to allocate the target Spot Instance capacity
 	// across the Spot Instance pools specified by the Spot Fleet launch configuration.
 	// For more information, see Allocation strategies for Spot Instances (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet-allocation-strategy.html)
-	// in the Amazon EC2 User Guide for Linux Instances.
+	// in the Amazon EC2 User Guide.
 	//
-	// lowestPrice - Spot Fleet launches instances from the lowest-price Spot Instance
-	// pool that has available capacity. If the cheapest pool doesn't have available
-	// capacity, the Spot Instances come from the next cheapest pool that has available
-	// capacity. If a pool runs out of capacity before fulfilling your desired capacity,
-	// Spot Fleet will continue to fulfill your request by drawing from the next
-	// cheapest pool. To ensure that your desired capacity is met, you might receive
-	// Spot Instances from several pools.
-	//
-	// diversified - Spot Fleet launches instances from all of the Spot Instance
-	// pools that you specify.
-	//
-	// capacityOptimized (recommended) - Spot Fleet launches instances from Spot
-	// Instance pools with optimal capacity for the number of instances that are
-	// launching. To give certain instance types a higher chance of launching first,
-	// use capacityOptimizedPrioritized. Set a priority for each instance type by
-	// using the Priority parameter for LaunchTemplateOverrides. You can assign
-	// the same priority to different LaunchTemplateOverrides. EC2 implements the
-	// priorities on a best-effort basis, but optimizes for capacity first. capacityOptimizedPrioritized
-	// is supported only if your Spot Fleet uses a launch template. Note that if
-	// the OnDemandAllocationStrategy is set to prioritized, the same priority is
-	// applied when fulfilling On-Demand capacity.
+	// priceCapacityOptimized (recommended)
+	//
+	// Spot Fleet identifies the pools with the highest capacity availability for
+	// the number of instances that are launching. This means that we will request
+	// Spot Instances from the pools that we believe have the lowest chance of interruption
+	// in the near term. Spot Fleet then requests Spot Instances from the lowest
+	// priced of these pools.
+	//
+	// capacityOptimized
+	//
+	// Spot Fleet identifies the pools with the highest capacity availability for
+	// the number of instances that are launching. This means that we will request
+	// Spot Instances from the pools that we believe have the lowest chance of interruption
+	// in the near term. To give certain instance types a higher chance of launching
+	// first, use capacityOptimizedPrioritized. Set a priority for each instance
+	// type by using the Priority parameter for LaunchTemplateOverrides. You can
+	// assign the same priority to different LaunchTemplateOverrides. EC2 implements
+	// the priorities on a best-effort basis, but optimizes for capacity first.
+	// capacityOptimizedPrioritized is supported only if your Spot Fleet uses a
+	// launch template. Note that if the OnDemandAllocationStrategy is set to prioritized,
+	// the same priority is applied when fulfilling On-Demand capacity.
+	//
+	// diversified
+	//
+	// Spot Fleet requests instances from all of the Spot Instance pools that you
+	// specify.
+	//
+	// lowestPrice
+	//
+	// Spot Fleet requests instances from the lowest priced Spot Instance pool that
+	// has available capacity. If the lowest priced pool doesn't have available
+	// capacity, the Spot Instances come from the next lowest priced pool that has
+	// available capacity. If a pool runs out of capacity before fulfilling your
+	// desired capacity, Spot Fleet will continue to fulfill your request by drawing
+	// from the next lowest priced pool. To ensure that your desired capacity is
+	// met, you might receive Spot Instances from several pools. Because this strategy
+	// only considers instance price and not capacity availability, it might lead
+	// to high interruption rates.
 	//
 	// Default: lowestPrice
 	AllocationStrategy *string `locationName:"allocationStrategy" type:"string" enum:"AllocationStrategy"`
@@ -155056,9 +162551,9 @@ type SpotFleetRequestConfigData struct {
 	// role that grants the Spot Fleet the permission to request, launch, terminate,
 	// and tag instances on your behalf. For more information, see Spot Fleet prerequisites
 	// (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet-requests.html#spot-fleet-prerequisites)
-	// in the Amazon EC2 User Guide for Linux Instances. Spot Fleet can terminate
-	// Spot Instances on your behalf when you cancel its Spot Fleet request using
-	// CancelSpotFleetRequests (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelSpotFleetRequests)
+	// in the Amazon EC2 User Guide. Spot Fleet can terminate Spot Instances on
+	// your behalf when you cancel its Spot Fleet request using CancelSpotFleetRequests
+	// (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelSpotFleetRequests)
 	// or when the Spot Fleet request expires, if you set TerminateInstancesWithExpiration.
 	//
 	// IamFleetRole is a required field
@@ -155894,27 +163389,44 @@ type SpotOptions struct {
 	// For more information, see Allocation strategies for Spot Instances (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-fleet-allocation-strategy.html)
 	// in the Amazon EC2 User Guide.
 	//
-	// lowest-price - EC2 Fleet launches instances from the lowest-price Spot Instance
-	// pool that has available capacity. If the cheapest pool doesn't have available
-	// capacity, the Spot Instances come from the next cheapest pool that has available
-	// capacity. If a pool runs out of capacity before fulfilling your desired capacity,
-	// EC2 Fleet will continue to fulfill your request by drawing from the next
-	// cheapest pool. To ensure that your desired capacity is met, you might receive
-	// Spot Instances from several pools.
-	//
-	// diversified - EC2 Fleet launches instances from all of the Spot Instance
-	// pools that you specify.
-	//
-	// capacity-optimized (recommended) - EC2 Fleet launches instances from Spot
-	// Instance pools with optimal capacity for the number of instances that are
-	// launching. To give certain instance types a higher chance of launching first,
-	// use capacity-optimized-prioritized. Set a priority for each instance type
-	// by using the Priority parameter for LaunchTemplateOverrides. You can assign
-	// the same priority to different LaunchTemplateOverrides. EC2 implements the
-	// priorities on a best-effort basis, but optimizes for capacity first. capacity-optimized-prioritized
-	// is supported only if your fleet uses a launch template. Note that if the
-	// On-Demand AllocationStrategy is set to prioritized, the same priority is
-	// applied when fulfilling On-Demand capacity.
+	// price-capacity-optimized (recommended)
+	//
+	// EC2 Fleet identifies the pools with the highest capacity availability for
+	// the number of instances that are launching. This means that we will request
+	// Spot Instances from the pools that we believe have the lowest chance of interruption
+	// in the near term. EC2 Fleet then requests Spot Instances from the lowest
+	// priced of these pools.
+	//
+	// capacity-optimized
+	//
+	// EC2 Fleet identifies the pools with the highest capacity availability for
+	// the number of instances that are launching. This means that we will request
+	// Spot Instances from the pools that we believe have the lowest chance of interruption
+	// in the near term. To give certain instance types a higher chance of launching
+	// first, use capacity-optimized-prioritized. Set a priority for each instance
+	// type by using the Priority parameter for LaunchTemplateOverrides. You can
+	// assign the same priority to different LaunchTemplateOverrides. EC2 implements
+	// the priorities on a best-effort basis, but optimizes for capacity first.
+	// capacity-optimized-prioritized is supported only if your EC2 Fleet uses a
+	// launch template. Note that if the On-Demand AllocationStrategy is set to
+	// prioritized, the same priority is applied when fulfilling On-Demand capacity.
+	//
+	// diversified
+	//
+	// EC2 Fleet requests instances from all of the Spot Instance pools that you
+	// specify.
+	//
+	// lowest-price
+	//
+	// EC2 Fleet requests instances from the lowest priced Spot Instance pool that
+	// has available capacity. If the lowest priced pool doesn't have available
+	// capacity, the Spot Instances come from the next lowest priced pool that has
+	// available capacity. If a pool runs out of capacity before fulfilling your
+	// desired capacity, EC2 Fleet will continue to fulfill your request by drawing
+	// from the next lowest priced pool. To ensure that your desired capacity is
+	// met, you might receive Spot Instances from several pools. Because this strategy
+	// only considers instance price and not capacity availability, it might lead
+	// to high interruption rates.
 	//
 	// Default: lowest-price
 	AllocationStrategy *string `locationName:"allocationStrategy" type:"string" enum:"SpotAllocationStrategy"`
@@ -156049,27 +163561,44 @@ type SpotOptionsRequest struct {
 	// For more information, see Allocation strategies for Spot Instances (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-fleet-allocation-strategy.html)
 	// in the Amazon EC2 User Guide.
 	//
-	// lowest-price - EC2 Fleet launches instances from the lowest-price Spot Instance
-	// pool that has available capacity. If the cheapest pool doesn't have available
-	// capacity, the Spot Instances come from the next cheapest pool that has available
-	// capacity. If a pool runs out of capacity before fulfilling your desired capacity,
-	// EC2 Fleet will continue to fulfill your request by drawing from the next
-	// cheapest pool. To ensure that your desired capacity is met, you might receive
-	// Spot Instances from several pools.
-	//
-	// diversified - EC2 Fleet launches instances from all of the Spot Instance
-	// pools that you specify.
-	//
-	// capacity-optimized (recommended) - EC2 Fleet launches instances from Spot
-	// Instance pools with optimal capacity for the number of instances that are
-	// launching. To give certain instance types a higher chance of launching first,
-	// use capacity-optimized-prioritized. Set a priority for each instance type
-	// by using the Priority parameter for LaunchTemplateOverrides. You can assign
-	// the same priority to different LaunchTemplateOverrides. EC2 implements the
-	// priorities on a best-effort basis, but optimizes for capacity first. capacity-optimized-prioritized
-	// is supported only if your fleet uses a launch template. Note that if the
-	// On-Demand AllocationStrategy is set to prioritized, the same priority is
-	// applied when fulfilling On-Demand capacity.
+	// price-capacity-optimized (recommended)
+	//
+	// EC2 Fleet identifies the pools with the highest capacity availability for
+	// the number of instances that are launching. This means that we will request
+	// Spot Instances from the pools that we believe have the lowest chance of interruption
+	// in the near term. EC2 Fleet then requests Spot Instances from the lowest
+	// priced of these pools.
+	//
+	// capacity-optimized
+	//
+	// EC2 Fleet identifies the pools with the highest capacity availability for
+	// the number of instances that are launching. This means that we will request
+	// Spot Instances from the pools that we believe have the lowest chance of interruption
+	// in the near term. To give certain instance types a higher chance of launching
+	// first, use capacity-optimized-prioritized. Set a priority for each instance
+	// type by using the Priority parameter for LaunchTemplateOverrides. You can
+	// assign the same priority to different LaunchTemplateOverrides. EC2 implements
+	// the priorities on a best-effort basis, but optimizes for capacity first.
+	// capacity-optimized-prioritized is supported only if your EC2 Fleet uses a
+	// launch template. Note that if the On-Demand AllocationStrategy is set to
+	// prioritized, the same priority is applied when fulfilling On-Demand capacity.
+	//
+	// diversified
+	//
+	// EC2 Fleet requests instances from all of the Spot Instance pools that you
+	// specify.
+	//
+	// lowest-price
+	//
+	// EC2 Fleet requests instances from the lowest priced Spot Instance pool that
+	// has available capacity. If the lowest priced pool doesn't have available
+	// capacity, the Spot Instances come from the next lowest priced pool that has
+	// available capacity. If a pool runs out of capacity before fulfilling your
+	// desired capacity, EC2 Fleet will continue to fulfill your request by drawing
+	// from the next lowest priced pool. To ensure that your desired capacity is
+	// met, you might receive Spot Instances from several pools. Because this strategy
+	// only considers instance price and not capacity availability, it might lead
+	// to high interruption rates.
 	//
 	// Default: lowest-price
 	AllocationStrategy *string `type:"string" enum:"SpotAllocationStrategy"`
@@ -156752,6 +164281,9 @@ func (s *StartNetworkInsightsAccessScopeAnalysisOutput) SetNetworkInsightsAccess
 type StartNetworkInsightsAnalysisInput struct {
 	_ struct{} `type:"structure"`
 
+	// The member accounts that contain resources that the path can traverse.
+	AdditionalAccounts []*string `locationName:"AdditionalAccount" locationNameList:"item" type:"list"`
+
 	// Unique, case-sensitive identifier that you provide to ensure the idempotency
 	// of the request. For more information, see How to ensure idempotency (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html).
 	ClientToken *string `type:"string" idempotencyToken:"true"`
@@ -156805,6 +164337,12 @@ func (s *StartNetworkInsightsAnalysisInput) Validate() error {
 	return nil
 }
 
+// SetAdditionalAccounts sets the AdditionalAccounts field's value.
+func (s *StartNetworkInsightsAnalysisInput) SetAdditionalAccounts(v []*string) *StartNetworkInsightsAnalysisInput {
+	s.AdditionalAccounts = v
+	return s
+}
+
 // SetClientToken sets the ClientToken field's value.
 func (s *StartNetworkInsightsAnalysisInput) SetClientToken(v string) *StartNetworkInsightsAnalysisInput {
 	s.ClientToken = &v
@@ -157750,6 +165288,76 @@ func (s *SubnetIpv6CidrBlockAssociation) SetIpv6CidrBlockState(v *SubnetCidrBloc
 	return s
 }
 
+// Describes an Infrastructure Performance subscription.
+type Subscription struct {
+	_ struct{} `type:"structure"`
+
+	// The Region or Availability Zone that's the target for the subscription. For
+	// example, eu-west-1.
+	Destination *string `locationName:"destination" type:"string"`
+
+	// The metric used for the subscription.
+	Metric *string `locationName:"metric" type:"string" enum:"MetricType"`
+
+	// The data aggregation time for the subscription.
+	Period *string `locationName:"period" type:"string" enum:"PeriodType"`
+
+	// The Region or Availability Zone that's the source for the subscription. For
+	// example, us-east-1.
+	Source *string `locationName:"source" type:"string"`
+
+	// The statistic used for the subscription.
+	Statistic *string `locationName:"statistic" type:"string" enum:"StatisticType"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s Subscription) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s Subscription) GoString() string {
+	return s.String()
+}
+
+// SetDestination sets the Destination field's value.
+func (s *Subscription) SetDestination(v string) *Subscription {
+	s.Destination = &v
+	return s
+}
+
+// SetMetric sets the Metric field's value.
+func (s *Subscription) SetMetric(v string) *Subscription {
+	s.Metric = &v
+	return s
+}
+
+// SetPeriod sets the Period field's value.
+func (s *Subscription) SetPeriod(v string) *Subscription {
+	s.Period = &v
+	return s
+}
+
+// SetSource sets the Source field's value.
+func (s *Subscription) SetSource(v string) *Subscription {
+	s.Source = &v
+	return s
+}
+
+// SetStatistic sets the Statistic field's value.
+func (s *Subscription) SetStatistic(v string) *Subscription {
+	s.Statistic = &v
+	return s
+}
+
 // Describes the burstable performance instance whose credit option for CPU
 // usage was successfully modified.
 type SuccessfulInstanceCreditSpecificationItem struct {
@@ -163729,6 +171337,1282 @@ func (s *ValidationWarning) SetErrors(v []*ValidationError) *ValidationWarning {
 	return s
 }
 
+// An Amazon Web Services Verified Access endpoint specifies the application
+// that Amazon Web Services Verified Access provides access to. It must be attached
+// to an Amazon Web Services Verified Access group. An Amazon Web Services Verified
+// Access endpoint must also have an attached access policy before you attached
+// it to a group.
+type VerifiedAccessEndpoint struct {
+	_ struct{} `type:"structure"`
+
+	// The DNS name for users to reach your application.
+	ApplicationDomain *string `locationName:"applicationDomain" type:"string"`
+
+	// The type of attachment used to provide connectivity between the Amazon Web
+	// Services Verified Access endpoint and the application.
+	AttachmentType *string `locationName:"attachmentType" type:"string" enum:"VerifiedAccessEndpointAttachmentType"`
+
+	// The creation time.
+	CreationTime *string `locationName:"creationTime" type:"string"`
+
+	// The deletion time.
+	DeletionTime *string `locationName:"deletionTime" type:"string"`
+
+	// A description for the Amazon Web Services Verified Access endpoint.
+	Description *string `locationName:"description" type:"string"`
+
+	// Returned if endpoint has a device trust provider attached.
+	DeviceValidationDomain *string `locationName:"deviceValidationDomain" type:"string"`
+
+	// The ARN of a public TLS/SSL certificate imported into or created with ACM.
+	DomainCertificateArn *string `locationName:"domainCertificateArn" type:"string"`
+
+	// A DNS name that is generated for the endpoint.
+	EndpointDomain *string `locationName:"endpointDomain" type:"string"`
+
+	// The type of Amazon Web Services Verified Access endpoint. Incoming application
+	// requests will be sent to an IP address, load balancer or a network interface
+	// depending on the endpoint type specified.
+	EndpointType *string `locationName:"endpointType" type:"string" enum:"VerifiedAccessEndpointType"`
+
+	// The last updated time.
+	LastUpdatedTime *string `locationName:"lastUpdatedTime" type:"string"`
+
+	// The load balancer details if creating the Amazon Web Services Verified Access
+	// endpoint as load-balancertype.
+	LoadBalancerOptions *VerifiedAccessEndpointLoadBalancerOptions `locationName:"loadBalancerOptions" type:"structure"`
+
+	// The options for network-interface type endpoint.
+	NetworkInterfaceOptions *VerifiedAccessEndpointEniOptions `locationName:"networkInterfaceOptions" type:"structure"`
+
+	// The IDs of the security groups for the endpoint.
+	SecurityGroupIds []*string `locationName:"securityGroupIdSet" locationNameList:"item" type:"list"`
+
+	// The endpoint status.
+	Status *VerifiedAccessEndpointStatus `locationName:"status" type:"structure"`
+
+	// The tags.
+	Tags []*Tag `locationName:"tagSet" locationNameList:"item" type:"list"`
+
+	// The ID of the Amazon Web Services Verified Access endpoint.
+	VerifiedAccessEndpointId *string `locationName:"verifiedAccessEndpointId" type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access group.
+	VerifiedAccessGroupId *string `locationName:"verifiedAccessGroupId" type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `locationName:"verifiedAccessInstanceId" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpoint) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpoint) GoString() string {
+	return s.String()
+}
+
+// SetApplicationDomain sets the ApplicationDomain field's value.
+func (s *VerifiedAccessEndpoint) SetApplicationDomain(v string) *VerifiedAccessEndpoint {
+	s.ApplicationDomain = &v
+	return s
+}
+
+// SetAttachmentType sets the AttachmentType field's value.
+func (s *VerifiedAccessEndpoint) SetAttachmentType(v string) *VerifiedAccessEndpoint {
+	s.AttachmentType = &v
+	return s
+}
+
+// SetCreationTime sets the CreationTime field's value.
+func (s *VerifiedAccessEndpoint) SetCreationTime(v string) *VerifiedAccessEndpoint {
+	s.CreationTime = &v
+	return s
+}
+
+// SetDeletionTime sets the DeletionTime field's value.
+func (s *VerifiedAccessEndpoint) SetDeletionTime(v string) *VerifiedAccessEndpoint {
+	s.DeletionTime = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *VerifiedAccessEndpoint) SetDescription(v string) *VerifiedAccessEndpoint {
+	s.Description = &v
+	return s
+}
+
+// SetDeviceValidationDomain sets the DeviceValidationDomain field's value.
+func (s *VerifiedAccessEndpoint) SetDeviceValidationDomain(v string) *VerifiedAccessEndpoint {
+	s.DeviceValidationDomain = &v
+	return s
+}
+
+// SetDomainCertificateArn sets the DomainCertificateArn field's value.
+func (s *VerifiedAccessEndpoint) SetDomainCertificateArn(v string) *VerifiedAccessEndpoint {
+	s.DomainCertificateArn = &v
+	return s
+}
+
+// SetEndpointDomain sets the EndpointDomain field's value.
+func (s *VerifiedAccessEndpoint) SetEndpointDomain(v string) *VerifiedAccessEndpoint {
+	s.EndpointDomain = &v
+	return s
+}
+
+// SetEndpointType sets the EndpointType field's value.
+func (s *VerifiedAccessEndpoint) SetEndpointType(v string) *VerifiedAccessEndpoint {
+	s.EndpointType = &v
+	return s
+}
+
+// SetLastUpdatedTime sets the LastUpdatedTime field's value.
+func (s *VerifiedAccessEndpoint) SetLastUpdatedTime(v string) *VerifiedAccessEndpoint {
+	s.LastUpdatedTime = &v
+	return s
+}
+
+// SetLoadBalancerOptions sets the LoadBalancerOptions field's value.
+func (s *VerifiedAccessEndpoint) SetLoadBalancerOptions(v *VerifiedAccessEndpointLoadBalancerOptions) *VerifiedAccessEndpoint {
+	s.LoadBalancerOptions = v
+	return s
+}
+
+// SetNetworkInterfaceOptions sets the NetworkInterfaceOptions field's value.
+func (s *VerifiedAccessEndpoint) SetNetworkInterfaceOptions(v *VerifiedAccessEndpointEniOptions) *VerifiedAccessEndpoint {
+	s.NetworkInterfaceOptions = v
+	return s
+}
+
+// SetSecurityGroupIds sets the SecurityGroupIds field's value.
+func (s *VerifiedAccessEndpoint) SetSecurityGroupIds(v []*string) *VerifiedAccessEndpoint {
+	s.SecurityGroupIds = v
+	return s
+}
+
+// SetStatus sets the Status field's value.
+func (s *VerifiedAccessEndpoint) SetStatus(v *VerifiedAccessEndpointStatus) *VerifiedAccessEndpoint {
+	s.Status = v
+	return s
+}
+
+// SetTags sets the Tags field's value.
+func (s *VerifiedAccessEndpoint) SetTags(v []*Tag) *VerifiedAccessEndpoint {
+	s.Tags = v
+	return s
+}
+
+// SetVerifiedAccessEndpointId sets the VerifiedAccessEndpointId field's value.
+func (s *VerifiedAccessEndpoint) SetVerifiedAccessEndpointId(v string) *VerifiedAccessEndpoint {
+	s.VerifiedAccessEndpointId = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *VerifiedAccessEndpoint) SetVerifiedAccessGroupId(v string) *VerifiedAccessEndpoint {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *VerifiedAccessEndpoint) SetVerifiedAccessInstanceId(v string) *VerifiedAccessEndpoint {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+// Options for a network-interface type endpoint.
+type VerifiedAccessEndpointEniOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the network interface.
+	NetworkInterfaceId *string `locationName:"networkInterfaceId" type:"string"`
+
+	// The IP port number.
+	Port *int64 `locationName:"port" min:"1" type:"integer"`
+
+	// The IP protocol.
+	Protocol *string `locationName:"protocol" type:"string" enum:"VerifiedAccessEndpointProtocol"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpointEniOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpointEniOptions) GoString() string {
+	return s.String()
+}
+
+// SetNetworkInterfaceId sets the NetworkInterfaceId field's value.
+func (s *VerifiedAccessEndpointEniOptions) SetNetworkInterfaceId(v string) *VerifiedAccessEndpointEniOptions {
+	s.NetworkInterfaceId = &v
+	return s
+}
+
+// SetPort sets the Port field's value.
+func (s *VerifiedAccessEndpointEniOptions) SetPort(v int64) *VerifiedAccessEndpointEniOptions {
+	s.Port = &v
+	return s
+}
+
+// SetProtocol sets the Protocol field's value.
+func (s *VerifiedAccessEndpointEniOptions) SetProtocol(v string) *VerifiedAccessEndpointEniOptions {
+	s.Protocol = &v
+	return s
+}
+
+// Describes a load balancer when creating an Amazon Web Services Verified Access
+// endpoint using the load-balancer type.
+type VerifiedAccessEndpointLoadBalancerOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ARN of the load balancer.
+	LoadBalancerArn *string `locationName:"loadBalancerArn" type:"string"`
+
+	// The IP port number.
+	Port *int64 `locationName:"port" min:"1" type:"integer"`
+
+	// The IP protocol.
+	Protocol *string `locationName:"protocol" type:"string" enum:"VerifiedAccessEndpointProtocol"`
+
+	// The IDs of the subnets.
+	SubnetIds []*string `locationName:"subnetIdSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpointLoadBalancerOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpointLoadBalancerOptions) GoString() string {
+	return s.String()
+}
+
+// SetLoadBalancerArn sets the LoadBalancerArn field's value.
+func (s *VerifiedAccessEndpointLoadBalancerOptions) SetLoadBalancerArn(v string) *VerifiedAccessEndpointLoadBalancerOptions {
+	s.LoadBalancerArn = &v
+	return s
+}
+
+// SetPort sets the Port field's value.
+func (s *VerifiedAccessEndpointLoadBalancerOptions) SetPort(v int64) *VerifiedAccessEndpointLoadBalancerOptions {
+	s.Port = &v
+	return s
+}
+
+// SetProtocol sets the Protocol field's value.
+func (s *VerifiedAccessEndpointLoadBalancerOptions) SetProtocol(v string) *VerifiedAccessEndpointLoadBalancerOptions {
+	s.Protocol = &v
+	return s
+}
+
+// SetSubnetIds sets the SubnetIds field's value.
+func (s *VerifiedAccessEndpointLoadBalancerOptions) SetSubnetIds(v []*string) *VerifiedAccessEndpointLoadBalancerOptions {
+	s.SubnetIds = v
+	return s
+}
+
+// Describes the status of a Verified Access endpoint.
+type VerifiedAccessEndpointStatus struct {
+	_ struct{} `type:"structure"`
+
+	// The status code of the Verified Access endpoint.
+	Code *string `locationName:"code" type:"string" enum:"VerifiedAccessEndpointStatusCode"`
+
+	// The status message of the Verified Access endpoint.
+	Message *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpointStatus) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessEndpointStatus) GoString() string {
+	return s.String()
+}
+
+// SetCode sets the Code field's value.
+func (s *VerifiedAccessEndpointStatus) SetCode(v string) *VerifiedAccessEndpointStatus {
+	s.Code = &v
+	return s
+}
+
+// SetMessage sets the Message field's value.
+func (s *VerifiedAccessEndpointStatus) SetMessage(v string) *VerifiedAccessEndpointStatus {
+	s.Message = &v
+	return s
+}
+
+// Describes a Verified Access group.
+type VerifiedAccessGroup struct {
+	_ struct{} `type:"structure"`
+
+	// The creation time.
+	CreationTime *string `locationName:"creationTime" type:"string"`
+
+	// The deletion time.
+	DeletionTime *string `locationName:"deletionTime" type:"string"`
+
+	// A description for the Amazon Web Services Verified Access group.
+	Description *string `locationName:"description" type:"string"`
+
+	// The last updated time.
+	LastUpdatedTime *string `locationName:"lastUpdatedTime" type:"string"`
+
+	// The Amazon Web Services account number that owns the group.
+	Owner *string `locationName:"owner" type:"string"`
+
+	// The tags.
+	Tags []*Tag `locationName:"tagSet" locationNameList:"item" type:"list"`
+
+	// The ARN of the Verified Access group.
+	VerifiedAccessGroupArn *string `locationName:"verifiedAccessGroupArn" type:"string"`
+
+	// The ID of the Verified Access group.
+	VerifiedAccessGroupId *string `locationName:"verifiedAccessGroupId" type:"string"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `locationName:"verifiedAccessInstanceId" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessGroup) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessGroup) GoString() string {
+	return s.String()
+}
+
+// SetCreationTime sets the CreationTime field's value.
+func (s *VerifiedAccessGroup) SetCreationTime(v string) *VerifiedAccessGroup {
+	s.CreationTime = &v
+	return s
+}
+
+// SetDeletionTime sets the DeletionTime field's value.
+func (s *VerifiedAccessGroup) SetDeletionTime(v string) *VerifiedAccessGroup {
+	s.DeletionTime = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *VerifiedAccessGroup) SetDescription(v string) *VerifiedAccessGroup {
+	s.Description = &v
+	return s
+}
+
+// SetLastUpdatedTime sets the LastUpdatedTime field's value.
+func (s *VerifiedAccessGroup) SetLastUpdatedTime(v string) *VerifiedAccessGroup {
+	s.LastUpdatedTime = &v
+	return s
+}
+
+// SetOwner sets the Owner field's value.
+func (s *VerifiedAccessGroup) SetOwner(v string) *VerifiedAccessGroup {
+	s.Owner = &v
+	return s
+}
+
+// SetTags sets the Tags field's value.
+func (s *VerifiedAccessGroup) SetTags(v []*Tag) *VerifiedAccessGroup {
+	s.Tags = v
+	return s
+}
+
+// SetVerifiedAccessGroupArn sets the VerifiedAccessGroupArn field's value.
+func (s *VerifiedAccessGroup) SetVerifiedAccessGroupArn(v string) *VerifiedAccessGroup {
+	s.VerifiedAccessGroupArn = &v
+	return s
+}
+
+// SetVerifiedAccessGroupId sets the VerifiedAccessGroupId field's value.
+func (s *VerifiedAccessGroup) SetVerifiedAccessGroupId(v string) *VerifiedAccessGroup {
+	s.VerifiedAccessGroupId = &v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *VerifiedAccessGroup) SetVerifiedAccessInstanceId(v string) *VerifiedAccessGroup {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+// Describes a Verified Access instance.
+type VerifiedAccessInstance struct {
+	_ struct{} `type:"structure"`
+
+	// The creation time.
+	CreationTime *string `locationName:"creationTime" type:"string"`
+
+	// A description for the Amazon Web Services Verified Access instance.
+	Description *string `locationName:"description" type:"string"`
+
+	// The last updated time.
+	LastUpdatedTime *string `locationName:"lastUpdatedTime" type:"string"`
+
+	// The tags.
+	Tags []*Tag `locationName:"tagSet" locationNameList:"item" type:"list"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `locationName:"verifiedAccessInstanceId" type:"string"`
+
+	// The IDs of the Amazon Web Services Verified Access trust providers.
+	VerifiedAccessTrustProviders []*VerifiedAccessTrustProviderCondensed `locationName:"verifiedAccessTrustProviderSet" locationNameList:"item" type:"list"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessInstance) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessInstance) GoString() string {
+	return s.String()
+}
+
+// SetCreationTime sets the CreationTime field's value.
+func (s *VerifiedAccessInstance) SetCreationTime(v string) *VerifiedAccessInstance {
+	s.CreationTime = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *VerifiedAccessInstance) SetDescription(v string) *VerifiedAccessInstance {
+	s.Description = &v
+	return s
+}
+
+// SetLastUpdatedTime sets the LastUpdatedTime field's value.
+func (s *VerifiedAccessInstance) SetLastUpdatedTime(v string) *VerifiedAccessInstance {
+	s.LastUpdatedTime = &v
+	return s
+}
+
+// SetTags sets the Tags field's value.
+func (s *VerifiedAccessInstance) SetTags(v []*Tag) *VerifiedAccessInstance {
+	s.Tags = v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *VerifiedAccessInstance) SetVerifiedAccessInstanceId(v string) *VerifiedAccessInstance {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviders sets the VerifiedAccessTrustProviders field's value.
+func (s *VerifiedAccessInstance) SetVerifiedAccessTrustProviders(v []*VerifiedAccessTrustProviderCondensed) *VerifiedAccessInstance {
+	s.VerifiedAccessTrustProviders = v
+	return s
+}
+
+// Describes logging options for an Amazon Web Services Verified Access instance.
+type VerifiedAccessInstanceLoggingConfiguration struct {
+	_ struct{} `type:"structure"`
+
+	// Details about the logging options.
+	AccessLogs *VerifiedAccessLogs `locationName:"accessLogs" type:"structure"`
+
+	// The ID of the Amazon Web Services Verified Access instance.
+	VerifiedAccessInstanceId *string `locationName:"verifiedAccessInstanceId" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessInstanceLoggingConfiguration) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessInstanceLoggingConfiguration) GoString() string {
+	return s.String()
+}
+
+// SetAccessLogs sets the AccessLogs field's value.
+func (s *VerifiedAccessInstanceLoggingConfiguration) SetAccessLogs(v *VerifiedAccessLogs) *VerifiedAccessInstanceLoggingConfiguration {
+	s.AccessLogs = v
+	return s
+}
+
+// SetVerifiedAccessInstanceId sets the VerifiedAccessInstanceId field's value.
+func (s *VerifiedAccessInstanceLoggingConfiguration) SetVerifiedAccessInstanceId(v string) *VerifiedAccessInstanceLoggingConfiguration {
+	s.VerifiedAccessInstanceId = &v
+	return s
+}
+
+// Options for CloudWatch Logs as a logging destination.
+type VerifiedAccessLogCloudWatchLogsDestination struct {
+	_ struct{} `type:"structure"`
+
+	// The delivery status for access logs.
+	DeliveryStatus *VerifiedAccessLogDeliveryStatus `locationName:"deliveryStatus" type:"structure"`
+
+	// Indicates whether logging is enabled.
+	Enabled *bool `locationName:"enabled" type:"boolean"`
+
+	// The ID of the CloudWatch Logs log group.
+	LogGroup *string `locationName:"logGroup" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogCloudWatchLogsDestination) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogCloudWatchLogsDestination) GoString() string {
+	return s.String()
+}
+
+// SetDeliveryStatus sets the DeliveryStatus field's value.
+func (s *VerifiedAccessLogCloudWatchLogsDestination) SetDeliveryStatus(v *VerifiedAccessLogDeliveryStatus) *VerifiedAccessLogCloudWatchLogsDestination {
+	s.DeliveryStatus = v
+	return s
+}
+
+// SetEnabled sets the Enabled field's value.
+func (s *VerifiedAccessLogCloudWatchLogsDestination) SetEnabled(v bool) *VerifiedAccessLogCloudWatchLogsDestination {
+	s.Enabled = &v
+	return s
+}
+
+// SetLogGroup sets the LogGroup field's value.
+func (s *VerifiedAccessLogCloudWatchLogsDestination) SetLogGroup(v string) *VerifiedAccessLogCloudWatchLogsDestination {
+	s.LogGroup = &v
+	return s
+}
+
+// Options for CloudWatch Logs as a logging destination.
+type VerifiedAccessLogCloudWatchLogsDestinationOptions struct {
+	_ struct{} `type:"structure"`
+
+	// Indicates whether logging is enabled.
+	//
+	// Enabled is a required field
+	Enabled *bool `type:"boolean" required:"true"`
+
+	// The ID of the CloudWatch Logs log group.
+	LogGroup *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogCloudWatchLogsDestinationOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogCloudWatchLogsDestinationOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *VerifiedAccessLogCloudWatchLogsDestinationOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "VerifiedAccessLogCloudWatchLogsDestinationOptions"}
+	if s.Enabled == nil {
+		invalidParams.Add(request.NewErrParamRequired("Enabled"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetEnabled sets the Enabled field's value.
+func (s *VerifiedAccessLogCloudWatchLogsDestinationOptions) SetEnabled(v bool) *VerifiedAccessLogCloudWatchLogsDestinationOptions {
+	s.Enabled = &v
+	return s
+}
+
+// SetLogGroup sets the LogGroup field's value.
+func (s *VerifiedAccessLogCloudWatchLogsDestinationOptions) SetLogGroup(v string) *VerifiedAccessLogCloudWatchLogsDestinationOptions {
+	s.LogGroup = &v
+	return s
+}
+
+// Describes a log delivery status.
+type VerifiedAccessLogDeliveryStatus struct {
+	_ struct{} `type:"structure"`
+
+	// The status code.
+	Code *string `locationName:"code" type:"string" enum:"VerifiedAccessLogDeliveryStatusCode"`
+
+	// The status message.
+	Message *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogDeliveryStatus) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogDeliveryStatus) GoString() string {
+	return s.String()
+}
+
+// SetCode sets the Code field's value.
+func (s *VerifiedAccessLogDeliveryStatus) SetCode(v string) *VerifiedAccessLogDeliveryStatus {
+	s.Code = &v
+	return s
+}
+
+// SetMessage sets the Message field's value.
+func (s *VerifiedAccessLogDeliveryStatus) SetMessage(v string) *VerifiedAccessLogDeliveryStatus {
+	s.Message = &v
+	return s
+}
+
+// Options for Kinesis as a logging destination.
+type VerifiedAccessLogKinesisDataFirehoseDestination struct {
+	_ struct{} `type:"structure"`
+
+	// The delivery status.
+	DeliveryStatus *VerifiedAccessLogDeliveryStatus `locationName:"deliveryStatus" type:"structure"`
+
+	// The ID of the delivery stream.
+	DeliveryStream *string `locationName:"deliveryStream" type:"string"`
+
+	// Indicates whether logging is enabled.
+	Enabled *bool `locationName:"enabled" type:"boolean"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogKinesisDataFirehoseDestination) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogKinesisDataFirehoseDestination) GoString() string {
+	return s.String()
+}
+
+// SetDeliveryStatus sets the DeliveryStatus field's value.
+func (s *VerifiedAccessLogKinesisDataFirehoseDestination) SetDeliveryStatus(v *VerifiedAccessLogDeliveryStatus) *VerifiedAccessLogKinesisDataFirehoseDestination {
+	s.DeliveryStatus = v
+	return s
+}
+
+// SetDeliveryStream sets the DeliveryStream field's value.
+func (s *VerifiedAccessLogKinesisDataFirehoseDestination) SetDeliveryStream(v string) *VerifiedAccessLogKinesisDataFirehoseDestination {
+	s.DeliveryStream = &v
+	return s
+}
+
+// SetEnabled sets the Enabled field's value.
+func (s *VerifiedAccessLogKinesisDataFirehoseDestination) SetEnabled(v bool) *VerifiedAccessLogKinesisDataFirehoseDestination {
+	s.Enabled = &v
+	return s
+}
+
+// Describes Amazon Kinesis Data Firehose logging options.
+type VerifiedAccessLogKinesisDataFirehoseDestinationOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The ID of the delivery stream.
+	DeliveryStream *string `type:"string"`
+
+	// Indicates whether logging is enabled.
+	//
+	// Enabled is a required field
+	Enabled *bool `type:"boolean" required:"true"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogKinesisDataFirehoseDestinationOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogKinesisDataFirehoseDestinationOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *VerifiedAccessLogKinesisDataFirehoseDestinationOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "VerifiedAccessLogKinesisDataFirehoseDestinationOptions"}
+	if s.Enabled == nil {
+		invalidParams.Add(request.NewErrParamRequired("Enabled"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDeliveryStream sets the DeliveryStream field's value.
+func (s *VerifiedAccessLogKinesisDataFirehoseDestinationOptions) SetDeliveryStream(v string) *VerifiedAccessLogKinesisDataFirehoseDestinationOptions {
+	s.DeliveryStream = &v
+	return s
+}
+
+// SetEnabled sets the Enabled field's value.
+func (s *VerifiedAccessLogKinesisDataFirehoseDestinationOptions) SetEnabled(v bool) *VerifiedAccessLogKinesisDataFirehoseDestinationOptions {
+	s.Enabled = &v
+	return s
+}
+
+// Describes the destinations for Verified Access logs.
+type VerifiedAccessLogOptions struct {
+	_ struct{} `type:"structure"`
+
+	// Sends Verified Access logs to CloudWatch Logs.
+	CloudWatchLogs *VerifiedAccessLogCloudWatchLogsDestinationOptions `type:"structure"`
+
+	// Sends Verified Access logs to Kinesis.
+	KinesisDataFirehose *VerifiedAccessLogKinesisDataFirehoseDestinationOptions `type:"structure"`
+
+	// Sends Verified Access logs to Amazon S3.
+	S3 *VerifiedAccessLogS3DestinationOptions `type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *VerifiedAccessLogOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "VerifiedAccessLogOptions"}
+	if s.CloudWatchLogs != nil {
+		if err := s.CloudWatchLogs.Validate(); err != nil {
+			invalidParams.AddNested("CloudWatchLogs", err.(request.ErrInvalidParams))
+		}
+	}
+	if s.KinesisDataFirehose != nil {
+		if err := s.KinesisDataFirehose.Validate(); err != nil {
+			invalidParams.AddNested("KinesisDataFirehose", err.(request.ErrInvalidParams))
+		}
+	}
+	if s.S3 != nil {
+		if err := s.S3.Validate(); err != nil {
+			invalidParams.AddNested("S3", err.(request.ErrInvalidParams))
+		}
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetCloudWatchLogs sets the CloudWatchLogs field's value.
+func (s *VerifiedAccessLogOptions) SetCloudWatchLogs(v *VerifiedAccessLogCloudWatchLogsDestinationOptions) *VerifiedAccessLogOptions {
+	s.CloudWatchLogs = v
+	return s
+}
+
+// SetKinesisDataFirehose sets the KinesisDataFirehose field's value.
+func (s *VerifiedAccessLogOptions) SetKinesisDataFirehose(v *VerifiedAccessLogKinesisDataFirehoseDestinationOptions) *VerifiedAccessLogOptions {
+	s.KinesisDataFirehose = v
+	return s
+}
+
+// SetS3 sets the S3 field's value.
+func (s *VerifiedAccessLogOptions) SetS3(v *VerifiedAccessLogS3DestinationOptions) *VerifiedAccessLogOptions {
+	s.S3 = v
+	return s
+}
+
+// Options for Amazon S3 as a logging destination.
+type VerifiedAccessLogS3Destination struct {
+	_ struct{} `type:"structure"`
+
+	// The bucket name.
+	BucketName *string `locationName:"bucketName" type:"string"`
+
+	// The Amazon Web Services account number that owns the bucket.
+	BucketOwner *string `locationName:"bucketOwner" type:"string"`
+
+	// The delivery status.
+	DeliveryStatus *VerifiedAccessLogDeliveryStatus `locationName:"deliveryStatus" type:"structure"`
+
+	// Indicates whether logging is enabled.
+	Enabled *bool `locationName:"enabled" type:"boolean"`
+
+	// The bucket prefix.
+	Prefix *string `locationName:"prefix" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogS3Destination) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogS3Destination) GoString() string {
+	return s.String()
+}
+
+// SetBucketName sets the BucketName field's value.
+func (s *VerifiedAccessLogS3Destination) SetBucketName(v string) *VerifiedAccessLogS3Destination {
+	s.BucketName = &v
+	return s
+}
+
+// SetBucketOwner sets the BucketOwner field's value.
+func (s *VerifiedAccessLogS3Destination) SetBucketOwner(v string) *VerifiedAccessLogS3Destination {
+	s.BucketOwner = &v
+	return s
+}
+
+// SetDeliveryStatus sets the DeliveryStatus field's value.
+func (s *VerifiedAccessLogS3Destination) SetDeliveryStatus(v *VerifiedAccessLogDeliveryStatus) *VerifiedAccessLogS3Destination {
+	s.DeliveryStatus = v
+	return s
+}
+
+// SetEnabled sets the Enabled field's value.
+func (s *VerifiedAccessLogS3Destination) SetEnabled(v bool) *VerifiedAccessLogS3Destination {
+	s.Enabled = &v
+	return s
+}
+
+// SetPrefix sets the Prefix field's value.
+func (s *VerifiedAccessLogS3Destination) SetPrefix(v string) *VerifiedAccessLogS3Destination {
+	s.Prefix = &v
+	return s
+}
+
+// Options for Amazon S3 as a logging destination.
+type VerifiedAccessLogS3DestinationOptions struct {
+	_ struct{} `type:"structure"`
+
+	// The bucket name.
+	BucketName *string `type:"string"`
+
+	// The ID of the Amazon Web Services account that owns the Amazon S3 bucket.
+	BucketOwner *string `type:"string"`
+
+	// Indicates whether logging is enabled.
+	//
+	// Enabled is a required field
+	Enabled *bool `type:"boolean" required:"true"`
+
+	// The bucket prefix.
+	Prefix *string `type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogS3DestinationOptions) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogS3DestinationOptions) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *VerifiedAccessLogS3DestinationOptions) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "VerifiedAccessLogS3DestinationOptions"}
+	if s.Enabled == nil {
+		invalidParams.Add(request.NewErrParamRequired("Enabled"))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetBucketName sets the BucketName field's value.
+func (s *VerifiedAccessLogS3DestinationOptions) SetBucketName(v string) *VerifiedAccessLogS3DestinationOptions {
+	s.BucketName = &v
+	return s
+}
+
+// SetBucketOwner sets the BucketOwner field's value.
+func (s *VerifiedAccessLogS3DestinationOptions) SetBucketOwner(v string) *VerifiedAccessLogS3DestinationOptions {
+	s.BucketOwner = &v
+	return s
+}
+
+// SetEnabled sets the Enabled field's value.
+func (s *VerifiedAccessLogS3DestinationOptions) SetEnabled(v bool) *VerifiedAccessLogS3DestinationOptions {
+	s.Enabled = &v
+	return s
+}
+
+// SetPrefix sets the Prefix field's value.
+func (s *VerifiedAccessLogS3DestinationOptions) SetPrefix(v string) *VerifiedAccessLogS3DestinationOptions {
+	s.Prefix = &v
+	return s
+}
+
+// Describes the destinations for Verified Access logs.
+type VerifiedAccessLogs struct {
+	_ struct{} `type:"structure"`
+
+	// CloudWatch Logs logging destination.
+	CloudWatchLogs *VerifiedAccessLogCloudWatchLogsDestination `locationName:"cloudWatchLogs" type:"structure"`
+
+	// Kinesis logging destination.
+	KinesisDataFirehose *VerifiedAccessLogKinesisDataFirehoseDestination `locationName:"kinesisDataFirehose" type:"structure"`
+
+	// Amazon S3 logging options.
+	S3 *VerifiedAccessLogS3Destination `locationName:"s3" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogs) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessLogs) GoString() string {
+	return s.String()
+}
+
+// SetCloudWatchLogs sets the CloudWatchLogs field's value.
+func (s *VerifiedAccessLogs) SetCloudWatchLogs(v *VerifiedAccessLogCloudWatchLogsDestination) *VerifiedAccessLogs {
+	s.CloudWatchLogs = v
+	return s
+}
+
+// SetKinesisDataFirehose sets the KinesisDataFirehose field's value.
+func (s *VerifiedAccessLogs) SetKinesisDataFirehose(v *VerifiedAccessLogKinesisDataFirehoseDestination) *VerifiedAccessLogs {
+	s.KinesisDataFirehose = v
+	return s
+}
+
+// SetS3 sets the S3 field's value.
+func (s *VerifiedAccessLogs) SetS3(v *VerifiedAccessLogS3Destination) *VerifiedAccessLogs {
+	s.S3 = v
+	return s
+}
+
+// Describes a Verified Access trust provider.
+type VerifiedAccessTrustProvider struct {
+	_ struct{} `type:"structure"`
+
+	// The creation time.
+	CreationTime *string `locationName:"creationTime" type:"string"`
+
+	// A description for the Amazon Web Services Verified Access trust provider.
+	Description *string `locationName:"description" type:"string"`
+
+	// The options for device-identity type trust provider.
+	DeviceOptions *DeviceOptions `locationName:"deviceOptions" type:"structure"`
+
+	// The type of device-based trust provider.
+	DeviceTrustProviderType *string `locationName:"deviceTrustProviderType" type:"string" enum:"DeviceTrustProviderType"`
+
+	// The last updated time.
+	LastUpdatedTime *string `locationName:"lastUpdatedTime" type:"string"`
+
+	// The OpenID Connect details for an oidc-type, user-identity based trust provider.
+	OidcOptions *OidcOptions `locationName:"oidcOptions" type:"structure"`
+
+	// The identifier to be used when working with policy rules.
+	PolicyReferenceName *string `locationName:"policyReferenceName" type:"string"`
+
+	// The tags.
+	Tags []*Tag `locationName:"tagSet" locationNameList:"item" type:"list"`
+
+	// The type of Verified Access trust provider.
+	TrustProviderType *string `locationName:"trustProviderType" type:"string" enum:"TrustProviderType"`
+
+	// The type of user-based trust provider.
+	UserTrustProviderType *string `locationName:"userTrustProviderType" type:"string" enum:"UserTrustProviderType"`
+
+	// The ID of the Amazon Web Services Verified Access trust provider.
+	VerifiedAccessTrustProviderId *string `locationName:"verifiedAccessTrustProviderId" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessTrustProvider) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessTrustProvider) GoString() string {
+	return s.String()
+}
+
+// SetCreationTime sets the CreationTime field's value.
+func (s *VerifiedAccessTrustProvider) SetCreationTime(v string) *VerifiedAccessTrustProvider {
+	s.CreationTime = &v
+	return s
+}
+
+// SetDescription sets the Description field's value.
+func (s *VerifiedAccessTrustProvider) SetDescription(v string) *VerifiedAccessTrustProvider {
+	s.Description = &v
+	return s
+}
+
+// SetDeviceOptions sets the DeviceOptions field's value.
+func (s *VerifiedAccessTrustProvider) SetDeviceOptions(v *DeviceOptions) *VerifiedAccessTrustProvider {
+	s.DeviceOptions = v
+	return s
+}
+
+// SetDeviceTrustProviderType sets the DeviceTrustProviderType field's value.
+func (s *VerifiedAccessTrustProvider) SetDeviceTrustProviderType(v string) *VerifiedAccessTrustProvider {
+	s.DeviceTrustProviderType = &v
+	return s
+}
+
+// SetLastUpdatedTime sets the LastUpdatedTime field's value.
+func (s *VerifiedAccessTrustProvider) SetLastUpdatedTime(v string) *VerifiedAccessTrustProvider {
+	s.LastUpdatedTime = &v
+	return s
+}
+
+// SetOidcOptions sets the OidcOptions field's value.
+func (s *VerifiedAccessTrustProvider) SetOidcOptions(v *OidcOptions) *VerifiedAccessTrustProvider {
+	s.OidcOptions = v
+	return s
+}
+
+// SetPolicyReferenceName sets the PolicyReferenceName field's value.
+func (s *VerifiedAccessTrustProvider) SetPolicyReferenceName(v string) *VerifiedAccessTrustProvider {
+	s.PolicyReferenceName = &v
+	return s
+}
+
+// SetTags sets the Tags field's value.
+func (s *VerifiedAccessTrustProvider) SetTags(v []*Tag) *VerifiedAccessTrustProvider {
+	s.Tags = v
+	return s
+}
+
+// SetTrustProviderType sets the TrustProviderType field's value.
+func (s *VerifiedAccessTrustProvider) SetTrustProviderType(v string) *VerifiedAccessTrustProvider {
+	s.TrustProviderType = &v
+	return s
+}
+
+// SetUserTrustProviderType sets the UserTrustProviderType field's value.
+func (s *VerifiedAccessTrustProvider) SetUserTrustProviderType(v string) *VerifiedAccessTrustProvider {
+	s.UserTrustProviderType = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderId sets the VerifiedAccessTrustProviderId field's value.
+func (s *VerifiedAccessTrustProvider) SetVerifiedAccessTrustProviderId(v string) *VerifiedAccessTrustProvider {
+	s.VerifiedAccessTrustProviderId = &v
+	return s
+}
+
+// Condensed information about a trust provider.
+type VerifiedAccessTrustProviderCondensed struct {
+	_ struct{} `type:"structure"`
+
+	// The description of trust provider.
+	Description *string `locationName:"description" type:"string"`
+
+	// The type of device-based trust provider.
+	DeviceTrustProviderType *string `locationName:"deviceTrustProviderType" type:"string" enum:"DeviceTrustProviderType"`
+
+	// The type of trust provider (user- or device-based).
+	TrustProviderType *string `locationName:"trustProviderType" type:"string" enum:"TrustProviderType"`
+
+	// The type of user-based trust provider.
+	UserTrustProviderType *string `locationName:"userTrustProviderType" type:"string" enum:"UserTrustProviderType"`
+
+	// The ID of the trust provider.
+	VerifiedAccessTrustProviderId *string `locationName:"verifiedAccessTrustProviderId" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessTrustProviderCondensed) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s VerifiedAccessTrustProviderCondensed) GoString() string {
+	return s.String()
+}
+
+// SetDescription sets the Description field's value.
+func (s *VerifiedAccessTrustProviderCondensed) SetDescription(v string) *VerifiedAccessTrustProviderCondensed {
+	s.Description = &v
+	return s
+}
+
+// SetDeviceTrustProviderType sets the DeviceTrustProviderType field's value.
+func (s *VerifiedAccessTrustProviderCondensed) SetDeviceTrustProviderType(v string) *VerifiedAccessTrustProviderCondensed {
+	s.DeviceTrustProviderType = &v
+	return s
+}
+
+// SetTrustProviderType sets the TrustProviderType field's value.
+func (s *VerifiedAccessTrustProviderCondensed) SetTrustProviderType(v string) *VerifiedAccessTrustProviderCondensed {
+	s.TrustProviderType = &v
+	return s
+}
+
+// SetUserTrustProviderType sets the UserTrustProviderType field's value.
+func (s *VerifiedAccessTrustProviderCondensed) SetUserTrustProviderType(v string) *VerifiedAccessTrustProviderCondensed {
+	s.UserTrustProviderType = &v
+	return s
+}
+
+// SetVerifiedAccessTrustProviderId sets the VerifiedAccessTrustProviderId field's value.
+func (s *VerifiedAccessTrustProviderCondensed) SetVerifiedAccessTrustProviderId(v string) *VerifiedAccessTrustProviderCondensed {
+	s.VerifiedAccessTrustProviderId = &v
+	return s
+}
+
 // Describes telemetry for a VPN tunnel.
 type VgwTelemetry struct {
 	_ struct{} `type:"structure"`
@@ -166857,6 +175741,9 @@ const (
 
 	// AllocationStrategyCapacityOptimizedPrioritized is a AllocationStrategy enum value
 	AllocationStrategyCapacityOptimizedPrioritized = "capacityOptimizedPrioritized"
+
+	// AllocationStrategyPriceCapacityOptimized is a AllocationStrategy enum value
+	AllocationStrategyPriceCapacityOptimized = "priceCapacityOptimized"
 )
 
 // AllocationStrategy_Values returns all elements of the AllocationStrategy enum
@@ -166866,6 +175753,7 @@ func AllocationStrategy_Values() []string {
 		AllocationStrategyDiversified,
 		AllocationStrategyCapacityOptimized,
 		AllocationStrategyCapacityOptimizedPrioritized,
+		AllocationStrategyPriceCapacityOptimized,
 	}
 }
 
@@ -166945,6 +175833,9 @@ const (
 
 	// ArchitectureTypeX8664Mac is a ArchitectureType enum value
 	ArchitectureTypeX8664Mac = "x86_64_mac"
+
+	// ArchitectureTypeArm64Mac is a ArchitectureType enum value
+	ArchitectureTypeArm64Mac = "arm64_mac"
 )
 
 // ArchitectureType_Values returns all elements of the ArchitectureType enum
@@ -166954,6 +175845,7 @@ func ArchitectureType_Values() []string {
 		ArchitectureTypeX8664,
 		ArchitectureTypeArm64,
 		ArchitectureTypeX8664Mac,
+		ArchitectureTypeArm64Mac,
 	}
 }
 
@@ -166969,6 +175861,9 @@ const (
 
 	// ArchitectureValuesX8664Mac is a ArchitectureValues enum value
 	ArchitectureValuesX8664Mac = "x86_64_mac"
+
+	// ArchitectureValuesArm64Mac is a ArchitectureValues enum value
+	ArchitectureValuesArm64Mac = "arm64_mac"
 )
 
 // ArchitectureValues_Values returns all elements of the ArchitectureValues enum
@@ -166978,6 +175873,7 @@ func ArchitectureValues_Values() []string {
 		ArchitectureValuesX8664,
 		ArchitectureValuesArm64,
 		ArchitectureValuesX8664Mac,
+		ArchitectureValuesArm64Mac,
 	}
 }
 
@@ -167989,6 +176885,22 @@ func DestinationFileFormat_Values() []string {
 	}
 }
 
+const (
+	// DeviceTrustProviderTypeJamf is a DeviceTrustProviderType enum value
+	DeviceTrustProviderTypeJamf = "jamf"
+
+	// DeviceTrustProviderTypeCrowdstrike is a DeviceTrustProviderType enum value
+	DeviceTrustProviderTypeCrowdstrike = "crowdstrike"
+)
+
+// DeviceTrustProviderType_Values returns all elements of the DeviceTrustProviderType enum
+func DeviceTrustProviderType_Values() []string {
+	return []string{
+		DeviceTrustProviderTypeJamf,
+		DeviceTrustProviderTypeCrowdstrike,
+	}
+}
+
 const (
 	// DeviceTypeEbs is a DeviceType enum value
 	DeviceTypeEbs = "ebs"
@@ -171048,6 +179960,21 @@ const (
 
 	// InstanceTypeU3tb156xlarge is a InstanceType enum value
 	InstanceTypeU3tb156xlarge = "u-3tb1.56xlarge"
+
+	// InstanceTypeU18tb1112xlarge is a InstanceType enum value
+	InstanceTypeU18tb1112xlarge = "u-18tb1.112xlarge"
+
+	// InstanceTypeU24tb1112xlarge is a InstanceType enum value
+	InstanceTypeU24tb1112xlarge = "u-24tb1.112xlarge"
+
+	// InstanceTypeTrn12xlarge is a InstanceType enum value
+	InstanceTypeTrn12xlarge = "trn1.2xlarge"
+
+	// InstanceTypeTrn132xlarge is a InstanceType enum value
+	InstanceTypeTrn132xlarge = "trn1.32xlarge"
+
+	// InstanceTypeHpc6id32xlarge is a InstanceType enum value
+	InstanceTypeHpc6id32xlarge = "hpc6id.32xlarge"
 )
 
 // InstanceType_Values returns all elements of the InstanceType enum
@@ -171622,6 +180549,11 @@ func InstanceType_Values() []string {
 		InstanceTypeR6aMetal,
 		InstanceTypeP4de24xlarge,
 		InstanceTypeU3tb156xlarge,
+		InstanceTypeU18tb1112xlarge,
+		InstanceTypeU24tb1112xlarge,
+		InstanceTypeTrn12xlarge,
+		InstanceTypeTrn132xlarge,
+		InstanceTypeHpc6id32xlarge,
 	}
 }
 
@@ -172473,6 +181405,18 @@ func MembershipType_Values() []string {
 	}
 }
 
+const (
+	// MetricTypeAggregateLatency is a MetricType enum value
+	MetricTypeAggregateLatency = "aggregate-latency"
+)
+
+// MetricType_Values returns all elements of the MetricType enum
+func MetricType_Values() []string {
+	return []string{
+		MetricTypeAggregateLatency,
+	}
+}
+
 const (
 	// ModifyAvailabilityZoneOptInStatusOptedIn is a ModifyAvailabilityZoneOptInStatus enum value
 	ModifyAvailabilityZoneOptInStatusOptedIn = "opted-in"
@@ -172881,6 +181825,38 @@ func PaymentOption_Values() []string {
 	}
 }
 
+const (
+	// PeriodTypeFiveMinutes is a PeriodType enum value
+	PeriodTypeFiveMinutes = "five-minutes"
+
+	// PeriodTypeFifteenMinutes is a PeriodType enum value
+	PeriodTypeFifteenMinutes = "fifteen-minutes"
+
+	// PeriodTypeOneHour is a PeriodType enum value
+	PeriodTypeOneHour = "one-hour"
+
+	// PeriodTypeThreeHours is a PeriodType enum value
+	PeriodTypeThreeHours = "three-hours"
+
+	// PeriodTypeOneDay is a PeriodType enum value
+	PeriodTypeOneDay = "one-day"
+
+	// PeriodTypeOneWeek is a PeriodType enum value
+	PeriodTypeOneWeek = "one-week"
+)
+
+// PeriodType_Values returns all elements of the PeriodType enum
+func PeriodType_Values() []string {
+	return []string{
+		PeriodTypeFiveMinutes,
+		PeriodTypeFifteenMinutes,
+		PeriodTypeOneHour,
+		PeriodTypeThreeHours,
+		PeriodTypeOneDay,
+		PeriodTypeOneWeek,
+	}
+}
+
 const (
 	// PermissionGroupAll is a PermissionGroup enum value
 	PermissionGroupAll = "all"
@@ -173554,6 +182530,21 @@ const (
 	// ResourceTypeVpcEndpointConnectionDeviceType is a ResourceType enum value
 	ResourceTypeVpcEndpointConnectionDeviceType = "vpc-endpoint-connection-device-type"
 
+	// ResourceTypeVerifiedAccessInstance is a ResourceType enum value
+	ResourceTypeVerifiedAccessInstance = "verified-access-instance"
+
+	// ResourceTypeVerifiedAccessGroup is a ResourceType enum value
+	ResourceTypeVerifiedAccessGroup = "verified-access-group"
+
+	// ResourceTypeVerifiedAccessEndpoint is a ResourceType enum value
+	ResourceTypeVerifiedAccessEndpoint = "verified-access-endpoint"
+
+	// ResourceTypeVerifiedAccessPolicy is a ResourceType enum value
+	ResourceTypeVerifiedAccessPolicy = "verified-access-policy"
+
+	// ResourceTypeVerifiedAccessTrustProvider is a ResourceType enum value
+	ResourceTypeVerifiedAccessTrustProvider = "verified-access-trust-provider"
+
 	// ResourceTypeVpnConnectionDeviceType is a ResourceType enum value
 	ResourceTypeVpnConnectionDeviceType = "vpn-connection-device-type"
 )
@@ -173637,6 +182628,11 @@ func ResourceType_Values() []string {
 		ResourceTypeCapacityReservationFleet,
 		ResourceTypeTrafficMirrorFilterRule,
 		ResourceTypeVpcEndpointConnectionDeviceType,
+		ResourceTypeVerifiedAccessInstance,
+		ResourceTypeVerifiedAccessGroup,
+		ResourceTypeVerifiedAccessEndpoint,
+		ResourceTypeVerifiedAccessPolicy,
+		ResourceTypeVerifiedAccessTrustProvider,
 		ResourceTypeVpnConnectionDeviceType,
 	}
 }
@@ -173905,6 +182901,9 @@ const (
 
 	// SpotAllocationStrategyCapacityOptimizedPrioritized is a SpotAllocationStrategy enum value
 	SpotAllocationStrategyCapacityOptimizedPrioritized = "capacity-optimized-prioritized"
+
+	// SpotAllocationStrategyPriceCapacityOptimized is a SpotAllocationStrategy enum value
+	SpotAllocationStrategyPriceCapacityOptimized = "price-capacity-optimized"
 )
 
 // SpotAllocationStrategy_Values returns all elements of the SpotAllocationStrategy enum
@@ -173914,6 +182913,7 @@ func SpotAllocationStrategy_Values() []string {
 		SpotAllocationStrategyDiversified,
 		SpotAllocationStrategyCapacityOptimized,
 		SpotAllocationStrategyCapacityOptimizedPrioritized,
+		SpotAllocationStrategyPriceCapacityOptimized,
 	}
 }
 
@@ -174053,6 +183053,18 @@ func StaticSourcesSupportValue_Values() []string {
 	}
 }
 
+const (
+	// StatisticTypeP50 is a StatisticType enum value
+	StatisticTypeP50 = "p50"
+)
+
+// StatisticType_Values returns all elements of the StatisticType enum
+func StatisticType_Values() []string {
+	return []string{
+		StatisticTypeP50,
+	}
+}
+
 const (
 	// StatusMoveInProgress is a Status enum value
 	StatusMoveInProgress = "MoveInProgress"
@@ -174901,6 +183913,22 @@ func TransportProtocol_Values() []string {
 	}
 }
 
+const (
+	// TrustProviderTypeUser is a TrustProviderType enum value
+	TrustProviderTypeUser = "user"
+
+	// TrustProviderTypeDevice is a TrustProviderType enum value
+	TrustProviderTypeDevice = "device"
+)
+
+// TrustProviderType_Values returns all elements of the TrustProviderType enum
+func TrustProviderType_Values() []string {
+	return []string{
+		TrustProviderTypeUser,
+		TrustProviderTypeDevice,
+	}
+}
+
 const (
 	// TunnelInsideIpVersionIpv4 is a TunnelInsideIpVersion enum value
 	TunnelInsideIpVersionIpv4 = "ipv4"
@@ -174981,6 +184009,110 @@ func UsageClassType_Values() []string {
 	}
 }
 
+const (
+	// UserTrustProviderTypeIamIdentityCenter is a UserTrustProviderType enum value
+	UserTrustProviderTypeIamIdentityCenter = "iam-identity-center"
+
+	// UserTrustProviderTypeOidc is a UserTrustProviderType enum value
+	UserTrustProviderTypeOidc = "oidc"
+)
+
+// UserTrustProviderType_Values returns all elements of the UserTrustProviderType enum
+func UserTrustProviderType_Values() []string {
+	return []string{
+		UserTrustProviderTypeIamIdentityCenter,
+		UserTrustProviderTypeOidc,
+	}
+}
+
+const (
+	// VerifiedAccessEndpointAttachmentTypeVpc is a VerifiedAccessEndpointAttachmentType enum value
+	VerifiedAccessEndpointAttachmentTypeVpc = "vpc"
+)
+
+// VerifiedAccessEndpointAttachmentType_Values returns all elements of the VerifiedAccessEndpointAttachmentType enum
+func VerifiedAccessEndpointAttachmentType_Values() []string {
+	return []string{
+		VerifiedAccessEndpointAttachmentTypeVpc,
+	}
+}
+
+const (
+	// VerifiedAccessEndpointProtocolHttp is a VerifiedAccessEndpointProtocol enum value
+	VerifiedAccessEndpointProtocolHttp = "http"
+
+	// VerifiedAccessEndpointProtocolHttps is a VerifiedAccessEndpointProtocol enum value
+	VerifiedAccessEndpointProtocolHttps = "https"
+)
+
+// VerifiedAccessEndpointProtocol_Values returns all elements of the VerifiedAccessEndpointProtocol enum
+func VerifiedAccessEndpointProtocol_Values() []string {
+	return []string{
+		VerifiedAccessEndpointProtocolHttp,
+		VerifiedAccessEndpointProtocolHttps,
+	}
+}
+
+const (
+	// VerifiedAccessEndpointStatusCodePending is a VerifiedAccessEndpointStatusCode enum value
+	VerifiedAccessEndpointStatusCodePending = "pending"
+
+	// VerifiedAccessEndpointStatusCodeActive is a VerifiedAccessEndpointStatusCode enum value
+	VerifiedAccessEndpointStatusCodeActive = "active"
+
+	// VerifiedAccessEndpointStatusCodeUpdating is a VerifiedAccessEndpointStatusCode enum value
+	VerifiedAccessEndpointStatusCodeUpdating = "updating"
+
+	// VerifiedAccessEndpointStatusCodeDeleting is a VerifiedAccessEndpointStatusCode enum value
+	VerifiedAccessEndpointStatusCodeDeleting = "deleting"
+
+	// VerifiedAccessEndpointStatusCodeDeleted is a VerifiedAccessEndpointStatusCode enum value
+	VerifiedAccessEndpointStatusCodeDeleted = "deleted"
+)
+
+// VerifiedAccessEndpointStatusCode_Values returns all elements of the VerifiedAccessEndpointStatusCode enum
+func VerifiedAccessEndpointStatusCode_Values() []string {
+	return []string{
+		VerifiedAccessEndpointStatusCodePending,
+		VerifiedAccessEndpointStatusCodeActive,
+		VerifiedAccessEndpointStatusCodeUpdating,
+		VerifiedAccessEndpointStatusCodeDeleting,
+		VerifiedAccessEndpointStatusCodeDeleted,
+	}
+}
+
+const (
+	// VerifiedAccessEndpointTypeLoadBalancer is a VerifiedAccessEndpointType enum value
+	VerifiedAccessEndpointTypeLoadBalancer = "load-balancer"
+
+	// VerifiedAccessEndpointTypeNetworkInterface is a VerifiedAccessEndpointType enum value
+	VerifiedAccessEndpointTypeNetworkInterface = "network-interface"
+)
+
+// VerifiedAccessEndpointType_Values returns all elements of the VerifiedAccessEndpointType enum
+func VerifiedAccessEndpointType_Values() []string {
+	return []string{
+		VerifiedAccessEndpointTypeLoadBalancer,
+		VerifiedAccessEndpointTypeNetworkInterface,
+	}
+}
+
+const (
+	// VerifiedAccessLogDeliveryStatusCodeSuccess is a VerifiedAccessLogDeliveryStatusCode enum value
+	VerifiedAccessLogDeliveryStatusCodeSuccess = "success"
+
+	// VerifiedAccessLogDeliveryStatusCodeFailed is a VerifiedAccessLogDeliveryStatusCode enum value
+	VerifiedAccessLogDeliveryStatusCodeFailed = "failed"
+)
+
+// VerifiedAccessLogDeliveryStatusCode_Values returns all elements of the VerifiedAccessLogDeliveryStatusCode enum
+func VerifiedAccessLogDeliveryStatusCode_Values() []string {
+	return []string{
+		VerifiedAccessLogDeliveryStatusCodeSuccess,
+		VerifiedAccessLogDeliveryStatusCodeFailed,
+	}
+}
+
 const (
 	// VirtualizationTypeHvm is a VirtualizationType enum value
 	VirtualizationTypeHvm = "hvm"
diff --git a/vendor/github.com/aws/aws-sdk-go/service/lightsail/api.go b/vendor/github.com/aws/aws-sdk-go/service/lightsail/api.go
index c4d38ebd91a5..d9e500ec172f 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/lightsail/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/lightsail/api.go
@@ -8015,7 +8015,7 @@ func (c *Lightsail) GetContainerLogRequest(input *GetContainerLogInput) (req *re
 //
 // Container logs are retained for a certain amount of time. For more information,
 // see Amazon Lightsail endpoints and quotas (https://docs.aws.amazon.com/general/latest/gr/lightsail.html)
-// in the AWS General Reference.
+// in the Amazon Web Services General Reference.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -8123,7 +8123,7 @@ func (c *Lightsail) GetContainerServiceDeploymentsRequest(input *GetContainerSer
 // A set number of deployments are kept before the oldest one is replaced with
 // the newest one. For more information, see Amazon Lightsail endpoints and
 // quotas (https://docs.aws.amazon.com/general/latest/gr/lightsail.html) in
-// the AWS General Reference.
+// the Amazon Web Services General Reference.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -15632,8 +15632,8 @@ func (c *Lightsail) UpdateBucketBundleRequest(input *UpdateBucketBundleInput) (r
 //
 // A bucket bundle specifies the monthly cost, storage space, and data transfer
 // quota for a bucket. You can update a bucket's bundle only one time within
-// a monthly AWS billing cycle. To determine if you can update a bucket's bundle,
-// use the GetBuckets (https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBuckets.html)
+// a monthly Amazon Web Services billing cycle. To determine if you can update
+// a bucket's bundle, use the GetBuckets (https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBuckets.html)
 // action. The ableToUpdateBundle parameter in the response will indicate whether
 // you can currently update a bucket's bundle.
 //
@@ -15951,9 +15951,9 @@ func (c *Lightsail) UpdateDistributionBundleRequest(input *UpdateDistributionBun
 // monthly network transfer quota and is incurring an overage fee.
 //
 // You can update your distribution's bundle only one time within your monthly
-// AWS billing cycle. To determine if you can update your distribution's bundle,
-// use the GetDistributions action. The ableToUpdateBundle parameter in the
-// result will indicate whether you can currently update your distribution's
+// Amazon Web Services billing cycle. To determine if you can update your distribution's
+// bundle, use the GetDistributions action. The ableToUpdateBundle parameter
+// in the result will indicate whether you can currently update your distribution's
 // bundle.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -16744,13 +16744,13 @@ type AccessKeyLastUsed struct {
 	// This value is null if the access key has not been used.
 	LastUsedDate *time.Time `locationName:"lastUsedDate" type:"timestamp"`
 
-	// The AWS Region where this access key was most recently used.
+	// The Amazon Web Services Region where this access key was most recently used.
 	//
 	// This value is N/A if the access key has not been used.
 	Region *string `locationName:"region" type:"string"`
 
-	// The name of the AWS service with which this access key was most recently
-	// used.
+	// The name of the Amazon Web Services service with which this access key was
+	// most recently used.
 	//
 	// This value is N/A if the access key has not been used.
 	ServiceName *string `locationName:"serviceName" type:"string"`
@@ -19244,8 +19244,9 @@ type Certificate struct {
 	//    * ADDITIONAL_VERIFICATION_REQUIRED - Lightsail requires additional information
 	//    to process this certificate request. This can happen as a fraud-protection
 	//    measure, such as when the domain ranks within the Alexa top 1000 websites.
-	//    To provide the required information, use the AWS Support Center (https://console.aws.amazon.com/support/home)
-	//    to contact AWS Support. You cannot request a certificate for Amazon-owned
+	//    To provide the required information, use the Amazon Web Services Support
+	//    Center (https://console.aws.amazon.com/support/home) to contact Amazon
+	//    Web Services Support. You cannot request a certificate for Amazon-owned
 	//    domain names such as those ending in amazonaws.com, cloudfront.net, or
 	//    elasticbeanstalk.com.
 	//
@@ -19260,7 +19261,7 @@ type Certificate struct {
 	//    domain from a block list itself. After you correct the problem and the
 	//    VirusTotal registry has been updated, request a new certificate. If you
 	//    see this error and your domain is not included in the VirusTotal list,
-	//    visit the AWS Support Center (https://console.aws.amazon.com/support/home)
+	//    visit the Amazon Web Services Support Center (https://console.aws.amazon.com/support/home)
 	//    and create a case.
 	//
 	//    * INVALID_PUBLIC_DOMAIN - One or more of the domain names in the certificate
@@ -21880,8 +21881,8 @@ type CreateContainerServiceInput struct {
 	// its default domain. The default domain of a container service is typically
 	// https://<ServiceName>.<RandomGUID>.<AWSRegion>.cs.amazonlightsail.com. If
 	// the name of your container service is container-service-1, and it's located
-	// in the US East (Ohio) AWS region (us-east-2), then the domain for your container
-	// service will be like the following example: https://container-service-1.ur4EXAMPLE2uq.us-east-2.cs.amazonlightsail.com
+	// in the US East (Ohio) Amazon Web Services Region (us-east-2), then the domain
+	// for your container service will be like the following example: https://container-service-1.ur4EXAMPLE2uq.us-east-2.cs.amazonlightsail.com
 	//
 	// The following are the requirements for container service names:
 	//
@@ -24263,7 +24264,7 @@ type CreateRelationalDatabaseInput struct {
 	// The default is a 30-minute window selected at random from an 8-hour block
 	// of time for each AWS Region. For more information about the preferred backup
 	// window time blocks for each region, see the Working With Backups (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow)
-	// guide in the Amazon Relational Database Service (Amazon RDS) documentation.
+	// guide in the Amazon Relational Database Service documentation.
 	//
 	// Constraints:
 	//
@@ -27452,6 +27453,67 @@ func (s *DistributionBundle) SetTransferPerMonthInGb(v int64) *DistributionBundl
 	return s
 }
 
+// Describes the creation state of the canonical name (CNAME) records that are
+// automatically added by Amazon Lightsail to the DNS of a domain to validate
+// domain ownership for an SSL/TLS certificate.
+//
+// When you create an SSL/TLS certificate for a Lightsail resource, you must
+// add a set of CNAME records to the DNS of the domains for the certificate
+// to validate that you own the domains. Lightsail can automatically add the
+// CNAME records to the DNS of the domain if the DNS zone for the domain exists
+// within your Lightsail account. If automatic record addition fails, or if
+// you manage the DNS of your domain using a third-party service, then you must
+// manually add the CNAME records to the DNS of your domain. For more information,
+// see Verify an SSL/TLS certificate in Amazon Lightsail (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/verify-tls-ssl-certificate-using-dns-cname-https)
+// in the Amazon Lightsail Developer Guide.
+type DnsRecordCreationState struct {
+	_ struct{} `type:"structure"`
+
+	// The status code for the automated DNS record creation.
+	//
+	// Following are the possible values:
+	//
+	//    * SUCCEEDED - The validation records were successfully added to the domain.
+	//
+	//    * STARTED - The automatic DNS record creation has started.
+	//
+	//    * FAILED - The validation records failed to be added to the domain.
+	Code *string `locationName:"code" type:"string" enum:"DnsRecordCreationStateCode"`
+
+	// The message that describes the reason for the status code.
+	Message *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DnsRecordCreationState) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s DnsRecordCreationState) GoString() string {
+	return s.String()
+}
+
+// SetCode sets the Code field's value.
+func (s *DnsRecordCreationState) SetCode(v string) *DnsRecordCreationState {
+	s.Code = &v
+	return s
+}
+
+// SetMessage sets the Message field's value.
+func (s *DnsRecordCreationState) SetMessage(v string) *DnsRecordCreationState {
+	s.Message = &v
+	return s
+}
+
 // Describes a domain where you are storing recordsets.
 type Domain struct {
 	_ struct{} `type:"structure"`
@@ -27471,6 +27533,10 @@ type Domain struct {
 	// The name of the domain.
 	Name *string `locationName:"name" type:"string"`
 
+	// An object that describes the state of the Route 53 domain delegation to a
+	// Lightsail DNS zone.
+	RegisteredDomainDelegationInfo *RegisteredDomainDelegationInfo `locationName:"registeredDomainDelegationInfo" type:"structure"`
+
 	// The resource type.
 	ResourceType *string `locationName:"resourceType" type:"string" enum:"ResourceType"`
 
@@ -27532,6 +27598,12 @@ func (s *Domain) SetName(v string) *Domain {
 	return s
 }
 
+// SetRegisteredDomainDelegationInfo sets the RegisteredDomainDelegationInfo field's value.
+func (s *Domain) SetRegisteredDomainDelegationInfo(v *RegisteredDomainDelegationInfo) *Domain {
+	s.RegisteredDomainDelegationInfo = v
+	return s
+}
+
 // SetResourceType sets the ResourceType field's value.
 func (s *Domain) SetResourceType(v string) *Domain {
 	s.ResourceType = &v
@@ -27661,10 +27733,17 @@ func (s *DomainEntry) SetType(v string) *DomainEntry {
 	return s
 }
 
-// Describes the domain validation records of an Amazon Lightsail SSL/TLS certificate.
+// Describes the domain name system (DNS) records that you must add to the DNS
+// of your registered domain to validate ownership for an Amazon Lightsail SSL/TLS
+// certificate.
 type DomainValidationRecord struct {
 	_ struct{} `type:"structure"`
 
+	// An object that describes the state of the canonical name (CNAME) records
+	// that are automatically added by Lightsail to the DNS of the domain to validate
+	// domain ownership.
+	DnsRecordCreationState *DnsRecordCreationState `locationName:"dnsRecordCreationState" type:"structure"`
+
 	// The domain name of the certificate validation record. For example, example.com
 	// or www.example.com.
 	DomainName *string `locationName:"domainName" type:"string"`
@@ -27672,6 +27751,9 @@ type DomainValidationRecord struct {
 	// An object that describes the DNS records to add to your domain's DNS to validate
 	// it for the certificate.
 	ResourceRecord *ResourceRecord `locationName:"resourceRecord" type:"structure"`
+
+	// The validation status of the record.
+	ValidationStatus *string `locationName:"validationStatus" type:"string" enum:"CertificateDomainValidationStatus"`
 }
 
 // String returns the string representation.
@@ -27692,6 +27774,12 @@ func (s DomainValidationRecord) GoString() string {
 	return s.String()
 }
 
+// SetDnsRecordCreationState sets the DnsRecordCreationState field's value.
+func (s *DomainValidationRecord) SetDnsRecordCreationState(v *DnsRecordCreationState) *DomainValidationRecord {
+	s.DnsRecordCreationState = v
+	return s
+}
+
 // SetDomainName sets the DomainName field's value.
 func (s *DomainValidationRecord) SetDomainName(v string) *DomainValidationRecord {
 	s.DomainName = &v
@@ -27704,6 +27792,12 @@ func (s *DomainValidationRecord) SetResourceRecord(v *ResourceRecord) *DomainVal
 	return s
 }
 
+// SetValidationStatus sets the ValidationStatus field's value.
+func (s *DomainValidationRecord) SetValidationStatus(v string) *DomainValidationRecord {
+	s.ValidationStatus = &v
+	return s
+}
+
 type DownloadDefaultKeyPairInput struct {
 	_ struct{} `type:"structure"`
 }
@@ -37021,7 +37115,8 @@ type LoadBalancerTlsCertificate struct {
 	// The load balancer name where your SSL/TLS certificate is attached.
 	LoadBalancerName *string `locationName:"loadBalancerName" type:"string"`
 
-	// The AWS Region and Availability Zone where you created your certificate.
+	// The Amazon Web Services Region and Availability Zone where you created your
+	// certificate.
 	Location *ResourceLocation `locationName:"location" type:"structure"`
 
 	// The name of the SSL/TLS certificate (e.g., my-certificate).
@@ -37265,6 +37360,57 @@ func (s *LoadBalancerTlsCertificate) SetTags(v []*Tag) *LoadBalancerTlsCertifica
 	return s
 }
 
+// An object that describes the state of the canonical name (CNAME) records
+// that are automatically added by Lightsail to the DNS of the domain to validate
+// domain ownership.
+type LoadBalancerTlsCertificateDnsRecordCreationState struct {
+	_ struct{} `type:"structure"`
+
+	// The status code for the automated DNS record creation.
+	//
+	// Following are the possible values:
+	//
+	//    * SUCCEEDED - The validation records were successfully added.
+	//
+	//    * STARTED - The automatic DNS record creation has started.
+	//
+	//    * FAILED - The validation record addition failed.
+	Code *string `locationName:"code" type:"string" enum:"LoadBalancerTlsCertificateDnsRecordCreationStateCode"`
+
+	// The message that describes the reason for the status code.
+	Message *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s LoadBalancerTlsCertificateDnsRecordCreationState) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s LoadBalancerTlsCertificateDnsRecordCreationState) GoString() string {
+	return s.String()
+}
+
+// SetCode sets the Code field's value.
+func (s *LoadBalancerTlsCertificateDnsRecordCreationState) SetCode(v string) *LoadBalancerTlsCertificateDnsRecordCreationState {
+	s.Code = &v
+	return s
+}
+
+// SetMessage sets the Message field's value.
+func (s *LoadBalancerTlsCertificateDnsRecordCreationState) SetMessage(v string) *LoadBalancerTlsCertificateDnsRecordCreationState {
+	s.Message = &v
+	return s
+}
+
 // Contains information about the domain names on an SSL/TLS certificate that
 // you will use to validate domain ownership.
 type LoadBalancerTlsCertificateDomainValidationOption struct {
@@ -37311,6 +37457,11 @@ func (s *LoadBalancerTlsCertificateDomainValidationOption) SetValidationStatus(v
 type LoadBalancerTlsCertificateDomainValidationRecord struct {
 	_ struct{} `type:"structure"`
 
+	// An object that describes the state of the canonical name (CNAME) records
+	// that are automatically added by Lightsail to the DNS of a domain to validate
+	// domain ownership.
+	DnsRecordCreationState *LoadBalancerTlsCertificateDnsRecordCreationState `locationName:"dnsRecordCreationState" type:"structure"`
+
 	// The domain name against which your SSL/TLS certificate was validated.
 	DomainName *string `locationName:"domainName" type:"string"`
 
@@ -37345,6 +37496,12 @@ func (s LoadBalancerTlsCertificateDomainValidationRecord) GoString() string {
 	return s.String()
 }
 
+// SetDnsRecordCreationState sets the DnsRecordCreationState field's value.
+func (s *LoadBalancerTlsCertificateDomainValidationRecord) SetDnsRecordCreationState(v *LoadBalancerTlsCertificateDnsRecordCreationState) *LoadBalancerTlsCertificateDomainValidationRecord {
+	s.DnsRecordCreationState = v
+	return s
+}
+
 // SetDomainName sets the DomainName field's value.
 func (s *LoadBalancerTlsCertificateDomainValidationRecord) SetDomainName(v string) *LoadBalancerTlsCertificateDomainValidationRecord {
 	s.DomainName = &v
@@ -37789,6 +37946,61 @@ func (s *MonthlyTransfer) SetGbPerMonthAllocated(v int64) *MonthlyTransfer {
 	return s
 }
 
+// Describes the state of the name server records update made by Amazon Lightsail
+// to an Amazon Route 53 registered domain.
+//
+// For more information, see DNS in Amazon Lightsail (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/understanding-dns-in-amazon-lightsail)
+// in the Amazon Lightsail Developer Guide.
+type NameServersUpdateState struct {
+	_ struct{} `type:"structure"`
+
+	// The status code for the name servers update.
+	//
+	// Following are the possible values:
+	//
+	//    * SUCCEEDED - The name server records were successfully updated.
+	//
+	//    * PENDING - The name server record update is in progress.
+	//
+	//    * FAILED - The name server record update failed.
+	//
+	//    * STARTED - The automatic name server record update started.
+	Code *string `locationName:"code" type:"string" enum:"NameServersUpdateStateCode"`
+
+	// The message that describes the reason for the status code.
+	Message *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s NameServersUpdateState) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s NameServersUpdateState) GoString() string {
+	return s.String()
+}
+
+// SetCode sets the Code field's value.
+func (s *NameServersUpdateState) SetCode(v string) *NameServersUpdateState {
+	s.Code = &v
+	return s
+}
+
+// SetMessage sets the Message field's value.
+func (s *NameServersUpdateState) SetMessage(v string) *NameServersUpdateState {
+	s.Message = &v
+	return s
+}
+
 // Lightsail throws this exception when it cannot find a resource.
 type NotFoundException struct {
 	_            struct{}                  `type:"structure"`
@@ -39133,6 +39345,58 @@ func (s *QueryStringObject) SetQueryStringsAllowList(v []*string) *QueryStringOb
 	return s
 }
 
+// Describes the deletion state of an Amazon Route 53 hosted zone for a domain
+// that is being automatically delegated to an Amazon Lightsail DNS zone.
+type R53HostedZoneDeletionState struct {
+	_ struct{} `type:"structure"`
+
+	// The status code for the deletion state.
+	//
+	// Following are the possible values:
+	//
+	//    * SUCCEEDED - The hosted zone was successfully deleted.
+	//
+	//    * PENDING - The hosted zone deletion is in progress.
+	//
+	//    * FAILED - The hosted zone deletion failed.
+	//
+	//    * STARTED - The hosted zone deletion started.
+	Code *string `locationName:"code" type:"string" enum:"R53HostedZoneDeletionStateCode"`
+
+	// The message that describes the reason for the status code.
+	Message *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s R53HostedZoneDeletionState) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s R53HostedZoneDeletionState) GoString() string {
+	return s.String()
+}
+
+// SetCode sets the Code field's value.
+func (s *R53HostedZoneDeletionState) SetCode(v string) *R53HostedZoneDeletionState {
+	s.Code = &v
+	return s
+}
+
+// SetMessage sets the Message field's value.
+func (s *R53HostedZoneDeletionState) SetMessage(v string) *R53HostedZoneDeletionState {
+	s.Message = &v
+	return s
+}
+
 type RebootInstanceInput struct {
 	_ struct{} `type:"structure"`
 
@@ -39291,7 +39555,7 @@ func (s *RebootRelationalDatabaseOutput) SetOperations(v []*Operation) *RebootRe
 	return s
 }
 
-// Describes the AWS Region.
+// Describes the Amazon Web Services Region.
 type Region struct {
 	_ struct{} `type:"structure"`
 
@@ -39301,8 +39565,8 @@ type Region struct {
 	// The continent code (e.g., NA, meaning North America).
 	ContinentCode *string `locationName:"continentCode" type:"string"`
 
-	// The description of the AWS Region (e.g., This region is recommended to serve
-	// users in the eastern United States and eastern Canada).
+	// The description of the Amazon Web Services Region (e.g., This region is recommended
+	// to serve users in the eastern United States and eastern Canada).
 	Description *string `locationName:"description" type:"string"`
 
 	// The display name (e.g., Ohio).
@@ -39501,6 +39765,76 @@ func (s *RegisterContainerImageOutput) SetContainerImage(v *ContainerImage) *Reg
 	return s
 }
 
+// Describes the delegation state of an Amazon Route 53 registered domain to
+// Amazon Lightsail.
+//
+// When you delegate an Amazon Route 53 registered domain to Lightsail, you
+// can manage the DNS of the domain using a Lightsail DNS zone. You no longer
+// use the Route 53 hosted zone to manage the DNS of the domain. To delegate
+// the domain, Lightsail automatically updates the domain's name servers in
+// Route 53 to the name servers of the Lightsail DNS zone. Then, Lightsail automatically
+// deletes the Route 53 hosted zone for the domain.
+//
+// All of the following conditions must be true for automatic domain delegation
+// to be successful:
+//
+//   - The registered domain must be in the same Amazon Web Services account
+//     as the Lightsail account making the request.
+//
+//   - The user or entity making the request must have permission to manage
+//     domains in Route 53.
+//
+//   - The Route 53 hosted zone for the domain must be empty. It cannot contain
+//     DNS records other than start of authority (SOA) and name server records.
+//
+// If automatic domain delegation fails, or if you manage the DNS of your domain
+// using a service other than Route 53, then you must manually add the Lightsail
+// DNS zone name servers to your domain in order to delegate management of its
+// DNS to Lightsail. For more information, see Creating a DNS zone to manage
+// your domain’s records in Amazon Lightsail (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-create-dns-entry)
+// in the Amazon Lightsail Developer Guide.
+type RegisteredDomainDelegationInfo struct {
+	_ struct{} `type:"structure"`
+
+	// An object that describes the state of the name server records that are automatically
+	// added to the Route 53 domain by Lightsail.
+	NameServersUpdateState *NameServersUpdateState `locationName:"nameServersUpdateState" type:"structure"`
+
+	// Describes the deletion state of an Amazon Route 53 hosted zone for a domain
+	// that is being automatically delegated to an Amazon Lightsail DNS zone.
+	R53HostedZoneDeletionState *R53HostedZoneDeletionState `locationName:"r53HostedZoneDeletionState" type:"structure"`
+}
+
+// String returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s RegisteredDomainDelegationInfo) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation.
+//
+// API parameter values that are decorated as "sensitive" in the API will not
+// be included in the string output. The member name will be present, but the
+// value will be replaced with "sensitive".
+func (s RegisteredDomainDelegationInfo) GoString() string {
+	return s.String()
+}
+
+// SetNameServersUpdateState sets the NameServersUpdateState field's value.
+func (s *RegisteredDomainDelegationInfo) SetNameServersUpdateState(v *NameServersUpdateState) *RegisteredDomainDelegationInfo {
+	s.NameServersUpdateState = v
+	return s
+}
+
+// SetR53HostedZoneDeletionState sets the R53HostedZoneDeletionState field's value.
+func (s *RegisteredDomainDelegationInfo) SetR53HostedZoneDeletionState(v *R53HostedZoneDeletionState) *RegisteredDomainDelegationInfo {
+	s.R53HostedZoneDeletionState = v
+	return s
+}
+
 // Describes a database.
 type RelationalDatabase struct {
 	_ struct{} `type:"structure"`
@@ -40616,7 +40950,7 @@ type ResourceLocation struct {
 	// The Availability Zone. Follows the format us-east-2a (case-sensitive).
 	AvailabilityZone *string `locationName:"availabilityZone" type:"string"`
 
-	// The AWS Region name.
+	// The Amazon Web Services Region name.
 	RegionName *string `locationName:"regionName" type:"string" enum:"RegionName"`
 }
 
@@ -43094,7 +43428,8 @@ type UpdateRelationalDatabaseInput struct {
 	// The weekly time range during which system maintenance can occur on your database.
 	//
 	// The default is a 30-minute window selected at random from an 8-hour block
-	// of time for each AWS Region, occurring on a random day of the week.
+	// of time for each Amazon Web Services Region, occurring on a random day of
+	// the week.
 	//
 	// Constraints:
 	//
@@ -43529,6 +43864,26 @@ func BucketMetricName_Values() []string {
 	}
 }
 
+const (
+	// CertificateDomainValidationStatusPendingValidation is a CertificateDomainValidationStatus enum value
+	CertificateDomainValidationStatusPendingValidation = "PENDING_VALIDATION"
+
+	// CertificateDomainValidationStatusFailed is a CertificateDomainValidationStatus enum value
+	CertificateDomainValidationStatusFailed = "FAILED"
+
+	// CertificateDomainValidationStatusSuccess is a CertificateDomainValidationStatus enum value
+	CertificateDomainValidationStatusSuccess = "SUCCESS"
+)
+
+// CertificateDomainValidationStatus_Values returns all elements of the CertificateDomainValidationStatus enum
+func CertificateDomainValidationStatus_Values() []string {
+	return []string{
+		CertificateDomainValidationStatusPendingValidation,
+		CertificateDomainValidationStatusFailed,
+		CertificateDomainValidationStatusSuccess,
+	}
+}
+
 const (
 	// CertificateStatusPendingValidation is a CertificateStatus enum value
 	CertificateStatusPendingValidation = "PENDING_VALIDATION"
@@ -43909,6 +44264,26 @@ func DistributionMetricName_Values() []string {
 	}
 }
 
+const (
+	// DnsRecordCreationStateCodeSucceeded is a DnsRecordCreationStateCode enum value
+	DnsRecordCreationStateCodeSucceeded = "SUCCEEDED"
+
+	// DnsRecordCreationStateCodeStarted is a DnsRecordCreationStateCode enum value
+	DnsRecordCreationStateCodeStarted = "STARTED"
+
+	// DnsRecordCreationStateCodeFailed is a DnsRecordCreationStateCode enum value
+	DnsRecordCreationStateCodeFailed = "FAILED"
+)
+
+// DnsRecordCreationStateCode_Values returns all elements of the DnsRecordCreationStateCode enum
+func DnsRecordCreationStateCode_Values() []string {
+	return []string{
+		DnsRecordCreationStateCodeSucceeded,
+		DnsRecordCreationStateCodeStarted,
+		DnsRecordCreationStateCodeFailed,
+	}
+}
+
 const (
 	// ExportSnapshotRecordSourceTypeInstanceSnapshot is a ExportSnapshotRecordSourceType enum value
 	ExportSnapshotRecordSourceTypeInstanceSnapshot = "InstanceSnapshot"
@@ -44401,6 +44776,26 @@ func LoadBalancerState_Values() []string {
 	}
 }
 
+const (
+	// LoadBalancerTlsCertificateDnsRecordCreationStateCodeSucceeded is a LoadBalancerTlsCertificateDnsRecordCreationStateCode enum value
+	LoadBalancerTlsCertificateDnsRecordCreationStateCodeSucceeded = "SUCCEEDED"
+
+	// LoadBalancerTlsCertificateDnsRecordCreationStateCodeStarted is a LoadBalancerTlsCertificateDnsRecordCreationStateCode enum value
+	LoadBalancerTlsCertificateDnsRecordCreationStateCodeStarted = "STARTED"
+
+	// LoadBalancerTlsCertificateDnsRecordCreationStateCodeFailed is a LoadBalancerTlsCertificateDnsRecordCreationStateCode enum value
+	LoadBalancerTlsCertificateDnsRecordCreationStateCodeFailed = "FAILED"
+)
+
+// LoadBalancerTlsCertificateDnsRecordCreationStateCode_Values returns all elements of the LoadBalancerTlsCertificateDnsRecordCreationStateCode enum
+func LoadBalancerTlsCertificateDnsRecordCreationStateCode_Values() []string {
+	return []string{
+		LoadBalancerTlsCertificateDnsRecordCreationStateCodeSucceeded,
+		LoadBalancerTlsCertificateDnsRecordCreationStateCodeStarted,
+		LoadBalancerTlsCertificateDnsRecordCreationStateCodeFailed,
+	}
+}
+
 const (
 	// LoadBalancerTlsCertificateDomainStatusPendingValidation is a LoadBalancerTlsCertificateDomainStatus enum value
 	LoadBalancerTlsCertificateDomainStatusPendingValidation = "PENDING_VALIDATION"
@@ -44813,6 +45208,30 @@ func MetricUnit_Values() []string {
 	}
 }
 
+const (
+	// NameServersUpdateStateCodeSucceeded is a NameServersUpdateStateCode enum value
+	NameServersUpdateStateCodeSucceeded = "SUCCEEDED"
+
+	// NameServersUpdateStateCodePending is a NameServersUpdateStateCode enum value
+	NameServersUpdateStateCodePending = "PENDING"
+
+	// NameServersUpdateStateCodeFailed is a NameServersUpdateStateCode enum value
+	NameServersUpdateStateCodeFailed = "FAILED"
+
+	// NameServersUpdateStateCodeStarted is a NameServersUpdateStateCode enum value
+	NameServersUpdateStateCodeStarted = "STARTED"
+)
+
+// NameServersUpdateStateCode_Values returns all elements of the NameServersUpdateStateCode enum
+func NameServersUpdateStateCode_Values() []string {
+	return []string{
+		NameServersUpdateStateCodeSucceeded,
+		NameServersUpdateStateCodePending,
+		NameServersUpdateStateCodeFailed,
+		NameServersUpdateStateCodeStarted,
+	}
+}
+
 const (
 	// NetworkProtocolTcp is a NetworkProtocol enum value
 	NetworkProtocolTcp = "tcp"
@@ -45265,6 +45684,30 @@ func PortState_Values() []string {
 	}
 }
 
+const (
+	// R53HostedZoneDeletionStateCodeSucceeded is a R53HostedZoneDeletionStateCode enum value
+	R53HostedZoneDeletionStateCodeSucceeded = "SUCCEEDED"
+
+	// R53HostedZoneDeletionStateCodePending is a R53HostedZoneDeletionStateCode enum value
+	R53HostedZoneDeletionStateCodePending = "PENDING"
+
+	// R53HostedZoneDeletionStateCodeFailed is a R53HostedZoneDeletionStateCode enum value
+	R53HostedZoneDeletionStateCodeFailed = "FAILED"
+
+	// R53HostedZoneDeletionStateCodeStarted is a R53HostedZoneDeletionStateCode enum value
+	R53HostedZoneDeletionStateCodeStarted = "STARTED"
+)
+
+// R53HostedZoneDeletionStateCode_Values returns all elements of the R53HostedZoneDeletionStateCode enum
+func R53HostedZoneDeletionStateCode_Values() []string {
+	return []string{
+		R53HostedZoneDeletionStateCodeSucceeded,
+		R53HostedZoneDeletionStateCodePending,
+		R53HostedZoneDeletionStateCodeFailed,
+		R53HostedZoneDeletionStateCodeStarted,
+	}
+}
+
 const (
 	// RecordStateStarted is a RecordState enum value
 	RecordStateStarted = "Started"
diff --git a/vendor/github.com/aws/aws-sdk-go/service/lightsail/doc.go b/vendor/github.com/aws/aws-sdk-go/service/lightsail/doc.go
index 11038df73d8f..046ecddbb576 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/lightsail/doc.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/lightsail/doc.go
@@ -12,9 +12,8 @@
 // snapshots (backups) - for a low, predictable monthly price.
 //
 // You can manage your Lightsail resources using the Lightsail console, Lightsail
-// API, AWS Command Line Interface (AWS CLI), or SDKs. For more information
-// about Lightsail concepts and tasks, see the Amazon Lightsail Developer Guide
-// (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-set-up-access-keys-to-use-sdk-api-cli).
+// API, Command Line Interface (CLI), or SDKs. For more information about Lightsail
+// concepts and tasks, see the Amazon Lightsail Developer Guide (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-set-up-access-keys-to-use-sdk-api-cli).
 //
 // This API Reference provides detailed information about the actions, data
 // types, parameters, and errors of the Lightsail service. For more information
diff --git a/vendor/github.com/aws/aws-sdk-go/service/sts/api.go b/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
index 2b7e675ab864..c0706bec93dd 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
@@ -74,16 +74,16 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 //
 // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
-// inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plaintext that you use for both inline
-// and managed session policies can't exceed 2,048 characters. Passing policies
-// to this operation returns new temporary credentials. The resulting session's
-// permissions are the intersection of the role's identity-based policy and
-// the session policies. You can use the role's temporary credentials in subsequent
-// Amazon Web Services API calls to access resources in the account that owns
-// the role. You cannot use session policies to grant more permissions than
-// those allowed by the identity-based policy of the role that is being assumed.
-// For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
+// inline session policy. You can also specify up to 10 managed policy Amazon
+// Resource Names (ARNs) to use as managed session policies. The plaintext that
+// you use for both inline and managed session policies can't exceed 2,048 characters.
+// Passing policies to this operation returns new temporary credentials. The
+// resulting session's permissions are the intersection of the role's identity-based
+// policy and the session policies. You can use the role's temporary credentials
+// in subsequent Amazon Web Services API calls to access resources in the account
+// that owns the role. You cannot use session policies to grant more permissions
+// than those allowed by the identity-based policy of the role that is being
+// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // in the IAM User Guide.
 //
 // When you create a role, you create two policies: A role trust policy that
@@ -307,16 +307,16 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 //
 // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
-// inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plaintext that you use for both inline
-// and managed session policies can't exceed 2,048 characters. Passing policies
-// to this operation returns new temporary credentials. The resulting session's
-// permissions are the intersection of the role's identity-based policy and
-// the session policies. You can use the role's temporary credentials in subsequent
-// Amazon Web Services API calls to access resources in the account that owns
-// the role. You cannot use session policies to grant more permissions than
-// those allowed by the identity-based policy of the role that is being assumed.
-// For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
+// inline session policy. You can also specify up to 10 managed policy Amazon
+// Resource Names (ARNs) to use as managed session policies. The plaintext that
+// you use for both inline and managed session policies can't exceed 2,048 characters.
+// Passing policies to this operation returns new temporary credentials. The
+// resulting session's permissions are the intersection of the role's identity-based
+// policy and the session policies. You can use the role's temporary credentials
+// in subsequent Amazon Web Services API calls to access resources in the account
+// that owns the role. You cannot use session policies to grant more permissions
+// than those allowed by the identity-based policy of the role that is being
+// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // in the IAM User Guide.
 //
 // Calling AssumeRoleWithSAML does not require the use of Amazon Web Services
@@ -343,11 +343,12 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 // in the IAM User Guide.
 //
-// An Amazon Web Services conversion compresses the passed session policies
-// and session tags into a packed binary format that has a separate limit. Your
-// request can fail for this limit even if your plaintext meets the other requirements.
-// The PackedPolicySize response element indicates by percentage how close the
-// policies and tags for your request are to the upper size limit.
+// An Amazon Web Services conversion compresses the passed inline session policy,
+// managed policy ARNs, and session tags into a packed binary format that has
+// a separate limit. Your request can fail for this limit even if your plaintext
+// meets the other requirements. The PackedPolicySize response element indicates
+// by percentage how close the policies and tags for your request are to the
+// upper size limit.
 //
 // You can pass a session tag with the same key as a tag that is attached to
 // the role. When you do, session tags override the role's tags with the same
@@ -563,16 +564,16 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 //
 // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
-// inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plaintext that you use for both inline
-// and managed session policies can't exceed 2,048 characters. Passing policies
-// to this operation returns new temporary credentials. The resulting session's
-// permissions are the intersection of the role's identity-based policy and
-// the session policies. You can use the role's temporary credentials in subsequent
-// Amazon Web Services API calls to access resources in the account that owns
-// the role. You cannot use session policies to grant more permissions than
-// those allowed by the identity-based policy of the role that is being assumed.
-// For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
+// inline session policy. You can also specify up to 10 managed policy Amazon
+// Resource Names (ARNs) to use as managed session policies. The plaintext that
+// you use for both inline and managed session policies can't exceed 2,048 characters.
+// Passing policies to this operation returns new temporary credentials. The
+// resulting session's permissions are the intersection of the role's identity-based
+// policy and the session policies. You can use the role's temporary credentials
+// in subsequent Amazon Web Services API calls to access resources in the account
+// that owns the role. You cannot use session policies to grant more permissions
+// than those allowed by the identity-based policy of the role that is being
+// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // in the IAM User Guide.
 //
 // # Tags
@@ -588,11 +589,12 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 // in the IAM User Guide.
 //
-// An Amazon Web Services conversion compresses the passed session policies
-// and session tags into a packed binary format that has a separate limit. Your
-// request can fail for this limit even if your plaintext meets the other requirements.
-// The PackedPolicySize response element indicates by percentage how close the
-// policies and tags for your request are to the upper size limit.
+// An Amazon Web Services conversion compresses the passed inline session policy,
+// managed policy ARNs, and session tags into a packed binary format that has
+// a separate limit. Your request can fail for this limit even if your plaintext
+// meets the other requirements. The PackedPolicySize response element indicates
+// by percentage how close the policies and tags for your request are to the
+// upper size limit.
 //
 // You can pass a session tag with the same key as a tag that is attached to
 // the role. When you do, the session tag overrides the role tag with the same
@@ -1110,9 +1112,9 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
 //
 // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
-// inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plaintext that you use for both inline
-// and managed session policies can't exceed 2,048 characters.
+// inline session policy. You can also specify up to 10 managed policy Amazon
+// Resource Names (ARNs) to use as managed session policies. The plaintext that
+// you use for both inline and managed session policies can't exceed 2,048 characters.
 //
 // Though the session policy parameters are optional, if you do not pass a policy,
 // then the resulting federated user session has no permissions. When you pass
@@ -1424,11 +1426,12 @@ type AssumeRoleInput struct {
 	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
 	// return (\u000D) characters.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -1441,11 +1444,12 @@ type AssumeRoleInput struct {
 	// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the Amazon Web Services General Reference.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -1520,11 +1524,12 @@ type AssumeRoleInput struct {
 	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 	// in the IAM User Guide.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	//
 	// You can pass a session tag with the same key as a tag that is already attached
 	// to the role. When you do, session tags override a role tag with the same
@@ -1843,11 +1848,12 @@ type AssumeRoleWithSAMLInput struct {
 	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
 	// return (\u000D) characters.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -1860,11 +1866,12 @@ type AssumeRoleWithSAMLInput struct {
 	// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the Amazon Web Services General Reference.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -2190,11 +2197,12 @@ type AssumeRoleWithWebIdentityInput struct {
 	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
 	// return (\u000D) characters.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -2207,11 +2215,12 @@ type AssumeRoleWithWebIdentityInput struct {
 	// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the Amazon Web Services General Reference.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -2934,8 +2943,8 @@ type GetFederationTokenInput struct {
 	//
 	// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// to this operation. You can pass a single JSON policy document to use as an
-	// inline session policy. You can also specify up to 10 managed policies to
-	// use as managed session policies.
+	// inline session policy. You can also specify up to 10 managed policy Amazon
+	// Resource Names (ARNs) to use as managed session policies.
 	//
 	// This parameter is optional. However, if you do not pass any session policies,
 	// then the resulting federated user session has no permissions.
@@ -2960,11 +2969,12 @@ type GetFederationTokenInput struct {
 	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
 	// return (\u000D) characters.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -2973,11 +2983,12 @@ type GetFederationTokenInput struct {
 	//
 	// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// to this operation. You can pass a single JSON policy document to use as an
-	// inline session policy. You can also specify up to 10 managed policies to
-	// use as managed session policies. The plaintext that you use for both inline
-	// and managed session policies can't exceed 2,048 characters. You can provide
-	// up to 10 managed policy ARNs. For more information about ARNs, see Amazon
-	// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// inline session policy. You can also specify up to 10 managed policy Amazon
+	// Resource Names (ARNs) to use as managed session policies. The plaintext that
+	// you use for both inline and managed session policies can't exceed 2,048 characters.
+	// You can provide up to 10 managed policy ARNs. For more information about
+	// ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces
+	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the Amazon Web Services General Reference.
 	//
 	// This parameter is optional. However, if you do not pass any session policies,
@@ -2997,11 +3008,12 @@ type GetFederationTokenInput struct {
 	// by the policy. These permissions are granted in addition to the permissions
 	// that are granted by the session policies.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	PolicyArns []*PolicyDescriptorType `type:"list"`
 
 	// A list of session tags. Each session tag consists of a key name and an associated
@@ -3015,11 +3027,12 @@ type GetFederationTokenInput struct {
 	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 	// in the IAM User Guide.
 	//
-	// An Amazon Web Services conversion compresses the passed session policies
-	// and session tags into a packed binary format that has a separate limit. Your
-	// request can fail for this limit even if your plaintext meets the other requirements.
-	// The PackedPolicySize response element indicates by percentage how close the
-	// policies and tags for your request are to the upper size limit.
+	// An Amazon Web Services conversion compresses the passed inline session policy,
+	// managed policy ARNs, and session tags into a packed binary format that has
+	// a separate limit. Your request can fail for this limit even if your plaintext
+	// meets the other requirements. The PackedPolicySize response element indicates
+	// by percentage how close the policies and tags for your request are to the
+	// upper size limit.
 	//
 	// You can pass a session tag with the same key as a tag that is already attached
 	// to the user you are federating. When you do, session tags override a user
diff --git a/vendor/github.com/cespare/xxhash/v2/README.md b/vendor/github.com/cespare/xxhash/v2/README.md
index 792b4a60b346..8bf0e5b78153 100644
--- a/vendor/github.com/cespare/xxhash/v2/README.md
+++ b/vendor/github.com/cespare/xxhash/v2/README.md
@@ -3,8 +3,7 @@
 [![Go Reference](https://pkg.go.dev/badge/github.com/cespare/xxhash/v2.svg)](https://pkg.go.dev/github.com/cespare/xxhash/v2)
 [![Test](https://github.com/cespare/xxhash/actions/workflows/test.yml/badge.svg)](https://github.com/cespare/xxhash/actions/workflows/test.yml)
 
-xxhash is a Go implementation of the 64-bit
-[xxHash](http://cyan4973.github.io/xxHash/) algorithm, XXH64. This is a
+xxhash is a Go implementation of the 64-bit [xxHash] algorithm, XXH64. This is a
 high-quality hashing algorithm that is much faster than anything in the Go
 standard library.
 
@@ -25,8 +24,11 @@ func (*Digest) WriteString(string) (int, error)
 func (*Digest) Sum64() uint64
 ```
 
-This implementation provides a fast pure-Go implementation and an even faster
-assembly implementation for amd64.
+The package is written with optimized pure Go and also contains even faster
+assembly implementations for amd64 and arm64. If desired, the `purego` build tag
+opts into using the Go code even on those architectures.
+
+[xxHash]: http://cyan4973.github.io/xxHash/
 
 ## Compatibility
 
@@ -45,19 +47,20 @@ I recommend using the latest release of Go.
 Here are some quick benchmarks comparing the pure-Go and assembly
 implementations of Sum64.
 
-| input size | purego | asm |
-| --- | --- | --- |
-| 5 B   |  979.66 MB/s |  1291.17 MB/s  |
-| 100 B | 7475.26 MB/s | 7973.40 MB/s  |
-| 4 KB  | 17573.46 MB/s | 17602.65 MB/s |
-| 10 MB | 17131.46 MB/s | 17142.16 MB/s |
+| input size | purego    | asm       |
+| ---------- | --------- | --------- |
+| 4 B        |  1.3 GB/s |  1.2 GB/s |
+| 16 B       |  2.9 GB/s |  3.5 GB/s |
+| 100 B      |  6.9 GB/s |  8.1 GB/s |
+| 4 KB       | 11.7 GB/s | 16.7 GB/s |
+| 10 MB      | 12.0 GB/s | 17.3 GB/s |
 
-These numbers were generated on Ubuntu 18.04 with an Intel i7-8700K CPU using
-the following commands under Go 1.11.2:
+These numbers were generated on Ubuntu 20.04 with an Intel Xeon Platinum 8252C
+CPU using the following commands under Go 1.19.2:
 
 ```
-$ go test -tags purego -benchtime 10s -bench '/xxhash,direct,bytes'
-$ go test -benchtime 10s -bench '/xxhash,direct,bytes'
+benchstat <(go test -tags purego -benchtime 500ms -count 15 -bench 'Sum64$')
+benchstat <(go test -benchtime 500ms -count 15 -bench 'Sum64$')
 ```
 
 ## Projects using this package
diff --git a/vendor/github.com/cespare/xxhash/v2/testall.sh b/vendor/github.com/cespare/xxhash/v2/testall.sh
new file mode 100644
index 000000000000..94b9c443987c
--- /dev/null
+++ b/vendor/github.com/cespare/xxhash/v2/testall.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eu -o pipefail
+
+# Small convenience script for running the tests with various combinations of
+# arch/tags. This assumes we're running on amd64 and have qemu available.
+
+go test ./...
+go test -tags purego ./...
+GOARCH=arm64 go test
+GOARCH=arm64 go test -tags purego
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash.go b/vendor/github.com/cespare/xxhash/v2/xxhash.go
index 15c835d5417c..a9e0d45c9dcc 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash.go
@@ -16,19 +16,11 @@ const (
 	prime5 uint64 = 2870177450012600261
 )
 
-// NOTE(caleb): I'm using both consts and vars of the primes. Using consts where
-// possible in the Go code is worth a small (but measurable) performance boost
-// by avoiding some MOVQs. Vars are needed for the asm and also are useful for
-// convenience in the Go code in a few places where we need to intentionally
-// avoid constant arithmetic (e.g., v1 := prime1 + prime2 fails because the
-// result overflows a uint64).
-var (
-	prime1v = prime1
-	prime2v = prime2
-	prime3v = prime3
-	prime4v = prime4
-	prime5v = prime5
-)
+// Store the primes in an array as well.
+//
+// The consts are used when possible in Go code to avoid MOVs but we need a
+// contiguous array of the assembly code.
+var primes = [...]uint64{prime1, prime2, prime3, prime4, prime5}
 
 // Digest implements hash.Hash64.
 type Digest struct {
@@ -50,10 +42,10 @@ func New() *Digest {
 
 // Reset clears the Digest's state so that it can be reused.
 func (d *Digest) Reset() {
-	d.v1 = prime1v + prime2
+	d.v1 = primes[0] + prime2
 	d.v2 = prime2
 	d.v3 = 0
-	d.v4 = -prime1v
+	d.v4 = -primes[0]
 	d.total = 0
 	d.n = 0
 }
@@ -69,21 +61,23 @@ func (d *Digest) Write(b []byte) (n int, err error) {
 	n = len(b)
 	d.total += uint64(n)
 
+	memleft := d.mem[d.n&(len(d.mem)-1):]
+
 	if d.n+n < 32 {
 		// This new data doesn't even fill the current block.
-		copy(d.mem[d.n:], b)
+		copy(memleft, b)
 		d.n += n
 		return
 	}
 
 	if d.n > 0 {
 		// Finish off the partial block.
-		copy(d.mem[d.n:], b)
+		c := copy(memleft, b)
 		d.v1 = round(d.v1, u64(d.mem[0:8]))
 		d.v2 = round(d.v2, u64(d.mem[8:16]))
 		d.v3 = round(d.v3, u64(d.mem[16:24]))
 		d.v4 = round(d.v4, u64(d.mem[24:32]))
-		b = b[32-d.n:]
+		b = b[c:]
 		d.n = 0
 	}
 
@@ -133,21 +127,20 @@ func (d *Digest) Sum64() uint64 {
 
 	h += d.total
 
-	i, end := 0, d.n
-	for ; i+8 <= end; i += 8 {
-		k1 := round(0, u64(d.mem[i:i+8]))
+	b := d.mem[:d.n&(len(d.mem)-1)]
+	for ; len(b) >= 8; b = b[8:] {
+		k1 := round(0, u64(b[:8]))
 		h ^= k1
 		h = rol27(h)*prime1 + prime4
 	}
-	if i+4 <= end {
-		h ^= uint64(u32(d.mem[i:i+4])) * prime1
+	if len(b) >= 4 {
+		h ^= uint64(u32(b[:4])) * prime1
 		h = rol23(h)*prime2 + prime3
-		i += 4
+		b = b[4:]
 	}
-	for i < end {
-		h ^= uint64(d.mem[i]) * prime5
+	for ; len(b) > 0; b = b[1:] {
+		h ^= uint64(b[0]) * prime5
 		h = rol11(h) * prime1
-		i++
 	}
 
 	h ^= h >> 33
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s b/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s
index be8db5bf7960..3e8b132579ec 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s
@@ -1,215 +1,209 @@
+//go:build !appengine && gc && !purego
 // +build !appengine
 // +build gc
 // +build !purego
 
 #include "textflag.h"
 
-// Register allocation:
-// AX	h
-// SI	pointer to advance through b
-// DX	n
-// BX	loop end
-// R8	v1, k1
-// R9	v2
-// R10	v3
-// R11	v4
-// R12	tmp
-// R13	prime1v
-// R14	prime2v
-// DI	prime4v
-
-// round reads from and advances the buffer pointer in SI.
-// It assumes that R13 has prime1v and R14 has prime2v.
-#define round(r) \
-	MOVQ  (SI), R12 \
-	ADDQ  $8, SI    \
-	IMULQ R14, R12  \
-	ADDQ  R12, r    \
-	ROLQ  $31, r    \
-	IMULQ R13, r
-
-// mergeRound applies a merge round on the two registers acc and val.
-// It assumes that R13 has prime1v, R14 has prime2v, and DI has prime4v.
-#define mergeRound(acc, val) \
-	IMULQ R14, val \
-	ROLQ  $31, val \
-	IMULQ R13, val \
-	XORQ  val, acc \
-	IMULQ R13, acc \
-	ADDQ  DI, acc
+// Registers:
+#define h      AX
+#define d      AX
+#define p      SI // pointer to advance through b
+#define n      DX
+#define end    BX // loop end
+#define v1     R8
+#define v2     R9
+#define v3     R10
+#define v4     R11
+#define x      R12
+#define prime1 R13
+#define prime2 R14
+#define prime4 DI
+
+#define round(acc, x) \
+	IMULQ prime2, x   \
+	ADDQ  x, acc      \
+	ROLQ  $31, acc    \
+	IMULQ prime1, acc
+
+// round0 performs the operation x = round(0, x).
+#define round0(x) \
+	IMULQ prime2, x \
+	ROLQ  $31, x    \
+	IMULQ prime1, x
+
+// mergeRound applies a merge round on the two registers acc and x.
+// It assumes that prime1, prime2, and prime4 have been loaded.
+#define mergeRound(acc, x) \
+	round0(x)         \
+	XORQ  x, acc      \
+	IMULQ prime1, acc \
+	ADDQ  prime4, acc
+
+// blockLoop processes as many 32-byte blocks as possible,
+// updating v1, v2, v3, and v4. It assumes that there is at least one block
+// to process.
+#define blockLoop() \
+loop:  \
+	MOVQ +0(p), x  \
+	round(v1, x)   \
+	MOVQ +8(p), x  \
+	round(v2, x)   \
+	MOVQ +16(p), x \
+	round(v3, x)   \
+	MOVQ +24(p), x \
+	round(v4, x)   \
+	ADDQ $32, p    \
+	CMPQ p, end    \
+	JLE  loop
 
 // func Sum64(b []byte) uint64
-TEXT ·Sum64(SB), NOSPLIT, $0-32
+TEXT ·Sum64(SB), NOSPLIT|NOFRAME, $0-32
 	// Load fixed primes.
-	MOVQ ·prime1v(SB), R13
-	MOVQ ·prime2v(SB), R14
-	MOVQ ·prime4v(SB), DI
+	MOVQ ·primes+0(SB), prime1
+	MOVQ ·primes+8(SB), prime2
+	MOVQ ·primes+24(SB), prime4
 
 	// Load slice.
-	MOVQ b_base+0(FP), SI
-	MOVQ b_len+8(FP), DX
-	LEAQ (SI)(DX*1), BX
+	MOVQ b_base+0(FP), p
+	MOVQ b_len+8(FP), n
+	LEAQ (p)(n*1), end
 
 	// The first loop limit will be len(b)-32.
-	SUBQ $32, BX
+	SUBQ $32, end
 
 	// Check whether we have at least one block.
-	CMPQ DX, $32
+	CMPQ n, $32
 	JLT  noBlocks
 
 	// Set up initial state (v1, v2, v3, v4).
-	MOVQ R13, R8
-	ADDQ R14, R8
-	MOVQ R14, R9
-	XORQ R10, R10
-	XORQ R11, R11
-	SUBQ R13, R11
-
-	// Loop until SI > BX.
-blockLoop:
-	round(R8)
-	round(R9)
-	round(R10)
-	round(R11)
-
-	CMPQ SI, BX
-	JLE  blockLoop
-
-	MOVQ R8, AX
-	ROLQ $1, AX
-	MOVQ R9, R12
-	ROLQ $7, R12
-	ADDQ R12, AX
-	MOVQ R10, R12
-	ROLQ $12, R12
-	ADDQ R12, AX
-	MOVQ R11, R12
-	ROLQ $18, R12
-	ADDQ R12, AX
-
-	mergeRound(AX, R8)
-	mergeRound(AX, R9)
-	mergeRound(AX, R10)
-	mergeRound(AX, R11)
+	MOVQ prime1, v1
+	ADDQ prime2, v1
+	MOVQ prime2, v2
+	XORQ v3, v3
+	XORQ v4, v4
+	SUBQ prime1, v4
+
+	blockLoop()
+
+	MOVQ v1, h
+	ROLQ $1, h
+	MOVQ v2, x
+	ROLQ $7, x
+	ADDQ x, h
+	MOVQ v3, x
+	ROLQ $12, x
+	ADDQ x, h
+	MOVQ v4, x
+	ROLQ $18, x
+	ADDQ x, h
+
+	mergeRound(h, v1)
+	mergeRound(h, v2)
+	mergeRound(h, v3)
+	mergeRound(h, v4)
 
 	JMP afterBlocks
 
 noBlocks:
-	MOVQ ·prime5v(SB), AX
+	MOVQ ·primes+32(SB), h
 
 afterBlocks:
-	ADDQ DX, AX
-
-	// Right now BX has len(b)-32, and we want to loop until SI > len(b)-8.
-	ADDQ $24, BX
-
-	CMPQ SI, BX
-	JG   fourByte
-
-wordLoop:
-	// Calculate k1.
-	MOVQ  (SI), R8
-	ADDQ  $8, SI
-	IMULQ R14, R8
-	ROLQ  $31, R8
-	IMULQ R13, R8
-
-	XORQ  R8, AX
-	ROLQ  $27, AX
-	IMULQ R13, AX
-	ADDQ  DI, AX
-
-	CMPQ SI, BX
-	JLE  wordLoop
-
-fourByte:
-	ADDQ $4, BX
-	CMPQ SI, BX
-	JG   singles
-
-	MOVL  (SI), R8
-	ADDQ  $4, SI
-	IMULQ R13, R8
-	XORQ  R8, AX
-
-	ROLQ  $23, AX
-	IMULQ R14, AX
-	ADDQ  ·prime3v(SB), AX
-
-singles:
-	ADDQ $4, BX
-	CMPQ SI, BX
+	ADDQ n, h
+
+	ADDQ $24, end
+	CMPQ p, end
+	JG   try4
+
+loop8:
+	MOVQ  (p), x
+	ADDQ  $8, p
+	round0(x)
+	XORQ  x, h
+	ROLQ  $27, h
+	IMULQ prime1, h
+	ADDQ  prime4, h
+
+	CMPQ p, end
+	JLE  loop8
+
+try4:
+	ADDQ $4, end
+	CMPQ p, end
+	JG   try1
+
+	MOVL  (p), x
+	ADDQ  $4, p
+	IMULQ prime1, x
+	XORQ  x, h
+
+	ROLQ  $23, h
+	IMULQ prime2, h
+	ADDQ  ·primes+16(SB), h
+
+try1:
+	ADDQ $4, end
+	CMPQ p, end
 	JGE  finalize
 
-singlesLoop:
-	MOVBQZX (SI), R12
-	ADDQ    $1, SI
-	IMULQ   ·prime5v(SB), R12
-	XORQ    R12, AX
+loop1:
+	MOVBQZX (p), x
+	ADDQ    $1, p
+	IMULQ   ·primes+32(SB), x
+	XORQ    x, h
+	ROLQ    $11, h
+	IMULQ   prime1, h
 
-	ROLQ  $11, AX
-	IMULQ R13, AX
-
-	CMPQ SI, BX
-	JL   singlesLoop
+	CMPQ p, end
+	JL   loop1
 
 finalize:
-	MOVQ  AX, R12
-	SHRQ  $33, R12
-	XORQ  R12, AX
-	IMULQ R14, AX
-	MOVQ  AX, R12
-	SHRQ  $29, R12
-	XORQ  R12, AX
-	IMULQ ·prime3v(SB), AX
-	MOVQ  AX, R12
-	SHRQ  $32, R12
-	XORQ  R12, AX
-
-	MOVQ AX, ret+24(FP)
+	MOVQ  h, x
+	SHRQ  $33, x
+	XORQ  x, h
+	IMULQ prime2, h
+	MOVQ  h, x
+	SHRQ  $29, x
+	XORQ  x, h
+	IMULQ ·primes+16(SB), h
+	MOVQ  h, x
+	SHRQ  $32, x
+	XORQ  x, h
+
+	MOVQ h, ret+24(FP)
 	RET
 
-// writeBlocks uses the same registers as above except that it uses AX to store
-// the d pointer.
-
 // func writeBlocks(d *Digest, b []byte) int
-TEXT ·writeBlocks(SB), NOSPLIT, $0-40
+TEXT ·writeBlocks(SB), NOSPLIT|NOFRAME, $0-40
 	// Load fixed primes needed for round.
-	MOVQ ·prime1v(SB), R13
-	MOVQ ·prime2v(SB), R14
+	MOVQ ·primes+0(SB), prime1
+	MOVQ ·primes+8(SB), prime2
 
 	// Load slice.
-	MOVQ b_base+8(FP), SI
-	MOVQ b_len+16(FP), DX
-	LEAQ (SI)(DX*1), BX
-	SUBQ $32, BX
+	MOVQ b_base+8(FP), p
+	MOVQ b_len+16(FP), n
+	LEAQ (p)(n*1), end
+	SUBQ $32, end
 
 	// Load vN from d.
-	MOVQ d+0(FP), AX
-	MOVQ 0(AX), R8   // v1
-	MOVQ 8(AX), R9   // v2
-	MOVQ 16(AX), R10 // v3
-	MOVQ 24(AX), R11 // v4
+	MOVQ s+0(FP), d
+	MOVQ 0(d), v1
+	MOVQ 8(d), v2
+	MOVQ 16(d), v3
+	MOVQ 24(d), v4
 
 	// We don't need to check the loop condition here; this function is
 	// always called with at least one block of data to process.
-blockLoop:
-	round(R8)
-	round(R9)
-	round(R10)
-	round(R11)
-
-	CMPQ SI, BX
-	JLE  blockLoop
+	blockLoop()
 
 	// Copy vN back to d.
-	MOVQ R8, 0(AX)
-	MOVQ R9, 8(AX)
-	MOVQ R10, 16(AX)
-	MOVQ R11, 24(AX)
-
-	// The number of bytes written is SI minus the old base pointer.
-	SUBQ b_base+8(FP), SI
-	MOVQ SI, ret+32(FP)
+	MOVQ v1, 0(d)
+	MOVQ v2, 8(d)
+	MOVQ v3, 16(d)
+	MOVQ v4, 24(d)
+
+	// The number of bytes written is p minus the old base pointer.
+	SUBQ b_base+8(FP), p
+	MOVQ p, ret+32(FP)
 
 	RET
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_arm64.s b/vendor/github.com/cespare/xxhash/v2/xxhash_arm64.s
new file mode 100644
index 000000000000..7e3145a22186
--- /dev/null
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_arm64.s
@@ -0,0 +1,183 @@
+//go:build !appengine && gc && !purego
+// +build !appengine
+// +build gc
+// +build !purego
+
+#include "textflag.h"
+
+// Registers:
+#define digest	R1
+#define h	R2 // return value
+#define p	R3 // input pointer
+#define n	R4 // input length
+#define nblocks	R5 // n / 32
+#define prime1	R7
+#define prime2	R8
+#define prime3	R9
+#define prime4	R10
+#define prime5	R11
+#define v1	R12
+#define v2	R13
+#define v3	R14
+#define v4	R15
+#define x1	R20
+#define x2	R21
+#define x3	R22
+#define x4	R23
+
+#define round(acc, x) \
+	MADD prime2, acc, x, acc \
+	ROR  $64-31, acc         \
+	MUL  prime1, acc
+
+// round0 performs the operation x = round(0, x).
+#define round0(x) \
+	MUL prime2, x \
+	ROR $64-31, x \
+	MUL prime1, x
+
+#define mergeRound(acc, x) \
+	round0(x)                     \
+	EOR  x, acc                   \
+	MADD acc, prime4, prime1, acc
+
+// blockLoop processes as many 32-byte blocks as possible,
+// updating v1, v2, v3, and v4. It assumes that n >= 32.
+#define blockLoop() \
+	LSR     $5, n, nblocks  \
+	PCALIGN $16             \
+	loop:                   \
+	LDP.P   16(p), (x1, x2) \
+	LDP.P   16(p), (x3, x4) \
+	round(v1, x1)           \
+	round(v2, x2)           \
+	round(v3, x3)           \
+	round(v4, x4)           \
+	SUB     $1, nblocks     \
+	CBNZ    nblocks, loop
+
+// func Sum64(b []byte) uint64
+TEXT ·Sum64(SB), NOSPLIT|NOFRAME, $0-32
+	LDP b_base+0(FP), (p, n)
+
+	LDP  ·primes+0(SB), (prime1, prime2)
+	LDP  ·primes+16(SB), (prime3, prime4)
+	MOVD ·primes+32(SB), prime5
+
+	CMP  $32, n
+	CSEL LT, prime5, ZR, h // if n < 32 { h = prime5 } else { h = 0 }
+	BLT  afterLoop
+
+	ADD  prime1, prime2, v1
+	MOVD prime2, v2
+	MOVD $0, v3
+	NEG  prime1, v4
+
+	blockLoop()
+
+	ROR $64-1, v1, x1
+	ROR $64-7, v2, x2
+	ADD x1, x2
+	ROR $64-12, v3, x3
+	ROR $64-18, v4, x4
+	ADD x3, x4
+	ADD x2, x4, h
+
+	mergeRound(h, v1)
+	mergeRound(h, v2)
+	mergeRound(h, v3)
+	mergeRound(h, v4)
+
+afterLoop:
+	ADD n, h
+
+	TBZ   $4, n, try8
+	LDP.P 16(p), (x1, x2)
+
+	round0(x1)
+
+	// NOTE: here and below, sequencing the EOR after the ROR (using a
+	// rotated register) is worth a small but measurable speedup for small
+	// inputs.
+	ROR  $64-27, h
+	EOR  x1 @> 64-27, h, h
+	MADD h, prime4, prime1, h
+
+	round0(x2)
+	ROR  $64-27, h
+	EOR  x2 @> 64-27, h, h
+	MADD h, prime4, prime1, h
+
+try8:
+	TBZ    $3, n, try4
+	MOVD.P 8(p), x1
+
+	round0(x1)
+	ROR  $64-27, h
+	EOR  x1 @> 64-27, h, h
+	MADD h, prime4, prime1, h
+
+try4:
+	TBZ     $2, n, try2
+	MOVWU.P 4(p), x2
+
+	MUL  prime1, x2
+	ROR  $64-23, h
+	EOR  x2 @> 64-23, h, h
+	MADD h, prime3, prime2, h
+
+try2:
+	TBZ     $1, n, try1
+	MOVHU.P 2(p), x3
+	AND     $255, x3, x1
+	LSR     $8, x3, x2
+
+	MUL prime5, x1
+	ROR $64-11, h
+	EOR x1 @> 64-11, h, h
+	MUL prime1, h
+
+	MUL prime5, x2
+	ROR $64-11, h
+	EOR x2 @> 64-11, h, h
+	MUL prime1, h
+
+try1:
+	TBZ   $0, n, finalize
+	MOVBU (p), x4
+
+	MUL prime5, x4
+	ROR $64-11, h
+	EOR x4 @> 64-11, h, h
+	MUL prime1, h
+
+finalize:
+	EOR h >> 33, h
+	MUL prime2, h
+	EOR h >> 29, h
+	MUL prime3, h
+	EOR h >> 32, h
+
+	MOVD h, ret+24(FP)
+	RET
+
+// func writeBlocks(d *Digest, b []byte) int
+TEXT ·writeBlocks(SB), NOSPLIT|NOFRAME, $0-40
+	LDP ·primes+0(SB), (prime1, prime2)
+
+	// Load state. Assume v[1-4] are stored contiguously.
+	MOVD d+0(FP), digest
+	LDP  0(digest), (v1, v2)
+	LDP  16(digest), (v3, v4)
+
+	LDP b_base+8(FP), (p, n)
+
+	blockLoop()
+
+	// Store updated state.
+	STP (v1, v2), 0(digest)
+	STP (v3, v4), 16(digest)
+
+	BIC  $31, n
+	MOVD n, ret+32(FP)
+	RET
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.go b/vendor/github.com/cespare/xxhash/v2/xxhash_asm.go
similarity index 73%
rename from vendor/github.com/cespare/xxhash/v2/xxhash_amd64.go
rename to vendor/github.com/cespare/xxhash/v2/xxhash_asm.go
index ad14b807f4d9..9216e0a40c1a 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_asm.go
@@ -1,3 +1,5 @@
+//go:build (amd64 || arm64) && !appengine && gc && !purego
+// +build amd64 arm64
 // +build !appengine
 // +build gc
 // +build !purego
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_other.go b/vendor/github.com/cespare/xxhash/v2/xxhash_other.go
index 4a5a821603e5..26df13bba4b7 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_other.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_other.go
@@ -1,4 +1,5 @@
-// +build !amd64 appengine !gc purego
+//go:build (!amd64 && !arm64) || appengine || !gc || purego
+// +build !amd64,!arm64 appengine !gc purego
 
 package xxhash
 
@@ -14,10 +15,10 @@ func Sum64(b []byte) uint64 {
 	var h uint64
 
 	if n >= 32 {
-		v1 := prime1v + prime2
+		v1 := primes[0] + prime2
 		v2 := prime2
 		v3 := uint64(0)
-		v4 := -prime1v
+		v4 := -primes[0]
 		for len(b) >= 32 {
 			v1 = round(v1, u64(b[0:8:len(b)]))
 			v2 = round(v2, u64(b[8:16:len(b)]))
@@ -36,19 +37,18 @@ func Sum64(b []byte) uint64 {
 
 	h += uint64(n)
 
-	i, end := 0, len(b)
-	for ; i+8 <= end; i += 8 {
-		k1 := round(0, u64(b[i:i+8:len(b)]))
+	for ; len(b) >= 8; b = b[8:] {
+		k1 := round(0, u64(b[:8]))
 		h ^= k1
 		h = rol27(h)*prime1 + prime4
 	}
-	if i+4 <= end {
-		h ^= uint64(u32(b[i:i+4:len(b)])) * prime1
+	if len(b) >= 4 {
+		h ^= uint64(u32(b[:4])) * prime1
 		h = rol23(h)*prime2 + prime3
-		i += 4
+		b = b[4:]
 	}
-	for ; i < end; i++ {
-		h ^= uint64(b[i]) * prime5
+	for ; len(b) > 0; b = b[1:] {
+		h ^= uint64(b[0]) * prime5
 		h = rol11(h) * prime1
 	}
 
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go b/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go
index fc9bea7a31f2..e86f1b5fd8e4 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go
@@ -1,3 +1,4 @@
+//go:build appengine
 // +build appengine
 
 // This file contains the safe implementations of otherwise unsafe-using code.
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go b/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go
index 376e0ca2e497..1c1638fd88a1 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go
@@ -1,3 +1,4 @@
+//go:build !appengine
 // +build !appengine
 
 // This file encapsulates usage of unsafe.
@@ -11,7 +12,7 @@ import (
 
 // In the future it's possible that compiler optimizations will make these
 // XxxString functions unnecessary by realizing that calls such as
-// Sum64([]byte(s)) don't need to copy s. See https://golang.org/issue/2205.
+// Sum64([]byte(s)) don't need to copy s. See https://go.dev/issue/2205.
 // If that happens, even if we keep these functions they can be replaced with
 // the trivial safe code.
 
diff --git a/vendor/github.com/cloudflare/cloudflare-go/device_posture_rule.go b/vendor/github.com/cloudflare/cloudflare-go/device_posture_rule.go
deleted file mode 100644
index f28af576396f..000000000000
--- a/vendor/github.com/cloudflare/cloudflare-go/device_posture_rule.go
+++ /dev/null
@@ -1,169 +0,0 @@
-package cloudflare
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-
-	"github.com/pkg/errors"
-)
-
-// DevicePostureRule represents a device posture rule.
-type DevicePostureRule struct {
-	ID          string                   `json:"id,omitempty"`
-	Type        string                   `json:"type"`
-	Name        string                   `json:"name"`
-	Description string                   `json:"description,omitempty"`
-	Schedule    string                   `json:"schedule,omitempty"`
-	Match       []DevicePostureRuleMatch `json:"match,omitempty"`
-	Input       DevicePostureRuleInput   `json:"input,omitempty"`
-}
-
-// DevicePostureRuleMatch represents the conditions that the client must match to run the rule.
-type DevicePostureRuleMatch struct {
-	Platform string `json:"platform,omitempty"`
-}
-
-// DevicePostureRuleInput represents the value to be checked against.
-type DevicePostureRuleInput struct {
-	ID         string `json:"id,omitempty"`
-	Path       string `json:"path,omitempty"`
-	Exists     bool   `json:"exists,omitempty"`
-	Thumbprint string `json:"thumbprint,omitempty"`
-	Sha256     string `json:"sha256,omitempty"`
-	Running    bool   `json:"running,omitempty"`
-	RequireAll bool   `json:"requireAll,omitempty"`
-	Enabled    bool   `json:"enabled,omitempty"`
-	Version    string `json:"version,omitempty"`
-	Operator   string `json:"operator,omitempty"`
-	Domain     string `json:"domain,omitempty"`
-}
-
-// DevicePostureRuleListResponse represents the response from the list
-// device posture rules endpoint.
-type DevicePostureRuleListResponse struct {
-	Result []DevicePostureRule `json:"result"`
-	Response
-	ResultInfo `json:"result_info"`
-}
-
-// DevicePostureRuleDetailResponse is the API response, containing a single
-// device posture rule.
-type DevicePostureRuleDetailResponse struct {
-	Response
-	Result DevicePostureRule `json:"result"`
-}
-
-// DevicePostureRules returns all device posture rules within an account.
-//
-// API reference: https://api.cloudflare.com/#device-posture-rules-list-device-posture-rules
-func (api *API) DevicePostureRules(ctx context.Context, accountID string) ([]DevicePostureRule, ResultInfo, error) {
-	uri := fmt.Sprintf("/%s/%s/devices/posture", AccountRouteRoot, accountID)
-
-	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
-	if err != nil {
-		return []DevicePostureRule{}, ResultInfo{}, err
-	}
-
-	var devicePostureRuleListResponse DevicePostureRuleListResponse
-	err = json.Unmarshal(res, &devicePostureRuleListResponse)
-	if err != nil {
-		return []DevicePostureRule{}, ResultInfo{}, errors.Wrap(err, errUnmarshalError)
-	}
-
-	return devicePostureRuleListResponse.Result, devicePostureRuleListResponse.ResultInfo, nil
-}
-
-// DevicePostureRule returns a single device posture rule based on the rule ID.
-//
-// API reference: https://api.cloudflare.com/#device-posture-rules-device-posture-rules-details
-func (api *API) DevicePostureRule(ctx context.Context, accountID, ruleID string) (DevicePostureRule, error) {
-	uri := fmt.Sprintf(
-		"/%s/%s/devices/posture/%s",
-		AccountRouteRoot,
-		accountID,
-		ruleID,
-	)
-
-	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
-	if err != nil {
-		return DevicePostureRule{}, err
-	}
-
-	var devicePostureRuleDetailResponse DevicePostureRuleDetailResponse
-	err = json.Unmarshal(res, &devicePostureRuleDetailResponse)
-	if err != nil {
-		return DevicePostureRule{}, errors.Wrap(err, errUnmarshalError)
-	}
-
-	return devicePostureRuleDetailResponse.Result, nil
-}
-
-// CreateDevicePostureRule creates a new device posture rule.
-//
-// API reference: https://api.cloudflare.com/#device-posture-rules-create-device-posture-rule
-func (api *API) CreateDevicePostureRule(ctx context.Context, accountID string, rule DevicePostureRule) (DevicePostureRule, error) {
-	uri := fmt.Sprintf("/%s/%s/devices/posture", AccountRouteRoot, accountID)
-
-	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, rule)
-	if err != nil {
-		return DevicePostureRule{}, err
-	}
-
-	var devicePostureRuleDetailResponse DevicePostureRuleDetailResponse
-	err = json.Unmarshal(res, &devicePostureRuleDetailResponse)
-	if err != nil {
-		return DevicePostureRule{}, errors.Wrap(err, errUnmarshalError)
-	}
-
-	return devicePostureRuleDetailResponse.Result, nil
-}
-
-// UpdateDevicePostureRule updates an existing device posture rule.
-//
-// API reference: https://api.cloudflare.com/#device-posture-rules-update-device-posture-rule
-func (api *API) UpdateDevicePostureRule(ctx context.Context, accountID string, rule DevicePostureRule) (DevicePostureRule, error) {
-	if rule.ID == "" {
-		return DevicePostureRule{}, errors.Errorf("device posture rule ID cannot be empty")
-	}
-
-	uri := fmt.Sprintf(
-		"/%s/%s/devices/posture/%s",
-		AccountRouteRoot,
-		accountID,
-		rule.ID,
-	)
-
-	res, err := api.makeRequestContext(ctx, http.MethodPut, uri, rule)
-	if err != nil {
-		return DevicePostureRule{}, err
-	}
-
-	var devicePostureRuleDetailResponse DevicePostureRuleDetailResponse
-	err = json.Unmarshal(res, &devicePostureRuleDetailResponse)
-	if err != nil {
-		return DevicePostureRule{}, errors.Wrap(err, errUnmarshalError)
-	}
-
-	return devicePostureRuleDetailResponse.Result, nil
-}
-
-// DeleteDevicePostureRule deletes a device posture rule.
-//
-// API reference: https://api.cloudflare.com/#device-posture-rules-delete-device-posture-rule
-func (api *API) DeleteDevicePostureRule(ctx context.Context, accountID, ruleID string) error {
-	uri := fmt.Sprintf(
-		"/%s/%s/devices/posture/%s",
-		AccountRouteRoot,
-		accountID,
-		ruleID,
-	)
-
-	_, err := api.makeRequestContext(ctx, http.MethodDelete, uri, nil)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/cloudflare/cloudflare-go/logpush.go b/vendor/github.com/cloudflare/cloudflare-go/logpush.go
deleted file mode 100644
index 1e5f363aa95a..000000000000
--- a/vendor/github.com/cloudflare/cloudflare-go/logpush.go
+++ /dev/null
@@ -1,275 +0,0 @@
-package cloudflare
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/pkg/errors"
-)
-
-// LogpushJob describes a Logpush job.
-type LogpushJob struct {
-	ID                 int        `json:"id,omitempty"`
-	Dataset            string     `json:"dataset"`
-	Enabled            bool       `json:"enabled"`
-	Name               string     `json:"name"`
-	LogpullOptions     string     `json:"logpull_options"`
-	DestinationConf    string     `json:"destination_conf"`
-	OwnershipChallenge string     `json:"ownership_challenge,omitempty"`
-	LastComplete       *time.Time `json:"last_complete,omitempty"`
-	LastError          *time.Time `json:"last_error,omitempty"`
-	ErrorMessage       string     `json:"error_message,omitempty"`
-}
-
-// LogpushJobsResponse is the API response, containing an array of Logpush Jobs.
-type LogpushJobsResponse struct {
-	Response
-	Result []LogpushJob `json:"result"`
-}
-
-// LogpushJobDetailsResponse is the API response, containing a single Logpush Job.
-type LogpushJobDetailsResponse struct {
-	Response
-	Result LogpushJob `json:"result"`
-}
-
-// LogpushFieldsResponse is the API response for a datasets fields
-type LogpushFieldsResponse struct {
-	Response
-	Result LogpushFields `json:"result"`
-}
-
-// LogpushFields is a map of available Logpush field names & descriptions
-type LogpushFields map[string]string
-
-// LogpushGetOwnershipChallenge describes a ownership validation.
-type LogpushGetOwnershipChallenge struct {
-	Filename string `json:"filename"`
-	Valid    bool   `json:"valid"`
-	Message  string `json:"message"`
-}
-
-// LogpushGetOwnershipChallengeResponse is the API response, containing a ownership challenge.
-type LogpushGetOwnershipChallengeResponse struct {
-	Response
-	Result LogpushGetOwnershipChallenge `json:"result"`
-}
-
-// LogpushGetOwnershipChallengeRequest is the API request for get ownership challenge.
-type LogpushGetOwnershipChallengeRequest struct {
-	DestinationConf string `json:"destination_conf"`
-}
-
-// LogpushOwnershipChallengeValidationResponse is the API response,
-// containing a ownership challenge validation result.
-type LogpushOwnershipChallengeValidationResponse struct {
-	Response
-	Result struct {
-		Valid bool `json:"valid"`
-	}
-}
-
-// LogpushValidateOwnershipChallengeRequest is the API request for validate ownership challenge.
-type LogpushValidateOwnershipChallengeRequest struct {
-	DestinationConf    string `json:"destination_conf"`
-	OwnershipChallenge string `json:"ownership_challenge"`
-}
-
-// LogpushDestinationExistsResponse is the API response,
-// containing a destination exists check result.
-type LogpushDestinationExistsResponse struct {
-	Response
-	Result struct {
-		Exists bool `json:"exists"`
-	}
-}
-
-// LogpushDestinationExistsRequest is the API request for check destination exists.
-type LogpushDestinationExistsRequest struct {
-	DestinationConf string `json:"destination_conf"`
-}
-
-// CreateLogpushJob creates a new LogpushJob for a zone.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-create-logpush-job
-func (api *API) CreateLogpushJob(ctx context.Context, zoneID string, job LogpushJob) (*LogpushJob, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/jobs", zoneID)
-	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, job)
-	if err != nil {
-		return nil, err
-	}
-	var r LogpushJobDetailsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return nil, errors.Wrap(err, errUnmarshalError)
-	}
-	return &r.Result, nil
-}
-
-// LogpushJobs returns all Logpush Jobs for a zone.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
-func (api *API) LogpushJobs(ctx context.Context, zoneID string) ([]LogpushJob, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/jobs", zoneID)
-	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
-	if err != nil {
-		return []LogpushJob{}, err
-	}
-	var r LogpushJobsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return []LogpushJob{}, errors.Wrap(err, errUnmarshalError)
-	}
-	return r.Result, nil
-}
-
-// LogpushJobsForDataset returns all Logpush Jobs for a dataset in a zone.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs-for-a-dataset
-func (api *API) LogpushJobsForDataset(ctx context.Context, zoneID, dataset string) ([]LogpushJob, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/datasets/%s/jobs", zoneID, dataset)
-	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
-	if err != nil {
-		return []LogpushJob{}, err
-	}
-	var r LogpushJobsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return []LogpushJob{}, errors.Wrap(err, errUnmarshalError)
-	}
-	return r.Result, nil
-}
-
-// LogpushFields returns fields for a given dataset.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
-func (api *API) LogpushFields(ctx context.Context, zoneID, dataset string) (LogpushFields, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/datasets/%s/fields", zoneID, dataset)
-	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
-	if err != nil {
-		return LogpushFields{}, err
-	}
-	var r LogpushFieldsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return LogpushFields{}, errors.Wrap(err, errUnmarshalError)
-	}
-	return r.Result, nil
-}
-
-// LogpushJob fetches detail about one Logpush Job for a zone.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-logpush-job-details
-func (api *API) LogpushJob(ctx context.Context, zoneID string, jobID int) (LogpushJob, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/jobs/%d", zoneID, jobID)
-	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
-	if err != nil {
-		return LogpushJob{}, err
-	}
-	var r LogpushJobDetailsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return LogpushJob{}, errors.Wrap(err, errUnmarshalError)
-	}
-	return r.Result, nil
-}
-
-// UpdateLogpushJob lets you update a Logpush Job.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-update-logpush-job
-func (api *API) UpdateLogpushJob(ctx context.Context, zoneID string, jobID int, job LogpushJob) error {
-	uri := fmt.Sprintf("/zones/%s/logpush/jobs/%d", zoneID, jobID)
-	res, err := api.makeRequestContext(ctx, http.MethodPut, uri, job)
-	if err != nil {
-		return err
-	}
-	var r LogpushJobDetailsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return errors.Wrap(err, errUnmarshalError)
-	}
-	return nil
-}
-
-// DeleteLogpushJob deletes a Logpush Job for a zone.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-delete-logpush-job
-func (api *API) DeleteLogpushJob(ctx context.Context, zoneID string, jobID int) error {
-	uri := fmt.Sprintf("/zones/%s/logpush/jobs/%d", zoneID, jobID)
-	res, err := api.makeRequestContext(ctx, http.MethodDelete, uri, nil)
-	if err != nil {
-		return err
-	}
-	var r LogpushJobDetailsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return errors.Wrap(err, errUnmarshalError)
-	}
-	return nil
-}
-
-// GetLogpushOwnershipChallenge returns ownership challenge.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-get-ownership-challenge
-func (api *API) GetLogpushOwnershipChallenge(ctx context.Context, zoneID, destinationConf string) (*LogpushGetOwnershipChallenge, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/ownership", zoneID)
-	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, LogpushGetOwnershipChallengeRequest{
-		DestinationConf: destinationConf,
-	})
-	if err != nil {
-		return nil, err
-	}
-	var r LogpushGetOwnershipChallengeResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return nil, errors.Wrap(err, errUnmarshalError)
-	}
-
-	if !r.Result.Valid {
-		return nil, errors.New(r.Result.Message)
-	}
-
-	return &r.Result, nil
-}
-
-// ValidateLogpushOwnershipChallenge returns ownership challenge validation result.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-validate-ownership-challenge
-func (api *API) ValidateLogpushOwnershipChallenge(ctx context.Context, zoneID, destinationConf, ownershipChallenge string) (bool, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/ownership/validate", zoneID)
-	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, LogpushValidateOwnershipChallengeRequest{
-		DestinationConf:    destinationConf,
-		OwnershipChallenge: ownershipChallenge,
-	})
-	if err != nil {
-		return false, err
-	}
-	var r LogpushGetOwnershipChallengeResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return false, errors.Wrap(err, errUnmarshalError)
-	}
-	return r.Result.Valid, nil
-}
-
-// CheckLogpushDestinationExists returns destination exists check result.
-//
-// API reference: https://api.cloudflare.com/#logpush-jobs-check-destination-exists
-func (api *API) CheckLogpushDestinationExists(ctx context.Context, zoneID, destinationConf string) (bool, error) {
-	uri := fmt.Sprintf("/zones/%s/logpush/validate/destination/exists", zoneID)
-	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, LogpushDestinationExistsRequest{
-		DestinationConf: destinationConf,
-	})
-	if err != nil {
-		return false, err
-	}
-	var r LogpushDestinationExistsResponse
-	err = json.Unmarshal(res, &r)
-	if err != nil {
-		return false, errors.Wrap(err, errUnmarshalError)
-	}
-	return r.Result.Exists, nil
-}
diff --git a/vendor/github.com/go-openapi/analysis/.golangci.yml b/vendor/github.com/go-openapi/analysis/.golangci.yml
index 8cad29879194..e24a6c14e6b5 100644
--- a/vendor/github.com/go-openapi/analysis/.golangci.yml
+++ b/vendor/github.com/go-openapi/analysis/.golangci.yml
@@ -51,3 +51,6 @@ linters:
     - forbidigo
     - cyclop
     - varnamelen
+    - exhaustruct
+    - nonamedreturns
+    - nosnakecase
diff --git a/vendor/github.com/go-openapi/errors/.golangci.yml b/vendor/github.com/go-openapi/errors/.golangci.yml
index 449a43c2bc8d..4e1fc0c7d482 100644
--- a/vendor/github.com/go-openapi/errors/.golangci.yml
+++ b/vendor/github.com/go-openapi/errors/.golangci.yml
@@ -44,3 +44,5 @@ linters:
     - cyclop
     - errname
     - varnamelen
+    - exhaustruct
+    - maintidx
diff --git a/vendor/github.com/go-openapi/errors/api.go b/vendor/github.com/go-openapi/errors/api.go
index 854d6eec1e10..77f1f92c5e32 100644
--- a/vendor/github.com/go-openapi/errors/api.go
+++ b/vendor/github.com/go-openapi/errors/api.go
@@ -99,6 +99,7 @@ func (m MethodNotAllowedError) MarshalJSON() ([]byte, error) {
 }
 
 func errorAsJSON(err Error) []byte {
+	//nolint:errchkjson
 	b, _ := json.Marshal(struct {
 		Code    int32  `json:"code"`
 		Message string `json:"message"`
@@ -146,7 +147,7 @@ func ServeError(rw http.ResponseWriter, r *http.Request, err error) {
 			ServeError(rw, r, nil)
 		}
 	case *MethodNotAllowedError:
-		rw.Header().Add("Allow", strings.Join(err.(*MethodNotAllowedError).Allowed, ","))
+		rw.Header().Add("Allow", strings.Join(e.Allowed, ","))
 		rw.WriteHeader(asHTTPCode(int(e.Code())))
 		if r == nil || r.Method != http.MethodHead {
 			_, _ = rw.Write(errorAsJSON(e))
diff --git a/vendor/github.com/go-openapi/errors/doc.go b/vendor/github.com/go-openapi/errors/doc.go
index 963d42740784..af01190ce610 100644
--- a/vendor/github.com/go-openapi/errors/doc.go
+++ b/vendor/github.com/go-openapi/errors/doc.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 /*
-
 Package errors provides an Error interface and several concrete types
 implementing this interface to manage API errors and JSON-schema validation
 errors.
@@ -23,6 +22,5 @@ it defines.
 
 It is used throughout the various go-openapi toolkit libraries
 (https://github.com/go-openapi).
-
 */
 package errors
diff --git a/vendor/github.com/go-openapi/errors/middleware.go b/vendor/github.com/go-openapi/errors/middleware.go
index c26ad484ebc0..963472d1f34b 100644
--- a/vendor/github.com/go-openapi/errors/middleware.go
+++ b/vendor/github.com/go-openapi/errors/middleware.go
@@ -28,7 +28,6 @@ type APIVerificationFailed struct {
 	MissingRegistration  []string `json:"missingRegistration,omitempty"`
 }
 
-//
 func (v *APIVerificationFailed) Error() string {
 	buf := bytes.NewBuffer(nil)
 
diff --git a/vendor/github.com/go-openapi/spec/.travis.yml b/vendor/github.com/go-openapi/spec/.travis.yml
deleted file mode 100644
index 2281a07b0577..000000000000
--- a/vendor/github.com/go-openapi/spec/.travis.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-after_success:
-- bash <(curl -s https://codecov.io/bash)
-go:
-- 1.16.x
-- 1.x
-arch:
-  - amd64
-jobs:
-  include:
-  # only run fast tests on ppc64le
-  - go: 1.x
-    arch: ppc64le
-    script:
-    - gotestsum -f short-verbose -- ./...
-
-  # include linting job, but only for latest go version and amd64 arch
-  - go: 1.x
-    arch: amd64
-    install:
-      go get github.com/golangci/golangci-lint/cmd/golangci-lint
-    script:
-    - golangci-lint run --new-from-rev master
-
-install:
-- GO111MODULE=off go get -u gotest.tools/gotestsum
-language: go
-notifications:
-  slack:
-    secure: QUWvCkBBK09GF7YtEvHHVt70JOkdlNBG0nIKu/5qc4/nW5HP8I2w0SEf/XR2je0eED1Qe3L/AfMCWwrEj+IUZc3l4v+ju8X8R3Lomhme0Eb0jd1MTMCuPcBT47YCj0M7RON7vXtbFfm1hFJ/jLe5+9FXz0hpXsR24PJc5ZIi/ogNwkaPqG4BmndzecpSh0vc2FJPZUD9LT0I09REY/vXR0oQAalLkW0asGD5taHZTUZq/kBpsNxaAFrLM23i4mUcf33M5fjLpvx5LRICrX/57XpBrDh2TooBU6Qj3CgoY0uPRYUmSNxbVx1czNzl2JtEpb5yjoxfVPQeg0BvQM00G8LJINISR+ohrjhkZmAqchDupAX+yFrxTtORa78CtnIL6z/aTNlgwwVD8kvL/1pFA/JWYmKDmz93mV/+6wubGzNSQCstzjkFA4/iZEKewKUoRIAi/fxyscP6L/rCpmY/4llZZvrnyTqVbt6URWpopUpH4rwYqreXAtJxJsfBJIeSmUIiDIOMGkCTvyTEW3fWGmGoqWtSHLoaWDyAIGb7azb+KvfpWtEcoPFWfSWU+LGee0A/YsUhBl7ADB9A0CJEuR8q4BPpKpfLwPKSiKSAXL7zDkyjExyhtgqbSl2jS+rKIHOZNL8JkCcTP2MKMVd563C5rC5FMKqu3S9m2b6380E=
-script:
-- gotestsum -f short-verbose -- -race -coverprofile=coverage.txt -covermode=atomic ./...
diff --git a/vendor/github.com/go-openapi/spec/normalizer.go b/vendor/github.com/go-openapi/spec/normalizer.go
index d6c483971280..e8b600994576 100644
--- a/vendor/github.com/go-openapi/spec/normalizer.go
+++ b/vendor/github.com/go-openapi/spec/normalizer.go
@@ -40,7 +40,7 @@ const fileScheme = "file"
 //
 // The base path argument is assumed to be canonicalized (e.g. using normalizeBase()).
 func normalizeURI(refPath, base string) string {
-	refURL, err := url.Parse(refPath)
+	refURL, err := parseURL(refPath)
 	if err != nil {
 		specLogger.Printf("warning: invalid URI in $ref  %q: %v", refPath, err)
 		refURL, refPath = repairURI(refPath)
@@ -58,7 +58,7 @@ func normalizeURI(refPath, base string) string {
 		return refURL.String()
 	}
 
-	baseURL, _ := url.Parse(base)
+	baseURL, _ := parseURL(base)
 	if path.IsAbs(refURL.Path) {
 		baseURL.Path = refURL.Path
 	} else if refURL.Path != "" {
@@ -84,7 +84,6 @@ func normalizeURI(refPath, base string) string {
 // There is a special case for schemas that are anchored with an "id":
 // in that case, the rebasing is performed // against the id only if this is an anchor for the initial root document.
 // All other intermediate "id"'s found along the way are ignored for the purpose of rebasing.
-//
 func denormalizeRef(ref *Ref, originalRelativeBase, id string) Ref {
 	debugLog("denormalizeRef called:\n$ref: %q\noriginal: %s\nroot ID:%s", ref.String(), originalRelativeBase, id)
 
@@ -94,7 +93,7 @@ func denormalizeRef(ref *Ref, originalRelativeBase, id string) Ref {
 	}
 
 	if id != "" {
-		idBaseURL, err := url.Parse(id)
+		idBaseURL, err := parseURL(id)
 		if err == nil { // if the schema id is not usable as a URI, ignore it
 			if ref, ok := rebase(ref, idBaseURL, true); ok { // rebase, but keep references to root unchaged (do not want $ref: "")
 				// $ref relative to the ID of the schema in the root document
@@ -103,7 +102,7 @@ func denormalizeRef(ref *Ref, originalRelativeBase, id string) Ref {
 		}
 	}
 
-	originalRelativeBaseURL, _ := url.Parse(originalRelativeBase)
+	originalRelativeBaseURL, _ := parseURL(originalRelativeBase)
 
 	r, _ := rebase(ref, originalRelativeBaseURL, false)
 
@@ -168,7 +167,7 @@ func normalizeRef(ref *Ref, relativeBase string) *Ref {
 //
 // See also: https://en.wikipedia.org/wiki/File_URI_scheme
 func normalizeBase(in string) string {
-	u, err := url.Parse(in)
+	u, err := parseURL(in)
 	if err != nil {
 		specLogger.Printf("warning: invalid URI in RelativeBase  %q: %v", in, err)
 		u, in = repairURI(in)
diff --git a/vendor/github.com/go-openapi/spec/normalizer_nonwindows.go b/vendor/github.com/go-openapi/spec/normalizer_nonwindows.go
index c8a064534741..2df0723154f2 100644
--- a/vendor/github.com/go-openapi/spec/normalizer_nonwindows.go
+++ b/vendor/github.com/go-openapi/spec/normalizer_nonwindows.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 // Copyright 2015 go-swagger maintainers
@@ -34,7 +35,7 @@ func absPath(in string) string {
 }
 
 func repairURI(in string) (*url.URL, string) {
-	u, _ := url.Parse("")
+	u, _ := parseURL("")
 	debugLog("repaired URI: original: %q, repaired: %q", in, "")
 	return u, ""
 }
diff --git a/vendor/github.com/go-openapi/spec/normalizer_windows.go b/vendor/github.com/go-openapi/spec/normalizer_windows.go
index fe2d1ecd43ea..a66c532dbc63 100644
--- a/vendor/github.com/go-openapi/spec/normalizer_windows.go
+++ b/vendor/github.com/go-openapi/spec/normalizer_windows.go
@@ -60,13 +60,13 @@ func repairURI(in string) (*url.URL, string) {
 	const prefix = fileScheme + "://"
 	if !strings.HasPrefix(in, prefix) {
 		// giving up: resolve to empty path
-		u, _ := url.Parse("")
+		u, _ := parseURL("")
 
 		return u, ""
 	}
 
 	// attempt the repair, stripping the scheme should be sufficient
-	u, _ := url.Parse(strings.TrimPrefix(in, prefix))
+	u, _ := parseURL(strings.TrimPrefix(in, prefix))
 	debugLog("repaired URI: original: %q, repaired: %q", in, u.String())
 
 	return u, u.String()
diff --git a/vendor/github.com/go-openapi/spec/schema.go b/vendor/github.com/go-openapi/spec/schema.go
index a8d0f737a7a2..4e9be8576bb6 100644
--- a/vendor/github.com/go-openapi/spec/schema.go
+++ b/vendor/github.com/go-openapi/spec/schema.go
@@ -17,7 +17,6 @@ package spec
 import (
 	"encoding/json"
 	"fmt"
-	"net/url"
 	"strings"
 
 	"github.com/go-openapi/jsonpointer"
@@ -145,7 +144,7 @@ func (r *SchemaURL) fromMap(v map[string]interface{}) error {
 	}
 	if vv, ok := v["$schema"]; ok {
 		if str, ok := vv.(string); ok {
-			u, err := url.Parse(str)
+			u, err := parseURL(str)
 			if err != nil {
 				return err
 			}
diff --git a/vendor/github.com/go-openapi/spec/url_go18.go b/vendor/github.com/go-openapi/spec/url_go18.go
new file mode 100644
index 000000000000..60b78515363a
--- /dev/null
+++ b/vendor/github.com/go-openapi/spec/url_go18.go
@@ -0,0 +1,8 @@
+//go:build !go1.19
+// +build !go1.19
+
+package spec
+
+import "net/url"
+
+var parseURL = url.Parse
diff --git a/vendor/github.com/go-openapi/spec/url_go19.go b/vendor/github.com/go-openapi/spec/url_go19.go
new file mode 100644
index 000000000000..392e3e6395b0
--- /dev/null
+++ b/vendor/github.com/go-openapi/spec/url_go19.go
@@ -0,0 +1,14 @@
+//go:build go1.19
+// +build go1.19
+
+package spec
+
+import "net/url"
+
+func parseURL(s string) (*url.URL, error) {
+	u, err := url.Parse(s)
+	if err == nil {
+		u.OmitHost = false
+	}
+	return u, err
+}
diff --git a/vendor/github.com/go-openapi/swag/.golangci.yml b/vendor/github.com/go-openapi/swag/.golangci.yml
index 2a4a71f3a858..bf503e400016 100644
--- a/vendor/github.com/go-openapi/swag/.golangci.yml
+++ b/vendor/github.com/go-openapi/swag/.golangci.yml
@@ -48,3 +48,7 @@ linters:
     - goimports
     - tenv
     - golint
+    - exhaustruct
+    - nilnil
+    - nonamedreturns
+    - nosnakecase
diff --git a/vendor/github.com/go-openapi/swag/doc.go b/vendor/github.com/go-openapi/swag/doc.go
index 8d2c8c5014e2..55094cb74c4d 100644
--- a/vendor/github.com/go-openapi/swag/doc.go
+++ b/vendor/github.com/go-openapi/swag/doc.go
@@ -17,16 +17,15 @@ Package swag contains a bunch of helper functions for go-openapi and go-swagger
 
 You may also use it standalone for your projects.
 
-  * convert between value and pointers for builtin types
-  * convert from string to builtin types (wraps strconv)
-  * fast json concatenation
-  * search in path
-  * load from file or http
-  * name mangling
-
+  - convert between value and pointers for builtin types
+  - convert from string to builtin types (wraps strconv)
+  - fast json concatenation
+  - search in path
+  - load from file or http
+  - name mangling
 
 This repo has only few dependencies outside of the standard library:
 
-  * YAML utilities depend on gopkg.in/yaml.v2
+  - YAML utilities depend on gopkg.in/yaml.v2
 */
 package swag
diff --git a/vendor/github.com/go-openapi/swag/loading.go b/vendor/github.com/go-openapi/swag/loading.go
index 9a60409725e4..00038c3773c9 100644
--- a/vendor/github.com/go-openapi/swag/loading.go
+++ b/vendor/github.com/go-openapi/swag/loading.go
@@ -16,10 +16,11 @@ package swag
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"net/http"
 	"net/url"
+	"os"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -40,13 +41,13 @@ var LoadHTTPCustomHeaders = map[string]string{}
 
 // LoadFromFileOrHTTP loads the bytes from a file or a remote http server based on the path passed in
 func LoadFromFileOrHTTP(path string) ([]byte, error) {
-	return LoadStrategy(path, ioutil.ReadFile, loadHTTPBytes(LoadHTTPTimeout))(path)
+	return LoadStrategy(path, os.ReadFile, loadHTTPBytes(LoadHTTPTimeout))(path)
 }
 
 // LoadFromFileOrHTTPWithTimeout loads the bytes from a file or a remote http server based on the path passed in
 // timeout arg allows for per request overriding of the request timeout
 func LoadFromFileOrHTTPWithTimeout(path string, timeout time.Duration) ([]byte, error) {
-	return LoadStrategy(path, ioutil.ReadFile, loadHTTPBytes(timeout))(path)
+	return LoadStrategy(path, os.ReadFile, loadHTTPBytes(timeout))(path)
 }
 
 // LoadStrategy returns a loader function for a given path or uri
@@ -86,7 +87,7 @@ func LoadStrategy(path string, local, remote func(string) ([]byte, error)) func(
 func loadHTTPBytes(timeout time.Duration) func(path string) ([]byte, error) {
 	return func(path string) ([]byte, error) {
 		client := &http.Client{Timeout: timeout}
-		req, err := http.NewRequest("GET", path, nil) // nolint: noctx
+		req, err := http.NewRequest(http.MethodGet, path, nil) //nolint:noctx
 		if err != nil {
 			return nil, err
 		}
@@ -115,6 +116,6 @@ func loadHTTPBytes(timeout time.Duration) func(path string) ([]byte, error) {
 			return nil, fmt.Errorf("could not access document at %q [%s] ", path, resp.Status)
 		}
 
-		return ioutil.ReadAll(resp.Body)
+		return io.ReadAll(resp.Body)
 	}
 }
diff --git a/vendor/github.com/go-openapi/swag/util.go b/vendor/github.com/go-openapi/swag/util.go
index 193702f2cec0..f78ab684a0ae 100644
--- a/vendor/github.com/go-openapi/swag/util.go
+++ b/vendor/github.com/go-openapi/swag/util.go
@@ -99,10 +99,11 @@ const (
 )
 
 // JoinByFormat joins a string array by a known format (e.g. swagger's collectionFormat attribute):
-//		ssv: space separated value
-//		tsv: tab separated value
-//		pipes: pipe (|) separated value
-//		csv: comma separated value (default)
+//
+//	ssv: space separated value
+//	tsv: tab separated value
+//	pipes: pipe (|) separated value
+//	csv: comma separated value (default)
 func JoinByFormat(data []string, format string) []string {
 	if len(data) == 0 {
 		return data
@@ -124,11 +125,11 @@ func JoinByFormat(data []string, format string) []string {
 }
 
 // SplitByFormat splits a string by a known format:
-//		ssv: space separated value
-//		tsv: tab separated value
-//		pipes: pipe (|) separated value
-//		csv: comma separated value (default)
 //
+//	ssv: space separated value
+//	tsv: tab separated value
+//	pipes: pipe (|) separated value
+//	csv: comma separated value (default)
 func SplitByFormat(data, format string) []string {
 	if data == "" {
 		return nil
diff --git a/vendor/github.com/go-openapi/swag/yaml.go b/vendor/github.com/go-openapi/swag/yaml.go
index ec96914405b7..f09ee609f3b4 100644
--- a/vendor/github.com/go-openapi/swag/yaml.go
+++ b/vendor/github.com/go-openapi/swag/yaml.go
@@ -22,7 +22,7 @@ import (
 
 	"github.com/mailru/easyjson/jlexer"
 	"github.com/mailru/easyjson/jwriter"
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 // YAMLMatcher matches yaml
@@ -43,16 +43,126 @@ func YAMLToJSON(data interface{}) (json.RawMessage, error) {
 
 // BytesToYAMLDoc converts a byte slice into a YAML document
 func BytesToYAMLDoc(data []byte) (interface{}, error) {
-	var canary map[interface{}]interface{} // validate this is an object and not a different type
-	if err := yaml.Unmarshal(data, &canary); err != nil {
+	var document yaml.Node // preserve order that is present in the document
+	if err := yaml.Unmarshal(data, &document); err != nil {
 		return nil, err
 	}
+	if document.Kind != yaml.DocumentNode || len(document.Content) != 1 || document.Content[0].Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("only YAML documents that are objects are supported")
+	}
+	return &document, nil
+}
 
-	var document yaml.MapSlice // preserve order that is present in the document
-	if err := yaml.Unmarshal(data, &document); err != nil {
-		return nil, err
+func yamlNode(root *yaml.Node) (interface{}, error) {
+	switch root.Kind {
+	case yaml.DocumentNode:
+		return yamlDocument(root)
+	case yaml.SequenceNode:
+		return yamlSequence(root)
+	case yaml.MappingNode:
+		return yamlMapping(root)
+	case yaml.ScalarNode:
+		return yamlScalar(root)
+	case yaml.AliasNode:
+		return yamlNode(root.Alias)
+	default:
+		return nil, fmt.Errorf("unsupported YAML node type: %v", root.Kind)
+	}
+}
+
+func yamlDocument(node *yaml.Node) (interface{}, error) {
+	if len(node.Content) != 1 {
+		return nil, fmt.Errorf("unexpected YAML Document node content length: %d", len(node.Content))
+	}
+	return yamlNode(node.Content[0])
+}
+
+func yamlMapping(node *yaml.Node) (interface{}, error) {
+	m := make(JSONMapSlice, len(node.Content)/2)
+
+	var j int
+	for i := 0; i < len(node.Content); i += 2 {
+		var nmi JSONMapItem
+		k, err := yamlStringScalarC(node.Content[i])
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode YAML map key: %w", err)
+		}
+		nmi.Key = k
+		v, err := yamlNode(node.Content[i+1])
+		if err != nil {
+			return nil, fmt.Errorf("unable to process YAML map value for key %q: %w", k, err)
+		}
+		nmi.Value = v
+		m[j] = nmi
+		j++
+	}
+	return m, nil
+}
+
+func yamlSequence(node *yaml.Node) (interface{}, error) {
+	s := make([]interface{}, 0)
+
+	for i := 0; i < len(node.Content); i++ {
+
+		v, err := yamlNode(node.Content[i])
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode YAML sequence value: %w", err)
+		}
+		s = append(s, v)
+	}
+	return s, nil
+}
+
+const ( // See https://yaml.org/type/
+	yamlStringScalar = "tag:yaml.org,2002:str"
+	yamlIntScalar    = "tag:yaml.org,2002:int"
+	yamlBoolScalar   = "tag:yaml.org,2002:bool"
+	yamlFloatScalar  = "tag:yaml.org,2002:float"
+	yamlTimestamp    = "tag:yaml.org,2002:timestamp"
+	yamlNull         = "tag:yaml.org,2002:null"
+)
+
+func yamlScalar(node *yaml.Node) (interface{}, error) {
+	switch node.LongTag() {
+	case yamlStringScalar:
+		return node.Value, nil
+	case yamlBoolScalar:
+		b, err := strconv.ParseBool(node.Value)
+		if err != nil {
+			return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting bool content: %w", node.Value, err)
+		}
+		return b, nil
+	case yamlIntScalar:
+		i, err := strconv.ParseInt(node.Value, 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting integer content: %w", node.Value, err)
+		}
+		return i, nil
+	case yamlFloatScalar:
+		f, err := strconv.ParseFloat(node.Value, 64)
+		if err != nil {
+			return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting float content: %w", node.Value, err)
+		}
+		return f, nil
+	case yamlTimestamp:
+		return node.Value, nil
+	case yamlNull:
+		return nil, nil
+	default:
+		return nil, fmt.Errorf("YAML tag %q is not supported", node.LongTag())
+	}
+}
+
+func yamlStringScalarC(node *yaml.Node) (string, error) {
+	if node.Kind != yaml.ScalarNode {
+		return "", fmt.Errorf("expecting a string scalar but got %q", node.Kind)
+	}
+	switch node.LongTag() {
+	case yamlStringScalar, yamlIntScalar, yamlFloatScalar:
+		return node.Value, nil
+	default:
+		return "", fmt.Errorf("YAML tag %q is not supported as map key", node.LongTag())
 	}
-	return document, nil
 }
 
 // JSONMapSlice represent a JSON object, with the order of keys maintained
@@ -105,6 +215,113 @@ func (s *JSONMapSlice) UnmarshalEasyJSON(in *jlexer.Lexer) {
 	*s = result
 }
 
+func (s JSONMapSlice) MarshalYAML() (interface{}, error) {
+	var n yaml.Node
+	n.Kind = yaml.DocumentNode
+	var nodes []*yaml.Node
+	for _, item := range s {
+		nn, err := json2yaml(item.Value)
+		if err != nil {
+			return nil, err
+		}
+		ns := []*yaml.Node{
+			{
+				Kind:  yaml.ScalarNode,
+				Tag:   yamlStringScalar,
+				Value: item.Key,
+			},
+			nn,
+		}
+		nodes = append(nodes, ns...)
+	}
+
+	n.Content = []*yaml.Node{
+		{
+			Kind:    yaml.MappingNode,
+			Content: nodes,
+		},
+	}
+
+	return yaml.Marshal(&n)
+}
+
+func json2yaml(item interface{}) (*yaml.Node, error) {
+	switch val := item.(type) {
+	case JSONMapSlice:
+		var n yaml.Node
+		n.Kind = yaml.MappingNode
+		for i := range val {
+			childNode, err := json2yaml(&val[i].Value)
+			if err != nil {
+				return nil, err
+			}
+			n.Content = append(n.Content, &yaml.Node{
+				Kind:  yaml.ScalarNode,
+				Tag:   yamlStringScalar,
+				Value: val[i].Key,
+			}, childNode)
+		}
+		return &n, nil
+	case map[string]interface{}:
+		var n yaml.Node
+		n.Kind = yaml.MappingNode
+		for k, v := range val {
+			childNode, err := json2yaml(v)
+			if err != nil {
+				return nil, err
+			}
+			n.Content = append(n.Content, &yaml.Node{
+				Kind:  yaml.ScalarNode,
+				Tag:   yamlStringScalar,
+				Value: k,
+			}, childNode)
+		}
+		return &n, nil
+	case []interface{}:
+		var n yaml.Node
+		n.Kind = yaml.SequenceNode
+		for i := range val {
+			childNode, err := json2yaml(val[i])
+			if err != nil {
+				return nil, err
+			}
+			n.Content = append(n.Content, childNode)
+		}
+		return &n, nil
+	case string:
+		return &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Tag:   yamlStringScalar,
+			Value: val,
+		}, nil
+	case float64:
+		return &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Tag:   yamlFloatScalar,
+			Value: strconv.FormatFloat(val, 'f', -1, 64),
+		}, nil
+	case int64:
+		return &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Tag:   yamlIntScalar,
+			Value: strconv.FormatInt(val, 10),
+		}, nil
+	case uint64:
+		return &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Tag:   yamlIntScalar,
+			Value: strconv.FormatUint(val, 10),
+		}, nil
+	case bool:
+		return &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Tag:   yamlBoolScalar,
+			Value: strconv.FormatBool(val),
+		}, nil
+	}
+	return nil, nil
+}
+
 // JSONMapItem represents the value of a key in a JSON object held by JSONMapSlice
 type JSONMapItem struct {
 	Key   string
@@ -173,23 +390,10 @@ func transformData(input interface{}) (out interface{}, err error) {
 	}
 
 	switch in := input.(type) {
-	case yaml.MapSlice:
-
-		o := make(JSONMapSlice, len(in))
-		for i, mi := range in {
-			var nmi JSONMapItem
-			if nmi.Key, err = format(mi.Key); err != nil {
-				return nil, err
-			}
-
-			v, ert := transformData(mi.Value)
-			if ert != nil {
-				return nil, ert
-			}
-			nmi.Value = v
-			o[i] = nmi
-		}
-		return o, nil
+	case yaml.Node:
+		return yamlNode(&in)
+	case *yaml.Node:
+		return yamlNode(in)
 	case map[interface{}]interface{}:
 		o := make(JSONMapSlice, 0, len(in))
 		for ke, va := range in {
diff --git a/vendor/github.com/go-openapi/validate/default_validator.go b/vendor/github.com/go-openapi/validate/default_validator.go
index 3e0d8c770d3c..bd14c2a269f1 100644
--- a/vendor/github.com/go-openapi/validate/default_validator.go
+++ b/vendor/github.com/go-openapi/validate/default_validator.go
@@ -92,7 +92,7 @@ func (d *defaultValidator) validateDefaultValueValidAgainstSchema() *Result {
 	res := new(Result)
 	s := d.SpecValidator
 
-	for method, pathItem := range s.analyzer.Operations() {
+	for method, pathItem := range s.expandedAnalyzer().Operations() {
 		for path, op := range pathItem {
 			// parameters
 			for _, param := range paramHelp.safeExpandedParamsFor(path, method, op.ID, res, s) {
diff --git a/vendor/github.com/go-openapi/validate/example_validator.go b/vendor/github.com/go-openapi/validate/example_validator.go
index f4b7a2dfe98b..c8bffd78e5ae 100644
--- a/vendor/github.com/go-openapi/validate/example_validator.go
+++ b/vendor/github.com/go-openapi/validate/example_validator.go
@@ -68,7 +68,7 @@ func (ex *exampleValidator) validateExampleValueValidAgainstSchema() *Result {
 	res := new(Result)
 	s := ex.SpecValidator
 
-	for method, pathItem := range s.analyzer.Operations() {
+	for method, pathItem := range s.expandedAnalyzer().Operations() {
 		for path, op := range pathItem {
 			// parameters
 			for _, param := range paramHelp.safeExpandedParamsFor(path, method, op.ID, res, s) {
diff --git a/vendor/github.com/go-openapi/validate/helpers.go b/vendor/github.com/go-openapi/validate/helpers.go
index 5d901dda7177..48ebfab58e54 100644
--- a/vendor/github.com/go-openapi/validate/helpers.go
+++ b/vendor/github.com/go-openapi/validate/helpers.go
@@ -210,7 +210,7 @@ type paramHelper struct {
 }
 
 func (h *paramHelper) safeExpandedParamsFor(path, method, operationID string, res *Result, s *SpecValidator) (params []spec.Parameter) {
-	operation, ok := s.analyzer.OperationFor(method, path)
+	operation, ok := s.expandedAnalyzer().OperationFor(method, path)
 	if ok {
 		// expand parameters first if necessary
 		resolvedParams := []spec.Parameter{}
@@ -224,7 +224,7 @@ func (h *paramHelper) safeExpandedParamsFor(path, method, operationID string, re
 		// remove params with invalid expansion from Slice
 		operation.Parameters = resolvedParams
 
-		for _, ppr := range s.analyzer.SafeParamsFor(method, path,
+		for _, ppr := range s.expandedAnalyzer().SafeParamsFor(method, path,
 			func(p spec.Parameter, err error) bool {
 				// since params have already been expanded, there are few causes for error
 				res.AddErrors(someParametersBrokenMsg(path, method, operationID))
diff --git a/vendor/github.com/go-openapi/validate/spec.go b/vendor/github.com/go-openapi/validate/spec.go
index cdf5627a2c81..dff01f00be73 100644
--- a/vendor/github.com/go-openapi/validate/spec.go
+++ b/vendor/github.com/go-openapi/validate/spec.go
@@ -624,7 +624,7 @@ func (s *SpecValidator) validateParameters() *Result {
 	// - path param must be required
 	res := new(Result)
 	rexGarbledPathSegment := mustCompileRegexp(`.*[{}\s]+.*`)
-	for method, pi := range s.analyzer.Operations() {
+	for method, pi := range s.expandedAnalyzer().Operations() {
 		methodPaths := make(map[string]map[string]string)
 		for path, op := range pi {
 			pathToAdd := pathHelp.stripParametersInPath(path)
@@ -793,3 +793,12 @@ func (s *SpecValidator) checkUniqueParams(path, method string, op *spec.Operatio
 func (s *SpecValidator) SetContinueOnErrors(c bool) {
 	s.Options.ContinueOnErrors = c
 }
+
+// expandedAnalyzer returns expanded.Analyzer when it is available.
+// otherwise just analyzer.
+func (s *SpecValidator) expandedAnalyzer() *analysis.Spec {
+	if s.expanded != nil && s.expanded.Analyzer != nil {
+		return s.expanded.Analyzer
+	}
+	return s.analyzer
+}
diff --git a/vendor/github.com/cloudflare/cloudflare-go/.gitignore b/vendor/github.com/grafana/cloudflare-go/.gitignore
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/.gitignore
rename to vendor/github.com/grafana/cloudflare-go/.gitignore
diff --git a/vendor/github.com/cloudflare/cloudflare-go/.golintci.yaml b/vendor/github.com/grafana/cloudflare-go/.golintci.yaml
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/.golintci.yaml
rename to vendor/github.com/grafana/cloudflare-go/.golintci.yaml
diff --git a/vendor/github.com/cloudflare/cloudflare-go/CODE_OF_CONDUCT.md b/vendor/github.com/grafana/cloudflare-go/CODE_OF_CONDUCT.md
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/CODE_OF_CONDUCT.md
rename to vendor/github.com/grafana/cloudflare-go/CODE_OF_CONDUCT.md
diff --git a/vendor/github.com/cloudflare/cloudflare-go/LICENSE b/vendor/github.com/grafana/cloudflare-go/LICENSE
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/LICENSE
rename to vendor/github.com/grafana/cloudflare-go/LICENSE
diff --git a/vendor/github.com/cloudflare/cloudflare-go/README.md b/vendor/github.com/grafana/cloudflare-go/README.md
similarity index 94%
rename from vendor/github.com/cloudflare/cloudflare-go/README.md
rename to vendor/github.com/grafana/cloudflare-go/README.md
index f2fff48d85e3..81abe76ad71b 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/README.md
+++ b/vendor/github.com/grafana/cloudflare-go/README.md
@@ -51,7 +51,7 @@ issue) to discuss any non-trivial changes before submitting code.
 
 ## Installation
 
-You need a working Go environment.
+You need a working Go environment. We officially support only currently supported Go versions according to [Go project's release policy](https://go.dev/doc/devel/release#policy).
 
 ```
 go get github.com/cloudflare/cloudflare-go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_application.go b/vendor/github.com/grafana/cloudflare-go/access_application.go
similarity index 98%
rename from vendor/github.com/cloudflare/cloudflare-go/access_application.go
rename to vendor/github.com/grafana/cloudflare-go/access_application.go
index bc83fda7adc0..6ca570ecec5e 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/access_application.go
+++ b/vendor/github.com/grafana/cloudflare-go/access_application.go
@@ -21,6 +21,7 @@ const (
 	SSH        AccessApplicationType = "ssh"
 	VNC        AccessApplicationType = "vnc"
 	File       AccessApplicationType = "file"
+	Bookmark   AccessApplicationType = "bookmark"
 )
 
 // AccessApplication represents an Access application.
@@ -43,6 +44,7 @@ type AccessApplication struct {
 	SameSiteCookieAttribute string                        `json:"same_site_cookie_attribute,omitempty"`
 	LogoURL                 string                        `json:"logo_url,omitempty"`
 	SkipInterstitial        bool                          `json:"skip_interstitial,omitempty"`
+	AppLauncherVisible    bool                            `json:"app_launcher_visible,omitempty"`
 }
 
 // AccessApplicationCorsHeaders represents the CORS HTTP headers for an Access
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_audit_log.go b/vendor/github.com/grafana/cloudflare-go/access_audit_log.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_audit_log.go
rename to vendor/github.com/grafana/cloudflare-go/access_audit_log.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_ca_certificate.go b/vendor/github.com/grafana/cloudflare-go/access_ca_certificate.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_ca_certificate.go
rename to vendor/github.com/grafana/cloudflare-go/access_ca_certificate.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_group.go b/vendor/github.com/grafana/cloudflare-go/access_group.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_group.go
rename to vendor/github.com/grafana/cloudflare-go/access_group.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_identity_provider.go b/vendor/github.com/grafana/cloudflare-go/access_identity_provider.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_identity_provider.go
rename to vendor/github.com/grafana/cloudflare-go/access_identity_provider.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_keys.go b/vendor/github.com/grafana/cloudflare-go/access_keys.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_keys.go
rename to vendor/github.com/grafana/cloudflare-go/access_keys.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_mutual_tls_certificates.go b/vendor/github.com/grafana/cloudflare-go/access_mutual_tls_certificates.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_mutual_tls_certificates.go
rename to vendor/github.com/grafana/cloudflare-go/access_mutual_tls_certificates.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_organization.go b/vendor/github.com/grafana/cloudflare-go/access_organization.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_organization.go
rename to vendor/github.com/grafana/cloudflare-go/access_organization.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_policy.go b/vendor/github.com/grafana/cloudflare-go/access_policy.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_policy.go
rename to vendor/github.com/grafana/cloudflare-go/access_policy.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/access_service_tokens.go b/vendor/github.com/grafana/cloudflare-go/access_service_tokens.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/access_service_tokens.go
rename to vendor/github.com/grafana/cloudflare-go/access_service_tokens.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/account_members.go b/vendor/github.com/grafana/cloudflare-go/account_members.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/account_members.go
rename to vendor/github.com/grafana/cloudflare-go/account_members.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/account_roles.go b/vendor/github.com/grafana/cloudflare-go/account_roles.go
similarity index 97%
rename from vendor/github.com/cloudflare/cloudflare-go/account_roles.go
rename to vendor/github.com/grafana/cloudflare-go/account_roles.go
index 0a0662ec4787..ea1582e70500 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/account_roles.go
+++ b/vendor/github.com/grafana/cloudflare-go/account_roles.go
@@ -45,7 +45,7 @@ type AccountRoleDetailResponse struct {
 //
 // API reference: https://api.cloudflare.com/#account-roles-list-roles
 func (api *API) AccountRoles(ctx context.Context, accountID string) ([]AccountRole, error) {
-	uri := fmt.Sprintf("/accounts/%s/roles", accountID)
+	uri := fmt.Sprintf("/accounts/%s/roles?per_page=50", accountID)
 
 	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
 	if err != nil {
diff --git a/vendor/github.com/cloudflare/cloudflare-go/accounts.go b/vendor/github.com/grafana/cloudflare-go/accounts.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/accounts.go
rename to vendor/github.com/grafana/cloudflare-go/accounts.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/api_token.go b/vendor/github.com/grafana/cloudflare-go/api_token.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/api_token.go
rename to vendor/github.com/grafana/cloudflare-go/api_token.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/argo.go b/vendor/github.com/grafana/cloudflare-go/argo.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/argo.go
rename to vendor/github.com/grafana/cloudflare-go/argo.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/argo_tunnel.go b/vendor/github.com/grafana/cloudflare-go/argo_tunnel.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/argo_tunnel.go
rename to vendor/github.com/grafana/cloudflare-go/argo_tunnel.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/auditlogs.go b/vendor/github.com/grafana/cloudflare-go/auditlogs.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/auditlogs.go
rename to vendor/github.com/grafana/cloudflare-go/auditlogs.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/authenticated_origin_pulls.go b/vendor/github.com/grafana/cloudflare-go/authenticated_origin_pulls.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/authenticated_origin_pulls.go
rename to vendor/github.com/grafana/cloudflare-go/authenticated_origin_pulls.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/authenticated_origin_pulls_per_hostname.go b/vendor/github.com/grafana/cloudflare-go/authenticated_origin_pulls_per_hostname.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/authenticated_origin_pulls_per_hostname.go
rename to vendor/github.com/grafana/cloudflare-go/authenticated_origin_pulls_per_hostname.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/authenticated_origin_pulls_per_zone.go b/vendor/github.com/grafana/cloudflare-go/authenticated_origin_pulls_per_zone.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/authenticated_origin_pulls_per_zone.go
rename to vendor/github.com/grafana/cloudflare-go/authenticated_origin_pulls_per_zone.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/certificate_packs.go b/vendor/github.com/grafana/cloudflare-go/certificate_packs.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/certificate_packs.go
rename to vendor/github.com/grafana/cloudflare-go/certificate_packs.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/cloudflare.go b/vendor/github.com/grafana/cloudflare-go/cloudflare.go
similarity index 97%
rename from vendor/github.com/cloudflare/cloudflare-go/cloudflare.go
rename to vendor/github.com/grafana/cloudflare-go/cloudflare.go
index 1a7ab31cb3f0..74a5641c4545 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/cloudflare.go
+++ b/vendor/github.com/grafana/cloudflare-go/cloudflare.go
@@ -6,6 +6,7 @@ import (
 	"compress/gzip"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"log"
@@ -316,7 +317,10 @@ func (b *closeDiscardBody) Read(p []byte) (n int, err error) {
 }
 
 func (b *closeDiscardBody) Close() error {
-	_, _ = io.Copy(ioutil.Discard, b.body)
+	_, err := io.Copy(ioutil.Discard, b.body)
+	if err != nil {
+		return fmt.Errorf("failed to discard response body: %w", err)
+	}
 	return b.body.Close()
 }
 
@@ -325,13 +329,16 @@ func newGzipResponseBody(body io.ReadCloser) (io.ReadCloser, error) {
 	if gz == nil {
 		gzipReader, err := gzip.NewReader(body)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("error creating gzip reader: %w", err)
 		}
 		return &gzipResponseBody{body: body, gzip: gzipReader}, nil
 	}
 	res := gz.(*gzipResponseBody)
 	err := res.Reset(body)
-	return res, err
+	if err != nil {
+		return nil, fmt.Errorf("error resetting gzip reader: %w", err)
+	}
+	return res, nil
 }
 
 func (b *gzipResponseBody) Read(p []byte) (int, error) {
@@ -370,6 +377,10 @@ func readBody(resp *http.Response) ([]byte, error) {
 		err  error
 	)
 	if body, err = getBodyReader(resp); err != nil {
+		_, copyErr := io.Copy(ioutil.Discard, resp.Body)
+		if copyErr != nil {
+			err = fmt.Errorf("%v: %w", err, copyErr)
+		}
 		return nil, err
 	}
 	defer body.Close()
diff --git a/vendor/github.com/cloudflare/cloudflare-go/consts.go b/vendor/github.com/grafana/cloudflare-go/consts.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/consts.go
rename to vendor/github.com/grafana/cloudflare-go/consts.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/custom_hostname.go b/vendor/github.com/grafana/cloudflare-go/custom_hostname.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/custom_hostname.go
rename to vendor/github.com/grafana/cloudflare-go/custom_hostname.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/custom_pages.go b/vendor/github.com/grafana/cloudflare-go/custom_pages.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/custom_pages.go
rename to vendor/github.com/grafana/cloudflare-go/custom_pages.go
diff --git a/vendor/github.com/grafana/cloudflare-go/device_posture_rule.go b/vendor/github.com/grafana/cloudflare-go/device_posture_rule.go
new file mode 100644
index 000000000000..138fe414b77a
--- /dev/null
+++ b/vendor/github.com/grafana/cloudflare-go/device_posture_rule.go
@@ -0,0 +1,305 @@
+package cloudflare
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/pkg/errors"
+)
+
+// DevicePostureIntegrationConfig contains authentication information
+// for a device posture integration.
+type DevicePostureIntegrationConfig struct {
+	ClientID     string `json:"client_id,omitempty"`
+	ClientSecret string `json:"client_secret,omitempty"`
+	AuthUrl      string `json:"auth_url,omitempty"`
+	ApiUrl       string `json:"api_url,omitempty"`
+}
+
+// DevicePosturIntegration represents a device posture integration.
+type DevicePostureIntegration struct {
+	IntegrationID string                         `json:"id,omitempty"`
+	Name          string                         `json:"name,omitempty"`
+	Type          string                         `json:"type,omitempty"`
+	Interval      string                         `json:"interval,omitempty"`
+	Config        DevicePostureIntegrationConfig `json:"config,omitempty"`
+}
+
+// DevicePostureIntegrationResponse represents the response from the get
+// device posture integrations endpoint.
+type DevicePostureIntegrationResponse struct {
+	Result DevicePostureIntegration `json:"result"`
+	Response
+	ResultInfo `json:"result_info"`
+}
+
+// DevicePostureIntegrationListResponse represents the response from the list
+// device posture integrations endpoint.
+type DevicePostureIntegrationListResponse struct {
+	Result []DevicePostureIntegration `json:"result"`
+	Response
+	ResultInfo `json:"result_info"`
+}
+
+// CreateDevicePostureIntegration creates a device posture integration within an account.
+//
+// API reference: https://api.cloudflare.com/#device-posture-integrations-create-device-posture-integration
+func (api *API) CreateDevicePostureIntegration(ctx context.Context, accountID string, integration DevicePostureIntegration) (DevicePostureIntegration, error) {
+	uri := fmt.Sprintf("/%s/%s/devices/posture/integration", AccountRouteRoot, accountID)
+
+	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, integration)
+	if err != nil {
+		fmt.Printf("err:%+v res:%+v\n", err, res)
+		return DevicePostureIntegration{}, err
+	}
+
+	var devicePostureIntegrationResponse DevicePostureIntegrationResponse
+	err = json.Unmarshal(res, &devicePostureIntegrationResponse)
+	if err != nil {
+		return DevicePostureIntegration{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureIntegrationResponse.Result, nil
+}
+
+// UpdateDevicePostureIntegration updates a device posture integration within an account.
+//
+// API reference: https://api.cloudflare.com/#device-posture-integrations-update-device-posture-integration
+func (api *API) UpdateDevicePostureIntegration(ctx context.Context, accountID string, integration DevicePostureIntegration) (DevicePostureIntegration, error) {
+	uri := fmt.Sprintf("/%s/%s/devices/posture/integration/%s", AccountRouteRoot, accountID, integration.IntegrationID)
+
+	res, err := api.makeRequestContext(ctx, http.MethodPatch, uri, integration)
+	if err != nil {
+		return DevicePostureIntegration{}, err
+	}
+
+	var devicePostureIntegrationResponse DevicePostureIntegrationResponse
+	err = json.Unmarshal(res, &devicePostureIntegrationResponse)
+	if err != nil {
+		return DevicePostureIntegration{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureIntegrationResponse.Result, nil
+}
+
+// DevicePostureIntegration returns a specific device posture integrations within an account.
+//
+// API reference: https://api.cloudflare.com/#device-posture-integrations-device-posture-integration-details
+func (api *API) DevicePostureIntegration(ctx context.Context, accountID, integrationID string) (DevicePostureIntegration, error) {
+	uri := fmt.Sprintf("/%s/%s/devices/posture/integration/%s", AccountRouteRoot, accountID, integrationID)
+
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return DevicePostureIntegration{}, err
+	}
+
+	var devicePostureIntegrationResponse DevicePostureIntegrationResponse
+	err = json.Unmarshal(res, &devicePostureIntegrationResponse)
+	if err != nil {
+		return DevicePostureIntegration{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureIntegrationResponse.Result, nil
+}
+
+// DevicePostureIntegrations returns all device posture integrations within an account.
+//
+// API reference: https://api.cloudflare.com/#device-posture-integrations-list-device-posture-integrations
+func (api *API) DevicePostureIntegrations(ctx context.Context, accountID string) ([]DevicePostureIntegration, ResultInfo, error) {
+	uri := fmt.Sprintf("/%s/%s/devices/posture/integration", AccountRouteRoot, accountID)
+
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return []DevicePostureIntegration{}, ResultInfo{}, err
+	}
+
+	var devicePostureIntegrationListResponse DevicePostureIntegrationListResponse
+	err = json.Unmarshal(res, &devicePostureIntegrationListResponse)
+	if err != nil {
+		return []DevicePostureIntegration{}, ResultInfo{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureIntegrationListResponse.Result, devicePostureIntegrationListResponse.ResultInfo, nil
+}
+
+// DeleteDevicePostureIntegration deletes a device posture integration.
+//
+// API reference: https://api.cloudflare.com/#device-posture-integrations-delete-device-posture-integration
+func (api *API) DeleteDevicePostureIntegration(ctx context.Context, accountID, ruleID string) error {
+	uri := fmt.Sprintf(
+		"/%s/%s/devices/posture/integration/%s",
+		AccountRouteRoot,
+		accountID,
+		ruleID,
+	)
+
+	_, err := api.makeRequestContext(ctx, http.MethodDelete, uri, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// DevicePostureRule represents a device posture rule.
+type DevicePostureRule struct {
+	ID          string                   `json:"id,omitempty"`
+	Type        string                   `json:"type"`
+	Name        string                   `json:"name"`
+	Description string                   `json:"description,omitempty"`
+	Schedule    string                   `json:"schedule,omitempty"`
+	Match       []DevicePostureRuleMatch `json:"match,omitempty"`
+	Input       DevicePostureRuleInput   `json:"input,omitempty"`
+}
+
+// DevicePostureRuleMatch represents the conditions that the client must match to run the rule.
+type DevicePostureRuleMatch struct {
+	Platform string `json:"platform,omitempty"`
+}
+
+// DevicePostureRuleInput represents the value to be checked against.
+type DevicePostureRuleInput struct {
+	ID               string `json:"id,omitempty"`
+	Path             string `json:"path,omitempty"`
+	Exists           bool   `json:"exists,omitempty"`
+	Thumbprint       string `json:"thumbprint,omitempty"`
+	Sha256           string `json:"sha256,omitempty"`
+	Running          bool   `json:"running,omitempty"`
+	RequireAll       bool   `json:"requireAll,omitempty"`
+	Enabled          bool   `json:"enabled,omitempty"`
+	Version          string `json:"version,omitempty"`
+	Operator         string `json:"operator,omitempty"`
+	Domain           string `json:"domain,omitempty"`
+	ComplianceStatus string `json:"compliance_status,omitempty"`
+	ConnectionID     string `json:"connection_id,omitempty"`
+}
+
+// DevicePostureRuleListResponse represents the response from the list
+// device posture rules endpoint.
+type DevicePostureRuleListResponse struct {
+	Result []DevicePostureRule `json:"result"`
+	Response
+	ResultInfo `json:"result_info"`
+}
+
+// DevicePostureRuleDetailResponse is the API response, containing a single
+// device posture rule.
+type DevicePostureRuleDetailResponse struct {
+	Response
+	Result DevicePostureRule `json:"result"`
+}
+
+// DevicePostureRules returns all device posture rules within an account.
+//
+// API reference: https://api.cloudflare.com/#device-posture-rules-list-device-posture-rules
+func (api *API) DevicePostureRules(ctx context.Context, accountID string) ([]DevicePostureRule, ResultInfo, error) {
+	uri := fmt.Sprintf("/%s/%s/devices/posture", AccountRouteRoot, accountID)
+
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return []DevicePostureRule{}, ResultInfo{}, err
+	}
+
+	var devicePostureRuleListResponse DevicePostureRuleListResponse
+	err = json.Unmarshal(res, &devicePostureRuleListResponse)
+	if err != nil {
+		return []DevicePostureRule{}, ResultInfo{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureRuleListResponse.Result, devicePostureRuleListResponse.ResultInfo, nil
+}
+
+// DevicePostureRule returns a single device posture rule based on the rule ID.
+//
+// API reference: https://api.cloudflare.com/#device-posture-rules-device-posture-rules-details
+func (api *API) DevicePostureRule(ctx context.Context, accountID, ruleID string) (DevicePostureRule, error) {
+	uri := fmt.Sprintf(
+		"/%s/%s/devices/posture/%s",
+		AccountRouteRoot,
+		accountID,
+		ruleID,
+	)
+
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return DevicePostureRule{}, err
+	}
+
+	var devicePostureRuleDetailResponse DevicePostureRuleDetailResponse
+	err = json.Unmarshal(res, &devicePostureRuleDetailResponse)
+	if err != nil {
+		return DevicePostureRule{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureRuleDetailResponse.Result, nil
+}
+
+// CreateDevicePostureRule creates a new device posture rule.
+//
+// API reference: https://api.cloudflare.com/#device-posture-rules-create-device-posture-rule
+func (api *API) CreateDevicePostureRule(ctx context.Context, accountID string, rule DevicePostureRule) (DevicePostureRule, error) {
+	uri := fmt.Sprintf("/%s/%s/devices/posture", AccountRouteRoot, accountID)
+
+	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, rule)
+	if err != nil {
+		return DevicePostureRule{}, err
+	}
+
+	var devicePostureRuleDetailResponse DevicePostureRuleDetailResponse
+	err = json.Unmarshal(res, &devicePostureRuleDetailResponse)
+	if err != nil {
+		return DevicePostureRule{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureRuleDetailResponse.Result, nil
+}
+
+// UpdateDevicePostureRule updates an existing device posture rule.
+//
+// API reference: https://api.cloudflare.com/#device-posture-rules-update-device-posture-rule
+func (api *API) UpdateDevicePostureRule(ctx context.Context, accountID string, rule DevicePostureRule) (DevicePostureRule, error) {
+	if rule.ID == "" {
+		return DevicePostureRule{}, errors.Errorf("device posture rule ID cannot be empty")
+	}
+
+	uri := fmt.Sprintf(
+		"/%s/%s/devices/posture/%s",
+		AccountRouteRoot,
+		accountID,
+		rule.ID,
+	)
+
+	res, err := api.makeRequestContext(ctx, http.MethodPut, uri, rule)
+	if err != nil {
+		return DevicePostureRule{}, err
+	}
+
+	var devicePostureRuleDetailResponse DevicePostureRuleDetailResponse
+	err = json.Unmarshal(res, &devicePostureRuleDetailResponse)
+	if err != nil {
+		return DevicePostureRule{}, errors.Wrap(err, errUnmarshalError)
+	}
+
+	return devicePostureRuleDetailResponse.Result, nil
+}
+
+// DeleteDevicePostureRule deletes a device posture rule.
+//
+// API reference: https://api.cloudflare.com/#device-posture-rules-delete-device-posture-rule
+func (api *API) DeleteDevicePostureRule(ctx context.Context, accountID, ruleID string) error {
+	uri := fmt.Sprintf(
+		"/%s/%s/devices/posture/%s",
+		AccountRouteRoot,
+		accountID,
+		ruleID,
+	)
+
+	_, err := api.makeRequestContext(ctx, http.MethodDelete, uri, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/vendor/github.com/cloudflare/cloudflare-go/diagnostics.go b/vendor/github.com/grafana/cloudflare-go/diagnostics.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/diagnostics.go
rename to vendor/github.com/grafana/cloudflare-go/diagnostics.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/dns.go b/vendor/github.com/grafana/cloudflare-go/dns.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/dns.go
rename to vendor/github.com/grafana/cloudflare-go/dns.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/duration.go b/vendor/github.com/grafana/cloudflare-go/duration.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/duration.go
rename to vendor/github.com/grafana/cloudflare-go/duration.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/errors.go b/vendor/github.com/grafana/cloudflare-go/errors.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/errors.go
rename to vendor/github.com/grafana/cloudflare-go/errors.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/filter.go b/vendor/github.com/grafana/cloudflare-go/filter.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/filter.go
rename to vendor/github.com/grafana/cloudflare-go/filter.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/firewall.go b/vendor/github.com/grafana/cloudflare-go/firewall.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/firewall.go
rename to vendor/github.com/grafana/cloudflare-go/firewall.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/firewall_rules.go b/vendor/github.com/grafana/cloudflare-go/firewall_rules.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/firewall_rules.go
rename to vendor/github.com/grafana/cloudflare-go/firewall_rules.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/healthchecks.go b/vendor/github.com/grafana/cloudflare-go/healthchecks.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/healthchecks.go
rename to vendor/github.com/grafana/cloudflare-go/healthchecks.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/ip_address_management.go b/vendor/github.com/grafana/cloudflare-go/ip_address_management.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/ip_address_management.go
rename to vendor/github.com/grafana/cloudflare-go/ip_address_management.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/ip_list.go b/vendor/github.com/grafana/cloudflare-go/ip_list.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/ip_list.go
rename to vendor/github.com/grafana/cloudflare-go/ip_list.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/ips.go b/vendor/github.com/grafana/cloudflare-go/ips.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/ips.go
rename to vendor/github.com/grafana/cloudflare-go/ips.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/keyless.go b/vendor/github.com/grafana/cloudflare-go/keyless.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/keyless.go
rename to vendor/github.com/grafana/cloudflare-go/keyless.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/load_balancing.go b/vendor/github.com/grafana/cloudflare-go/load_balancing.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/load_balancing.go
rename to vendor/github.com/grafana/cloudflare-go/load_balancing.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/lockdown.go b/vendor/github.com/grafana/cloudflare-go/lockdown.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/lockdown.go
rename to vendor/github.com/grafana/cloudflare-go/lockdown.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/logpull.go b/vendor/github.com/grafana/cloudflare-go/logpull.go
similarity index 91%
rename from vendor/github.com/cloudflare/cloudflare-go/logpull.go
rename to vendor/github.com/grafana/cloudflare-go/logpull.go
index 8351b4942919..aeb2a3e6716e 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/logpull.go
+++ b/vendor/github.com/grafana/cloudflare-go/logpull.go
@@ -103,7 +103,7 @@ type (
 //
 // API reference: https://developers.cloudflare.com/logs/logpull/requesting-logs
 func (api *API) LogpullReceived(ctx context.Context, zoneID string, start, end time.Time, opts LogpullReceivedOption) (LogpullReceivedIterator, error) {
-	uri := fmt.Sprintf("/zones/%s/logs/received", zoneID)
+	uri := "/zones/" + zoneID + "/logs/received"
 	v := url.Values{}
 
 	v.Set("start", strconv.FormatInt(start.UnixNano(), 10))
@@ -134,18 +134,22 @@ func (api *API) LogpullReceived(ctx context.Context, zoneID string, start, end t
 	}, nil
 }
 
+// Next Advances the iterator to the next log line, returns true if there is a line to be read.
 func (r *logpullReceivedResponse) Next() bool {
 	return r.scanner.Scan()
 }
 
+// Err returns the last error encountered while iterating.
 func (r *logpullReceivedResponse) Err() error {
 	return r.scanner.Err()
 }
 
+// Line returns the current raw log line as a slice of bytes, you must copy the line as each call to `Next()` will change its value.
 func (r *logpullReceivedResponse) Line() []byte {
 	return r.scanner.Bytes()
 }
 
+// Fields returns the parsed log fields as a map of string.
 func (r *logpullReceivedResponse) Fields() (map[string]string, error) {
 	var fields map[string]string
 	data := r.Line()
@@ -153,6 +157,7 @@ func (r *logpullReceivedResponse) Fields() (map[string]string, error) {
 	return fields, err
 }
 
+// Close closes the iterator.
 func (r *logpullReceivedResponse) Close() error {
 	return r.reader.Close()
 }
@@ -161,7 +166,7 @@ func (r *logpullReceivedResponse) Close() error {
 //
 // API reference: https://developers.cloudflare.com/logs/logpull/requesting-logs
 func (api *API) LogpullFields(ctx context.Context, zoneID string) (map[string]string, error) {
-	uri := fmt.Sprintf("/zones/%s/logs/received/fields", zoneID)
+	uri := "/zones/" + zoneID + "/logs/received/fields"
 	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
 	if err != nil {
 		return nil, err
diff --git a/vendor/github.com/grafana/cloudflare-go/logpush.go b/vendor/github.com/grafana/cloudflare-go/logpush.go
new file mode 100644
index 000000000000..c4aed24e048c
--- /dev/null
+++ b/vendor/github.com/grafana/cloudflare-go/logpush.go
@@ -0,0 +1,493 @@
+package cloudflare
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+// LogpushJob describes a Logpush job.
+type LogpushJob struct {
+	ID                 int        `json:"id,omitempty"`
+	Dataset            string     `json:"dataset"`
+	Enabled            bool       `json:"enabled"`
+	Name               string     `json:"name"`
+	LogpullOptions     string     `json:"logpull_options"`
+	DestinationConf    string     `json:"destination_conf"`
+	OwnershipChallenge string     `json:"ownership_challenge,omitempty"`
+	LastComplete       *time.Time `json:"last_complete,omitempty"`
+	LastError          *time.Time `json:"last_error,omitempty"`
+	ErrorMessage       string     `json:"error_message,omitempty"`
+}
+
+// LogpushJobsResponse is the API response, containing an array of Logpush Jobs.
+type LogpushJobsResponse struct {
+	Response
+	Result []LogpushJob `json:"result"`
+}
+
+// LogpushJobDetailsResponse is the API response, containing a single Logpush Job.
+type LogpushJobDetailsResponse struct {
+	Response
+	Result LogpushJob `json:"result"`
+}
+
+// LogpushFieldsResponse is the API response for a datasets fields
+type LogpushFieldsResponse struct {
+	Response
+	Result LogpushFields `json:"result"`
+}
+
+// LogpushFields is a map of available Logpush field names & descriptions
+type LogpushFields map[string]string
+
+// LogpushGetOwnershipChallenge describes a ownership validation.
+type LogpushGetOwnershipChallenge struct {
+	Filename string `json:"filename"`
+	Valid    bool   `json:"valid"`
+	Message  string `json:"message"`
+}
+
+// LogpushGetOwnershipChallengeResponse is the API response, containing a ownership challenge.
+type LogpushGetOwnershipChallengeResponse struct {
+	Response
+	Result LogpushGetOwnershipChallenge `json:"result"`
+}
+
+// LogpushGetOwnershipChallengeRequest is the API request for get ownership challenge.
+type LogpushGetOwnershipChallengeRequest struct {
+	DestinationConf string `json:"destination_conf"`
+}
+
+// LogpushOwnershipChallengeValidationResponse is the API response,
+// containing a ownership challenge validation result.
+type LogpushOwnershipChallengeValidationResponse struct {
+	Response
+	Result struct {
+		Valid bool `json:"valid"`
+	}
+}
+
+// LogpushValidateOwnershipChallengeRequest is the API request for validate ownership challenge.
+type LogpushValidateOwnershipChallengeRequest struct {
+	DestinationConf    string `json:"destination_conf"`
+	OwnershipChallenge string `json:"ownership_challenge"`
+}
+
+// LogpushDestinationExistsResponse is the API response,
+// containing a destination exists check result.
+type LogpushDestinationExistsResponse struct {
+	Response
+	Result struct {
+		Exists bool `json:"exists"`
+	}
+}
+
+// LogpushDestinationExistsRequest is the API request for check destination exists.
+type LogpushDestinationExistsRequest struct {
+	DestinationConf string `json:"destination_conf"`
+}
+
+// CreateAccountLogpushJob creates a new account-level Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-create-logpush-job
+func (api *API) CreateAccountLogpushJob(ctx context.Context, accountID string, job LogpushJob) (*LogpushJob, error) {
+	return api.createLogpushJob(ctx, AccountRouteRoot, accountID, job)
+}
+
+// CreateZoneLogpushJob creates a new zone-level Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-create-logpush-job
+func (api *API) CreateZoneLogpushJob(ctx context.Context, zoneID string, job LogpushJob) (*LogpushJob, error) {
+	return api.createLogpushJob(ctx, ZoneRouteRoot, zoneID, job)
+}
+
+// CreateLogpushJob creates a new zone-level Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-create-logpush-job
+//
+// Deprecated: Use `CreateZoneLogpushJob` or `CreateAccountLogpushJob` depending 
+// on the desired resource to target.
+func (api *API) CreateLogpushJob(ctx context.Context, zoneID string, job LogpushJob) (*LogpushJob, error) {
+	return api.createLogpushJob(ctx, ZoneRouteRoot, zoneID, job)
+}
+
+func (api *API) createLogpushJob(ctx context.Context, identifierType RouteRoot, identifier string, job LogpushJob) (*LogpushJob, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/jobs", identifierType, identifier)
+	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, job)
+	if err != nil {
+		return nil, err
+	}
+	var r LogpushJobDetailsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return nil, errors.Wrap(err, errUnmarshalError)
+	}
+	return &r.Result, nil
+}
+
+// ListAccountLogpushJobs returns all account-level Logpush Jobs for all datasets.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
+func (api *API) ListAccountLogpushJobs(ctx context.Context, accountID string) ([]LogpushJob, error) {
+	return api.listLogpushJobs(ctx, AccountRouteRoot, accountID)
+}
+
+// ListZoneLogpushJobs returns all zone-level Logpush Jobs for all datasets.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
+func (api *API) ListZoneLogpushJobs(ctx context.Context, zoneID string) ([]LogpushJob, error) {
+	return api.listLogpushJobs(ctx, ZoneRouteRoot, zoneID)
+}
+
+// LogpushJobs returns all zone-level Logpush Jobs for all datasets.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
+//
+// Deprecated: Use `ListZoneLogpushJobs` or `ListAccountLogpushJobs`
+// depending on the desired resource to target.
+func (api *API) LogpushJobs(ctx context.Context, zoneID string) ([]LogpushJob, error) {
+	return api.listLogpushJobs(ctx, ZoneRouteRoot, zoneID)
+}
+
+func (api *API) listLogpushJobs(ctx context.Context, identifierType RouteRoot, identifier string) ([]LogpushJob, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/jobs", identifierType, identifier)
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return []LogpushJob{}, err
+	}
+	var r LogpushJobsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return []LogpushJob{}, errors.Wrap(err, errUnmarshalError)
+	}
+	return r.Result, nil
+}
+
+// ListAccountLogpushJobsForDataset returns all account-level Logpush Jobs for a dataset.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs-for-a-dataset
+func (api *API) ListAccountLogpushJobsForDataset(ctx context.Context, accountID, dataset string) ([]LogpushJob, error) {
+	return api.listLogpushJobsForDataset(ctx, AccountRouteRoot, accountID, dataset)
+}
+
+// ListZoneLogpushJobsForDataset returns all zone-level Logpush Jobs for a dataset.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs-for-a-dataset
+func (api *API) ListZoneLogpushJobsForDataset(ctx context.Context, zoneID, dataset string) ([]LogpushJob, error) {
+	return api.listLogpushJobsForDataset(ctx, ZoneRouteRoot, zoneID, dataset)
+}
+
+// LogpushJobsForDataset returns all zone-level Logpush Jobs for a dataset.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs-for-a-dataset
+//
+// Deprecated: Use `ListZoneLogpushJobsForDataset` or 
+// `ListAccountLogpushJobsForDataset` depending on the desired resource
+// to target.
+func (api *API) LogpushJobsForDataset(ctx context.Context, zoneID, dataset string) ([]LogpushJob, error) {
+	return api.listLogpushJobsForDataset(ctx, ZoneRouteRoot, zoneID, dataset)
+}
+
+func (api *API) listLogpushJobsForDataset(ctx context.Context, identifierType RouteRoot, identifier, dataset string) ([]LogpushJob, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/datasets/%s/jobs", identifierType, identifier, dataset)
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return []LogpushJob{}, err
+	}
+	var r LogpushJobsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return []LogpushJob{}, errors.Wrap(err, errUnmarshalError)
+	}
+	return r.Result, nil
+}
+
+// GetAccountLogpushFields returns fields for a given account-level dataset.
+//
+// Account fields documentation: https://developers.cloudflare.com/logs/reference/log-fields/account
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
+func (api *API) GetAccountLogpushFields(ctx context.Context, accountID, dataset string) (LogpushFields, error) {
+	return api.getLogpushFields(ctx, AccountRouteRoot, accountID, dataset)
+}
+
+// GetZoneLogpushFields returns fields for a given zone-level dataset.
+//
+// Zone fields documentation: https://developers.cloudflare.com/logs/reference/log-fields/zone
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
+func (api *API) GetZoneLogpushFields(ctx context.Context, zoneID, dataset string) (LogpushFields, error) {
+	return api.getLogpushFields(ctx, ZoneRouteRoot, zoneID, dataset)
+}
+
+// LogpushFields returns fields for a given dataset.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-list-logpush-jobs
+//
+// Deprecated: Use `GetZoneLogpushFields` or `GetAccountLogpushFields` 
+// depending on the desired resource to target.
+func (api *API) LogpushFields(ctx context.Context, zoneID, dataset string) (LogpushFields, error) {
+	return api.getLogpushFields(ctx, ZoneRouteRoot, zoneID, dataset)
+}
+
+func (api *API) getLogpushFields(ctx context.Context, identifierType RouteRoot, identifier, dataset string) (LogpushFields, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/datasets/%s/fields", identifierType, identifier, dataset)
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return LogpushFields{}, err
+	}
+	var r LogpushFieldsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return LogpushFields{}, errors.Wrap(err, errUnmarshalError)
+	}
+	return r.Result, nil
+}
+
+// GetAccountLogpushJob fetches detail about one account-level Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-logpush-job-details
+func (api *API) GetAccountLogpushJob(ctx context.Context, accountID string, jobID int) (LogpushJob, error) {
+	return api.getLogpushJob(ctx, AccountRouteRoot, accountID, jobID)
+}
+
+// GetZoneLogpushJob fetches detail about one Logpush Job for a zone.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-logpush-job-details
+func (api *API) GetZoneLogpushJob(ctx context.Context, zoneID string, jobID int) (LogpushJob, error) {
+	return api.getLogpushJob(ctx, ZoneRouteRoot, zoneID, jobID)
+}
+
+// LogpushJob fetches detail about one Logpush Job for a zone.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-logpush-job-details
+//
+// Deprecated: Use `GetZoneLogpushJob` or `GetAccountLogpushJob` 
+// depending on the desired resource to target.
+func (api *API) LogpushJob(ctx context.Context, zoneID string, jobID int) (LogpushJob, error) {
+	return api.getLogpushJob(ctx, ZoneRouteRoot, zoneID, jobID)
+}
+
+func (api *API) getLogpushJob(ctx context.Context, identifierType RouteRoot, identifier string, jobID int) (LogpushJob, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/jobs/%d", identifierType, identifier, jobID)
+	res, err := api.makeRequestContext(ctx, http.MethodGet, uri, nil)
+	if err != nil {
+		return LogpushJob{}, err
+	}
+	var r LogpushJobDetailsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return LogpushJob{}, errors.Wrap(err, errUnmarshalError)
+	}
+	return r.Result, nil
+}
+
+// UpdateAccountLogpushJob lets you update an account-level Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-update-logpush-job
+func (api *API) UpdateAccountLogpushJob(ctx context.Context, accountID string, jobID int, job LogpushJob) error {
+	return api.updateLogpushJob(ctx, AccountRouteRoot, accountID, jobID, job)
+}
+
+// UpdateZoneLogpushJob lets you update a Logpush Job for a zone.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-update-logpush-job
+func (api *API) UpdateZoneLogpushJob(ctx context.Context, zoneID string, jobID int, job LogpushJob) error {
+	return api.updateLogpushJob(ctx, ZoneRouteRoot, zoneID, jobID, job)
+}
+
+// UpdateLogpushJob lets you update a Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-update-logpush-job
+//
+// Deprecated: Use `UpdateZoneLogpushJob` or `UpdateAccountLogpushJob` 
+// depending on the desired resource to target.
+func (api *API) UpdateLogpushJob(ctx context.Context, zoneID string, jobID int, job LogpushJob) error {
+	return api.updateLogpushJob(ctx, ZoneRouteRoot, zoneID, jobID, job)
+}
+
+func (api *API) updateLogpushJob(ctx context.Context, identifierType RouteRoot, identifier string, jobID int, job LogpushJob) error {
+	uri := fmt.Sprintf("/%s/%s/logpush/jobs/%d", identifierType, identifier, jobID)
+	res, err := api.makeRequestContext(ctx, http.MethodPut, uri, job)
+	if err != nil {
+		return err
+	}
+	var r LogpushJobDetailsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return errors.Wrap(err, errUnmarshalError)
+	}
+	return nil
+}
+
+// DeleteAccountLogpushJob deletes an account-level Logpush Job.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-delete-logpush-job
+func (api *API) DeleteAccountLogpushJob(ctx context.Context, accountID string, jobID int) error {
+	return api.deleteLogpushJob(ctx, AccountRouteRoot, accountID, jobID)
+}
+
+// DeleteZoneLogpushJob deletes a Logpush Job for a zone.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-delete-logpush-job
+func (api *API) DeleteZoneLogpushJob(ctx context.Context, zoneID string, jobID int) error {
+	return api.deleteLogpushJob(ctx, ZoneRouteRoot, zoneID, jobID)
+}
+
+// DeleteLogpushJob deletes a Logpush Job for a zone.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-delete-logpush-job
+//
+// Deprecated: Use `DeleteZoneLogpushJob` or `DeleteAccountLogpushJob` 
+// depending on the desired resource to target.
+func (api *API) DeleteLogpushJob(ctx context.Context, zoneID string, jobID int) error {
+	return api.deleteLogpushJob(ctx, ZoneRouteRoot, zoneID, jobID)
+}
+
+func (api *API) deleteLogpushJob(ctx context.Context, identifierType RouteRoot, identifier string, jobID int) error {
+	uri := fmt.Sprintf("/%s/%s/logpush/jobs/%d", identifierType, identifier, jobID)
+	res, err := api.makeRequestContext(ctx, http.MethodDelete, uri, nil)
+	if err != nil {
+		return err
+	}
+	var r LogpushJobDetailsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return errors.Wrap(err, errUnmarshalError)
+	}
+	return nil
+}
+
+// GetAccountLogpushOwnershipChallenge returns ownership challenge.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-get-ownership-challenge
+func (api *API) GetAccountLogpushOwnershipChallenge(ctx context.Context, accountID, destinationConf string) (*LogpushGetOwnershipChallenge, error) {
+	return api.getLogpushOwnershipChallenge(ctx, AccountRouteRoot, accountID, destinationConf)
+}
+
+// GetZoneLogpushOwnershipChallenge returns ownership challenge.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-get-ownership-challenge
+func (api *API) GetZoneLogpushOwnershipChallenge(ctx context.Context, zoneID, destinationConf string) (*LogpushGetOwnershipChallenge, error) {
+	return api.getLogpushOwnershipChallenge(ctx, ZoneRouteRoot, zoneID, destinationConf)
+}
+
+// GetLogpushOwnershipChallenge returns ownership challenge.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-get-ownership-challenge
+//
+// Deprecated: Use `GetZoneLogpushOwnershipChallenge` or
+// `GetAccountLogpushOwnershipChallenge` depending on the 
+// desired resource to target.
+func (api *API) GetLogpushOwnershipChallenge(ctx context.Context, zoneID, destinationConf string) (*LogpushGetOwnershipChallenge, error) {
+	return api.getLogpushOwnershipChallenge(ctx, ZoneRouteRoot, zoneID, destinationConf)
+}
+
+func (api *API) getLogpushOwnershipChallenge(ctx context.Context, identifierType RouteRoot, identifier, destinationConf string) (*LogpushGetOwnershipChallenge, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/ownership", identifierType, identifier)
+	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, LogpushGetOwnershipChallengeRequest{
+		DestinationConf: destinationConf,
+	})
+	if err != nil {
+		return nil, err
+	}
+	var r LogpushGetOwnershipChallengeResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return nil, errors.Wrap(err, errUnmarshalError)
+	}
+
+	if !r.Result.Valid {
+		return nil, errors.New(r.Result.Message)
+	}
+
+	return &r.Result, nil
+}
+
+// ValidateAccountLogpushOwnershipChallenge returns account-level ownership challenge validation result.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-validate-ownership-challenge
+func (api *API) ValidateAccountLogpushOwnershipChallenge(ctx context.Context, accountID, destinationConf, ownershipChallenge string) (bool, error) {
+	return api.validateLogpushOwnershipChallenge(ctx, AccountRouteRoot, accountID, destinationConf, ownershipChallenge)
+}
+
+// ValidateZoneLogpushOwnershipChallenge returns zone-level ownership challenge validation result.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-validate-ownership-challenge
+func (api *API) ValidateZoneLogpushOwnershipChallenge(ctx context.Context, zoneID, destinationConf, ownershipChallenge string) (bool, error) {
+	return api.validateLogpushOwnershipChallenge(ctx, ZoneRouteRoot, zoneID, destinationConf, ownershipChallenge)
+}
+
+// ValidateLogpushOwnershipChallenge returns zone-level ownership challenge validation result.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-validate-ownership-challenge
+//
+// Deprecated: Use `ValidateZoneLogpushOwnershipChallenge` or
+// `ValidateAccountLogpushOwnershipChallenge` depending on the 
+// desired resource to target.
+func (api *API) ValidateLogpushOwnershipChallenge(ctx context.Context, zoneID, destinationConf, ownershipChallenge string) (bool, error) {
+	return api.validateLogpushOwnershipChallenge(ctx, ZoneRouteRoot, zoneID, destinationConf, ownershipChallenge)
+}
+
+func (api *API) validateLogpushOwnershipChallenge(ctx context.Context, identifierType RouteRoot, identifier, destinationConf, ownershipChallenge string) (bool, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/ownership/validate", identifierType, identifier)
+	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, LogpushValidateOwnershipChallengeRequest{
+		DestinationConf:    destinationConf,
+		OwnershipChallenge: ownershipChallenge,
+	})
+	if err != nil {
+		return false, err
+	}
+	var r LogpushGetOwnershipChallengeResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return false, errors.Wrap(err, errUnmarshalError)
+	}
+	return r.Result.Valid, nil
+}
+
+// CheckAccountLogpushDestinationExists returns account-level destination exists check result.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-check-destination-exists
+func (api *API) CheckAccountLogpushDestinationExists(ctx context.Context, accountID, destinationConf string) (bool, error) {
+	return api.checkLogpushDestinationExists(ctx, AccountRouteRoot, accountID, destinationConf)
+}
+
+// CheckZoneLogpushDestinationExists returns zone-level destination exists check result.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-check-destination-exists
+func (api *API) CheckZoneLogpushDestinationExists(ctx context.Context, zoneID, destinationConf string) (bool, error) {
+	return api.checkLogpushDestinationExists(ctx, ZoneRouteRoot, zoneID, destinationConf)
+}
+
+// CheckLogpushDestinationExists returns zone-level destination exists check result.
+//
+// API reference: https://api.cloudflare.com/#logpush-jobs-check-destination-exists
+//
+// Deprecated: Use `CheckZoneLogpushDestinationExists` or
+// `CheckAccountLogpushDestinationExists` depending 
+// on the desired resource to target.
+func (api *API) CheckLogpushDestinationExists(ctx context.Context, zoneID, destinationConf string) (bool, error) {
+	return api.checkLogpushDestinationExists(ctx, ZoneRouteRoot, zoneID, destinationConf)
+}
+
+func (api *API) checkLogpushDestinationExists(ctx context.Context, identifierType RouteRoot, identifier, destinationConf string) (bool, error) {
+	uri := fmt.Sprintf("/%s/%s/logpush/validate/destination/exists", identifierType, identifier)
+	res, err := api.makeRequestContext(ctx, http.MethodPost, uri, LogpushDestinationExistsRequest{
+		DestinationConf: destinationConf,
+	})
+	if err != nil {
+		return false, err
+	}
+	var r LogpushDestinationExistsResponse
+	err = json.Unmarshal(res, &r)
+	if err != nil {
+		return false, errors.Wrap(err, errUnmarshalError)
+	}
+	return r.Result.Exists, nil
+}
diff --git a/vendor/github.com/cloudflare/cloudflare-go/magic_firewall_rulesets.go b/vendor/github.com/grafana/cloudflare-go/magic_firewall_rulesets.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/magic_firewall_rulesets.go
rename to vendor/github.com/grafana/cloudflare-go/magic_firewall_rulesets.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/magic_transit_static_routes.go b/vendor/github.com/grafana/cloudflare-go/magic_transit_static_routes.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/magic_transit_static_routes.go
rename to vendor/github.com/grafana/cloudflare-go/magic_transit_static_routes.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/notifications.go b/vendor/github.com/grafana/cloudflare-go/notifications.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/notifications.go
rename to vendor/github.com/grafana/cloudflare-go/notifications.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/options.go b/vendor/github.com/grafana/cloudflare-go/options.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/options.go
rename to vendor/github.com/grafana/cloudflare-go/options.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/origin_ca.go b/vendor/github.com/grafana/cloudflare-go/origin_ca.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/origin_ca.go
rename to vendor/github.com/grafana/cloudflare-go/origin_ca.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/page_rules.go b/vendor/github.com/grafana/cloudflare-go/page_rules.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/page_rules.go
rename to vendor/github.com/grafana/cloudflare-go/page_rules.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/pages_project.go b/vendor/github.com/grafana/cloudflare-go/pages_project.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/pages_project.go
rename to vendor/github.com/grafana/cloudflare-go/pages_project.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/railgun.go b/vendor/github.com/grafana/cloudflare-go/railgun.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/railgun.go
rename to vendor/github.com/grafana/cloudflare-go/railgun.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/rate_limiting.go b/vendor/github.com/grafana/cloudflare-go/rate_limiting.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/rate_limiting.go
rename to vendor/github.com/grafana/cloudflare-go/rate_limiting.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/registrar.go b/vendor/github.com/grafana/cloudflare-go/registrar.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/registrar.go
rename to vendor/github.com/grafana/cloudflare-go/registrar.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/rulesets.go b/vendor/github.com/grafana/cloudflare-go/rulesets.go
similarity index 95%
rename from vendor/github.com/cloudflare/cloudflare-go/rulesets.go
rename to vendor/github.com/grafana/cloudflare-go/rulesets.go
index d1bdd526afe0..b7ceae9f0f66 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/rulesets.go
+++ b/vendor/github.com/grafana/cloudflare-go/rulesets.go
@@ -17,17 +17,18 @@ const (
 	RulesetKindSchema  RulesetKind = "schema"
 	RulesetKindZone    RulesetKind = "zone"
 
-	RulesetPhaseDDoSL4                      RulesetPhase = "ddos_l4"
-	RulesetPhaseDDoSL7                      RulesetPhase = "ddos_l7"
-	RulesetPhaseHTTPRequestFirewallCustom   RulesetPhase = "http_request_firewall_custom"
-	RulesetPhaseHTTPRequestFirewallManaged  RulesetPhase = "http_request_firewall_managed"
-	RulesetPhaseHTTPRequestLateTransform    RulesetPhase = "http_request_late_transform"
-	RulesetPhaseHTTPRequestMain             RulesetPhase = "http_request_main"
-	RulesetPhaseHTTPRequestSanitize         RulesetPhase = "http_request_sanitize"
-	RulesetPhaseHTTPRequestTransform        RulesetPhase = "http_request_transform"
-	RulesetPhaseHTTPResponseFirewallManaged RulesetPhase = "http_response_firewall_managed"
-	RulesetPhaseMagicTransit                RulesetPhase = "magic_transit"
-	RulesetPhaseRateLimit                   RulesetPhase = "http_ratelimit"
+	RulesetPhaseDDoSL4                       RulesetPhase = "ddos_l4"
+	RulesetPhaseDDoSL7                       RulesetPhase = "ddos_l7"
+	RulesetPhaseHTTPRequestFirewallCustom    RulesetPhase = "http_request_firewall_custom"
+	RulesetPhaseHTTPRequestFirewallManaged   RulesetPhase = "http_request_firewall_managed"
+	RulesetPhaseHTTPRequestLateTransform     RulesetPhase = "http_request_late_transform"
+	RulesetPhaseHTTPRequestMain              RulesetPhase = "http_request_main"
+	RulesetPhaseHTTPRequestSanitize          RulesetPhase = "http_request_sanitize"
+	RulesetPhaseHTTPRequestTransform         RulesetPhase = "http_request_transform"
+	RulesetPhaseHTTPResponseHeadersTransform RulesetPhase = "http_response_headers_transform"
+	RulesetPhaseHTTPResponseFirewallManaged  RulesetPhase = "http_response_firewall_managed"
+	RulesetPhaseMagicTransit                 RulesetPhase = "magic_transit"
+	RulesetPhaseRateLimit                    RulesetPhase = "http_ratelimit"
 
 	RulesetRuleActionBlock                RulesetRuleAction = "block"
 	RulesetRuleActionChallenge            RulesetRuleAction = "challenge"
@@ -76,6 +77,7 @@ func RulesetPhaseValues() []string {
 		string(RulesetPhaseHTTPRequestMain),
 		string(RulesetPhaseHTTPRequestSanitize),
 		string(RulesetPhaseHTTPRequestTransform),
+		string(RulesetPhaseHTTPResponseHeadersTransform),
 		string(RulesetPhaseHTTPResponseFirewallManaged),
 		string(RulesetPhaseMagicTransit),
 		string(RulesetPhaseRateLimit),
diff --git a/vendor/github.com/cloudflare/cloudflare-go/secondary_dns_primaries.go b/vendor/github.com/grafana/cloudflare-go/secondary_dns_primaries.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/secondary_dns_primaries.go
rename to vendor/github.com/grafana/cloudflare-go/secondary_dns_primaries.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/secondary_dns_tsig.go b/vendor/github.com/grafana/cloudflare-go/secondary_dns_tsig.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/secondary_dns_tsig.go
rename to vendor/github.com/grafana/cloudflare-go/secondary_dns_tsig.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/secondary_dns_zone.go b/vendor/github.com/grafana/cloudflare-go/secondary_dns_zone.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/secondary_dns_zone.go
rename to vendor/github.com/grafana/cloudflare-go/secondary_dns_zone.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/spectrum.go b/vendor/github.com/grafana/cloudflare-go/spectrum.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/spectrum.go
rename to vendor/github.com/grafana/cloudflare-go/spectrum.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/split_tunnel.go b/vendor/github.com/grafana/cloudflare-go/split_tunnel.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/split_tunnel.go
rename to vendor/github.com/grafana/cloudflare-go/split_tunnel.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/ssl.go b/vendor/github.com/grafana/cloudflare-go/ssl.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/ssl.go
rename to vendor/github.com/grafana/cloudflare-go/ssl.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/teams_accounts.go b/vendor/github.com/grafana/cloudflare-go/teams_accounts.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/teams_accounts.go
rename to vendor/github.com/grafana/cloudflare-go/teams_accounts.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/teams_list.go b/vendor/github.com/grafana/cloudflare-go/teams_list.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/teams_list.go
rename to vendor/github.com/grafana/cloudflare-go/teams_list.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/teams_locations.go b/vendor/github.com/grafana/cloudflare-go/teams_locations.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/teams_locations.go
rename to vendor/github.com/grafana/cloudflare-go/teams_locations.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/teams_rules.go b/vendor/github.com/grafana/cloudflare-go/teams_rules.go
similarity index 88%
rename from vendor/github.com/cloudflare/cloudflare-go/teams_rules.go
rename to vendor/github.com/grafana/cloudflare-go/teams_rules.go
index 177cf2d6cb5b..065db2d236d7 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/teams_rules.go
+++ b/vendor/github.com/grafana/cloudflare-go/teams_rules.go
@@ -85,20 +85,21 @@ func TeamsRulesActionValues() []string {
 
 // TeamsRule represents an Teams wirefilter rule.
 type TeamsRule struct {
-	ID           string             `json:"id,omitempty"`
-	CreatedAt    *time.Time         `json:"created_at,omitempty"`
-	UpdatedAt    *time.Time         `json:"updated_at,omitempty"`
-	DeletedAt    *time.Time         `json:"deleted_at,omitempty"`
-	Name         string             `json:"name"`
-	Description  string             `json:"description"`
-	Precedence   uint64             `json:"precedence"`
-	Enabled      bool               `json:"enabled"`
-	Action       TeamsGatewayAction `json:"action"`
-	Filters      []TeamsFilterType  `json:"filters"`
-	Traffic      string             `json:"traffic"`
-	Identity     string             `json:"identity"`
-	Version      uint64             `json:"version"`
-	RuleSettings TeamsRuleSettings  `json:"rule_settings,omitempty"`
+	ID            string             `json:"id,omitempty"`
+	CreatedAt     *time.Time         `json:"created_at,omitempty"`
+	UpdatedAt     *time.Time         `json:"updated_at,omitempty"`
+	DeletedAt     *time.Time         `json:"deleted_at,omitempty"`
+	Name          string             `json:"name"`
+	Description   string             `json:"description"`
+	Precedence    uint64             `json:"precedence"`
+	Enabled       bool               `json:"enabled"`
+	Action        TeamsGatewayAction `json:"action"`
+	Filters       []TeamsFilterType  `json:"filters"`
+	Traffic       string             `json:"traffic"`
+	Identity      string             `json:"identity"`
+	DevicePosture string             `json:"device_posture"`
+	Version       uint64             `json:"version"`
+	RuleSettings  TeamsRuleSettings  `json:"rule_settings,omitempty"`
 }
 
 // TeamsRuleResponse is the API response, containing a single rule.
diff --git a/vendor/github.com/cloudflare/cloudflare-go/universal_ssl.go b/vendor/github.com/grafana/cloudflare-go/universal_ssl.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/universal_ssl.go
rename to vendor/github.com/grafana/cloudflare-go/universal_ssl.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/user.go b/vendor/github.com/grafana/cloudflare-go/user.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/user.go
rename to vendor/github.com/grafana/cloudflare-go/user.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/user_agent.go b/vendor/github.com/grafana/cloudflare-go/user_agent.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/user_agent.go
rename to vendor/github.com/grafana/cloudflare-go/user_agent.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/virtualdns.go b/vendor/github.com/grafana/cloudflare-go/virtualdns.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/virtualdns.go
rename to vendor/github.com/grafana/cloudflare-go/virtualdns.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/waf.go b/vendor/github.com/grafana/cloudflare-go/waf.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/waf.go
rename to vendor/github.com/grafana/cloudflare-go/waf.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/waf_overrides.go b/vendor/github.com/grafana/cloudflare-go/waf_overrides.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/waf_overrides.go
rename to vendor/github.com/grafana/cloudflare-go/waf_overrides.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/waiting_room.go b/vendor/github.com/grafana/cloudflare-go/waiting_room.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/waiting_room.go
rename to vendor/github.com/grafana/cloudflare-go/waiting_room.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/workers.go b/vendor/github.com/grafana/cloudflare-go/workers.go
similarity index 99%
rename from vendor/github.com/cloudflare/cloudflare-go/workers.go
rename to vendor/github.com/grafana/cloudflare-go/workers.go
index 5710b3457d7b..09aedc1d2900 100644
--- a/vendor/github.com/cloudflare/cloudflare-go/workers.go
+++ b/vendor/github.com/grafana/cloudflare-go/workers.go
@@ -297,7 +297,7 @@ func (api *API) DeleteWorker(ctx context.Context, requestParams *WorkerRequestPa
 }
 
 // DeleteWorkerWithName deletes worker for a zone.
-// Sccount must be specified as api option https://godoc.org/github.com/cloudflare/cloudflare-go#UsingAccount
+// Sccount must be specified as api option https://godoc.org/github.com/grafana/cloudflare-go#UsingAccount
 //
 // API reference: https://developers.cloudflare.com/workers/tooling/api/scripts/
 func (api *API) deleteWorkerWithName(ctx context.Context, scriptName string) (WorkerScriptResponse, error) {
diff --git a/vendor/github.com/cloudflare/cloudflare-go/workers_cron_triggers.go b/vendor/github.com/grafana/cloudflare-go/workers_cron_triggers.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/workers_cron_triggers.go
rename to vendor/github.com/grafana/cloudflare-go/workers_cron_triggers.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/workers_kv.go b/vendor/github.com/grafana/cloudflare-go/workers_kv.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/workers_kv.go
rename to vendor/github.com/grafana/cloudflare-go/workers_kv.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/workers_secrets.go b/vendor/github.com/grafana/cloudflare-go/workers_secrets.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/workers_secrets.go
rename to vendor/github.com/grafana/cloudflare-go/workers_secrets.go
diff --git a/vendor/github.com/cloudflare/cloudflare-go/zone.go b/vendor/github.com/grafana/cloudflare-go/zone.go
similarity index 100%
rename from vendor/github.com/cloudflare/cloudflare-go/zone.go
rename to vendor/github.com/grafana/cloudflare-go/zone.go
diff --git a/vendor/github.com/grafana/dskit/crypto/tls/tls.go b/vendor/github.com/grafana/dskit/crypto/tls/tls.go
index c573366d69dd..ba4a0da9c9f1 100644
--- a/vendor/github.com/grafana/dskit/crypto/tls/tls.go
+++ b/vendor/github.com/grafana/dskit/crypto/tls/tls.go
@@ -8,6 +8,8 @@ import (
 	"os"
 	"strings"
 
+	"google.golang.org/grpc/credentials/insecure"
+
 	"github.com/pkg/errors"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -126,7 +128,7 @@ func (cfg *ClientConfig) GetTLSConfig() (*tls.Config, error) {
 // GetGRPCDialOptions creates GRPC DialOptions for TLS
 func (cfg *ClientConfig) GetGRPCDialOptions(enabled bool) ([]grpc.DialOption, error) {
 	if !enabled {
-		return []grpc.DialOption{grpc.WithInsecure()}, nil
+		return []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}, nil
 	}
 
 	tlsConfig, err := cfg.GetTLSConfig()
diff --git a/vendor/github.com/grafana/dskit/internal/slices/slices.go b/vendor/github.com/grafana/dskit/internal/slices/slices.go
new file mode 100644
index 000000000000..838e9bf83513
--- /dev/null
+++ b/vendor/github.com/grafana/dskit/internal/slices/slices.go
@@ -0,0 +1,11 @@
+package slices
+
+func Contains[T comparable](haystack []T, needle T) bool {
+	for _, e := range haystack {
+		if e == needle {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/vendor/github.com/grafana/dskit/kv/memberlist/memberlist_client.go b/vendor/github.com/grafana/dskit/kv/memberlist/memberlist_client.go
index 390eca606f54..d18b6d452cb7 100644
--- a/vendor/github.com/grafana/dskit/kv/memberlist/memberlist_client.go
+++ b/vendor/github.com/grafana/dskit/kv/memberlist/memberlist_client.go
@@ -18,6 +18,7 @@ import (
 	"github.com/go-kit/log/level"
 	"github.com/hashicorp/memberlist"
 	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/atomic"
 
 	"github.com/grafana/dskit/backoff"
 	"github.com/grafana/dskit/flagext"
@@ -233,9 +234,9 @@ type KV struct {
 	provider DNSProvider
 
 	// Protects access to memberlist and broadcasts fields.
-	initWG     sync.WaitGroup
-	memberlist *memberlist.Memberlist
-	broadcasts *memberlist.TransmitLimitedQueue
+	delegateReady atomic.Bool
+	memberlist    *memberlist.Memberlist
+	broadcasts    *memberlist.TransmitLimitedQueue
 
 	// KV Store.
 	storeMu sync.Mutex
@@ -451,7 +452,6 @@ func (m *KV) starting(ctx context.Context) error {
 	//
 	// Note: We cannot check for Starting state, as we want to use delegate during cluster joining process
 	// that happens in Starting state.
-	m.initWG.Add(1)
 	list, err := memberlist.Create(mlCfg)
 	if err != nil {
 		return fmt.Errorf("failed to create memberlist: %v", err)
@@ -462,7 +462,7 @@ func (m *KV) starting(ctx context.Context) error {
 		NumNodes:       list.NumMembers,
 		RetransmitMult: mlCfg.RetransmitMult,
 	}
-	m.initWG.Done()
+	m.delegateReady.Store(true)
 
 	// Try to fast-join memberlist cluster in Starting state, so that we don't start with empty KV store.
 	if len(m.cfg.JoinMembers) > 0 {
@@ -992,6 +992,10 @@ func (m *KV) NodeMeta(limit int) []byte {
 // NotifyMsg is method from Memberlist Delegate interface
 // Called when single message is received, i.e. what our broadcastNewValue has sent.
 func (m *KV) NotifyMsg(msg []byte) {
+	if !m.delegateReady.Load() {
+		return
+	}
+
 	m.numberOfReceivedMessages.Inc()
 	m.totalSizeOfReceivedMessages.Add(float64(len(msg)))
 
@@ -1101,7 +1105,9 @@ func (m *KV) queueBroadcast(key string, content []string, version uint, message
 // GetBroadcasts is method from Memberlist Delegate interface
 // It returns all pending broadcasts (within the size limit)
 func (m *KV) GetBroadcasts(overhead, limit int) [][]byte {
-	m.initWG.Wait()
+	if !m.delegateReady.Load() {
+		return nil
+	}
 
 	return m.broadcasts.GetBroadcasts(overhead, limit)
 }
@@ -1112,7 +1118,9 @@ func (m *KV) GetBroadcasts(overhead, limit int) [][]byte {
 // Here we dump our entire state -- all keys and their values. There is no limit on message size here,
 // as Memberlist uses 'stream' operations for transferring this state.
 func (m *KV) LocalState(join bool) []byte {
-	m.initWG.Wait()
+	if !m.delegateReady.Load() {
+		return nil
+	}
 
 	m.numberOfPulls.Inc()
 
@@ -1184,9 +1192,11 @@ func (m *KV) LocalState(join bool) []byte {
 //
 // Data is full state of remote KV store, as generated by LocalState method (run on another node).
 func (m *KV) MergeRemoteState(data []byte, join bool) {
-	received := time.Now()
+	if !m.delegateReady.Load() {
+		return
+	}
 
-	m.initWG.Wait()
+	received := time.Now()
 
 	m.numberOfPushes.Inc()
 	m.totalSizeOfPushes.Add(float64(len(data)))
diff --git a/vendor/github.com/grafana/dskit/ring/client/pool.go b/vendor/github.com/grafana/dskit/ring/client/pool.go
index eca27ef68884..77a17f35f1e7 100644
--- a/vendor/github.com/grafana/dskit/ring/client/pool.go
+++ b/vendor/github.com/grafana/dskit/ring/client/pool.go
@@ -14,7 +14,7 @@ import (
 	"google.golang.org/grpc/health/grpc_health_v1"
 
 	"github.com/grafana/dskit/concurrency"
-	"github.com/grafana/dskit/ring/util"
+	"github.com/grafana/dskit/internal/slices"
 	"github.com/grafana/dskit/services"
 )
 
@@ -171,7 +171,7 @@ func (p *Pool) removeStaleClients() {
 	}
 
 	for _, addr := range p.RegisteredAddresses() {
-		if util.StringsContain(serviceAddrs, addr) {
+		if slices.Contains(serviceAddrs, addr) {
 			continue
 		}
 		level.Info(p.logger).Log("msg", "removing stale client", "addr", addr)
diff --git a/vendor/github.com/grafana/dskit/ring/ring.go b/vendor/github.com/grafana/dskit/ring/ring.go
index 02f5ea0d9925..493e6ac14ddb 100644
--- a/vendor/github.com/grafana/dskit/ring/ring.go
+++ b/vendor/github.com/grafana/dskit/ring/ring.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+
 	"math"
 	"math/rand"
 	"net/http"
@@ -19,13 +20,12 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 
+	"github.com/grafana/dskit/flagext"
+	dsmath "github.com/grafana/dskit/internal/math"
+	"github.com/grafana/dskit/internal/slices"
 	"github.com/grafana/dskit/kv"
 	shardUtil "github.com/grafana/dskit/ring/shard"
-	"github.com/grafana/dskit/ring/util"
 	"github.com/grafana/dskit/services"
-
-	"github.com/grafana/dskit/flagext"
-	dsmath "github.com/grafana/dskit/internal/math"
 )
 
 const (
@@ -291,7 +291,7 @@ func (r *Ring) updateRingState(ringDesc *Desc) {
 	// Filter out all instances belonging to excluded zones.
 	if len(r.cfg.ExcludedZones) > 0 {
 		for instanceID, instance := range ringDesc.Ingesters {
-			if util.StringsContain(r.cfg.ExcludedZones, instance.Zone) {
+			if slices.Contains(r.cfg.ExcludedZones, instance.Zone) {
 				delete(ringDesc.Ingesters, instanceID)
 			}
 		}
@@ -364,13 +364,13 @@ func (r *Ring) Get(key uint32, op Operation, bufDescs []InstanceDesc, bufHosts,
 		}
 
 		// We want n *distinct* instances && distinct zones.
-		if util.StringsContain(distinctHosts, info.InstanceID) {
+		if slices.Contains(distinctHosts, info.InstanceID) {
 			continue
 		}
 
 		// Ignore if the instances don't have a zone set.
 		if r.cfg.ZoneAwarenessEnabled && info.Zone != "" {
-			if util.StringsContain(distinctZones, info.Zone) {
+			if slices.Contains(distinctZones, info.Zone) {
 				continue
 			}
 		}
diff --git a/vendor/github.com/grafana/dskit/ring/util/string_utils.go b/vendor/github.com/grafana/dskit/ring/util/string_utils.go
deleted file mode 100644
index 39868e1d1cbf..000000000000
--- a/vendor/github.com/grafana/dskit/ring/util/string_utils.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package util
-
-// StringsContain returns true if the search value is within the list of input values.
-func StringsContain(values []string, search string) bool {
-	for _, v := range values {
-		if search == v {
-			return true
-		}
-	}
-
-	return false
-}
diff --git a/vendor/github.com/grafana/gomemcache/memcache/memcache.go b/vendor/github.com/grafana/gomemcache/memcache/memcache.go
index 7f2d5a6269d0..61fda56e81a8 100644
--- a/vendor/github.com/grafana/gomemcache/memcache/memcache.go
+++ b/vendor/github.com/grafana/gomemcache/memcache/memcache.go
@@ -100,7 +100,6 @@ func legalKey(key string) bool {
 
 var (
 	crlf            = []byte("\r\n")
-	space           = []byte(" ")
 	resultOK        = []byte("OK\r\n")
 	resultStored    = []byte("STORED\r\n")
 	resultNotStored = []byte("NOT_STORED\r\n")
@@ -113,6 +112,7 @@ var (
 
 	resultClientErrorPrefix = []byte("CLIENT_ERROR ")
 	versionPrefix           = []byte("VERSION")
+	valuePrefix             = []byte("VALUE ")
 )
 
 // New returns a memcache client using the provided server(s)
@@ -120,7 +120,7 @@ var (
 // it gets a proportional amount of weight.
 func New(server ...string) *Client {
 	ss := new(ServerList)
-	ss.SetServers(server...)
+	_ = ss.SetServers(server...)
 	return NewFromSelector(ss)
 }
 
@@ -146,8 +146,6 @@ type Client struct {
 	// be set to a number higher than your peak parallel requests.
 	MaxIdleConns int
 
-	Pool BytesPool
-
 	selector ServerSelector
 
 	lk       sync.Mutex
@@ -183,22 +181,13 @@ type conn struct {
 	c    *Client
 }
 
-// BytesPool is a pool of bytes that can be reused.
-type BytesPool interface {
-	// Get returns a new byte slice that has a capacity at least the same as the
-	// requested size.
-	Get(sz int) (*[]byte, error)
-	// Put returns a byte slice to the pool.
-	Put(b *[]byte)
-}
-
 // release returns this connection back to the client's free pool
 func (cn *conn) release() {
 	cn.c.putFreeConn(cn.addr, cn)
 }
 
 func (cn *conn) extendDeadline() {
-	cn.nc.SetDeadline(time.Now().Add(cn.c.netTimeout()))
+	_ = cn.nc.SetDeadline(time.Now().Add(cn.c.netTimeout()))
 }
 
 // condRelease releases this connection if the error pointed to by err
@@ -326,9 +315,10 @@ func (c *Client) FlushAll() error {
 
 // Get gets the item for the given key. ErrCacheMiss is returned for a
 // memcache cache miss. The key must be at most 250 bytes in length.
-func (c *Client) Get(key string) (item *Item, err error) {
+func (c *Client) Get(key string, opts ...Option) (item *Item, err error) {
+	options := newOptions(opts...)
 	err = c.withKeyAddr(key, func(addr net.Addr) error {
-		return c.getFromAddr(addr, []string{key}, func(it *Item) { item = it })
+		return c.getFromAddr(addr, []string{key}, options, func(it *Item) { item = it })
 	})
 	if err == nil && item == nil {
 		err = ErrCacheMiss
@@ -373,7 +363,7 @@ func (c *Client) withKeyRw(key string, fn func(*bufio.ReadWriter) error) error {
 	})
 }
 
-func (c *Client) getFromAddr(addr net.Addr, keys []string, cb func(*Item)) error {
+func (c *Client) getFromAddr(addr net.Addr, keys []string, opts *Options, cb func(*Item)) error {
 	return c.withAddrRw(addr, func(rw *bufio.ReadWriter) error {
 		if _, err := fmt.Fprintf(rw, "gets %s\r\n", strings.Join(keys, " ")); err != nil {
 			return err
@@ -381,7 +371,7 @@ func (c *Client) getFromAddr(addr net.Addr, keys []string, cb func(*Item)) error
 		if err := rw.Flush(); err != nil {
 			return err
 		}
-		if err := c.parseGetResponse(rw.Reader, cb); err != nil {
+		if err := c.parseGetResponse(rw.Reader, opts, cb); err != nil {
 			return err
 		}
 		return nil
@@ -465,7 +455,9 @@ func (c *Client) touchFromAddr(addr net.Addr, keys []string, expiration int32) e
 // items may have fewer elements than the input slice, due to memcache
 // cache misses. Each key must be at most 250 bytes in length.
 // If no error is returned, the returned map will also be non-nil.
-func (c *Client) GetMulti(keys []string) (map[string]*Item, error) {
+func (c *Client) GetMulti(keys []string, opts ...Option) (map[string]*Item, error) {
+	options := newOptions(opts...)
+
 	var lk sync.Mutex
 	m := make(map[string]*Item)
 	addItemToMap := func(it *Item) {
@@ -489,12 +481,12 @@ func (c *Client) GetMulti(keys []string) (map[string]*Item, error) {
 	ch := make(chan error, buffered)
 	for addr, keys := range keyMap {
 		go func(addr net.Addr, keys []string) {
-			ch <- c.getFromAddr(addr, keys, addItemToMap)
+			ch <- c.getFromAddr(addr, keys, options, addItemToMap)
 		}(addr, keys)
 	}
 
 	var err error
-	for _ = range keyMap {
+	for range keyMap {
 		if ge := <-ch; ge != nil {
 			err = ge
 		}
@@ -504,7 +496,7 @@ func (c *Client) GetMulti(keys []string) (map[string]*Item, error) {
 
 // parseGetResponse reads a GET response from r and calls cb for each
 // read and allocated Item
-func (c *Client) parseGetResponse(r *bufio.Reader, cb func(*Item)) error {
+func (c *Client) parseGetResponse(r *bufio.Reader, opts *Options, cb func(*Item)) error {
 	for {
 		line, err := r.ReadSlice('\n')
 		if err != nil {
@@ -519,26 +511,15 @@ func (c *Client) parseGetResponse(r *bufio.Reader, cb func(*Item)) error {
 			return err
 		}
 		buffSize := size + 2
-		if c.Pool != nil {
-			v, err := c.Pool.Get(buffSize)
-			if err != nil {
-				return err
-			}
-			it.Value = (*v)[:buffSize]
-		} else {
-			it.Value = make([]byte, buffSize)
-		}
+		buff := opts.Alloc.Get(buffSize)
+		it.Value = (*buff)[:buffSize]
 		_, err = io.ReadFull(r, it.Value)
 		if err != nil {
-			if c.Pool != nil {
-				c.Pool.Put(&it.Value)
-			}
+			opts.Alloc.Put(buff)
 			return err
 		}
 		if !bytes.HasSuffix(it.Value, crlf) {
-			if c.Pool != nil {
-				c.Pool.Put(&it.Value)
-			}
+			opts.Alloc.Put(buff)
 			return fmt.Errorf("memcache: corrupt get result read")
 		}
 		it.Value = it.Value[:size]
@@ -552,7 +533,7 @@ func scanGetResponseLine(line []byte, it *Item) (size int, err error) {
 	errf := func(line []byte) (int, error) {
 		return -1, fmt.Errorf("memcache: unexpected line in get response: %q", line)
 	}
-	if !bytes.HasPrefix(line, []byte("VALUE ")) || !bytes.HasSuffix(line, []byte("\r\n")) {
+	if !bytes.HasPrefix(line, valuePrefix) || !bytes.HasSuffix(line, []byte("\r\n")) {
 		return errf(line)
 	}
 	s := string(line[6 : len(line)-2])
diff --git a/vendor/github.com/grafana/gomemcache/memcache/options.go b/vendor/github.com/grafana/gomemcache/memcache/options.go
new file mode 100644
index 000000000000..ec0b38410291
--- /dev/null
+++ b/vendor/github.com/grafana/gomemcache/memcache/options.go
@@ -0,0 +1,59 @@
+package memcache
+
+var nopAllocator = &defaultAllocator{}
+
+func newOptions(opts ...Option) *Options {
+	o := &Options{
+		Alloc: nopAllocator,
+	}
+
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	return o
+}
+
+// Options are used to modify the behavior of an individual Get or GetMulti
+// call made by the Client. They are constructed by applying Option callbacks
+// passed to a Client method to a default Options instance.
+type Options struct {
+	Alloc Allocator
+}
+
+// Option is a callback used to modify the Options that a particular Client
+// method uses.
+type Option func(opts *Options)
+
+// WithAllocator creates a new Option that makes use of a specific memory Allocator
+// for result values (Item.Value) loaded from memcached.
+func WithAllocator(alloc Allocator) Option {
+	return func(opts *Options) {
+		opts.Alloc = alloc
+	}
+}
+
+// Allocator allows memory for memcached result values (Item.Value) to be managed by
+// callers of the Client instead of by the Client itself. For example, this can be
+// used by callers to implement arena-style memory management. The default implementation
+// used, when not otherwise overridden, uses `make` and relies on GC for cleanup.
+type Allocator interface {
+	// Get returns a byte slice with at least sz capacity. Length of the slice is
+	// not guaranteed and so must be asserted by callers (the Client).
+	Get(sz int) *[]byte
+	// Put returns the byte slice to the underlying allocator. The Client will
+	// only call this method during error handling when allocated values are not
+	// returned to the caller as cache results.
+	Put(b *[]byte)
+}
+
+type defaultAllocator struct{}
+
+func (d defaultAllocator) Get(sz int) *[]byte {
+	b := make([]byte, sz)
+	return &b
+}
+
+func (d defaultAllocator) Put(_ *[]byte) {
+	// no-op
+}
diff --git a/vendor/github.com/hashicorp/go-hclog/README.md b/vendor/github.com/hashicorp/go-hclog/README.md
index 5d56f4b59c3f..a16f5cd5728c 100644
--- a/vendor/github.com/hashicorp/go-hclog/README.md
+++ b/vendor/github.com/hashicorp/go-hclog/README.md
@@ -17,11 +17,8 @@ JSON output mode for production.
 
 ## Stability Note
 
-While this library is fully open source and HashiCorp will be maintaining it
-(since we are and will be making extensive use of it), the API and output
-format is subject to minor changes as we fully bake and vet it in our projects.
-This notice will be removed once it's fully integrated into our major projects
-and no further changes are anticipated.
+This library has reached 1.0 stability. It's API can be considered solidified
+and promised through future versions.
 
 ## Installation and Docs
 
@@ -102,7 +99,7 @@ into all the callers.
 ### Using `hclog.Fmt()`
 
 ```go
-var int totalBandwidth = 200
+totalBandwidth := 200
 appLogger.Info("total bandwidth exceeded", "bandwidth", hclog.Fmt("%d GB/s", totalBandwidth))
 ```
 
@@ -146,3 +143,6 @@ log.Printf("[DEBUG] %d", 42)
 Notice that if `appLogger` is initialized with the `INFO` log level _and_ you
 specify `InferLevels: true`, you will not see any output here. You must change
 `appLogger` to `DEBUG` to see output. See the docs for more information.
+
+If the log lines start with a timestamp you can use the
+`InferLevelsWithTimestamp` option to try and ignore them.
diff --git a/vendor/github.com/hashicorp/go-hclog/colorize_unix.go b/vendor/github.com/hashicorp/go-hclog/colorize_unix.go
index 44aa9bf2c620..9635c838b4e9 100644
--- a/vendor/github.com/hashicorp/go-hclog/colorize_unix.go
+++ b/vendor/github.com/hashicorp/go-hclog/colorize_unix.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package hclog
@@ -21,6 +22,7 @@ func (l *intLogger) setColorization(opts *LoggerOptions) {
 		isCygwinTerm := isatty.IsCygwinTerminal(fi.Fd())
 		isTerm := isUnixTerm || isCygwinTerm
 		if !isTerm {
+			l.headerColor = ColorOff
 			l.writer.color = ColorOff
 		}
 	}
diff --git a/vendor/github.com/hashicorp/go-hclog/colorize_windows.go b/vendor/github.com/hashicorp/go-hclog/colorize_windows.go
index 23486b6d74f8..30859168eebe 100644
--- a/vendor/github.com/hashicorp/go-hclog/colorize_windows.go
+++ b/vendor/github.com/hashicorp/go-hclog/colorize_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package hclog
@@ -26,8 +27,12 @@ func (l *intLogger) setColorization(opts *LoggerOptions) {
 		isTerm := isUnixTerm || isCygwinTerm
 		if !isTerm {
 			l.writer.color = ColorOff
+			l.headerColor = ColorOff
 			return
 		}
-		l.writer.w = colorable.NewColorable(fi)
+
+		if l.headerColor == ColorOff {
+			l.writer.w = colorable.NewColorable(fi)
+		}
 	}
 }
diff --git a/vendor/github.com/hashicorp/go-hclog/global.go b/vendor/github.com/hashicorp/go-hclog/global.go
index 22ebc57d877f..b9f00217cae3 100644
--- a/vendor/github.com/hashicorp/go-hclog/global.go
+++ b/vendor/github.com/hashicorp/go-hclog/global.go
@@ -2,6 +2,7 @@ package hclog
 
 import (
 	"sync"
+	"time"
 )
 
 var (
@@ -14,6 +15,7 @@ var (
 	DefaultOptions = &LoggerOptions{
 		Level:  DefaultLevel,
 		Output: DefaultOutput,
+		TimeFn: time.Now,
 	}
 )
 
diff --git a/vendor/github.com/hashicorp/go-hclog/interceptlogger.go b/vendor/github.com/hashicorp/go-hclog/interceptlogger.go
index 631baf2f0cc1..ff42f1bfc1dd 100644
--- a/vendor/github.com/hashicorp/go-hclog/interceptlogger.go
+++ b/vendor/github.com/hashicorp/go-hclog/interceptlogger.go
@@ -180,9 +180,10 @@ func (i *interceptLogger) StandardWriterIntercept(opts *StandardLoggerOptions) i
 
 func (i *interceptLogger) StandardWriter(opts *StandardLoggerOptions) io.Writer {
 	return &stdlogAdapter{
-		log:         i,
-		inferLevels: opts.InferLevels,
-		forceLevel:  opts.ForceLevel,
+		log:                      i,
+		inferLevels:              opts.InferLevels,
+		inferLevelsWithTimestamp: opts.InferLevelsWithTimestamp,
+		forceLevel:               opts.ForceLevel,
 	}
 }
 
diff --git a/vendor/github.com/hashicorp/go-hclog/intlogger.go b/vendor/github.com/hashicorp/go-hclog/intlogger.go
index d491ae8f9789..83232f7a622f 100644
--- a/vendor/github.com/hashicorp/go-hclog/intlogger.go
+++ b/vendor/github.com/hashicorp/go-hclog/intlogger.go
@@ -60,6 +60,7 @@ type intLogger struct {
 	callerOffset int
 	name         string
 	timeFormat   string
+	timeFn       TimeFunction
 	disableTime  bool
 
 	// This is an interface so that it's shared by any derived loggers, since
@@ -68,6 +69,8 @@ type intLogger struct {
 	writer *writer
 	level  *int32
 
+	headerColor ColorOption
+
 	implied []interface{}
 
 	exclude func(level Level, msg string, args ...interface{}) bool
@@ -112,16 +115,28 @@ func newLogger(opts *LoggerOptions) *intLogger {
 		mutex = new(sync.Mutex)
 	}
 
+	var primaryColor, headerColor ColorOption
+
+	if opts.ColorHeaderOnly {
+		primaryColor = ColorOff
+		headerColor = opts.Color
+	} else {
+		primaryColor = opts.Color
+		headerColor = ColorOff
+	}
+
 	l := &intLogger{
 		json:              opts.JSONFormat,
 		name:              opts.Name,
 		timeFormat:        TimeFormat,
+		timeFn:            time.Now,
 		disableTime:       opts.DisableTime,
 		mutex:             mutex,
-		writer:            newWriter(output, opts.Color),
+		writer:            newWriter(output, primaryColor),
 		level:             new(int32),
 		exclude:           opts.Exclude,
 		independentLevels: opts.IndependentLevels,
+		headerColor:       headerColor,
 	}
 	if opts.IncludeLocation {
 		l.callerOffset = offsetIntLogger + opts.AdditionalLocationOffset
@@ -130,6 +145,9 @@ func newLogger(opts *LoggerOptions) *intLogger {
 	if l.json {
 		l.timeFormat = TimeFormatJSON
 	}
+	if opts.TimeFn != nil {
+		l.timeFn = opts.TimeFn
+	}
 	if opts.TimeFormat != "" {
 		l.timeFormat = opts.TimeFormat
 	}
@@ -152,7 +170,7 @@ func (l *intLogger) log(name string, level Level, msg string, args ...interface{
 		return
 	}
 
-	t := time.Now()
+	t := l.timeFn()
 
 	l.mutex.Lock()
 	defer l.mutex.Unlock()
@@ -199,6 +217,24 @@ func trimCallerPath(path string) string {
 	return path[idx+1:]
 }
 
+// isNormal indicates if the rune is one allowed to exist as an unquoted
+// string value. This is a subset of ASCII, `-` through `~`.
+func isNormal(r rune) bool {
+	return 0x2D <= r && r <= 0x7E // - through ~
+}
+
+// needsQuoting returns false if all the runes in string are normal, according
+// to isNormal
+func needsQuoting(str string) bool {
+	for _, r := range str {
+		if !isNormal(r) {
+			return true
+		}
+	}
+
+	return false
+}
+
 // Non-JSON logging format function
 func (l *intLogger) logPlain(t time.Time, name string, level Level, msg string, args ...interface{}) {
 
@@ -209,7 +245,12 @@ func (l *intLogger) logPlain(t time.Time, name string, level Level, msg string,
 
 	s, ok := _levelToBracket[level]
 	if ok {
-		l.writer.WriteString(s)
+		if l.headerColor != ColorOff {
+			color := _levelToColor[level]
+			color.Fprint(l.writer, s)
+		} else {
+			l.writer.WriteString(s)
+		}
 	} else {
 		l.writer.WriteString("[?????]")
 	}
@@ -263,6 +304,7 @@ func (l *intLogger) logPlain(t time.Time, name string, level Level, msg string,
 				val = st
 				if st == "" {
 					val = `""`
+					raw = true
 				}
 			case int:
 				val = strconv.FormatInt(int64(st), 10)
@@ -323,13 +365,11 @@ func (l *intLogger) logPlain(t time.Time, name string, level Level, msg string,
 				l.writer.WriteString("=\n")
 				writeIndent(l.writer, val, "  | ")
 				l.writer.WriteString("  ")
-			} else if !raw && strings.ContainsAny(val, " \t") {
+			} else if !raw && needsQuoting(val) {
 				l.writer.WriteByte(' ')
 				l.writer.WriteString(key)
 				l.writer.WriteByte('=')
-				l.writer.WriteByte('"')
-				l.writer.WriteString(val)
-				l.writer.WriteByte('"')
+				l.writer.WriteString(strconv.Quote(val))
 			} else {
 				l.writer.WriteByte(' ')
 				l.writer.WriteString(key)
@@ -687,9 +727,10 @@ func (l *intLogger) StandardWriter(opts *StandardLoggerOptions) io.Writer {
 		newLog.callerOffset = l.callerOffset + 4
 	}
 	return &stdlogAdapter{
-		log:         &newLog,
-		inferLevels: opts.InferLevels,
-		forceLevel:  opts.ForceLevel,
+		log:                      &newLog,
+		inferLevels:              opts.InferLevels,
+		inferLevelsWithTimestamp: opts.InferLevelsWithTimestamp,
+		forceLevel:               opts.ForceLevel,
 	}
 }
 
diff --git a/vendor/github.com/hashicorp/go-hclog/logger.go b/vendor/github.com/hashicorp/go-hclog/logger.go
index 6a4665ba9fea..858143028427 100644
--- a/vendor/github.com/hashicorp/go-hclog/logger.go
+++ b/vendor/github.com/hashicorp/go-hclog/logger.go
@@ -5,6 +5,7 @@ import (
 	"log"
 	"os"
 	"strings"
+	"time"
 )
 
 var (
@@ -212,6 +213,15 @@ type StandardLoggerOptions struct {
 	// [DEBUG] and strip it off before reapplying it.
 	InferLevels bool
 
+	// Indicate that some minimal parsing should be done on strings to try
+	// and detect their level and re-emit them while ignoring possible
+	// timestamp values in the beginning of the string.
+	// This supports the strings like [ERROR], [ERR] [TRACE], [WARN], [INFO],
+	// [DEBUG] and strip it off before reapplying it.
+	// The timestamp detection may result in false positives and incomplete
+	// string outputs.
+	InferLevelsWithTimestamp bool
+
 	// ForceLevel is used to force all output from the standard logger to be at
 	// the specified level. Similar to InferLevels, this will strip any level
 	// prefix contained in the logged string before applying the forced level.
@@ -219,6 +229,8 @@ type StandardLoggerOptions struct {
 	ForceLevel Level
 }
 
+type TimeFunction = func() time.Time
+
 // LoggerOptions can be used to configure a new logger.
 type LoggerOptions struct {
 	// Name of the subsystem to prefix logs with
@@ -248,6 +260,9 @@ type LoggerOptions struct {
 	// The time format to use instead of the default
 	TimeFormat string
 
+	// A function which is called to get the time object that is formatted using `TimeFormat`
+	TimeFn TimeFunction
+
 	// Control whether or not to display the time at all. This is required
 	// because setting TimeFormat to empty assumes the default format.
 	DisableTime bool
@@ -256,6 +271,9 @@ type LoggerOptions struct {
 	// are concretely instances of *os.File.
 	Color ColorOption
 
+	// Only color the header, not the body. This can help with readability of long messages.
+	ColorHeaderOnly bool
+
 	// A function which is called with the log information and if it returns true the value
 	// should not be logged.
 	// This is useful when interacting with a system that you wish to suppress the log
diff --git a/vendor/github.com/hashicorp/go-hclog/stdlog.go b/vendor/github.com/hashicorp/go-hclog/stdlog.go
index 271d546d5c92..641f20ccbcc8 100644
--- a/vendor/github.com/hashicorp/go-hclog/stdlog.go
+++ b/vendor/github.com/hashicorp/go-hclog/stdlog.go
@@ -3,16 +3,22 @@ package hclog
 import (
 	"bytes"
 	"log"
+	"regexp"
 	"strings"
 )
 
+// Regex to ignore characters commonly found in timestamp formats from the
+// beginning of inputs.
+var logTimestampRegexp = regexp.MustCompile(`^[\d\s\:\/\.\+-TZ]*`)
+
 // Provides a io.Writer to shim the data out of *log.Logger
 // and back into our Logger. This is basically the only way to
 // build upon *log.Logger.
 type stdlogAdapter struct {
-	log         Logger
-	inferLevels bool
-	forceLevel  Level
+	log                      Logger
+	inferLevels              bool
+	inferLevelsWithTimestamp bool
+	forceLevel               Level
 }
 
 // Take the data, infer the levels if configured, and send it through
@@ -28,6 +34,10 @@ func (s *stdlogAdapter) Write(data []byte) (int, error) {
 		// Log at the forced level
 		s.dispatch(str, s.forceLevel)
 	} else if s.inferLevels {
+		if s.inferLevelsWithTimestamp {
+			str = s.trimTimestamp(str)
+		}
+
 		level, str := s.pickLevel(str)
 		s.dispatch(str, level)
 	} else {
@@ -74,6 +84,11 @@ func (s *stdlogAdapter) pickLevel(str string) (Level, string) {
 	}
 }
 
+func (s *stdlogAdapter) trimTimestamp(str string) string {
+	idx := logTimestampRegexp.FindStringIndex(str)
+	return str[idx[1]:]
+}
+
 type logWriter struct {
 	l *log.Logger
 }
diff --git a/vendor/github.com/hashicorp/golang-lru/.golangci.yml b/vendor/github.com/hashicorp/golang-lru/.golangci.yml
new file mode 100644
index 000000000000..49202fc41e64
--- /dev/null
+++ b/vendor/github.com/hashicorp/golang-lru/.golangci.yml
@@ -0,0 +1,30 @@
+linters:
+  enable:
+    - megacheck
+    - revive
+    - govet
+    - unconvert
+    - megacheck
+    - gas
+    - gocyclo
+    - dupl
+    - misspell
+    - unparam
+    - unused
+    - typecheck
+    - ineffassign
+    - stylecheck
+    - exportloopref
+    - gocritic
+    - nakedret
+    - gosimple
+    - prealloc
+  fast: false
+  disable-all: true
+
+issues:
+  exclude-rules:
+    - path: _test\.go
+      linters:
+        - dupl
+  exclude-use-default: false
diff --git a/vendor/github.com/hashicorp/golang-lru/2q.go b/vendor/github.com/hashicorp/golang-lru/2q.go
index e474cd07581a..15fcad0306e3 100644
--- a/vendor/github.com/hashicorp/golang-lru/2q.go
+++ b/vendor/github.com/hashicorp/golang-lru/2q.go
@@ -44,7 +44,7 @@ func New2Q(size int) (*TwoQueueCache, error) {
 
 // New2QParams creates a new TwoQueueCache using the provided
 // parameter values.
-func New2QParams(size int, recentRatio float64, ghostRatio float64) (*TwoQueueCache, error) {
+func New2QParams(size int, recentRatio, ghostRatio float64) (*TwoQueueCache, error) {
 	if size <= 0 {
 		return nil, fmt.Errorf("invalid size")
 	}
@@ -138,7 +138,6 @@ func (c *TwoQueueCache) Add(key, value interface{}) {
 	// Add to the recently seen list
 	c.ensureSpace(false)
 	c.recent.Add(key, value)
-	return
 }
 
 // ensureSpace is used to ensure we have space in the cache
diff --git a/vendor/github.com/hashicorp/golang-lru/LICENSE b/vendor/github.com/hashicorp/golang-lru/LICENSE
index be2cc4dfb609..0e5d580e0e96 100644
--- a/vendor/github.com/hashicorp/golang-lru/LICENSE
+++ b/vendor/github.com/hashicorp/golang-lru/LICENSE
@@ -1,3 +1,5 @@
+Copyright (c) 2014 HashiCorp, Inc.
+
 Mozilla Public License, version 2.0
 
 1. Definitions
diff --git a/vendor/github.com/hashicorp/golang-lru/README.md b/vendor/github.com/hashicorp/golang-lru/README.md
index 33e58cfaf97e..063bb16056ef 100644
--- a/vendor/github.com/hashicorp/golang-lru/README.md
+++ b/vendor/github.com/hashicorp/golang-lru/README.md
@@ -7,7 +7,7 @@ thread safe LRU cache. It is based on the cache in Groupcache.
 Documentation
 =============
 
-Full docs are available on [Godoc](http://godoc.org/github.com/hashicorp/golang-lru)
+Full docs are available on [Godoc](https://pkg.go.dev/github.com/hashicorp/golang-lru)
 
 Example
 =======
diff --git a/vendor/github.com/hashicorp/golang-lru/arc.go b/vendor/github.com/hashicorp/golang-lru/arc.go
index 555225a218c9..e396f8428aa3 100644
--- a/vendor/github.com/hashicorp/golang-lru/arc.go
+++ b/vendor/github.com/hashicorp/golang-lru/arc.go
@@ -173,7 +173,6 @@ func (c *ARCCache) Add(key, value interface{}) {
 
 	// Add to the recently seen list
 	c.t1.Add(key, value)
-	return
 }
 
 // replace is used to adaptively evict from either T1 or T2
diff --git a/vendor/github.com/hashicorp/golang-lru/lru.go b/vendor/github.com/hashicorp/golang-lru/lru.go
index 4e5e9d8fd080..895d8e3ea0c1 100644
--- a/vendor/github.com/hashicorp/golang-lru/lru.go
+++ b/vendor/github.com/hashicorp/golang-lru/lru.go
@@ -6,10 +6,17 @@ import (
 	"github.com/hashicorp/golang-lru/simplelru"
 )
 
+const (
+	// DefaultEvictedBufferSize defines the default buffer size to store evicted key/val
+	DefaultEvictedBufferSize = 16
+)
+
 // Cache is a thread-safe fixed size LRU cache.
 type Cache struct {
-	lru  simplelru.LRUCache
-	lock sync.RWMutex
+	lru                      *simplelru.LRU
+	evictedKeys, evictedVals []interface{}
+	onEvictedCB              func(k, v interface{})
+	lock                     sync.RWMutex
 }
 
 // New creates an LRU of the given size.
@@ -19,30 +26,63 @@ func New(size int) (*Cache, error) {
 
 // NewWithEvict constructs a fixed size cache with the given eviction
 // callback.
-func NewWithEvict(size int, onEvicted func(key interface{}, value interface{})) (*Cache, error) {
-	lru, err := simplelru.NewLRU(size, simplelru.EvictCallback(onEvicted))
-	if err != nil {
-		return nil, err
+func NewWithEvict(size int, onEvicted func(key, value interface{})) (c *Cache, err error) {
+	// create a cache with default settings
+	c = &Cache{
+		onEvictedCB: onEvicted,
 	}
-	c := &Cache{
-		lru: lru,
+	if onEvicted != nil {
+		c.initEvictBuffers()
+		onEvicted = c.onEvicted
 	}
-	return c, nil
+	c.lru, err = simplelru.NewLRU(size, onEvicted)
+	return
+}
+
+func (c *Cache) initEvictBuffers() {
+	c.evictedKeys = make([]interface{}, 0, DefaultEvictedBufferSize)
+	c.evictedVals = make([]interface{}, 0, DefaultEvictedBufferSize)
+}
+
+// onEvicted save evicted key/val and sent in externally registered callback
+// outside of critical section
+func (c *Cache) onEvicted(k, v interface{}) {
+	c.evictedKeys = append(c.evictedKeys, k)
+	c.evictedVals = append(c.evictedVals, v)
 }
 
 // Purge is used to completely clear the cache.
 func (c *Cache) Purge() {
+	var ks, vs []interface{}
 	c.lock.Lock()
 	c.lru.Purge()
+	if c.onEvictedCB != nil && len(c.evictedKeys) > 0 {
+		ks, vs = c.evictedKeys, c.evictedVals
+		c.initEvictBuffers()
+	}
 	c.lock.Unlock()
+	// invoke callback outside of critical section
+	if c.onEvictedCB != nil {
+		for i := 0; i < len(ks); i++ {
+			c.onEvictedCB(ks[i], vs[i])
+		}
+	}
 }
 
 // Add adds a value to the cache. Returns true if an eviction occurred.
 func (c *Cache) Add(key, value interface{}) (evicted bool) {
+	var k, v interface{}
 	c.lock.Lock()
 	evicted = c.lru.Add(key, value)
+	if c.onEvictedCB != nil && evicted {
+		k, v = c.evictedKeys[0], c.evictedVals[0]
+		c.evictedKeys, c.evictedVals = c.evictedKeys[:0], c.evictedVals[:0]
+	}
 	c.lock.Unlock()
-	return evicted
+	if c.onEvictedCB != nil && evicted {
+		c.onEvictedCB(k, v)
+	}
+	return
 }
 
 // Get looks up a key's value from the cache.
@@ -75,13 +115,21 @@ func (c *Cache) Peek(key interface{}) (value interface{}, ok bool) {
 // recent-ness or deleting it for being stale, and if not, adds the value.
 // Returns whether found and whether an eviction occurred.
 func (c *Cache) ContainsOrAdd(key, value interface{}) (ok, evicted bool) {
+	var k, v interface{}
 	c.lock.Lock()
-	defer c.lock.Unlock()
-
 	if c.lru.Contains(key) {
+		c.lock.Unlock()
 		return true, false
 	}
 	evicted = c.lru.Add(key, value)
+	if c.onEvictedCB != nil && evicted {
+		k, v = c.evictedKeys[0], c.evictedVals[0]
+		c.evictedKeys, c.evictedVals = c.evictedKeys[:0], c.evictedVals[:0]
+	}
+	c.lock.Unlock()
+	if c.onEvictedCB != nil && evicted {
+		c.onEvictedCB(k, v)
+	}
 	return false, evicted
 }
 
@@ -89,47 +137,80 @@ func (c *Cache) ContainsOrAdd(key, value interface{}) (ok, evicted bool) {
 // recent-ness or deleting it for being stale, and if not, adds the value.
 // Returns whether found and whether an eviction occurred.
 func (c *Cache) PeekOrAdd(key, value interface{}) (previous interface{}, ok, evicted bool) {
+	var k, v interface{}
 	c.lock.Lock()
-	defer c.lock.Unlock()
-
 	previous, ok = c.lru.Peek(key)
 	if ok {
+		c.lock.Unlock()
 		return previous, true, false
 	}
-
 	evicted = c.lru.Add(key, value)
+	if c.onEvictedCB != nil && evicted {
+		k, v = c.evictedKeys[0], c.evictedVals[0]
+		c.evictedKeys, c.evictedVals = c.evictedKeys[:0], c.evictedVals[:0]
+	}
+	c.lock.Unlock()
+	if c.onEvictedCB != nil && evicted {
+		c.onEvictedCB(k, v)
+	}
 	return nil, false, evicted
 }
 
 // Remove removes the provided key from the cache.
 func (c *Cache) Remove(key interface{}) (present bool) {
+	var k, v interface{}
 	c.lock.Lock()
 	present = c.lru.Remove(key)
+	if c.onEvictedCB != nil && present {
+		k, v = c.evictedKeys[0], c.evictedVals[0]
+		c.evictedKeys, c.evictedVals = c.evictedKeys[:0], c.evictedVals[:0]
+	}
 	c.lock.Unlock()
+	if c.onEvictedCB != nil && present {
+		c.onEvictedCB(k, v)
+	}
 	return
 }
 
 // Resize changes the cache size.
 func (c *Cache) Resize(size int) (evicted int) {
+	var ks, vs []interface{}
 	c.lock.Lock()
 	evicted = c.lru.Resize(size)
+	if c.onEvictedCB != nil && evicted > 0 {
+		ks, vs = c.evictedKeys, c.evictedVals
+		c.initEvictBuffers()
+	}
 	c.lock.Unlock()
+	if c.onEvictedCB != nil && evicted > 0 {
+		for i := 0; i < len(ks); i++ {
+			c.onEvictedCB(ks[i], vs[i])
+		}
+	}
 	return evicted
 }
 
 // RemoveOldest removes the oldest item from the cache.
-func (c *Cache) RemoveOldest() (key interface{}, value interface{}, ok bool) {
+func (c *Cache) RemoveOldest() (key, value interface{}, ok bool) {
+	var k, v interface{}
 	c.lock.Lock()
 	key, value, ok = c.lru.RemoveOldest()
+	if c.onEvictedCB != nil && ok {
+		k, v = c.evictedKeys[0], c.evictedVals[0]
+		c.evictedKeys, c.evictedVals = c.evictedKeys[:0], c.evictedVals[:0]
+	}
 	c.lock.Unlock()
+	if c.onEvictedCB != nil && ok {
+		c.onEvictedCB(k, v)
+	}
 	return
 }
 
 // GetOldest returns the oldest entry
-func (c *Cache) GetOldest() (key interface{}, value interface{}, ok bool) {
-	c.lock.Lock()
+func (c *Cache) GetOldest() (key, value interface{}, ok bool) {
+	c.lock.RLock()
 	key, value, ok = c.lru.GetOldest()
-	c.lock.Unlock()
+	c.lock.RUnlock()
 	return
 }
 
diff --git a/vendor/github.com/hashicorp/golang-lru/simplelru/lru.go b/vendor/github.com/hashicorp/golang-lru/simplelru/lru.go
index a86c8539e066..9233583c91c1 100644
--- a/vendor/github.com/hashicorp/golang-lru/simplelru/lru.go
+++ b/vendor/github.com/hashicorp/golang-lru/simplelru/lru.go
@@ -25,7 +25,7 @@ type entry struct {
 // NewLRU constructs an LRU of the given size
 func NewLRU(size int, onEvict EvictCallback) (*LRU, error) {
 	if size <= 0 {
-		return nil, errors.New("Must provide a positive size")
+		return nil, errors.New("must provide a positive size")
 	}
 	c := &LRU{
 		size:      size,
@@ -109,7 +109,7 @@ func (c *LRU) Remove(key interface{}) (present bool) {
 }
 
 // RemoveOldest removes the oldest item from the cache.
-func (c *LRU) RemoveOldest() (key interface{}, value interface{}, ok bool) {
+func (c *LRU) RemoveOldest() (key, value interface{}, ok bool) {
 	ent := c.evictList.Back()
 	if ent != nil {
 		c.removeElement(ent)
@@ -120,7 +120,7 @@ func (c *LRU) RemoveOldest() (key interface{}, value interface{}, ok bool) {
 }
 
 // GetOldest returns the oldest entry
-func (c *LRU) GetOldest() (key interface{}, value interface{}, ok bool) {
+func (c *LRU) GetOldest() (key, value interface{}, ok bool) {
 	ent := c.evictList.Back()
 	if ent != nil {
 		kv := ent.Value.(*entry)
diff --git a/vendor/github.com/hashicorp/golang-lru/simplelru/lru_interface.go b/vendor/github.com/hashicorp/golang-lru/simplelru/lru_interface.go
index 92d70934d632..cb7f8caf03d6 100644
--- a/vendor/github.com/hashicorp/golang-lru/simplelru/lru_interface.go
+++ b/vendor/github.com/hashicorp/golang-lru/simplelru/lru_interface.go
@@ -1,3 +1,4 @@
+// Package simplelru provides simple LRU implementation based on build-in container/list.
 package simplelru
 
 // LRUCache is the interface for simple LRU cache.
@@ -34,6 +35,6 @@ type LRUCache interface {
 	// Clears all cache entries.
 	Purge()
 
-  // Resizes cache, returning number evicted
-  Resize(int) int
+	// Resizes cache, returning number evicted
+	Resize(int) int
 }
diff --git a/vendor/github.com/hashicorp/golang-lru/testing.go b/vendor/github.com/hashicorp/golang-lru/testing.go
new file mode 100644
index 000000000000..492760782c5e
--- /dev/null
+++ b/vendor/github.com/hashicorp/golang-lru/testing.go
@@ -0,0 +1,16 @@
+package lru
+
+import (
+	"crypto/rand"
+	"math"
+	"math/big"
+	"testing"
+)
+
+func getRand(tb testing.TB) int64 {
+	out, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
+	if err != nil {
+		tb.Fatal(err)
+	}
+	return out.Int64()
+}
diff --git a/vendor/github.com/huandu/xstrings/.travis.yml b/vendor/github.com/huandu/xstrings/.travis.yml
deleted file mode 100644
index d6460be411e5..000000000000
--- a/vendor/github.com/huandu/xstrings/.travis.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-language: go
-install:
-  - go get golang.org/x/tools/cmd/cover
-  - go get github.com/mattn/goveralls
-script:
-  - go test -v -covermode=count -coverprofile=coverage.out
-  - 'if [ "$TRAVIS_PULL_REQUEST" = "false" ] && [ ! -z "$COVERALLS_TOKEN" ]; then $HOME/gopath/bin/goveralls -coverprofile=coverage.out -service=travis-ci -repotoken $COVERALLS_TOKEN; fi'
diff --git a/vendor/github.com/huandu/xstrings/README.md b/vendor/github.com/huandu/xstrings/README.md
index 292bf2f39e13..750c3c7eb69a 100644
--- a/vendor/github.com/huandu/xstrings/README.md
+++ b/vendor/github.com/huandu/xstrings/README.md
@@ -1,7 +1,7 @@
-# xstrings #
+# xstrings
 
-[![Build Status](https://travis-ci.org/huandu/xstrings.svg?branch=master)](https://travis-ci.org/huandu/xstrings)
-[![GoDoc](https://godoc.org/github.com/huandu/xstrings?status.svg)](https://godoc.org/github.com/huandu/xstrings)
+[![Build Status](https://github.com/huandu/xstrings/workflows/Go/badge.svg)](https://github.com/huandu/xstrings/actions)
+[![Go Doc](https://godoc.org/github.com/huandu/xstrings?status.svg)](https://pkg.go.dev/github.com/huandu/xstrings)
 [![Go Report](https://goreportcard.com/badge/github.com/huandu/xstrings)](https://goreportcard.com/report/github.com/huandu/xstrings)
 [![Coverage Status](https://coveralls.io/repos/github/huandu/xstrings/badge.svg?branch=master)](https://coveralls.io/github/huandu/xstrings?branch=master)
 
@@ -9,109 +9,109 @@ Go package [xstrings](https://godoc.org/github.com/huandu/xstrings) is a collect
 
 All functions are well tested and carefully tuned for performance.
 
-## Propose a new function ##
+## Propose a new function
 
 Please review [contributing guideline](CONTRIBUTING.md) and [create new issue](https://github.com/huandu/xstrings/issues) to state why it should be included.
 
-## Install ##
+## Install
 
 Use `go get` to install this library.
 
     go get github.com/huandu/xstrings
 
-## API document ##
+## API document
 
 See [GoDoc](https://godoc.org/github.com/huandu/xstrings) for full document.
 
-## Function list ##
+## Function list
 
 Go functions have a unique naming style. One, who has experience in other language but new in Go, may have difficulties to find out right string function to use.
 
 Here is a list of functions in [strings](http://golang.org/pkg/strings) and [xstrings](https://godoc.org/github.com/huandu/xstrings) with enough extra information about how to map these functions to their friends in other languages. Hope this list could be helpful for fresh gophers.
 
-### Package `xstrings` functions ###
-
-*Keep this table sorted by Function in ascending order.*
-
-| Function | Friends | # |
-| -------- | ------- | --- |
-| [Center](https://godoc.org/github.com/huandu/xstrings#Center) | `str.center` in Python; `String#center` in Ruby | [#30](https://github.com/huandu/xstrings/issues/30) |
-| [Count](https://godoc.org/github.com/huandu/xstrings#Count) | `String#count` in Ruby | [#16](https://github.com/huandu/xstrings/issues/16) |
-| [Delete](https://godoc.org/github.com/huandu/xstrings#Delete) | `String#delete` in Ruby | [#17](https://github.com/huandu/xstrings/issues/17) |
-| [ExpandTabs](https://godoc.org/github.com/huandu/xstrings#ExpandTabs) | `str.expandtabs` in Python | [#27](https://github.com/huandu/xstrings/issues/27) |
-| [FirstRuneToLower](https://godoc.org/github.com/huandu/xstrings#FirstRuneToLower) | `lcfirst` in PHP or Perl | [#15](https://github.com/huandu/xstrings/issues/15) |
-| [FirstRuneToUpper](https://godoc.org/github.com/huandu/xstrings#FirstRuneToUpper) | `String#capitalize` in Ruby; `ucfirst` in PHP or Perl | [#15](https://github.com/huandu/xstrings/issues/15) |
-| [Insert](https://godoc.org/github.com/huandu/xstrings#Insert) | `String#insert` in Ruby | [#18](https://github.com/huandu/xstrings/issues/18) |
-| [LastPartition](https://godoc.org/github.com/huandu/xstrings#LastPartition) | `str.rpartition` in Python; `String#rpartition` in Ruby | [#19](https://github.com/huandu/xstrings/issues/19) |
-| [LeftJustify](https://godoc.org/github.com/huandu/xstrings#LeftJustify) | `str.ljust` in Python; `String#ljust` in Ruby | [#28](https://github.com/huandu/xstrings/issues/28) |
-| [Len](https://godoc.org/github.com/huandu/xstrings#Len) | `mb_strlen` in PHP | [#23](https://github.com/huandu/xstrings/issues/23) |
-| [Partition](https://godoc.org/github.com/huandu/xstrings#Partition) | `str.partition` in Python; `String#partition` in Ruby | [#10](https://github.com/huandu/xstrings/issues/10) |
-| [Reverse](https://godoc.org/github.com/huandu/xstrings#Reverse) | `String#reverse` in Ruby; `strrev` in PHP; `reverse` in Perl | [#7](https://github.com/huandu/xstrings/issues/7) |
-| [RightJustify](https://godoc.org/github.com/huandu/xstrings#RightJustify) | `str.rjust` in Python; `String#rjust` in Ruby | [#29](https://github.com/huandu/xstrings/issues/29) |
-| [RuneWidth](https://godoc.org/github.com/huandu/xstrings#RuneWidth) | - | [#27](https://github.com/huandu/xstrings/issues/27) |
-| [Scrub](https://godoc.org/github.com/huandu/xstrings#Scrub) | `String#scrub` in Ruby | [#20](https://github.com/huandu/xstrings/issues/20) |
-| [Shuffle](https://godoc.org/github.com/huandu/xstrings#Shuffle) | `str_shuffle` in PHP | [#13](https://github.com/huandu/xstrings/issues/13) |
-| [ShuffleSource](https://godoc.org/github.com/huandu/xstrings#ShuffleSource) | `str_shuffle` in PHP | [#13](https://github.com/huandu/xstrings/issues/13) |
-| [Slice](https://godoc.org/github.com/huandu/xstrings#Slice) | `mb_substr` in PHP | [#9](https://github.com/huandu/xstrings/issues/9) |
-| [Squeeze](https://godoc.org/github.com/huandu/xstrings#Squeeze) | `String#squeeze` in Ruby | [#11](https://github.com/huandu/xstrings/issues/11) |
-| [Successor](https://godoc.org/github.com/huandu/xstrings#Successor) | `String#succ` or `String#next` in Ruby | [#22](https://github.com/huandu/xstrings/issues/22) |
-| [SwapCase](https://godoc.org/github.com/huandu/xstrings#SwapCase) | `str.swapcase` in Python; `String#swapcase` in Ruby | [#12](https://github.com/huandu/xstrings/issues/12) |
-| [ToCamelCase](https://godoc.org/github.com/huandu/xstrings#ToCamelCase) | `String#camelize` in RoR | [#1](https://github.com/huandu/xstrings/issues/1) |
-| [ToKebab](https://godoc.org/github.com/huandu/xstrings#ToKebabCase) | - | [#41](https://github.com/huandu/xstrings/issues/41) |
-| [ToSnakeCase](https://godoc.org/github.com/huandu/xstrings#ToSnakeCase) | `String#underscore` in RoR | [#1](https://github.com/huandu/xstrings/issues/1) |
-| [Translate](https://godoc.org/github.com/huandu/xstrings#Translate) | `str.translate` in Python; `String#tr` in Ruby; `strtr` in PHP; `tr///` in Perl | [#21](https://github.com/huandu/xstrings/issues/21) |
-| [Width](https://godoc.org/github.com/huandu/xstrings#Width) | `mb_strwidth` in PHP | [#26](https://github.com/huandu/xstrings/issues/26) |
-| [WordCount](https://godoc.org/github.com/huandu/xstrings#WordCount) | `str_word_count` in PHP | [#14](https://github.com/huandu/xstrings/issues/14) |
-| [WordSplit](https://godoc.org/github.com/huandu/xstrings#WordSplit) | - | [#14](https://github.com/huandu/xstrings/issues/14) |
-
-### Package `strings` functions ###
-
-*Keep this table sorted by Function in ascending order.*
-
-| Function | Friends |
-| -------- | ------- |
-| [Contains](http://golang.org/pkg/strings/#Contains) | `String#include?` in Ruby |
-| [ContainsAny](http://golang.org/pkg/strings/#ContainsAny) | - |
-| [ContainsRune](http://golang.org/pkg/strings/#ContainsRune) | - |
-| [Count](http://golang.org/pkg/strings/#Count) | `str.count` in Python; `substr_count` in PHP |
-| [EqualFold](http://golang.org/pkg/strings/#EqualFold) | `stricmp` in PHP; `String#casecmp` in Ruby |
-| [Fields](http://golang.org/pkg/strings/#Fields) | `str.split` in Python; `split` in Perl; `String#split` in Ruby |
-| [FieldsFunc](http://golang.org/pkg/strings/#FieldsFunc) | - |
-| [HasPrefix](http://golang.org/pkg/strings/#HasPrefix) | `str.startswith` in Python; `String#start_with?` in Ruby |
-| [HasSuffix](http://golang.org/pkg/strings/#HasSuffix) | `str.endswith` in Python; `String#end_with?` in Ruby |
-| [Index](http://golang.org/pkg/strings/#Index) | `str.index` in Python; `String#index` in Ruby; `strpos` in PHP; `index` in Perl |
-| [IndexAny](http://golang.org/pkg/strings/#IndexAny) | - |
-| [IndexByte](http://golang.org/pkg/strings/#IndexByte) | - |
-| [IndexFunc](http://golang.org/pkg/strings/#IndexFunc) | - |
-| [IndexRune](http://golang.org/pkg/strings/#IndexRune) | - |
-| [Join](http://golang.org/pkg/strings/#Join) | `str.join` in Python; `Array#join` in Ruby; `implode` in PHP; `join` in Perl |
-| [LastIndex](http://golang.org/pkg/strings/#LastIndex) | `str.rindex` in Python; `String#rindex`; `strrpos` in PHP; `rindex` in Perl |
-| [LastIndexAny](http://golang.org/pkg/strings/#LastIndexAny) | - |
-| [LastIndexFunc](http://golang.org/pkg/strings/#LastIndexFunc) | - |
-| [Map](http://golang.org/pkg/strings/#Map) | `String#each_codepoint` in Ruby |
-| [Repeat](http://golang.org/pkg/strings/#Repeat) | operator `*` in Python and Ruby; `str_repeat` in PHP |
-| [Replace](http://golang.org/pkg/strings/#Replace) | `str.replace` in Python; `String#sub` in Ruby; `str_replace` in PHP |
-| [Split](http://golang.org/pkg/strings/#Split) | `str.split` in Python; `String#split` in Ruby; `explode` in PHP; `split` in Perl |
-| [SplitAfter](http://golang.org/pkg/strings/#SplitAfter) | - |
-| [SplitAfterN](http://golang.org/pkg/strings/#SplitAfterN) | - |
-| [SplitN](http://golang.org/pkg/strings/#SplitN) | `str.split` in Python; `String#split` in Ruby; `explode` in PHP; `split` in Perl |
-| [Title](http://golang.org/pkg/strings/#Title) | `str.title` in Python |
-| [ToLower](http://golang.org/pkg/strings/#ToLower) | `str.lower` in Python; `String#downcase` in Ruby; `strtolower` in PHP; `lc` in Perl |
-| [ToLowerSpecial](http://golang.org/pkg/strings/#ToLowerSpecial) | - |
-| [ToTitle](http://golang.org/pkg/strings/#ToTitle) | - |
-| [ToTitleSpecial](http://golang.org/pkg/strings/#ToTitleSpecial) | - |
-| [ToUpper](http://golang.org/pkg/strings/#ToUpper) | `str.upper` in Python; `String#upcase` in Ruby; `strtoupper` in PHP; `uc` in Perl |
-| [ToUpperSpecial](http://golang.org/pkg/strings/#ToUpperSpecial) | - |
-| [Trim](http://golang.org/pkg/strings/#Trim) | `str.strip` in Python; `String#strip` in Ruby; `trim` in PHP |
-| [TrimFunc](http://golang.org/pkg/strings/#TrimFunc) | - |
-| [TrimLeft](http://golang.org/pkg/strings/#TrimLeft) | `str.lstrip` in Python; `String#lstrip` in Ruby; `ltrim` in PHP |
-| [TrimLeftFunc](http://golang.org/pkg/strings/#TrimLeftFunc) | - |
-| [TrimPrefix](http://golang.org/pkg/strings/#TrimPrefix) | - |
-| [TrimRight](http://golang.org/pkg/strings/#TrimRight) | `str.rstrip` in Python; `String#rstrip` in Ruby; `rtrim` in PHP |
-| [TrimRightFunc](http://golang.org/pkg/strings/#TrimRightFunc) | - |
-| [TrimSpace](http://golang.org/pkg/strings/#TrimSpace) | `str.strip` in Python; `String#strip` in Ruby; `trim` in PHP |
-| [TrimSuffix](http://golang.org/pkg/strings/#TrimSuffix) | `String#chomp` in Ruby; `chomp` in Perl |
-
-## License ##
+### Package `xstrings` functions
+
+_Keep this table sorted by Function in ascending order._
+
+| Function                                                                          | Friends                                                                         | #                                                   |
+| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | --------------------------------------------------- |
+| [Center](https://godoc.org/github.com/huandu/xstrings#Center)                     | `str.center` in Python; `String#center` in Ruby                                 | [#30](https://github.com/huandu/xstrings/issues/30) |
+| [Count](https://godoc.org/github.com/huandu/xstrings#Count)                       | `String#count` in Ruby                                                          | [#16](https://github.com/huandu/xstrings/issues/16) |
+| [Delete](https://godoc.org/github.com/huandu/xstrings#Delete)                     | `String#delete` in Ruby                                                         | [#17](https://github.com/huandu/xstrings/issues/17) |
+| [ExpandTabs](https://godoc.org/github.com/huandu/xstrings#ExpandTabs)             | `str.expandtabs` in Python                                                      | [#27](https://github.com/huandu/xstrings/issues/27) |
+| [FirstRuneToLower](https://godoc.org/github.com/huandu/xstrings#FirstRuneToLower) | `lcfirst` in PHP or Perl                                                        | [#15](https://github.com/huandu/xstrings/issues/15) |
+| [FirstRuneToUpper](https://godoc.org/github.com/huandu/xstrings#FirstRuneToUpper) | `String#capitalize` in Ruby; `ucfirst` in PHP or Perl                           | [#15](https://github.com/huandu/xstrings/issues/15) |
+| [Insert](https://godoc.org/github.com/huandu/xstrings#Insert)                     | `String#insert` in Ruby                                                         | [#18](https://github.com/huandu/xstrings/issues/18) |
+| [LastPartition](https://godoc.org/github.com/huandu/xstrings#LastPartition)       | `str.rpartition` in Python; `String#rpartition` in Ruby                         | [#19](https://github.com/huandu/xstrings/issues/19) |
+| [LeftJustify](https://godoc.org/github.com/huandu/xstrings#LeftJustify)           | `str.ljust` in Python; `String#ljust` in Ruby                                   | [#28](https://github.com/huandu/xstrings/issues/28) |
+| [Len](https://godoc.org/github.com/huandu/xstrings#Len)                           | `mb_strlen` in PHP                                                              | [#23](https://github.com/huandu/xstrings/issues/23) |
+| [Partition](https://godoc.org/github.com/huandu/xstrings#Partition)               | `str.partition` in Python; `String#partition` in Ruby                           | [#10](https://github.com/huandu/xstrings/issues/10) |
+| [Reverse](https://godoc.org/github.com/huandu/xstrings#Reverse)                   | `String#reverse` in Ruby; `strrev` in PHP; `reverse` in Perl                    | [#7](https://github.com/huandu/xstrings/issues/7)   |
+| [RightJustify](https://godoc.org/github.com/huandu/xstrings#RightJustify)         | `str.rjust` in Python; `String#rjust` in Ruby                                   | [#29](https://github.com/huandu/xstrings/issues/29) |
+| [RuneWidth](https://godoc.org/github.com/huandu/xstrings#RuneWidth)               | -                                                                               | [#27](https://github.com/huandu/xstrings/issues/27) |
+| [Scrub](https://godoc.org/github.com/huandu/xstrings#Scrub)                       | `String#scrub` in Ruby                                                          | [#20](https://github.com/huandu/xstrings/issues/20) |
+| [Shuffle](https://godoc.org/github.com/huandu/xstrings#Shuffle)                   | `str_shuffle` in PHP                                                            | [#13](https://github.com/huandu/xstrings/issues/13) |
+| [ShuffleSource](https://godoc.org/github.com/huandu/xstrings#ShuffleSource)       | `str_shuffle` in PHP                                                            | [#13](https://github.com/huandu/xstrings/issues/13) |
+| [Slice](https://godoc.org/github.com/huandu/xstrings#Slice)                       | `mb_substr` in PHP                                                              | [#9](https://github.com/huandu/xstrings/issues/9)   |
+| [Squeeze](https://godoc.org/github.com/huandu/xstrings#Squeeze)                   | `String#squeeze` in Ruby                                                        | [#11](https://github.com/huandu/xstrings/issues/11) |
+| [Successor](https://godoc.org/github.com/huandu/xstrings#Successor)               | `String#succ` or `String#next` in Ruby                                          | [#22](https://github.com/huandu/xstrings/issues/22) |
+| [SwapCase](https://godoc.org/github.com/huandu/xstrings#SwapCase)                 | `str.swapcase` in Python; `String#swapcase` in Ruby                             | [#12](https://github.com/huandu/xstrings/issues/12) |
+| [ToCamelCase](https://godoc.org/github.com/huandu/xstrings#ToCamelCase)           | `String#camelize` in RoR                                                        | [#1](https://github.com/huandu/xstrings/issues/1)   |
+| [ToKebab](https://godoc.org/github.com/huandu/xstrings#ToKebabCase)               | -                                                                               | [#41](https://github.com/huandu/xstrings/issues/41) |
+| [ToSnakeCase](https://godoc.org/github.com/huandu/xstrings#ToSnakeCase)           | `String#underscore` in RoR                                                      | [#1](https://github.com/huandu/xstrings/issues/1)   |
+| [Translate](https://godoc.org/github.com/huandu/xstrings#Translate)               | `str.translate` in Python; `String#tr` in Ruby; `strtr` in PHP; `tr///` in Perl | [#21](https://github.com/huandu/xstrings/issues/21) |
+| [Width](https://godoc.org/github.com/huandu/xstrings#Width)                       | `mb_strwidth` in PHP                                                            | [#26](https://github.com/huandu/xstrings/issues/26) |
+| [WordCount](https://godoc.org/github.com/huandu/xstrings#WordCount)               | `str_word_count` in PHP                                                         | [#14](https://github.com/huandu/xstrings/issues/14) |
+| [WordSplit](https://godoc.org/github.com/huandu/xstrings#WordSplit)               | -                                                                               | [#14](https://github.com/huandu/xstrings/issues/14) |
+
+### Package `strings` functions
+
+_Keep this table sorted by Function in ascending order._
+
+| Function                                                        | Friends                                                                             |
+| --------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| [Contains](http://golang.org/pkg/strings/#Contains)             | `String#include?` in Ruby                                                           |
+| [ContainsAny](http://golang.org/pkg/strings/#ContainsAny)       | -                                                                                   |
+| [ContainsRune](http://golang.org/pkg/strings/#ContainsRune)     | -                                                                                   |
+| [Count](http://golang.org/pkg/strings/#Count)                   | `str.count` in Python; `substr_count` in PHP                                        |
+| [EqualFold](http://golang.org/pkg/strings/#EqualFold)           | `stricmp` in PHP; `String#casecmp` in Ruby                                          |
+| [Fields](http://golang.org/pkg/strings/#Fields)                 | `str.split` in Python; `split` in Perl; `String#split` in Ruby                      |
+| [FieldsFunc](http://golang.org/pkg/strings/#FieldsFunc)         | -                                                                                   |
+| [HasPrefix](http://golang.org/pkg/strings/#HasPrefix)           | `str.startswith` in Python; `String#start_with?` in Ruby                            |
+| [HasSuffix](http://golang.org/pkg/strings/#HasSuffix)           | `str.endswith` in Python; `String#end_with?` in Ruby                                |
+| [Index](http://golang.org/pkg/strings/#Index)                   | `str.index` in Python; `String#index` in Ruby; `strpos` in PHP; `index` in Perl     |
+| [IndexAny](http://golang.org/pkg/strings/#IndexAny)             | -                                                                                   |
+| [IndexByte](http://golang.org/pkg/strings/#IndexByte)           | -                                                                                   |
+| [IndexFunc](http://golang.org/pkg/strings/#IndexFunc)           | -                                                                                   |
+| [IndexRune](http://golang.org/pkg/strings/#IndexRune)           | -                                                                                   |
+| [Join](http://golang.org/pkg/strings/#Join)                     | `str.join` in Python; `Array#join` in Ruby; `implode` in PHP; `join` in Perl        |
+| [LastIndex](http://golang.org/pkg/strings/#LastIndex)           | `str.rindex` in Python; `String#rindex`; `strrpos` in PHP; `rindex` in Perl         |
+| [LastIndexAny](http://golang.org/pkg/strings/#LastIndexAny)     | -                                                                                   |
+| [LastIndexFunc](http://golang.org/pkg/strings/#LastIndexFunc)   | -                                                                                   |
+| [Map](http://golang.org/pkg/strings/#Map)                       | `String#each_codepoint` in Ruby                                                     |
+| [Repeat](http://golang.org/pkg/strings/#Repeat)                 | operator `*` in Python and Ruby; `str_repeat` in PHP                                |
+| [Replace](http://golang.org/pkg/strings/#Replace)               | `str.replace` in Python; `String#sub` in Ruby; `str_replace` in PHP                 |
+| [Split](http://golang.org/pkg/strings/#Split)                   | `str.split` in Python; `String#split` in Ruby; `explode` in PHP; `split` in Perl    |
+| [SplitAfter](http://golang.org/pkg/strings/#SplitAfter)         | -                                                                                   |
+| [SplitAfterN](http://golang.org/pkg/strings/#SplitAfterN)       | -                                                                                   |
+| [SplitN](http://golang.org/pkg/strings/#SplitN)                 | `str.split` in Python; `String#split` in Ruby; `explode` in PHP; `split` in Perl    |
+| [Title](http://golang.org/pkg/strings/#Title)                   | `str.title` in Python                                                               |
+| [ToLower](http://golang.org/pkg/strings/#ToLower)               | `str.lower` in Python; `String#downcase` in Ruby; `strtolower` in PHP; `lc` in Perl |
+| [ToLowerSpecial](http://golang.org/pkg/strings/#ToLowerSpecial) | -                                                                                   |
+| [ToTitle](http://golang.org/pkg/strings/#ToTitle)               | -                                                                                   |
+| [ToTitleSpecial](http://golang.org/pkg/strings/#ToTitleSpecial) | -                                                                                   |
+| [ToUpper](http://golang.org/pkg/strings/#ToUpper)               | `str.upper` in Python; `String#upcase` in Ruby; `strtoupper` in PHP; `uc` in Perl   |
+| [ToUpperSpecial](http://golang.org/pkg/strings/#ToUpperSpecial) | -                                                                                   |
+| [Trim](http://golang.org/pkg/strings/#Trim)                     | `str.strip` in Python; `String#strip` in Ruby; `trim` in PHP                        |
+| [TrimFunc](http://golang.org/pkg/strings/#TrimFunc)             | -                                                                                   |
+| [TrimLeft](http://golang.org/pkg/strings/#TrimLeft)             | `str.lstrip` in Python; `String#lstrip` in Ruby; `ltrim` in PHP                     |
+| [TrimLeftFunc](http://golang.org/pkg/strings/#TrimLeftFunc)     | -                                                                                   |
+| [TrimPrefix](http://golang.org/pkg/strings/#TrimPrefix)         | -                                                                                   |
+| [TrimRight](http://golang.org/pkg/strings/#TrimRight)           | `str.rstrip` in Python; `String#rstrip` in Ruby; `rtrim` in PHP                     |
+| [TrimRightFunc](http://golang.org/pkg/strings/#TrimRightFunc)   | -                                                                                   |
+| [TrimSpace](http://golang.org/pkg/strings/#TrimSpace)           | `str.strip` in Python; `String#strip` in Ruby; `trim` in PHP                        |
+| [TrimSuffix](http://golang.org/pkg/strings/#TrimSuffix)         | `String#chomp` in Ruby; `chomp` in Perl                                             |
+
+## License
 
 This library is licensed under MIT license. See LICENSE for details.
diff --git a/vendor/github.com/huandu/xstrings/common.go b/vendor/github.com/huandu/xstrings/common.go
index 2aff57aab4d6..f427cc84e2ee 100644
--- a/vendor/github.com/huandu/xstrings/common.go
+++ b/vendor/github.com/huandu/xstrings/common.go
@@ -3,15 +3,11 @@
 
 package xstrings
 
-import (
-	"bytes"
-)
-
 const bufferMaxInitGrowSize = 2048
 
 // Lazy initialize a buffer.
-func allocBuffer(orig, cur string) *bytes.Buffer {
-	output := &bytes.Buffer{}
+func allocBuffer(orig, cur string) *stringBuilder {
+	output := &stringBuilder{}
 	maxSize := len(orig) * 4
 
 	// Avoid to reserve too much memory at once.
diff --git a/vendor/github.com/huandu/xstrings/convert.go b/vendor/github.com/huandu/xstrings/convert.go
index 3d58fa81ae0e..151c3151d9c8 100644
--- a/vendor/github.com/huandu/xstrings/convert.go
+++ b/vendor/github.com/huandu/xstrings/convert.go
@@ -4,7 +4,6 @@
 package xstrings
 
 import (
-	"bytes"
 	"math/rand"
 	"unicode"
 	"unicode/utf8"
@@ -23,7 +22,7 @@ func ToCamelCase(str string) string {
 		return ""
 	}
 
-	buf := &bytes.Buffer{}
+	buf := &stringBuilder{}
 	var r0, r1 rune
 	var size int
 
@@ -112,7 +111,7 @@ func camelCaseToLowerCase(str string, connector rune) string {
 		return ""
 	}
 
-	buf := &bytes.Buffer{}
+	buf := &stringBuilder{}
 	wt, word, remaining := nextWord(str)
 
 	for len(remaining) > 0 {
@@ -131,7 +130,7 @@ func camelCaseToLowerCase(str string, connector rune) string {
 				wt, word, remaining = nextWord(remaining)
 			}
 
-			if wt != invalidWord && wt != punctWord {
+			if wt != invalidWord && wt != punctWord && wt != connectorWord {
 				buf.WriteRune(connector)
 			}
 
@@ -374,7 +373,7 @@ func nextValidRune(str string, prev rune) (r rune, size int) {
 	return
 }
 
-func toLower(buf *bytes.Buffer, wt wordType, str string, connector rune) {
+func toLower(buf *stringBuilder, wt wordType, str string, connector rune) {
 	buf.Grow(buf.Len() + len(str))
 
 	if wt != upperCaseWord && wt != connectorWord {
@@ -401,7 +400,7 @@ func SwapCase(str string) string {
 	var r rune
 	var size int
 
-	buf := &bytes.Buffer{}
+	buf := &stringBuilder{}
 
 	for len(str) > 0 {
 		r, size = utf8.DecodeRuneInString(str)
@@ -435,7 +434,7 @@ func FirstRuneToUpper(str string) string {
 		return str
 	}
 
-	buf := &bytes.Buffer{}
+	buf := &stringBuilder{}
 	buf.WriteRune(unicode.ToUpper(r))
 	buf.WriteString(str[size:])
 	return buf.String()
@@ -453,7 +452,7 @@ func FirstRuneToLower(str string) string {
 		return str
 	}
 
-	buf := &bytes.Buffer{}
+	buf := &stringBuilder{}
 	buf.WriteRune(unicode.ToLower(r))
 	buf.WriteString(str[size:])
 	return buf.String()
@@ -566,7 +565,7 @@ func Successor(str string) string {
 
 	// Needs to add one character for carry.
 	if i < 0 && carry != ' ' {
-		buf := &bytes.Buffer{}
+		buf := &stringBuilder{}
 		buf.Grow(l + 4) // Reserve enough space for write.
 
 		if lastAlphanumeric != 0 {
diff --git a/vendor/github.com/huandu/xstrings/format.go b/vendor/github.com/huandu/xstrings/format.go
index 2d02df1c042f..8cd76c525ccb 100644
--- a/vendor/github.com/huandu/xstrings/format.go
+++ b/vendor/github.com/huandu/xstrings/format.go
@@ -4,7 +4,6 @@
 package xstrings
 
 import (
-	"bytes"
 	"unicode/utf8"
 )
 
@@ -28,7 +27,7 @@ func ExpandTabs(str string, tabSize int) string {
 
 	var r rune
 	var i, size, column, expand int
-	var output *bytes.Buffer
+	var output *stringBuilder
 
 	orig := str
 
@@ -43,7 +42,7 @@ func ExpandTabs(str string, tabSize int) string {
 			}
 
 			for i = 0; i < expand; i++ {
-				output.WriteByte(byte(' '))
+				output.WriteRune(' ')
 			}
 
 			column += expand
@@ -88,7 +87,7 @@ func LeftJustify(str string, length int, pad string) string {
 	remains := length - l
 	padLen := Len(pad)
 
-	output := &bytes.Buffer{}
+	output := &stringBuilder{}
 	output.Grow(len(str) + (remains/padLen+1)*len(pad))
 	output.WriteString(str)
 	writePadString(output, pad, padLen, remains)
@@ -114,7 +113,7 @@ func RightJustify(str string, length int, pad string) string {
 	remains := length - l
 	padLen := Len(pad)
 
-	output := &bytes.Buffer{}
+	output := &stringBuilder{}
 	output.Grow(len(str) + (remains/padLen+1)*len(pad))
 	writePadString(output, pad, padLen, remains)
 	output.WriteString(str)
@@ -140,7 +139,7 @@ func Center(str string, length int, pad string) string {
 	remains := length - l
 	padLen := Len(pad)
 
-	output := &bytes.Buffer{}
+	output := &stringBuilder{}
 	output.Grow(len(str) + (remains/padLen+1)*len(pad))
 	writePadString(output, pad, padLen, remains/2)
 	output.WriteString(str)
@@ -148,7 +147,7 @@ func Center(str string, length int, pad string) string {
 	return output.String()
 }
 
-func writePadString(output *bytes.Buffer, pad string, padLen, remains int) {
+func writePadString(output *stringBuilder, pad string, padLen, remains int) {
 	var r rune
 	var size int
 
diff --git a/vendor/github.com/huandu/xstrings/manipulate.go b/vendor/github.com/huandu/xstrings/manipulate.go
index 0eefb43ed71d..64075f9bb8a7 100644
--- a/vendor/github.com/huandu/xstrings/manipulate.go
+++ b/vendor/github.com/huandu/xstrings/manipulate.go
@@ -4,7 +4,6 @@
 package xstrings
 
 import (
-	"bytes"
 	"strings"
 	"unicode/utf8"
 )
@@ -131,7 +130,7 @@ func Insert(dst, src string, index int) string {
 // Scrub scrubs invalid utf8 bytes with repl string.
 // Adjacent invalid bytes are replaced only once.
 func Scrub(str, repl string) string {
-	var buf *bytes.Buffer
+	var buf *stringBuilder
 	var r rune
 	var size, pos int
 	var hasError bool
@@ -144,7 +143,7 @@ func Scrub(str, repl string) string {
 		if r == utf8.RuneError {
 			if !hasError {
 				if buf == nil {
-					buf = &bytes.Buffer{}
+					buf = &stringBuilder{}
 				}
 
 				buf.WriteString(origin[:pos])
diff --git a/vendor/github.com/huandu/xstrings/stringbuilder.go b/vendor/github.com/huandu/xstrings/stringbuilder.go
new file mode 100644
index 000000000000..bb0919d32f77
--- /dev/null
+++ b/vendor/github.com/huandu/xstrings/stringbuilder.go
@@ -0,0 +1,7 @@
+//+build go1.10
+
+package xstrings
+
+import "strings"
+
+type stringBuilder = strings.Builder
diff --git a/vendor/github.com/huandu/xstrings/stringbuilder_go110.go b/vendor/github.com/huandu/xstrings/stringbuilder_go110.go
new file mode 100644
index 000000000000..dac389d139e7
--- /dev/null
+++ b/vendor/github.com/huandu/xstrings/stringbuilder_go110.go
@@ -0,0 +1,9 @@
+//+build !go1.10
+
+package xstrings
+
+import "bytes"
+
+type stringBuilder struct {
+	bytes.Buffer
+}
diff --git a/vendor/github.com/huandu/xstrings/translate.go b/vendor/github.com/huandu/xstrings/translate.go
index 66e23f86d030..42e694fb1761 100644
--- a/vendor/github.com/huandu/xstrings/translate.go
+++ b/vendor/github.com/huandu/xstrings/translate.go
@@ -4,7 +4,6 @@
 package xstrings
 
 import (
-	"bytes"
 	"unicode"
 	"unicode/utf8"
 )
@@ -152,12 +151,12 @@ func NewTranslator(from, to string) *Translator {
 			continue
 		}
 
-		fromStart, toStart = tr.addRuneRange(fromStart, fromEnd, toStart, toStart, singleRunes)
+		_, toStart = tr.addRuneRange(fromStart, fromEnd, toStart, toStart, singleRunes)
 		fromEnd = utf8.RuneError
 	}
 
 	if fromEnd != utf8.RuneError {
-		singleRunes = tr.addRune(fromEnd, toStart, singleRunes)
+		tr.addRune(fromEnd, toStart, singleRunes)
 	}
 
 	tr.reverted = reverted
@@ -303,7 +302,7 @@ func (tr *Translator) Translate(str string) string {
 
 	orig := str
 
-	var output *bytes.Buffer
+	var output *stringBuilder
 
 	for len(str) > 0 {
 		r, size = utf8.DecodeRuneInString(str)
@@ -500,7 +499,7 @@ func Squeeze(str, pattern string) string {
 	var size int
 	var skipSqueeze, matched bool
 	var tr *Translator
-	var output *bytes.Buffer
+	var output *stringBuilder
 
 	orig := str
 	last = -1
diff --git a/vendor/github.com/imdario/mergo/README.md b/vendor/github.com/imdario/mergo/README.md
index aa8cbd7ce6d7..7e6f7aeee82e 100644
--- a/vendor/github.com/imdario/mergo/README.md
+++ b/vendor/github.com/imdario/mergo/README.md
@@ -8,8 +8,7 @@
 [![Coverage Status][9]][10]
 [![Sourcegraph][11]][12]
 [![FOSSA Status][13]][14]
-
-[![GoCenter Kudos][15]][16]
+[![Become my sponsor][15]][16]
 
 [1]: https://travis-ci.org/imdario/mergo.png
 [2]: https://travis-ci.org/imdario/mergo
@@ -25,8 +24,8 @@
 [12]: https://sourcegraph.com/github.com/imdario/mergo?badge
 [13]: https://app.fossa.io/api/projects/git%2Bgithub.com%2Fimdario%2Fmergo.svg?type=shield
 [14]: https://app.fossa.io/projects/git%2Bgithub.com%2Fimdario%2Fmergo?ref=badge_shield
-[15]: https://search.gocenter.io/api/ui/badge/github.com%2Fimdario%2Fmergo
-[16]: https://search.gocenter.io/github.com/imdario/mergo
+[15]: https://img.shields.io/github/sponsors/imdario
+[16]: https://github.com/sponsors/imdario
 
 A helper to merge structs and maps in Golang. Useful for configuration default values, avoiding messy if-statements.
 
@@ -36,11 +35,11 @@ Also a lovely [comune](http://en.wikipedia.org/wiki/Mergo) (municipality) in the
 
 ## Status
 
-It is ready for production use. [It is used in several projects by Docker, Google, The Linux Foundation, VMWare, Shopify, etc](https://github.com/imdario/mergo#mergo-in-the-wild).
+It is ready for production use. [It is used in several projects by Docker, Google, The Linux Foundation, VMWare, Shopify, Microsoft, etc](https://github.com/imdario/mergo#mergo-in-the-wild).
 
 ### Important note
 
-Please keep in mind that a problematic PR broke [0.3.9](//github.com/imdario/mergo/releases/tag/0.3.9). I reverted it in [0.3.10](//github.com/imdario/mergo/releases/tag/0.3.10), and I consider it stable but not bug-free. Also, this version adds suppot for go modules.
+Please keep in mind that a problematic PR broke [0.3.9](//github.com/imdario/mergo/releases/tag/0.3.9). I reverted it in [0.3.10](//github.com/imdario/mergo/releases/tag/0.3.10), and I consider it stable but not bug-free. Also, this version adds support for go modules.
 
 Keep in mind that in [0.3.2](//github.com/imdario/mergo/releases/tag/0.3.2), Mergo changed `Merge()`and `Map()` signatures to support [transformers](#transformers). I added an optional/variadic argument so that it won't break the existing code.
 
@@ -51,12 +50,12 @@ If you were using Mergo before April 6th, 2015, please check your project works
 If Mergo is useful to you, consider buying me a coffee, a beer, or making a monthly donation to allow me to keep building great free software. :heart_eyes:
 
 <a href='https://ko-fi.com/B0B58839' target='_blank'><img height='36' style='border:0px;height:36px;' src='https://az743702.vo.msecnd.net/cdn/kofi1.png?v=0' border='0' alt='Buy Me a Coffee at ko-fi.com' /></a>
-[![Beerpay](https://beerpay.io/imdario/mergo/badge.svg)](https://beerpay.io/imdario/mergo)
-[![Beerpay](https://beerpay.io/imdario/mergo/make-wish.svg)](https://beerpay.io/imdario/mergo)
 <a href="https://liberapay.com/dario/donate"><img alt="Donate using Liberapay" src="https://liberapay.com/assets/widgets/donate.svg"></a>
+<a href='https://github.com/sponsors/imdario' target='_blank'><img alt="Become my sponsor" src="https://img.shields.io/github/sponsors/imdario?style=for-the-badge" /></a>
 
 ### Mergo in the wild
 
+- [cli/cli](https://github.com/cli/cli)
 - [moby/moby](https://github.com/moby/moby)
 - [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
 - [vmware/dispatch](https://github.com/vmware/dispatch)
@@ -98,6 +97,8 @@ If Mergo is useful to you, consider buying me a coffee, a beer, or making a mont
 - [jnuthong/item_search](https://github.com/jnuthong/item_search)
 - [bukalapak/snowboard](https://github.com/bukalapak/snowboard)
 - [containerssh/containerssh](https://github.com/containerssh/containerssh)
+- [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser)
+- [tjpnz/structbot](https://github.com/tjpnz/structbot)
 
 ## Install
 
@@ -168,7 +169,7 @@ func main() {
 
 Note: if test are failing due missing package, please execute:
 
-    go get gopkg.in/yaml.v2
+    go get gopkg.in/yaml.v3
 
 ### Transformers
 
@@ -218,7 +219,6 @@ func main() {
 }
 ```
 
-
 ## Contact me
 
 If I can help you, you have an idea or you are using Mergo in your projects, don't hesitate to drop me a line (or a pull request): [@im_dario](https://twitter.com/im_dario)
@@ -227,18 +227,6 @@ If I can help you, you have an idea or you are using Mergo in your projects, don
 
 Written by [Dario Castañé](http://dario.im).
 
-## Top Contributors
-
-[![0](https://sourcerer.io/fame/imdario/imdario/mergo/images/0)](https://sourcerer.io/fame/imdario/imdario/mergo/links/0)
-[![1](https://sourcerer.io/fame/imdario/imdario/mergo/images/1)](https://sourcerer.io/fame/imdario/imdario/mergo/links/1)
-[![2](https://sourcerer.io/fame/imdario/imdario/mergo/images/2)](https://sourcerer.io/fame/imdario/imdario/mergo/links/2)
-[![3](https://sourcerer.io/fame/imdario/imdario/mergo/images/3)](https://sourcerer.io/fame/imdario/imdario/mergo/links/3)
-[![4](https://sourcerer.io/fame/imdario/imdario/mergo/images/4)](https://sourcerer.io/fame/imdario/imdario/mergo/links/4)
-[![5](https://sourcerer.io/fame/imdario/imdario/mergo/images/5)](https://sourcerer.io/fame/imdario/imdario/mergo/links/5)
-[![6](https://sourcerer.io/fame/imdario/imdario/mergo/images/6)](https://sourcerer.io/fame/imdario/imdario/mergo/links/6)
-[![7](https://sourcerer.io/fame/imdario/imdario/mergo/images/7)](https://sourcerer.io/fame/imdario/imdario/mergo/links/7)
-
-
 ## License
 
 [BSD 3-Clause](http://opensource.org/licenses/BSD-3-Clause) license, as [Go language](http://golang.org/LICENSE).
diff --git a/vendor/github.com/imdario/mergo/merge.go b/vendor/github.com/imdario/mergo/merge.go
index 8c2a8fcd9019..8b4e2f47a08c 100644
--- a/vendor/github.com/imdario/mergo/merge.go
+++ b/vendor/github.com/imdario/mergo/merge.go
@@ -79,7 +79,7 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 		visited[h] = &visit{addr, typ, seen}
 	}
 
-	if config.Transformers != nil && !isEmptyValue(dst) {
+	if config.Transformers != nil && !isReflectNil(dst) && dst.IsValid() {
 		if fn := config.Transformers.Transformer(dst.Type()); fn != nil {
 			err = fn(dst, src)
 			return
diff --git a/vendor/github.com/imdario/mergo/mergo.go b/vendor/github.com/imdario/mergo/mergo.go
index 3cc926c7f624..9fe362d476aa 100644
--- a/vendor/github.com/imdario/mergo/mergo.go
+++ b/vendor/github.com/imdario/mergo/mergo.go
@@ -17,7 +17,7 @@ import (
 var (
 	ErrNilArguments                = errors.New("src and dst must not be nil")
 	ErrDifferentArgumentsTypes     = errors.New("src and dst must be of same type")
-	ErrNotSupported                = errors.New("only structs and maps are supported")
+	ErrNotSupported                = errors.New("only structs, maps, and slices are supported")
 	ErrExpectedMapAsDestination    = errors.New("dst was expected to be a map")
 	ErrExpectedStructAsDestination = errors.New("dst was expected to be a struct")
 	ErrNonPointerAgument           = errors.New("dst must be a pointer")
@@ -65,7 +65,7 @@ func resolveValues(dst, src interface{}) (vDst, vSrc reflect.Value, err error) {
 		return
 	}
 	vDst = reflect.ValueOf(dst).Elem()
-	if vDst.Kind() != reflect.Struct && vDst.Kind() != reflect.Map {
+	if vDst.Kind() != reflect.Struct && vDst.Kind() != reflect.Map && vDst.Kind() != reflect.Slice {
 		err = ErrNotSupported
 		return
 	}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert.go
index 170307544662..a3f30c53c6c4 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -59,7 +61,6 @@ func (m *Alert) Validate(formats strfmt.Registry) error {
 }
 
 func (m *Alert) validateGeneratorURL(formats strfmt.Registry) error {
-
 	if swag.IsZero(m.GeneratorURL) { // not required
 		return nil
 	}
@@ -73,9 +74,45 @@ func (m *Alert) validateGeneratorURL(formats strfmt.Registry) error {
 
 func (m *Alert) validateLabels(formats strfmt.Registry) error {
 
-	if err := m.Labels.Validate(formats); err != nil {
+	if err := validate.Required("labels", "body", m.Labels); err != nil {
+		return err
+	}
+
+	if m.Labels != nil {
+		if err := m.Labels.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("labels")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("labels")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ContextValidate validate this alert based on the context it is used
+func (m *Alert) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateLabels(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *Alert) contextValidateLabels(ctx context.Context, formats strfmt.Registry) error {
+
+	if err := m.Labels.ContextValidate(ctx, formats); err != nil {
 		if ve, ok := err.(*errors.Validation); ok {
 			return ve.ValidateName("labels")
+		} else if ce, ok := err.(*errors.CompositeError); ok {
+			return ce.ValidateName("labels")
 		}
 		return err
 	}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_group.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_group.go
index 3db729359dd6..c943e683303e 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_group.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_group.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -83,6 +84,8 @@ func (m *AlertGroup) validateAlerts(formats strfmt.Registry) error {
 			if err := m.Alerts[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName("alerts" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("alerts" + "." + strconv.Itoa(i))
 				}
 				return err
 			}
@@ -95,13 +98,21 @@ func (m *AlertGroup) validateAlerts(formats strfmt.Registry) error {
 
 func (m *AlertGroup) validateLabels(formats strfmt.Registry) error {
 
-	if err := m.Labels.Validate(formats); err != nil {
-		if ve, ok := err.(*errors.Validation); ok {
-			return ve.ValidateName("labels")
-		}
+	if err := validate.Required("labels", "body", m.Labels); err != nil {
 		return err
 	}
 
+	if m.Labels != nil {
+		if err := m.Labels.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("labels")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("labels")
+			}
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -115,6 +126,80 @@ func (m *AlertGroup) validateReceiver(formats strfmt.Registry) error {
 		if err := m.Receiver.Validate(formats); err != nil {
 			if ve, ok := err.(*errors.Validation); ok {
 				return ve.ValidateName("receiver")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("receiver")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ContextValidate validate this alert group based on the context it is used
+func (m *AlertGroup) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateAlerts(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.contextValidateLabels(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.contextValidateReceiver(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *AlertGroup) contextValidateAlerts(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(m.Alerts); i++ {
+
+		if m.Alerts[i] != nil {
+			if err := m.Alerts[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("alerts" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("alerts" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func (m *AlertGroup) contextValidateLabels(ctx context.Context, formats strfmt.Registry) error {
+
+	if err := m.Labels.ContextValidate(ctx, formats); err != nil {
+		if ve, ok := err.(*errors.Validation); ok {
+			return ve.ValidateName("labels")
+		} else if ce, ok := err.(*errors.CompositeError); ok {
+			return ce.ValidateName("labels")
+		}
+		return err
+	}
+
+	return nil
+}
+
+func (m *AlertGroup) contextValidateReceiver(ctx context.Context, formats strfmt.Registry) error {
+
+	if m.Receiver != nil {
+		if err := m.Receiver.ContextValidate(ctx, formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("receiver")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("receiver")
 			}
 			return err
 		}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_groups.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_groups.go
index cb48c08e5f53..31ccb2172b94 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_groups.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_groups.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -45,6 +46,33 @@ func (m AlertGroups) Validate(formats strfmt.Registry) error {
 			if err := m[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// ContextValidate validate this alert groups based on the context it is used
+func (m AlertGroups) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+
+		if m[i] != nil {
+			if err := m[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
 				}
 				return err
 			}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_status.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_status.go
index 9ee99f7851b3..ae1f248c996b 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_status.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/alert_status.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"encoding/json"
 
 	"github.com/go-openapi/errors"
@@ -133,6 +134,11 @@ func (m *AlertStatus) validateState(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this alert status based on context it is used
+func (m *AlertStatus) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *AlertStatus) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_config.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_config.go
index 958114bbf8ce..bf7721eb55ef 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_config.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_config.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -59,6 +61,11 @@ func (m *AlertmanagerConfig) validateOriginal(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this alertmanager config based on context it is used
+func (m *AlertmanagerConfig) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *AlertmanagerConfig) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_status.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_status.go
index 483beb23e11d..0d5370edfb3a 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_status.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/alertmanager_status.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -85,6 +87,8 @@ func (m *AlertmanagerStatus) validateCluster(formats strfmt.Registry) error {
 		if err := m.Cluster.Validate(formats); err != nil {
 			if ve, ok := err.(*errors.Validation); ok {
 				return ve.ValidateName("cluster")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("cluster")
 			}
 			return err
 		}
@@ -103,6 +107,8 @@ func (m *AlertmanagerStatus) validateConfig(formats strfmt.Registry) error {
 		if err := m.Config.Validate(formats); err != nil {
 			if ve, ok := err.(*errors.Validation); ok {
 				return ve.ValidateName("config")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("config")
 			}
 			return err
 		}
@@ -134,6 +140,78 @@ func (m *AlertmanagerStatus) validateVersionInfo(formats strfmt.Registry) error
 		if err := m.VersionInfo.Validate(formats); err != nil {
 			if ve, ok := err.(*errors.Validation); ok {
 				return ve.ValidateName("versionInfo")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("versionInfo")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ContextValidate validate this alertmanager status based on the context it is used
+func (m *AlertmanagerStatus) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateCluster(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.contextValidateConfig(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.contextValidateVersionInfo(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *AlertmanagerStatus) contextValidateCluster(ctx context.Context, formats strfmt.Registry) error {
+
+	if m.Cluster != nil {
+		if err := m.Cluster.ContextValidate(ctx, formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("cluster")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("cluster")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *AlertmanagerStatus) contextValidateConfig(ctx context.Context, formats strfmt.Registry) error {
+
+	if m.Config != nil {
+		if err := m.Config.ContextValidate(ctx, formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("config")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("config")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *AlertmanagerStatus) contextValidateVersionInfo(ctx context.Context, formats strfmt.Registry) error {
+
+	if m.VersionInfo != nil {
+		if err := m.VersionInfo.ContextValidate(ctx, formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("versionInfo")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("versionInfo")
 			}
 			return err
 		}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/cluster_status.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/cluster_status.go
index a3373a729d4e..0078320f15c3 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/cluster_status.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/cluster_status.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"encoding/json"
 	"strconv"
 
@@ -65,7 +66,6 @@ func (m *ClusterStatus) Validate(formats strfmt.Registry) error {
 }
 
 func (m *ClusterStatus) validatePeers(formats strfmt.Registry) error {
-
 	if swag.IsZero(m.Peers) { // not required
 		return nil
 	}
@@ -79,6 +79,8 @@ func (m *ClusterStatus) validatePeers(formats strfmt.Registry) error {
 			if err := m.Peers[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName("peers" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("peers" + "." + strconv.Itoa(i))
 				}
 				return err
 			}
@@ -135,6 +137,40 @@ func (m *ClusterStatus) validateStatus(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validate this cluster status based on the context it is used
+func (m *ClusterStatus) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidatePeers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *ClusterStatus) contextValidatePeers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(m.Peers); i++ {
+
+		if m.Peers[i] != nil {
+			if err := m.Peers[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("peers" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("peers" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *ClusterStatus) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alert.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alert.go
index 2f74818c27e6..f7db3321c1f9 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alert.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alert.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -206,13 +207,21 @@ func (m *GettableAlert) Validate(formats strfmt.Registry) error {
 
 func (m *GettableAlert) validateAnnotations(formats strfmt.Registry) error {
 
-	if err := m.Annotations.Validate(formats); err != nil {
-		if ve, ok := err.(*errors.Validation); ok {
-			return ve.ValidateName("annotations")
-		}
+	if err := validate.Required("annotations", "body", m.Annotations); err != nil {
 		return err
 	}
 
+	if m.Annotations != nil {
+		if err := m.Annotations.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("annotations")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("annotations")
+			}
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -253,6 +262,8 @@ func (m *GettableAlert) validateReceivers(formats strfmt.Registry) error {
 			if err := m.Receivers[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName("receivers" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("receivers" + "." + strconv.Itoa(i))
 				}
 				return err
 			}
@@ -286,6 +297,8 @@ func (m *GettableAlert) validateStatus(formats strfmt.Registry) error {
 		if err := m.Status.Validate(formats); err != nil {
 			if ve, ok := err.(*errors.Validation); ok {
 				return ve.ValidateName("status")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("status")
 			}
 			return err
 		}
@@ -307,6 +320,83 @@ func (m *GettableAlert) validateUpdatedAt(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validate this gettable alert based on the context it is used
+func (m *GettableAlert) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateAnnotations(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.contextValidateReceivers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.contextValidateStatus(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	// validation for a type composition with Alert
+	if err := m.Alert.ContextValidate(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *GettableAlert) contextValidateAnnotations(ctx context.Context, formats strfmt.Registry) error {
+
+	if err := m.Annotations.ContextValidate(ctx, formats); err != nil {
+		if ve, ok := err.(*errors.Validation); ok {
+			return ve.ValidateName("annotations")
+		} else if ce, ok := err.(*errors.CompositeError); ok {
+			return ce.ValidateName("annotations")
+		}
+		return err
+	}
+
+	return nil
+}
+
+func (m *GettableAlert) contextValidateReceivers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(m.Receivers); i++ {
+
+		if m.Receivers[i] != nil {
+			if err := m.Receivers[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("receivers" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("receivers" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func (m *GettableAlert) contextValidateStatus(ctx context.Context, formats strfmt.Registry) error {
+
+	if m.Status != nil {
+		if err := m.Status.ContextValidate(ctx, formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("status")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("status")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *GettableAlert) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alerts.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alerts.go
index f5a5c04215e3..4efe8cd5ec80 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alerts.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_alerts.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -45,6 +46,33 @@ func (m GettableAlerts) Validate(formats strfmt.Registry) error {
 			if err := m[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// ContextValidate validate this gettable alerts based on the context it is used
+func (m GettableAlerts) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+
+		if m[i] != nil {
+			if err := m[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
 				}
 				return err
 			}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silence.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silence.go
index 8fb7a5129ce9..fe9d178d7f74 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silence.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silence.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -155,6 +157,8 @@ func (m *GettableSilence) validateStatus(formats strfmt.Registry) error {
 		if err := m.Status.Validate(formats); err != nil {
 			if ve, ok := err.(*errors.Validation); ok {
 				return ve.ValidateName("status")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("status")
 			}
 			return err
 		}
@@ -176,6 +180,41 @@ func (m *GettableSilence) validateUpdatedAt(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validate this gettable silence based on the context it is used
+func (m *GettableSilence) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateStatus(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	// validation for a type composition with Silence
+	if err := m.Silence.ContextValidate(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *GettableSilence) contextValidateStatus(ctx context.Context, formats strfmt.Registry) error {
+
+	if m.Status != nil {
+		if err := m.Status.ContextValidate(ctx, formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("status")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("status")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *GettableSilence) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silences.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silences.go
index 32d109ef7e20..cda5ef6497ab 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silences.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/gettable_silences.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -45,6 +46,33 @@ func (m GettableSilences) Validate(formats strfmt.Registry) error {
 			if err := m[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// ContextValidate validate this gettable silences based on the context it is used
+func (m GettableSilences) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+
+		if m[i] != nil {
+			if err := m[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
 				}
 				return err
 			}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/label_set.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/label_set.go
index d7d2985238d3..9dcae13b8bbc 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/label_set.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/label_set.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/strfmt"
 )
 
@@ -32,3 +34,8 @@ type LabelSet map[string]string
 func (m LabelSet) Validate(formats strfmt.Registry) error {
 	return nil
 }
+
+// ContextValidate validates this label set based on context it is used
+func (m LabelSet) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/matcher.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/matcher.go
index f2e2d6de8c89..0d30e7ea94d4 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/matcher.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/matcher.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -96,6 +98,11 @@ func (m *Matcher) validateValue(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this matcher based on context it is used
+func (m *Matcher) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *Matcher) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/matchers.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/matchers.go
index 3fb73c434292..4e2061872e4c 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/matchers.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/matchers.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -52,6 +53,33 @@ func (m Matchers) Validate(formats strfmt.Registry) error {
 			if err := m[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// ContextValidate validate this matchers based on the context it is used
+func (m Matchers) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+
+		if m[i] != nil {
+			if err := m[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
 				}
 				return err
 			}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/peer_status.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/peer_status.go
index 204c3d7857f3..9d9b393aea56 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/peer_status.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/peer_status.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -76,6 +78,11 @@ func (m *PeerStatus) validateName(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this peer status based on context it is used
+func (m *PeerStatus) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *PeerStatus) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alert.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alert.go
index 88c06e835221..dcec7f0a19ef 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alert.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alert.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -140,11 +142,15 @@ func (m *PostableAlert) validateAnnotations(formats strfmt.Registry) error {
 		return nil
 	}
 
-	if err := m.Annotations.Validate(formats); err != nil {
-		if ve, ok := err.(*errors.Validation); ok {
-			return ve.ValidateName("annotations")
+	if m.Annotations != nil {
+		if err := m.Annotations.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("annotations")
+			} else if ce, ok := err.(*errors.CompositeError); ok {
+				return ce.ValidateName("annotations")
+			}
+			return err
 		}
-		return err
 	}
 
 	return nil
@@ -176,6 +182,39 @@ func (m *PostableAlert) validateStartsAt(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validate this postable alert based on the context it is used
+func (m *PostableAlert) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateAnnotations(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	// validation for a type composition with Alert
+	if err := m.Alert.ContextValidate(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *PostableAlert) contextValidateAnnotations(ctx context.Context, formats strfmt.Registry) error {
+
+	if err := m.Annotations.ContextValidate(ctx, formats); err != nil {
+		if ve, ok := err.(*errors.Validation); ok {
+			return ve.ValidateName("annotations")
+		} else if ce, ok := err.(*errors.CompositeError); ok {
+			return ce.ValidateName("annotations")
+		}
+		return err
+	}
+
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *PostableAlert) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alerts.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alerts.go
index 9a135636821c..ed4d7fb9babe 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alerts.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_alerts.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"strconv"
 
 	"github.com/go-openapi/errors"
@@ -45,6 +46,33 @@ func (m PostableAlerts) Validate(formats strfmt.Registry) error {
 			if err := m[i].Validate(formats); err != nil {
 				if ve, ok := err.(*errors.Validation); ok {
 					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// ContextValidate validate this postable alerts based on the context it is used
+func (m PostableAlerts) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+
+		if m[i] != nil {
+			if err := m[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName(strconv.Itoa(i))
 				}
 				return err
 			}
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_silence.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_silence.go
index c77a9534a807..88aaa54fd859 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_silence.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/postable_silence.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -97,6 +99,21 @@ func (m *PostableSilence) Validate(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validate this postable silence based on the context it is used
+func (m *PostableSilence) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	// validation for a type composition with Silence
+	if err := m.Silence.ContextValidate(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *PostableSilence) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/receiver.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/receiver.go
index 9f85db60a11b..8e1bf9ee4578 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/receiver.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/receiver.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -59,6 +61,11 @@ func (m *Receiver) validateName(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this receiver based on context it is used
+func (m *Receiver) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *Receiver) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/silence.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/silence.go
index 27fb9f3d1533..b58913b5c06d 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/silence.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/silence.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -124,6 +126,8 @@ func (m *Silence) validateMatchers(formats strfmt.Registry) error {
 	if err := m.Matchers.Validate(formats); err != nil {
 		if ve, ok := err.(*errors.Validation); ok {
 			return ve.ValidateName("matchers")
+		} else if ce, ok := err.(*errors.CompositeError); ok {
+			return ce.ValidateName("matchers")
 		}
 		return err
 	}
@@ -144,6 +148,34 @@ func (m *Silence) validateStartsAt(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validate this silence based on the context it is used
+func (m *Silence) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.contextValidateMatchers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *Silence) contextValidateMatchers(ctx context.Context, formats strfmt.Registry) error {
+
+	if err := m.Matchers.ContextValidate(ctx, formats); err != nil {
+		if ve, ok := err.(*errors.Validation); ok {
+			return ve.ValidateName("matchers")
+		} else if ce, ok := err.(*errors.CompositeError); ok {
+			return ce.ValidateName("matchers")
+		}
+		return err
+	}
+
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *Silence) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/silence_status.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/silence_status.go
index 0c63df853310..25b073795cac 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/silence_status.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/silence_status.go
@@ -20,6 +20,7 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
 	"encoding/json"
 
 	"github.com/go-openapi/errors"
@@ -99,6 +100,11 @@ func (m *SilenceStatus) validateState(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this silence status based on context it is used
+func (m *SilenceStatus) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *SilenceStatus) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/alertmanager/api/v2/models/version_info.go b/vendor/github.com/prometheus/alertmanager/api/v2/models/version_info.go
index f7124eca8e70..18b77584d7cf 100644
--- a/vendor/github.com/prometheus/alertmanager/api/v2/models/version_info.go
+++ b/vendor/github.com/prometheus/alertmanager/api/v2/models/version_info.go
@@ -20,6 +20,8 @@ package models
 // Editing this file might prove futile when you re-run the swagger generate command
 
 import (
+	"context"
+
 	"github.com/go-openapi/errors"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -144,6 +146,11 @@ func (m *VersionInfo) validateVersion(formats strfmt.Registry) error {
 	return nil
 }
 
+// ContextValidate validates this version info based on context it is used
+func (m *VersionInfo) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
 // MarshalBinary interface implementation
 func (m *VersionInfo) MarshalBinary() ([]byte, error) {
 	if m == nil {
diff --git a/vendor/github.com/prometheus/client_golang/api/prometheus/v1/api.go b/vendor/github.com/prometheus/client_golang/api/prometheus/v1/api.go
index 5f0ecef29876..f74139c71f6e 100644
--- a/vendor/github.com/prometheus/client_golang/api/prometheus/v1/api.go
+++ b/vendor/github.com/prometheus/client_golang/api/prometheus/v1/api.go
@@ -335,14 +335,15 @@ type RuleGroup struct {
 // that rules are returned in by the API.
 //
 // Rule types can be determined using a type switch:
-//   switch v := rule.(type) {
-//   case RecordingRule:
-//   	fmt.Print("got a recording rule")
-//   case AlertingRule:
-//   	fmt.Print("got a alerting rule")
-//   default:
-//   	fmt.Printf("unknown rule type %s", v)
-//   }
+//
+//	switch v := rule.(type) {
+//	case RecordingRule:
+//		fmt.Print("got a recording rule")
+//	case AlertingRule:
+//		fmt.Print("got a alerting rule")
+//	default:
+//		fmt.Printf("unknown rule type %s", v)
+//	}
 type Rules []interface{}
 
 // AlertingRule models a alerting rule.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/counter.go b/vendor/github.com/prometheus/client_golang/prometheus/counter.go
index 3668a16b3e74..a912b75a05b7 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/counter.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/counter.go
@@ -246,7 +246,8 @@ func (v *CounterVec) GetMetricWith(labels Labels) (Counter, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Add(42)
+//
+//	myVec.WithLabelValues("404", "GET").Add(42)
 func (v *CounterVec) WithLabelValues(lvs ...string) Counter {
 	c, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -257,7 +258,8 @@ func (v *CounterVec) WithLabelValues(lvs ...string) Counter {
 
 // With works as GetMetricWith, but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
 func (v *CounterVec) With(labels Labels) Counter {
 	c, err := v.GetMetricWith(labels)
 	if err != nil {
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/doc.go b/vendor/github.com/prometheus/client_golang/prometheus/doc.go
index 98450125d6a3..811072cbd54f 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/doc.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/doc.go
@@ -21,55 +21,66 @@
 // All exported functions and methods are safe to be used concurrently unless
 // specified otherwise.
 //
-// A Basic Example
+// # A Basic Example
 //
 // As a starting point, a very basic usage example:
 //
-//    package main
-//
-//    import (
-//    	"log"
-//    	"net/http"
-//
-//    	"github.com/prometheus/client_golang/prometheus"
-//    	"github.com/prometheus/client_golang/prometheus/promhttp"
-//    )
-//
-//    var (
-//    	cpuTemp = prometheus.NewGauge(prometheus.GaugeOpts{
-//    		Name: "cpu_temperature_celsius",
-//    		Help: "Current temperature of the CPU.",
-//    	})
-//    	hdFailures = prometheus.NewCounterVec(
-//    		prometheus.CounterOpts{
-//    			Name: "hd_errors_total",
-//    			Help: "Number of hard-disk errors.",
-//    		},
-//    		[]string{"device"},
-//    	)
-//    )
-//
-//    func init() {
-//    	// Metrics have to be registered to be exposed:
-//    	prometheus.MustRegister(cpuTemp)
-//    	prometheus.MustRegister(hdFailures)
-//    }
-//
-//    func main() {
-//    	cpuTemp.Set(65.3)
-//    	hdFailures.With(prometheus.Labels{"device":"/dev/sda"}).Inc()
-//
-//    	// The Handler function provides a default handler to expose metrics
-//    	// via an HTTP server. "/metrics" is the usual endpoint for that.
-//    	http.Handle("/metrics", promhttp.Handler())
-//    	log.Fatal(http.ListenAndServe(":8080", nil))
-//    }
-//
+//	package main
+//
+//	import (
+//		"log"
+//		"net/http"
+//
+//		"github.com/prometheus/client_golang/prometheus"
+//		"github.com/prometheus/client_golang/prometheus/promhttp"
+//	)
+//
+//	type metrics struct {
+//		cpuTemp  prometheus.Gauge
+//	  hdFailures *prometheus.CounterVec
+//	}
+//
+//	func NewMetrics(reg prometheus.Registerer) *metrics {
+//	  m := &metrics{
+//	    cpuTemp: prometheus.NewGauge(prometheus.GaugeOpts{
+//	      Name: "cpu_temperature_celsius",
+//	      Help: "Current temperature of the CPU.",
+//	    }),
+//	    hdFailures: prometheus.NewCounterVec(
+//	      prometheus.CounterOpts{
+//	        Name: "hd_errors_total",
+//	        Help: "Number of hard-disk errors.",
+//	      },
+//	      []string{"device"},
+//	    ),
+//	  }
+//	  reg.MustRegister(m.cpuTemp)
+//	  reg.MustRegister(m.hdFailures)
+//	  return m
+//	}
+//
+//	func main() {
+//	  // Create a non-global registry.
+//	  reg := prometheus.NewRegistry()
+//
+//	  // Create new metrics and register them using the custom registry.
+//	  m := NewMetrics(reg)
+//	  // Set values for the new created metrics.
+//		m.cpuTemp.Set(65.3)
+//		m.hdFailures.With(prometheus.Labels{"device":"/dev/sda"}).Inc()
+//
+//		// Expose metrics and custom registry via an HTTP server
+//		// using the HandleFor function. "/metrics" is the usual endpoint for that.
+//		http.Handle("/metrics", promhttp.HandlerFor(reg, promhttp.HandlerOpts{Registry: reg}))
+//		log.Fatal(http.ListenAndServe(":8080", nil))
+//	}
 //
 // This is a complete program that exports two metrics, a Gauge and a Counter,
 // the latter with a label attached to turn it into a (one-dimensional) vector.
+// It register the metrics using a custom registry and exposes them via an HTTP server
+// on the /metrics endpoint.
 //
-// Metrics
+// # Metrics
 //
 // The number of exported identifiers in this package might appear a bit
 // overwhelming. However, in addition to the basic plumbing shown in the example
@@ -100,7 +111,7 @@
 // To create instances of Metrics and their vector versions, you need a suitable
 // …Opts struct, i.e. GaugeOpts, CounterOpts, SummaryOpts, or HistogramOpts.
 //
-// Custom Collectors and constant Metrics
+// # Custom Collectors and constant Metrics
 //
 // While you could create your own implementations of Metric, most likely you
 // will only ever implement the Collector interface on your own. At a first
@@ -141,7 +152,7 @@
 // a metric, GaugeFunc, CounterFunc, or UntypedFunc might be interesting
 // shortcuts.
 //
-// Advanced Uses of the Registry
+// # Advanced Uses of the Registry
 //
 // While MustRegister is the by far most common way of registering a Collector,
 // sometimes you might want to handle the errors the registration might cause.
@@ -176,23 +187,23 @@
 // NewProcessCollector). With a custom registry, you are in control and decide
 // yourself about the Collectors to register.
 //
-// HTTP Exposition
+// # HTTP Exposition
 //
 // The Registry implements the Gatherer interface. The caller of the Gather
 // method can then expose the gathered metrics in some way. Usually, the metrics
 // are served via HTTP on the /metrics endpoint. That's happening in the example
 // above. The tools to expose metrics via HTTP are in the promhttp sub-package.
 //
-// Pushing to the Pushgateway
+// # Pushing to the Pushgateway
 //
 // Function for pushing to the Pushgateway can be found in the push sub-package.
 //
-// Graphite Bridge
+// # Graphite Bridge
 //
 // Functions and examples to push metrics from a Gatherer to Graphite can be
 // found in the graphite sub-package.
 //
-// Other Means of Exposition
+// # Other Means of Exposition
 //
 // More ways of exposing metrics can easily be added by following the approaches
 // of the existing implementations.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/gauge.go b/vendor/github.com/prometheus/client_golang/prometheus/gauge.go
index bd0733d6a7d6..21271a5bb462 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/gauge.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/gauge.go
@@ -210,7 +210,8 @@ func (v *GaugeVec) GetMetricWith(labels Labels) (Gauge, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Add(42)
+//
+//	myVec.WithLabelValues("404", "GET").Add(42)
 func (v *GaugeVec) WithLabelValues(lvs ...string) Gauge {
 	g, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -221,7 +222,8 @@ func (v *GaugeVec) WithLabelValues(lvs ...string) Gauge {
 
 // With works as GetMetricWith, but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
 func (v *GaugeVec) With(labels Labels) Gauge {
 	g, err := v.GetMetricWith(labels)
 	if err != nil {
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/histogram.go b/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
index 73e814a4d5c4..4c873a01c3d3 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
@@ -28,19 +28,216 @@ import (
 	dto "github.com/prometheus/client_model/go"
 )
 
+// nativeHistogramBounds for the frac of observed values. Only relevant for
+// schema > 0. The position in the slice is the schema. (0 is never used, just
+// here for convenience of using the schema directly as the index.)
+//
+// TODO(beorn7): Currently, we do a binary search into these slices. There are
+// ways to turn it into a small number of simple array lookups. It probably only
+// matters for schema 5 and beyond, but should be investigated. See this comment
+// as a starting point:
+// https://github.com/open-telemetry/opentelemetry-specification/issues/1776#issuecomment-870164310
+var nativeHistogramBounds = [][]float64{
+	// Schema "0":
+	{0.5},
+	// Schema 1:
+	{0.5, 0.7071067811865475},
+	// Schema 2:
+	{0.5, 0.5946035575013605, 0.7071067811865475, 0.8408964152537144},
+	// Schema 3:
+	{
+		0.5, 0.5452538663326288, 0.5946035575013605, 0.6484197773255048,
+		0.7071067811865475, 0.7711054127039704, 0.8408964152537144, 0.9170040432046711,
+	},
+	// Schema 4:
+	{
+		0.5, 0.5221368912137069, 0.5452538663326288, 0.5693943173783458,
+		0.5946035575013605, 0.620928906036742, 0.6484197773255048, 0.6771277734684463,
+		0.7071067811865475, 0.7384130729697496, 0.7711054127039704, 0.805245165974627,
+		0.8408964152537144, 0.8781260801866495, 0.9170040432046711, 0.9576032806985735,
+	},
+	// Schema 5:
+	{
+		0.5, 0.5109485743270583, 0.5221368912137069, 0.5335702003384117,
+		0.5452538663326288, 0.5571933712979462, 0.5693943173783458, 0.5818624293887887,
+		0.5946035575013605, 0.6076236799902344, 0.620928906036742, 0.6345254785958666,
+		0.6484197773255048, 0.6626183215798706, 0.6771277734684463, 0.6919549409819159,
+		0.7071067811865475, 0.7225904034885232, 0.7384130729697496, 0.7545822137967112,
+		0.7711054127039704, 0.7879904225539431, 0.805245165974627, 0.8228777390769823,
+		0.8408964152537144, 0.8593096490612387, 0.8781260801866495, 0.8973545375015533,
+		0.9170040432046711, 0.9370838170551498, 0.9576032806985735, 0.9785720620876999,
+	},
+	// Schema 6:
+	{
+		0.5, 0.5054446430258502, 0.5109485743270583, 0.5165124395106142,
+		0.5221368912137069, 0.5278225891802786, 0.5335702003384117, 0.5393803988785598,
+		0.5452538663326288, 0.5511912916539204, 0.5571933712979462, 0.5632608093041209,
+		0.5693943173783458, 0.5755946149764913, 0.5818624293887887, 0.5881984958251406,
+		0.5946035575013605, 0.6010783657263515, 0.6076236799902344, 0.6142402680534349,
+		0.620928906036742, 0.6276903785123455, 0.6345254785958666, 0.6414350080393891,
+		0.6484197773255048, 0.6554806057623822, 0.6626183215798706, 0.6698337620266515,
+		0.6771277734684463, 0.6845012114872953, 0.6919549409819159, 0.6994898362691555,
+		0.7071067811865475, 0.7148066691959849, 0.7225904034885232, 0.7304588970903234,
+		0.7384130729697496, 0.7464538641456323, 0.7545822137967112, 0.762799075372269,
+		0.7711054127039704, 0.7795022001189185, 0.7879904225539431, 0.7965710756711334,
+		0.805245165974627, 0.8140137109286738, 0.8228777390769823, 0.8318382901633681,
+		0.8408964152537144, 0.8500531768592616, 0.8593096490612387, 0.8686669176368529,
+		0.8781260801866495, 0.8876882462632604, 0.8973545375015533, 0.9071260877501991,
+		0.9170040432046711, 0.9269895625416926, 0.9370838170551498, 0.9472879907934827,
+		0.9576032806985735, 0.9680308967461471, 0.9785720620876999, 0.9892280131939752,
+	},
+	// Schema 7:
+	{
+		0.5, 0.5027149505564014, 0.5054446430258502, 0.5081891574554764,
+		0.5109485743270583, 0.5137229745593818, 0.5165124395106142, 0.5193170509806894,
+		0.5221368912137069, 0.5249720429003435, 0.5278225891802786, 0.5306886136446309,
+		0.5335702003384117, 0.5364674337629877, 0.5393803988785598, 0.5423091811066545,
+		0.5452538663326288, 0.5482145409081883, 0.5511912916539204, 0.5541842058618393,
+		0.5571933712979462, 0.5602188762048033, 0.5632608093041209, 0.5663192597993595,
+		0.5693943173783458, 0.572486072215902, 0.5755946149764913, 0.5787200368168754,
+		0.5818624293887887, 0.585021884841625, 0.5881984958251406, 0.5913923554921704,
+		0.5946035575013605, 0.5978321960199137, 0.6010783657263515, 0.6043421618132907,
+		0.6076236799902344, 0.6109230164863786, 0.6142402680534349, 0.6175755319684665,
+		0.620928906036742, 0.6243004885946023, 0.6276903785123455, 0.6310986751971253,
+		0.6345254785958666, 0.637970889198196, 0.6414350080393891, 0.6449179367033329,
+		0.6484197773255048, 0.6519406325959679, 0.6554806057623822, 0.659039800633032,
+		0.6626183215798706, 0.6662162735415805, 0.6698337620266515, 0.6734708931164728,
+		0.6771277734684463, 0.6808045103191123, 0.6845012114872953, 0.688217985377265,
+		0.6919549409819159, 0.6957121878859629, 0.6994898362691555, 0.7032879969095076,
+		0.7071067811865475, 0.7109463010845827, 0.7148066691959849, 0.718687998724491,
+		0.7225904034885232, 0.7265139979245261, 0.7304588970903234, 0.7344252166684908,
+		0.7384130729697496, 0.7424225829363761, 0.7464538641456323, 0.7505070348132126,
+		0.7545822137967112, 0.7586795205991071, 0.762799075372269, 0.7669409989204777,
+		0.7711054127039704, 0.7752924388424999, 0.7795022001189185, 0.7837348199827764,
+		0.7879904225539431, 0.7922691326262467, 0.7965710756711334, 0.8008963778413465,
+		0.805245165974627, 0.8096175675974316, 0.8140137109286738, 0.8184337248834821,
+		0.8228777390769823, 0.8273458838280969, 0.8318382901633681, 0.8363550898207981,
+		0.8408964152537144, 0.8454623996346523, 0.8500531768592616, 0.8546688815502312,
+		0.8593096490612387, 0.8639756154809185, 0.8686669176368529, 0.8733836930995842,
+		0.8781260801866495, 0.8828942179666361, 0.8876882462632604, 0.8925083056594671,
+		0.8973545375015533, 0.9022270839033115, 0.9071260877501991, 0.9120516927035263,
+		0.9170040432046711, 0.9219832844793128, 0.9269895625416926, 0.9320230241988943,
+		0.9370838170551498, 0.9421720895161669, 0.9472879907934827, 0.9524316709088368,
+		0.9576032806985735, 0.9628029718180622, 0.9680308967461471, 0.9732872087896164,
+		0.9785720620876999, 0.9838856116165875, 0.9892280131939752, 0.9945994234836328,
+	},
+	// Schema 8:
+	{
+		0.5, 0.5013556375251013, 0.5027149505564014, 0.5040779490592088,
+		0.5054446430258502, 0.5068150424757447, 0.5081891574554764, 0.509566998038869,
+		0.5109485743270583, 0.5123338964485679, 0.5137229745593818, 0.5151158188430205,
+		0.5165124395106142, 0.5179128468009786, 0.5193170509806894, 0.520725062344158,
+		0.5221368912137069, 0.5235525479396449, 0.5249720429003435, 0.526395386502313,
+		0.5278225891802786, 0.5292536613972564, 0.5306886136446309, 0.5321274564422321,
+		0.5335702003384117, 0.5350168559101208, 0.5364674337629877, 0.5379219445313954,
+		0.5393803988785598, 0.5408428074966075, 0.5423091811066545, 0.5437795304588847,
+		0.5452538663326288, 0.5467321995364429, 0.5482145409081883, 0.549700901315111,
+		0.5511912916539204, 0.5526857228508706, 0.5541842058618393, 0.5556867516724088,
+		0.5571933712979462, 0.5587040757836845, 0.5602188762048033, 0.5617377836665098,
+		0.5632608093041209, 0.564787964283144, 0.5663192597993595, 0.5678547070789026,
+		0.5693943173783458, 0.5709381019847808, 0.572486072215902, 0.5740382394200894,
+		0.5755946149764913, 0.5771552102951081, 0.5787200368168754, 0.5802891060137493,
+		0.5818624293887887, 0.5834400184762408, 0.585021884841625, 0.5866080400818185,
+		0.5881984958251406, 0.5897932637314379, 0.5913923554921704, 0.5929957828304968,
+		0.5946035575013605, 0.5962156912915756, 0.5978321960199137, 0.5994530835371903,
+		0.6010783657263515, 0.6027080545025619, 0.6043421618132907, 0.6059806996384005,
+		0.6076236799902344, 0.6092711149137041, 0.6109230164863786, 0.6125793968185725,
+		0.6142402680534349, 0.6159056423670379, 0.6175755319684665, 0.6192499490999082,
+		0.620928906036742, 0.622612415087629, 0.6243004885946023, 0.6259931389331581,
+		0.6276903785123455, 0.6293922197748583, 0.6310986751971253, 0.6328097572894031,
+		0.6345254785958666, 0.6362458516947014, 0.637970889198196, 0.6397006037528346,
+		0.6414350080393891, 0.6431741147730128, 0.6449179367033329, 0.6466664866145447,
+		0.6484197773255048, 0.6501778216898253, 0.6519406325959679, 0.6537082229673385,
+		0.6554806057623822, 0.6572577939746774, 0.659039800633032, 0.6608266388015788,
+		0.6626183215798706, 0.6644148621029772, 0.6662162735415805, 0.6680225691020727,
+		0.6698337620266515, 0.6716498655934177, 0.6734708931164728, 0.6752968579460171,
+		0.6771277734684463, 0.6789636531064505, 0.6808045103191123, 0.6826503586020058,
+		0.6845012114872953, 0.6863570825438342, 0.688217985377265, 0.690083933630119,
+		0.6919549409819159, 0.6938310211492645, 0.6957121878859629, 0.6975984549830999,
+		0.6994898362691555, 0.7013863456101023, 0.7032879969095076, 0.7051948041086352,
+		0.7071067811865475, 0.7090239421602076, 0.7109463010845827, 0.7128738720527471,
+		0.7148066691959849, 0.7167447066838943, 0.718687998724491, 0.7206365595643126,
+		0.7225904034885232, 0.7245495448210174, 0.7265139979245261, 0.7284837772007218,
+		0.7304588970903234, 0.7324393720732029, 0.7344252166684908, 0.7364164454346837,
+		0.7384130729697496, 0.7404151139112358, 0.7424225829363761, 0.7444354947621984,
+		0.7464538641456323, 0.7484777058836176, 0.7505070348132126, 0.7525418658117031,
+		0.7545822137967112, 0.7566280937263048, 0.7586795205991071, 0.7607365094544071,
+		0.762799075372269, 0.7648672334736434, 0.7669409989204777, 0.7690203869158282,
+		0.7711054127039704, 0.7731960915705107, 0.7752924388424999, 0.7773944698885442,
+		0.7795022001189185, 0.7816156449856788, 0.7837348199827764, 0.7858597406461707,
+		0.7879904225539431, 0.7901268813264122, 0.7922691326262467, 0.7944171921585818,
+		0.7965710756711334, 0.7987307989543135, 0.8008963778413465, 0.8030678282083853,
+		0.805245165974627, 0.8074284071024302, 0.8096175675974316, 0.8118126635086642,
+		0.8140137109286738, 0.8162207259936375, 0.8184337248834821, 0.820652723822003,
+		0.8228777390769823, 0.8251087869603088, 0.8273458838280969, 0.8295890460808079,
+		0.8318382901633681, 0.8340936325652911, 0.8363550898207981, 0.8386226785089391,
+		0.8408964152537144, 0.8431763167241966, 0.8454623996346523, 0.8477546807446661,
+		0.8500531768592616, 0.8523579048290255, 0.8546688815502312, 0.8569861239649629,
+		0.8593096490612387, 0.8616394738731368, 0.8639756154809185, 0.8663180910111553,
+		0.8686669176368529, 0.871022112577578, 0.8733836930995842, 0.8757516765159389,
+		0.8781260801866495, 0.8805069215187917, 0.8828942179666361, 0.8852879870317771,
+		0.8876882462632604, 0.890095013257712, 0.8925083056594671, 0.8949281411607002,
+		0.8973545375015533, 0.8997875124702672, 0.9022270839033115, 0.9046732696855155,
+		0.9071260877501991, 0.909585556079304, 0.9120516927035263, 0.9145245157024483,
+		0.9170040432046711, 0.9194902933879467, 0.9219832844793128, 0.9244830347552253,
+		0.9269895625416926, 0.92950288621441, 0.9320230241988943, 0.9345499949706191,
+		0.9370838170551498, 0.93962450902828, 0.9421720895161669, 0.9447265771954693,
+		0.9472879907934827, 0.9498563490882775, 0.9524316709088368, 0.9550139751351947,
+		0.9576032806985735, 0.9601996065815236, 0.9628029718180622, 0.9654133954938133,
+		0.9680308967461471, 0.9706554947643201, 0.9732872087896164, 0.9759260581154889,
+		0.9785720620876999, 0.9812252401044634, 0.9838856116165875, 0.9865531961276168,
+		0.9892280131939752, 0.9919100824251095, 0.9945994234836328, 0.9972960560854698,
+	},
+}
+
+// The nativeHistogramBounds above can be generated with the code below.
+//
+// TODO(beorn7): It's tempting to actually use `go generate` to generate the
+// code above. However, this could lead to slightly different numbers on
+// different architectures. We still need to come to terms if we are fine with
+// that, or if we might prefer to specify precise numbers in the standard.
+//
+// var nativeHistogramBounds [][]float64 = make([][]float64, 9)
+//
+// func init() {
+// 	// Populate nativeHistogramBounds.
+// 	numBuckets := 1
+// 	for i := range nativeHistogramBounds {
+// 		bounds := []float64{0.5}
+// 		factor := math.Exp2(math.Exp2(float64(-i)))
+// 		for j := 0; j < numBuckets-1; j++ {
+// 			var bound float64
+// 			if (j+1)%2 == 0 {
+// 				// Use previously calculated value for increased precision.
+// 				bound = nativeHistogramBounds[i-1][j/2+1]
+// 			} else {
+// 				bound = bounds[j] * factor
+// 			}
+// 			bounds = append(bounds, bound)
+// 		}
+// 		numBuckets *= 2
+// 		nativeHistogramBounds[i] = bounds
+// 	}
+// }
+
 // A Histogram counts individual observations from an event or sample stream in
-// configurable buckets. Similar to a summary, it also provides a sum of
-// observations and an observation count.
+// configurable static buckets (or in dynamic sparse buckets as part of the
+// experimental Native Histograms, see below for more details). Similar to a
+// Summary, it also provides a sum of observations and an observation count.
 //
 // On the Prometheus server, quantiles can be calculated from a Histogram using
-// the histogram_quantile function in the query language.
+// the histogram_quantile PromQL function.
+//
+// Note that Histograms, in contrast to Summaries, can be aggregated in PromQL
+// (see the documentation for detailed procedures). However, Histograms require
+// the user to pre-define suitable buckets, and they are in general less
+// accurate. (Both problems are addressed by the experimental Native
+// Histograms. To use them, configure a NativeHistogramBucketFactor in the
+// HistogramOpts. They also require a Prometheus server v2.40+ with the
+// corresponding feature flag enabled.)
 //
-// Note that Histograms, in contrast to Summaries, can be aggregated with the
-// Prometheus query language (see the documentation for detailed
-// procedures). However, Histograms require the user to pre-define suitable
-// buckets, and they are in general less accurate. The Observe method of a
-// Histogram has a very low performance overhead in comparison with the Observe
-// method of a Summary.
+// The Observe method of a Histogram has a very low performance overhead in
+// comparison with the Observe method of a Summary.
 //
 // To create Histogram instances, use NewHistogram.
 type Histogram interface {
@@ -50,7 +247,8 @@ type Histogram interface {
 	// Observe adds a single observation to the histogram. Observations are
 	// usually positive or zero. Negative observations are accepted but
 	// prevent current versions of Prometheus from properly detecting
-	// counter resets in the sum of observations. See
+	// counter resets in the sum of observations. (The experimental Native
+	// Histograms handle negative observations properly.) See
 	// https://prometheus.io/docs/practices/histograms/#count-and-sum-of-observations
 	// for details.
 	Observe(float64)
@@ -64,18 +262,28 @@ const bucketLabel = "le"
 // tailored to broadly measure the response time (in seconds) of a network
 // service. Most likely, however, you will be required to define buckets
 // customized to your use case.
-var (
-	DefBuckets = []float64{.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10}
+var DefBuckets = []float64{.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10}
 
-	errBucketLabelNotAllowed = fmt.Errorf(
-		"%q is not allowed as label name in histograms", bucketLabel,
-	)
+// DefNativeHistogramZeroThreshold is the default value for
+// NativeHistogramZeroThreshold in the HistogramOpts.
+//
+// The value is 2^-128 (or 0.5*2^-127 in the actual IEEE 754 representation),
+// which is a bucket boundary at all possible resolutions.
+const DefNativeHistogramZeroThreshold = 2.938735877055719e-39
+
+// NativeHistogramZeroThresholdZero can be used as NativeHistogramZeroThreshold
+// in the HistogramOpts to create a zero bucket of width zero, i.e. a zero
+// bucket that only receives observations of precisely zero.
+const NativeHistogramZeroThresholdZero = -1
+
+var errBucketLabelNotAllowed = fmt.Errorf(
+	"%q is not allowed as label name in histograms", bucketLabel,
 )
 
-// LinearBuckets creates 'count' buckets, each 'width' wide, where the lowest
-// bucket has an upper bound of 'start'. The final +Inf bucket is not counted
-// and not included in the returned slice. The returned slice is meant to be
-// used for the Buckets field of HistogramOpts.
+// LinearBuckets creates 'count' regular buckets, each 'width' wide, where the
+// lowest bucket has an upper bound of 'start'. The final +Inf bucket is not
+// counted and not included in the returned slice. The returned slice is meant
+// to be used for the Buckets field of HistogramOpts.
 //
 // The function panics if 'count' is zero or negative.
 func LinearBuckets(start, width float64, count int) []float64 {
@@ -90,11 +298,11 @@ func LinearBuckets(start, width float64, count int) []float64 {
 	return buckets
 }
 
-// ExponentialBuckets creates 'count' buckets, where the lowest bucket has an
-// upper bound of 'start' and each following bucket's upper bound is 'factor'
-// times the previous bucket's upper bound. The final +Inf bucket is not counted
-// and not included in the returned slice. The returned slice is meant to be
-// used for the Buckets field of HistogramOpts.
+// ExponentialBuckets creates 'count' regular buckets, where the lowest bucket
+// has an upper bound of 'start' and each following bucket's upper bound is
+// 'factor' times the previous bucket's upper bound. The final +Inf bucket is
+// not counted and not included in the returned slice. The returned slice is
+// meant to be used for the Buckets field of HistogramOpts.
 //
 // The function panics if 'count' is 0 or negative, if 'start' is 0 or negative,
 // or if 'factor' is less than or equal 1.
@@ -180,8 +388,85 @@ type HistogramOpts struct {
 	// element in the slice is the upper inclusive bound of a bucket. The
 	// values must be sorted in strictly increasing order. There is no need
 	// to add a highest bucket with +Inf bound, it will be added
-	// implicitly. The default value is DefBuckets.
+	// implicitly. If Buckets is left as nil or set to a slice of length
+	// zero, it is replaced by default buckets. The default buckets are
+	// DefBuckets if no buckets for a native histogram (see below) are used,
+	// otherwise the default is no buckets. (In other words, if you want to
+	// use both reguler buckets and buckets for a native histogram, you have
+	// to define the regular buckets here explicitly.)
 	Buckets []float64
+
+	// If NativeHistogramBucketFactor is greater than one, so-called sparse
+	// buckets are used (in addition to the regular buckets, if defined
+	// above). A Histogram with sparse buckets will be ingested as a Native
+	// Histogram by a Prometheus server with that feature enabled (requires
+	// Prometheus v2.40+). Sparse buckets are exponential buckets covering
+	// the whole float64 range (with the exception of the “zero” bucket, see
+	// SparseBucketsZeroThreshold below). From any one bucket to the next,
+	// the width of the bucket grows by a constant
+	// factor. NativeHistogramBucketFactor provides an upper bound for this
+	// factor (exception see below). The smaller
+	// NativeHistogramBucketFactor, the more buckets will be used and thus
+	// the more costly the histogram will become. A generally good trade-off
+	// between cost and accuracy is a value of 1.1 (each bucket is at most
+	// 10% wider than the previous one), which will result in each power of
+	// two divided into 8 buckets (e.g. there will be 8 buckets between 1
+	// and 2, same as between 2 and 4, and 4 and 8, etc.).
+	//
+	// Details about the actually used factor: The factor is calculated as
+	// 2^(2^n), where n is an integer number between (and including) -8 and
+	// 4. n is chosen so that the resulting factor is the largest that is
+	// still smaller or equal to NativeHistogramBucketFactor. Note that the
+	// smallest possible factor is therefore approx. 1.00271 (i.e. 2^(2^-8)
+	// ). If NativeHistogramBucketFactor is greater than 1 but smaller than
+	// 2^(2^-8), then the actually used factor is still 2^(2^-8) even though
+	// it is larger than the provided NativeHistogramBucketFactor.
+	//
+	// NOTE: Native Histograms are still an experimental feature. Their
+	// behavior might still change without a major version
+	// bump. Subsequently, all NativeHistogram... options here might still
+	// change their behavior or name (or might completely disappear) without
+	// a major version bump.
+	NativeHistogramBucketFactor float64
+	// All observations with an absolute value of less or equal
+	// NativeHistogramZeroThreshold are accumulated into a “zero”
+	// bucket. For best results, this should be close to a bucket
+	// boundary. This is usually the case if picking a power of two. If
+	// NativeHistogramZeroThreshold is left at zero,
+	// DefSparseBucketsZeroThreshold is used as the threshold. To configure
+	// a zero bucket with an actual threshold of zero (i.e. only
+	// observations of precisely zero will go into the zero bucket), set
+	// NativeHistogramZeroThreshold to the NativeHistogramZeroThresholdZero
+	// constant (or any negative float value).
+	NativeHistogramZeroThreshold float64
+
+	// The remaining fields define a strategy to limit the number of
+	// populated sparse buckets. If NativeHistogramMaxBucketNumber is left
+	// at zero, the number of buckets is not limited. (Note that this might
+	// lead to unbounded memory consumption if the values observed by the
+	// Histogram are sufficiently wide-spread. In particular, this could be
+	// used as a DoS attack vector. Where the observed values depend on
+	// external inputs, it is highly recommended to set a
+	// NativeHistogramMaxBucketNumber.)  Once the set
+	// NativeHistogramMaxBucketNumber is exceeded, the following strategy is
+	// enacted: First, if the last reset (or the creation) of the histogram
+	// is at least NativeHistogramMinResetDuration ago, then the whole
+	// histogram is reset to its initial state (including regular
+	// buckets). If less time has passed, or if
+	// NativeHistogramMinResetDuration is zero, no reset is
+	// performed. Instead, the zero threshold is increased sufficiently to
+	// reduce the number of buckets to or below
+	// NativeHistogramMaxBucketNumber, but not to more than
+	// NativeHistogramMaxZeroThreshold. Thus, if
+	// NativeHistogramMaxZeroThreshold is already at or below the current
+	// zero threshold, nothing happens at this step. After that, if the
+	// number of buckets still exceeds NativeHistogramMaxBucketNumber, the
+	// resolution of the histogram is reduced by doubling the width of the
+	// sparse buckets (up to a growth factor between one bucket to the next
+	// of 2^(2^4) = 65536, see above).
+	NativeHistogramMaxBucketNumber  uint32
+	NativeHistogramMinResetDuration time.Duration
+	NativeHistogramMaxZeroThreshold float64
 }
 
 // NewHistogram creates a new Histogram based on the provided HistogramOpts. It
@@ -218,16 +503,29 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
 		}
 	}
 
-	if len(opts.Buckets) == 0 {
-		opts.Buckets = DefBuckets
-	}
-
 	h := &histogram{
-		desc:        desc,
-		upperBounds: opts.Buckets,
-		labelPairs:  MakeLabelPairs(desc, labelValues),
-		counts:      [2]*histogramCounts{{}, {}},
-		now:         time.Now,
+		desc:                            desc,
+		upperBounds:                     opts.Buckets,
+		labelPairs:                      MakeLabelPairs(desc, labelValues),
+		nativeHistogramMaxBuckets:       opts.NativeHistogramMaxBucketNumber,
+		nativeHistogramMaxZeroThreshold: opts.NativeHistogramMaxZeroThreshold,
+		nativeHistogramMinResetDuration: opts.NativeHistogramMinResetDuration,
+		lastResetTime:                   time.Now(),
+		now:                             time.Now,
+	}
+	if len(h.upperBounds) == 0 && opts.NativeHistogramBucketFactor <= 1 {
+		h.upperBounds = DefBuckets
+	}
+	if opts.NativeHistogramBucketFactor <= 1 {
+		h.nativeHistogramSchema = math.MinInt32 // To mark that there are no sparse buckets.
+	} else {
+		switch {
+		case opts.NativeHistogramZeroThreshold > 0:
+			h.nativeHistogramZeroThreshold = opts.NativeHistogramZeroThreshold
+		case opts.NativeHistogramZeroThreshold == 0:
+			h.nativeHistogramZeroThreshold = DefNativeHistogramZeroThreshold
+		} // Leave h.nativeHistogramZeroThreshold at 0 otherwise.
+		h.nativeHistogramSchema = pickSchema(opts.NativeHistogramBucketFactor)
 	}
 	for i, upperBound := range h.upperBounds {
 		if i < len(h.upperBounds)-1 {
@@ -246,8 +544,16 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
 	}
 	// Finally we know the final length of h.upperBounds and can make buckets
 	// for both counts as well as exemplars:
-	h.counts[0].buckets = make([]uint64, len(h.upperBounds))
-	h.counts[1].buckets = make([]uint64, len(h.upperBounds))
+	h.counts[0] = &histogramCounts{
+		buckets:                          make([]uint64, len(h.upperBounds)),
+		nativeHistogramZeroThresholdBits: math.Float64bits(h.nativeHistogramZeroThreshold),
+		nativeHistogramSchema:            h.nativeHistogramSchema,
+	}
+	h.counts[1] = &histogramCounts{
+		buckets:                          make([]uint64, len(h.upperBounds)),
+		nativeHistogramZeroThresholdBits: math.Float64bits(h.nativeHistogramZeroThreshold),
+		nativeHistogramSchema:            h.nativeHistogramSchema,
+	}
 	h.exemplars = make([]atomic.Value, len(h.upperBounds)+1)
 
 	h.init(h) // Init self-collection.
@@ -255,13 +561,98 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
 }
 
 type histogramCounts struct {
+	// Order in this struct matters for the alignment required by atomic
+	// operations, see http://golang.org/pkg/sync/atomic/#pkg-note-BUG
+
 	// sumBits contains the bits of the float64 representing the sum of all
-	// observations. sumBits and count have to go first in the struct to
-	// guarantee alignment for atomic operations.
-	// http://golang.org/pkg/sync/atomic/#pkg-note-BUG
+	// observations.
 	sumBits uint64
 	count   uint64
+
+	// nativeHistogramZeroBucket counts all (positive and negative)
+	// observations in the zero bucket (with an absolute value less or equal
+	// the current threshold, see next field.
+	nativeHistogramZeroBucket uint64
+	// nativeHistogramZeroThresholdBits is the bit pattern of the current
+	// threshold for the zero bucket. It's initially equal to
+	// nativeHistogramZeroThreshold but may change according to the bucket
+	// count limitation strategy.
+	nativeHistogramZeroThresholdBits uint64
+	// nativeHistogramSchema may change over time according to the bucket
+	// count limitation strategy and therefore has to be saved here.
+	nativeHistogramSchema int32
+	// Number of (positive and negative) sparse buckets.
+	nativeHistogramBucketsNumber uint32
+
+	// Regular buckets.
 	buckets []uint64
+
+	// The sparse buckets for native histograms are implemented with a
+	// sync.Map for now. A dedicated data structure will likely be more
+	// efficient. There are separate maps for negative and positive
+	// observations. The map's value is an *int64, counting observations in
+	// that bucket. (Note that we don't use uint64 as an int64 won't
+	// overflow in practice, and working with signed numbers from the
+	// beginning simplifies the handling of deltas.) The map's key is the
+	// index of the bucket according to the used
+	// nativeHistogramSchema. Index 0 is for an upper bound of 1.
+	nativeHistogramBucketsPositive, nativeHistogramBucketsNegative sync.Map
+}
+
+// observe manages the parts of observe that only affects
+// histogramCounts. doSparse is true if sparse buckets should be done,
+// too.
+func (hc *histogramCounts) observe(v float64, bucket int, doSparse bool) {
+	if bucket < len(hc.buckets) {
+		atomic.AddUint64(&hc.buckets[bucket], 1)
+	}
+	atomicAddFloat(&hc.sumBits, v)
+	if doSparse && !math.IsNaN(v) {
+		var (
+			key                  int
+			schema               = atomic.LoadInt32(&hc.nativeHistogramSchema)
+			zeroThreshold        = math.Float64frombits(atomic.LoadUint64(&hc.nativeHistogramZeroThresholdBits))
+			bucketCreated, isInf bool
+		)
+		if math.IsInf(v, 0) {
+			// Pretend v is MaxFloat64 but later increment key by one.
+			if math.IsInf(v, +1) {
+				v = math.MaxFloat64
+			} else {
+				v = -math.MaxFloat64
+			}
+			isInf = true
+		}
+		frac, exp := math.Frexp(math.Abs(v))
+		if schema > 0 {
+			bounds := nativeHistogramBounds[schema]
+			key = sort.SearchFloat64s(bounds, frac) + (exp-1)*len(bounds)
+		} else {
+			key = exp
+			if frac == 0.5 {
+				key--
+			}
+			div := 1 << -schema
+			key = (key + div - 1) / div
+		}
+		if isInf {
+			key++
+		}
+		switch {
+		case v > zeroThreshold:
+			bucketCreated = addToBucket(&hc.nativeHistogramBucketsPositive, key, 1)
+		case v < -zeroThreshold:
+			bucketCreated = addToBucket(&hc.nativeHistogramBucketsNegative, key, 1)
+		default:
+			atomic.AddUint64(&hc.nativeHistogramZeroBucket, 1)
+		}
+		if bucketCreated {
+			atomic.AddUint32(&hc.nativeHistogramBucketsNumber, 1)
+		}
+	}
+	// Increment count last as we take it as a signal that the observation
+	// is complete.
+	atomic.AddUint64(&hc.count, 1)
 }
 
 type histogram struct {
@@ -276,7 +667,7 @@ type histogram struct {
 	// perspective of the histogram) swap the hot–cold under the writeMtx
 	// lock. A cooldown is awaited (while locked) by comparing the number of
 	// observations with the initiation count. Once they match, then the
-	// last observation on the now cool one has completed. All cool fields must
+	// last observation on the now cool one has completed. All cold fields must
 	// be merged into the new hot before releasing writeMtx.
 	//
 	// Fields with atomic access first! See alignment constraint:
@@ -284,8 +675,10 @@ type histogram struct {
 	countAndHotIdx uint64
 
 	selfCollector
-	desc     *Desc
-	writeMtx sync.Mutex // Only used in the Write method.
+	desc *Desc
+
+	// Only used in the Write method and for sparse bucket management.
+	mtx sync.Mutex
 
 	// Two counts, one is "hot" for lock-free observations, the other is
 	// "cold" for writing out a dto.Metric. It has to be an array of
@@ -293,9 +686,15 @@ type histogram struct {
 	// http://golang.org/pkg/sync/atomic/#pkg-note-BUG.
 	counts [2]*histogramCounts
 
-	upperBounds []float64
-	labelPairs  []*dto.LabelPair
-	exemplars   []atomic.Value // One more than buckets (to include +Inf), each a *dto.Exemplar.
+	upperBounds                     []float64
+	labelPairs                      []*dto.LabelPair
+	exemplars                       []atomic.Value // One more than buckets (to include +Inf), each a *dto.Exemplar.
+	nativeHistogramSchema           int32          // The initial schema. Set to math.MinInt32 if no sparse buckets are used.
+	nativeHistogramZeroThreshold    float64        // The initial zero threshold.
+	nativeHistogramMaxZeroThreshold float64
+	nativeHistogramMaxBuckets       uint32
+	nativeHistogramMinResetDuration time.Duration
+	lastResetTime                   time.Time // Protected by mtx.
 
 	now func() time.Time // To mock out time.Now() for testing.
 }
@@ -319,8 +718,8 @@ func (h *histogram) Write(out *dto.Metric) error {
 	// the hot path, i.e. Observe is called much more often than Write. The
 	// complication of making Write lock-free isn't worth it, if possible at
 	// all.
-	h.writeMtx.Lock()
-	defer h.writeMtx.Unlock()
+	h.mtx.Lock()
+	defer h.mtx.Unlock()
 
 	// Adding 1<<63 switches the hot index (from 0 to 1 or from 1 to 0)
 	// without touching the count bits. See the struct comments for a full
@@ -333,16 +732,16 @@ func (h *histogram) Write(out *dto.Metric) error {
 	hotCounts := h.counts[n>>63]
 	coldCounts := h.counts[(^n)>>63]
 
-	// Await cooldown.
-	for count != atomic.LoadUint64(&coldCounts.count) {
-		runtime.Gosched() // Let observations get work done.
-	}
+	waitForCooldown(count, coldCounts)
 
 	his := &dto.Histogram{
 		Bucket:      make([]*dto.Bucket, len(h.upperBounds)),
 		SampleCount: proto.Uint64(count),
 		SampleSum:   proto.Float64(math.Float64frombits(atomic.LoadUint64(&coldCounts.sumBits))),
 	}
+	out.Histogram = his
+	out.Label = h.labelPairs
+
 	var cumCount uint64
 	for i, upperBound := range h.upperBounds {
 		cumCount += atomic.LoadUint64(&coldCounts.buckets[i])
@@ -363,25 +762,21 @@ func (h *histogram) Write(out *dto.Metric) error {
 		}
 		his.Bucket = append(his.Bucket, b)
 	}
-
-	out.Histogram = his
-	out.Label = h.labelPairs
-
-	// Finally add all the cold counts to the new hot counts and reset the cold counts.
-	atomic.AddUint64(&hotCounts.count, count)
-	atomic.StoreUint64(&coldCounts.count, 0)
-	for {
-		oldBits := atomic.LoadUint64(&hotCounts.sumBits)
-		newBits := math.Float64bits(math.Float64frombits(oldBits) + his.GetSampleSum())
-		if atomic.CompareAndSwapUint64(&hotCounts.sumBits, oldBits, newBits) {
-			atomic.StoreUint64(&coldCounts.sumBits, 0)
-			break
-		}
-	}
-	for i := range h.upperBounds {
-		atomic.AddUint64(&hotCounts.buckets[i], atomic.LoadUint64(&coldCounts.buckets[i]))
-		atomic.StoreUint64(&coldCounts.buckets[i], 0)
+	if h.nativeHistogramSchema > math.MinInt32 {
+		his.ZeroThreshold = proto.Float64(math.Float64frombits(atomic.LoadUint64(&coldCounts.nativeHistogramZeroThresholdBits)))
+		his.Schema = proto.Int32(atomic.LoadInt32(&coldCounts.nativeHistogramSchema))
+		zeroBucket := atomic.LoadUint64(&coldCounts.nativeHistogramZeroBucket)
+
+		defer func() {
+			coldCounts.nativeHistogramBucketsPositive.Range(addAndReset(&hotCounts.nativeHistogramBucketsPositive, &hotCounts.nativeHistogramBucketsNumber))
+			coldCounts.nativeHistogramBucketsNegative.Range(addAndReset(&hotCounts.nativeHistogramBucketsNegative, &hotCounts.nativeHistogramBucketsNumber))
+		}()
+
+		his.ZeroCount = proto.Uint64(zeroBucket)
+		his.NegativeSpan, his.NegativeDelta = makeBuckets(&coldCounts.nativeHistogramBucketsNegative)
+		his.PositiveSpan, his.PositiveDelta = makeBuckets(&coldCounts.nativeHistogramBucketsPositive)
 	}
+	addAndResetCounts(hotCounts, coldCounts)
 	return nil
 }
 
@@ -402,25 +797,216 @@ func (h *histogram) findBucket(v float64) int {
 
 // observe is the implementation for Observe without the findBucket part.
 func (h *histogram) observe(v float64, bucket int) {
+	// Do not add to sparse buckets for NaN observations.
+	doSparse := h.nativeHistogramSchema > math.MinInt32 && !math.IsNaN(v)
 	// We increment h.countAndHotIdx so that the counter in the lower
 	// 63 bits gets incremented. At the same time, we get the new value
 	// back, which we can use to find the currently-hot counts.
 	n := atomic.AddUint64(&h.countAndHotIdx, 1)
 	hotCounts := h.counts[n>>63]
+	hotCounts.observe(v, bucket, doSparse)
+	if doSparse {
+		h.limitBuckets(hotCounts, v, bucket)
+	}
+}
 
-	if bucket < len(h.upperBounds) {
-		atomic.AddUint64(&hotCounts.buckets[bucket], 1)
+// limitSparsebuckets applies a strategy to limit the number of populated sparse
+// buckets. It's generally best effort, and there are situations where the
+// number can go higher (if even the lowest resolution isn't enough to reduce
+// the number sufficiently, or if the provided counts aren't fully updated yet
+// by a concurrently happening Write call).
+func (h *histogram) limitBuckets(counts *histogramCounts, value float64, bucket int) {
+	if h.nativeHistogramMaxBuckets == 0 {
+		return // No limit configured.
 	}
-	for {
-		oldBits := atomic.LoadUint64(&hotCounts.sumBits)
-		newBits := math.Float64bits(math.Float64frombits(oldBits) + v)
-		if atomic.CompareAndSwapUint64(&hotCounts.sumBits, oldBits, newBits) {
-			break
+	if h.nativeHistogramMaxBuckets >= atomic.LoadUint32(&counts.nativeHistogramBucketsNumber) {
+		return // Bucket limit not exceeded yet.
+	}
+
+	h.mtx.Lock()
+	defer h.mtx.Unlock()
+
+	// The hot counts might have been swapped just before we acquired the
+	// lock. Re-fetch the hot counts first...
+	n := atomic.LoadUint64(&h.countAndHotIdx)
+	hotIdx := n >> 63
+	coldIdx := (^n) >> 63
+	hotCounts := h.counts[hotIdx]
+	coldCounts := h.counts[coldIdx]
+	// ...and then check again if we really have to reduce the bucket count.
+	if h.nativeHistogramMaxBuckets >= atomic.LoadUint32(&hotCounts.nativeHistogramBucketsNumber) {
+		return // Bucket limit not exceeded after all.
+	}
+	// Try the various strategies in order.
+	if h.maybeReset(hotCounts, coldCounts, coldIdx, value, bucket) {
+		return
+	}
+	if h.maybeWidenZeroBucket(hotCounts, coldCounts) {
+		return
+	}
+	h.doubleBucketWidth(hotCounts, coldCounts)
+}
+
+// maybeReset resests the whole histogram if at least h.nativeHistogramMinResetDuration
+// has been passed. It returns true if the histogram has been reset. The caller
+// must have locked h.mtx.
+func (h *histogram) maybeReset(hot, cold *histogramCounts, coldIdx uint64, value float64, bucket int) bool {
+	// We are using the possibly mocked h.now() rather than
+	// time.Since(h.lastResetTime) to enable testing.
+	if h.nativeHistogramMinResetDuration == 0 || h.now().Sub(h.lastResetTime) < h.nativeHistogramMinResetDuration {
+		return false
+	}
+	// Completely reset coldCounts.
+	h.resetCounts(cold)
+	// Repeat the latest observation to not lose it completely.
+	cold.observe(value, bucket, true)
+	// Make coldCounts the new hot counts while ressetting countAndHotIdx.
+	n := atomic.SwapUint64(&h.countAndHotIdx, (coldIdx<<63)+1)
+	count := n & ((1 << 63) - 1)
+	waitForCooldown(count, hot)
+	// Finally, reset the formerly hot counts, too.
+	h.resetCounts(hot)
+	h.lastResetTime = h.now()
+	return true
+}
+
+// maybeWidenZeroBucket widens the zero bucket until it includes the existing
+// buckets closest to the zero bucket (which could be two, if an equidistant
+// negative and a positive bucket exists, but usually it's only one bucket to be
+// merged into the new wider zero bucket). h.nativeHistogramMaxZeroThreshold
+// limits how far the zero bucket can be extended, and if that's not enough to
+// include an existing bucket, the method returns false. The caller must have
+// locked h.mtx.
+func (h *histogram) maybeWidenZeroBucket(hot, cold *histogramCounts) bool {
+	currentZeroThreshold := math.Float64frombits(atomic.LoadUint64(&hot.nativeHistogramZeroThresholdBits))
+	if currentZeroThreshold >= h.nativeHistogramMaxZeroThreshold {
+		return false
+	}
+	// Find the key of the bucket closest to zero.
+	smallestKey := findSmallestKey(&hot.nativeHistogramBucketsPositive)
+	smallestNegativeKey := findSmallestKey(&hot.nativeHistogramBucketsNegative)
+	if smallestNegativeKey < smallestKey {
+		smallestKey = smallestNegativeKey
+	}
+	if smallestKey == math.MaxInt32 {
+		return false
+	}
+	newZeroThreshold := getLe(smallestKey, atomic.LoadInt32(&hot.nativeHistogramSchema))
+	if newZeroThreshold > h.nativeHistogramMaxZeroThreshold {
+		return false // New threshold would exceed the max threshold.
+	}
+	atomic.StoreUint64(&cold.nativeHistogramZeroThresholdBits, math.Float64bits(newZeroThreshold))
+	// Remove applicable buckets.
+	if _, loaded := cold.nativeHistogramBucketsNegative.LoadAndDelete(smallestKey); loaded {
+		atomicDecUint32(&cold.nativeHistogramBucketsNumber)
+	}
+	if _, loaded := cold.nativeHistogramBucketsPositive.LoadAndDelete(smallestKey); loaded {
+		atomicDecUint32(&cold.nativeHistogramBucketsNumber)
+	}
+	// Make cold counts the new hot counts.
+	n := atomic.AddUint64(&h.countAndHotIdx, 1<<63)
+	count := n & ((1 << 63) - 1)
+	// Swap the pointer names to represent the new roles and make
+	// the rest less confusing.
+	hot, cold = cold, hot
+	waitForCooldown(count, cold)
+	// Add all the now cold counts to the new hot counts...
+	addAndResetCounts(hot, cold)
+	// ...adjust the new zero threshold in the cold counts, too...
+	atomic.StoreUint64(&cold.nativeHistogramZeroThresholdBits, math.Float64bits(newZeroThreshold))
+	// ...and then merge the newly deleted buckets into the wider zero
+	// bucket.
+	mergeAndDeleteOrAddAndReset := func(hotBuckets, coldBuckets *sync.Map) func(k, v interface{}) bool {
+		return func(k, v interface{}) bool {
+			key := k.(int)
+			bucket := v.(*int64)
+			if key == smallestKey {
+				// Merge into hot zero bucket...
+				atomic.AddUint64(&hot.nativeHistogramZeroBucket, uint64(atomic.LoadInt64(bucket)))
+				// ...and delete from cold counts.
+				coldBuckets.Delete(key)
+				atomicDecUint32(&cold.nativeHistogramBucketsNumber)
+			} else {
+				// Add to corresponding hot bucket...
+				if addToBucket(hotBuckets, key, atomic.LoadInt64(bucket)) {
+					atomic.AddUint32(&hot.nativeHistogramBucketsNumber, 1)
+				}
+				// ...and reset cold bucket.
+				atomic.StoreInt64(bucket, 0)
+			}
+			return true
 		}
 	}
-	// Increment count last as we take it as a signal that the observation
-	// is complete.
-	atomic.AddUint64(&hotCounts.count, 1)
+
+	cold.nativeHistogramBucketsPositive.Range(mergeAndDeleteOrAddAndReset(&hot.nativeHistogramBucketsPositive, &cold.nativeHistogramBucketsPositive))
+	cold.nativeHistogramBucketsNegative.Range(mergeAndDeleteOrAddAndReset(&hot.nativeHistogramBucketsNegative, &cold.nativeHistogramBucketsNegative))
+	return true
+}
+
+// doubleBucketWidth doubles the bucket width (by decrementing the schema
+// number). Note that very sparse buckets could lead to a low reduction of the
+// bucket count (or even no reduction at all). The method does nothing if the
+// schema is already -4.
+func (h *histogram) doubleBucketWidth(hot, cold *histogramCounts) {
+	coldSchema := atomic.LoadInt32(&cold.nativeHistogramSchema)
+	if coldSchema == -4 {
+		return // Already at lowest resolution.
+	}
+	coldSchema--
+	atomic.StoreInt32(&cold.nativeHistogramSchema, coldSchema)
+	// Play it simple and just delete all cold buckets.
+	atomic.StoreUint32(&cold.nativeHistogramBucketsNumber, 0)
+	deleteSyncMap(&cold.nativeHistogramBucketsNegative)
+	deleteSyncMap(&cold.nativeHistogramBucketsPositive)
+	// Make coldCounts the new hot counts.
+	n := atomic.AddUint64(&h.countAndHotIdx, 1<<63)
+	count := n & ((1 << 63) - 1)
+	// Swap the pointer names to represent the new roles and make
+	// the rest less confusing.
+	hot, cold = cold, hot
+	waitForCooldown(count, cold)
+	// Add all the now cold counts to the new hot counts...
+	addAndResetCounts(hot, cold)
+	// ...adjust the schema in the cold counts, too...
+	atomic.StoreInt32(&cold.nativeHistogramSchema, coldSchema)
+	// ...and then merge the cold buckets into the wider hot buckets.
+	merge := func(hotBuckets *sync.Map) func(k, v interface{}) bool {
+		return func(k, v interface{}) bool {
+			key := k.(int)
+			bucket := v.(*int64)
+			// Adjust key to match the bucket to merge into.
+			if key > 0 {
+				key++
+			}
+			key /= 2
+			// Add to corresponding hot bucket.
+			if addToBucket(hotBuckets, key, atomic.LoadInt64(bucket)) {
+				atomic.AddUint32(&hot.nativeHistogramBucketsNumber, 1)
+			}
+			return true
+		}
+	}
+
+	cold.nativeHistogramBucketsPositive.Range(merge(&hot.nativeHistogramBucketsPositive))
+	cold.nativeHistogramBucketsNegative.Range(merge(&hot.nativeHistogramBucketsNegative))
+	// Play it simple again and just delete all cold buckets.
+	atomic.StoreUint32(&cold.nativeHistogramBucketsNumber, 0)
+	deleteSyncMap(&cold.nativeHistogramBucketsNegative)
+	deleteSyncMap(&cold.nativeHistogramBucketsPositive)
+}
+
+func (h *histogram) resetCounts(counts *histogramCounts) {
+	atomic.StoreUint64(&counts.sumBits, 0)
+	atomic.StoreUint64(&counts.count, 0)
+	atomic.StoreUint64(&counts.nativeHistogramZeroBucket, 0)
+	atomic.StoreUint64(&counts.nativeHistogramZeroThresholdBits, math.Float64bits(h.nativeHistogramZeroThreshold))
+	atomic.StoreInt32(&counts.nativeHistogramSchema, h.nativeHistogramSchema)
+	atomic.StoreUint32(&counts.nativeHistogramBucketsNumber, 0)
+	for i := range h.upperBounds {
+		atomic.StoreUint64(&counts.buckets[i], 0)
+	}
+	deleteSyncMap(&counts.nativeHistogramBucketsNegative)
+	deleteSyncMap(&counts.nativeHistogramBucketsPositive)
 }
 
 // updateExemplar replaces the exemplar for the provided bucket. With empty
@@ -516,7 +1102,8 @@ func (v *HistogramVec) GetMetricWith(labels Labels) (Observer, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Observe(42.21)
+//
+//	myVec.WithLabelValues("404", "GET").Observe(42.21)
 func (v *HistogramVec) WithLabelValues(lvs ...string) Observer {
 	h, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -527,7 +1114,8 @@ func (v *HistogramVec) WithLabelValues(lvs ...string) Observer {
 
 // With works as GetMetricWith but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
 func (v *HistogramVec) With(labels Labels) Observer {
 	h, err := v.GetMetricWith(labels)
 	if err != nil {
@@ -668,3 +1256,229 @@ func (s buckSort) Swap(i, j int) {
 func (s buckSort) Less(i, j int) bool {
 	return s[i].GetUpperBound() < s[j].GetUpperBound()
 }
+
+// pickSchema returns the largest number n between -4 and 8 such that
+// 2^(2^-n) is less or equal the provided bucketFactor.
+//
+// Special cases:
+//   - bucketFactor <= 1: panics.
+//   - bucketFactor < 2^(2^-8) (but > 1): still returns 8.
+func pickSchema(bucketFactor float64) int32 {
+	if bucketFactor <= 1 {
+		panic(fmt.Errorf("bucketFactor %f is <=1", bucketFactor))
+	}
+	floor := math.Floor(math.Log2(math.Log2(bucketFactor)))
+	switch {
+	case floor <= -8:
+		return 8
+	case floor >= 4:
+		return -4
+	default:
+		return -int32(floor)
+	}
+}
+
+func makeBuckets(buckets *sync.Map) ([]*dto.BucketSpan, []int64) {
+	var ii []int
+	buckets.Range(func(k, v interface{}) bool {
+		ii = append(ii, k.(int))
+		return true
+	})
+	sort.Ints(ii)
+
+	if len(ii) == 0 {
+		return nil, nil
+	}
+
+	var (
+		spans     []*dto.BucketSpan
+		deltas    []int64
+		prevCount int64
+		nextI     int
+	)
+
+	appendDelta := func(count int64) {
+		*spans[len(spans)-1].Length++
+		deltas = append(deltas, count-prevCount)
+		prevCount = count
+	}
+
+	for n, i := range ii {
+		v, _ := buckets.Load(i)
+		count := atomic.LoadInt64(v.(*int64))
+		// Multiple spans with only small gaps in between are probably
+		// encoded more efficiently as one larger span with a few empty
+		// buckets. Needs some research to find the sweet spot. For now,
+		// we assume that gaps of one ore two buckets should not create
+		// a new span.
+		iDelta := int32(i - nextI)
+		if n == 0 || iDelta > 2 {
+			// We have to create a new span, either because we are
+			// at the very beginning, or because we have found a gap
+			// of more than two buckets.
+			spans = append(spans, &dto.BucketSpan{
+				Offset: proto.Int32(iDelta),
+				Length: proto.Uint32(0),
+			})
+		} else {
+			// We have found a small gap (or no gap at all).
+			// Insert empty buckets as needed.
+			for j := int32(0); j < iDelta; j++ {
+				appendDelta(0)
+			}
+		}
+		appendDelta(count)
+		nextI = i + 1
+	}
+	return spans, deltas
+}
+
+// addToBucket increments the sparse bucket at key by the provided amount. It
+// returns true if a new sparse bucket had to be created for that.
+func addToBucket(buckets *sync.Map, key int, increment int64) bool {
+	if existingBucket, ok := buckets.Load(key); ok {
+		// Fast path without allocation.
+		atomic.AddInt64(existingBucket.(*int64), increment)
+		return false
+	}
+	// Bucket doesn't exist yet. Slow path allocating new counter.
+	newBucket := increment // TODO(beorn7): Check if this is sufficient to not let increment escape.
+	if actualBucket, loaded := buckets.LoadOrStore(key, &newBucket); loaded {
+		// The bucket was created concurrently in another goroutine.
+		// Have to increment after all.
+		atomic.AddInt64(actualBucket.(*int64), increment)
+		return false
+	}
+	return true
+}
+
+// addAndReset returns a function to be used with sync.Map.Range of spare
+// buckets in coldCounts. It increments the buckets in the provided hotBuckets
+// according to the buckets ranged through. It then resets all buckets ranged
+// through to 0 (but leaves them in place so that they don't need to get
+// recreated on the next scrape).
+func addAndReset(hotBuckets *sync.Map, bucketNumber *uint32) func(k, v interface{}) bool {
+	return func(k, v interface{}) bool {
+		bucket := v.(*int64)
+		if addToBucket(hotBuckets, k.(int), atomic.LoadInt64(bucket)) {
+			atomic.AddUint32(bucketNumber, 1)
+		}
+		atomic.StoreInt64(bucket, 0)
+		return true
+	}
+}
+
+func deleteSyncMap(m *sync.Map) {
+	m.Range(func(k, v interface{}) bool {
+		m.Delete(k)
+		return true
+	})
+}
+
+func findSmallestKey(m *sync.Map) int {
+	result := math.MaxInt32
+	m.Range(func(k, v interface{}) bool {
+		key := k.(int)
+		if key < result {
+			result = key
+		}
+		return true
+	})
+	return result
+}
+
+func getLe(key int, schema int32) float64 {
+	// Here a bit of context about the behavior for the last bucket counting
+	// regular numbers (called simply "last bucket" below) and the bucket
+	// counting observations of ±Inf (called "inf bucket" below, with a key
+	// one higher than that of the "last bucket"):
+	//
+	// If we apply the usual formula to the last bucket, its upper bound
+	// would be calculated as +Inf. The reason is that the max possible
+	// regular float64 number (math.MaxFloat64) doesn't coincide with one of
+	// the calculated bucket boundaries. So the calculated boundary has to
+	// be larger than math.MaxFloat64, and the only float64 larger than
+	// math.MaxFloat64 is +Inf. However, we want to count actual
+	// observations of ±Inf in the inf bucket. Therefore, we have to treat
+	// the upper bound of the last bucket specially and set it to
+	// math.MaxFloat64. (The upper bound of the inf bucket, with its key
+	// being one higher than that of the last bucket, naturally comes out as
+	// +Inf by the usual formula. So that's fine.)
+	//
+	// math.MaxFloat64 has a frac of 0.9999999999999999 and an exp of
+	// 1024. If there were a float64 number following math.MaxFloat64, it
+	// would have a frac of 1.0 and an exp of 1024, or equivalently a frac
+	// of 0.5 and an exp of 1025. However, since frac must be smaller than
+	// 1, and exp must be smaller than 1025, either representation overflows
+	// a float64. (Which, in turn, is the reason that math.MaxFloat64 is the
+	// largest possible float64. Q.E.D.) However, the formula for
+	// calculating the upper bound from the idx and schema of the last
+	// bucket results in precisely that. It is either frac=1.0 & exp=1024
+	// (for schema < 0) or frac=0.5 & exp=1025 (for schema >=0). (This is,
+	// by the way, a power of two where the exponent itself is a power of
+	// two, 2¹⁰ in fact, which coinicides with a bucket boundary in all
+	// schemas.) So these are the special cases we have to catch below.
+	if schema < 0 {
+		exp := key << -schema
+		if exp == 1024 {
+			// This is the last bucket before the overflow bucket
+			// (for ±Inf observations). Return math.MaxFloat64 as
+			// explained above.
+			return math.MaxFloat64
+		}
+		return math.Ldexp(1, exp)
+	}
+
+	fracIdx := key & ((1 << schema) - 1)
+	frac := nativeHistogramBounds[schema][fracIdx]
+	exp := (key >> schema) + 1
+	if frac == 0.5 && exp == 1025 {
+		// This is the last bucket before the overflow bucket (for ±Inf
+		// observations). Return math.MaxFloat64 as explained above.
+		return math.MaxFloat64
+	}
+	return math.Ldexp(frac, exp)
+}
+
+// waitForCooldown returns after the count field in the provided histogramCounts
+// has reached the provided count value.
+func waitForCooldown(count uint64, counts *histogramCounts) {
+	for count != atomic.LoadUint64(&counts.count) {
+		runtime.Gosched() // Let observations get work done.
+	}
+}
+
+// atomicAddFloat adds the provided float atomically to another float
+// represented by the bit pattern the bits pointer is pointing to.
+func atomicAddFloat(bits *uint64, v float64) {
+	for {
+		loadedBits := atomic.LoadUint64(bits)
+		newBits := math.Float64bits(math.Float64frombits(loadedBits) + v)
+		if atomic.CompareAndSwapUint64(bits, loadedBits, newBits) {
+			break
+		}
+	}
+}
+
+// atomicDecUint32 atomically decrements the uint32 p points to.  See
+// https://pkg.go.dev/sync/atomic#AddUint32 to understand how this is done.
+func atomicDecUint32(p *uint32) {
+	atomic.AddUint32(p, ^uint32(0))
+}
+
+// addAndResetCounts adds certain fields (count, sum, conventional buckets, zero
+// bucket) from the cold counts to the corresponding fields in the hot
+// counts. Those fields are then reset to 0 in the cold counts.
+func addAndResetCounts(hot, cold *histogramCounts) {
+	atomic.AddUint64(&hot.count, atomic.LoadUint64(&cold.count))
+	atomic.StoreUint64(&cold.count, 0)
+	coldSum := math.Float64frombits(atomic.LoadUint64(&cold.sumBits))
+	atomicAddFloat(&hot.sumBits, coldSum)
+	atomic.StoreUint64(&cold.sumBits, 0)
+	for i := range hot.buckets {
+		atomic.AddUint64(&hot.buckets[i], atomic.LoadUint64(&cold.buckets[i]))
+		atomic.StoreUint64(&cold.buckets[i], 0)
+	}
+	atomic.AddUint64(&hot.nativeHistogramZeroBucket, atomic.LoadUint64(&cold.nativeHistogramZeroBucket))
+	atomic.StoreUint64(&cold.nativeHistogramZeroBucket, 0)
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/internal/almost_equal.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/almost_equal.go
new file mode 100644
index 000000000000..1ed5abe74c16
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/almost_equal.go
@@ -0,0 +1,60 @@
+// Copyright (c) 2015 Björn Rabenstein
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// The code in this package is copy/paste to avoid a dependency. Hence this file
+// carries the copyright of the original repo.
+// https://github.com/beorn7/floats
+package internal
+
+import (
+	"math"
+)
+
+// minNormalFloat64 is the smallest positive normal value of type float64.
+var minNormalFloat64 = math.Float64frombits(0x0010000000000000)
+
+// AlmostEqualFloat64 returns true if a and b are equal within a relative error
+// of epsilon. See http://floating-point-gui.de/errors/comparison/ for the
+// details of the applied method.
+func AlmostEqualFloat64(a, b, epsilon float64) bool {
+	if a == b {
+		return true
+	}
+	absA := math.Abs(a)
+	absB := math.Abs(b)
+	diff := math.Abs(a - b)
+	if a == 0 || b == 0 || absA+absB < minNormalFloat64 {
+		return diff < epsilon*minNormalFloat64
+	}
+	return diff/math.Min(absA+absB, math.MaxFloat64) < epsilon
+}
+
+// AlmostEqualFloat64s is the slice form of AlmostEqualFloat64.
+func AlmostEqualFloat64s(a, b []float64, epsilon float64) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if !AlmostEqualFloat64(a[i], b[i], epsilon) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go
index fd45cadc0c6c..fd0750f2cf50 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go
@@ -201,12 +201,15 @@ func (m *SequenceMatcher) isBJunk(s string) bool {
 // If IsJunk is not defined:
 //
 // Return (i,j,k) such that a[i:i+k] is equal to b[j:j+k], where
-//     alo <= i <= i+k <= ahi
-//     blo <= j <= j+k <= bhi
+//
+//	alo <= i <= i+k <= ahi
+//	blo <= j <= j+k <= bhi
+//
 // and for all (i',j',k') meeting those conditions,
-//     k >= k'
-//     i <= i'
-//     and if i == i', j <= j'
+//
+//	k >= k'
+//	i <= i'
+//	and if i == i', j <= j'
 //
 // In other words, of all maximal matching blocks, return one that
 // starts earliest in a, and of all those maximal matching blocks that
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/labels.go b/vendor/github.com/prometheus/client_golang/prometheus/labels.go
index 6eee198fef07..c1b8fad36aeb 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/labels.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/labels.go
@@ -25,7 +25,8 @@ import (
 // Labels represents a collection of label name -> value mappings. This type is
 // commonly used with the With(Labels) and GetMetricWith(Labels) methods of
 // metric vector Collectors, e.g.:
-//     myVec.With(Labels{"code": "404", "method": "GET"}).Add(42)
+//
+//	myVec.With(Labels{"code": "404", "method": "GET"}).Add(42)
 //
 // The other use-case is the specification of constant label pairs in Opts or to
 // create a Desc.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promauto/auto.go b/vendor/github.com/prometheus/client_golang/prometheus/promauto/auto.go
index f8d50d1f9112..8031e8704244 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promauto/auto.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promauto/auto.go
@@ -14,114 +14,114 @@
 // Package promauto provides alternative constructors for the fundamental
 // Prometheus metric types and their …Vec and …Func variants. The difference to
 // their counterparts in the prometheus package is that the promauto
-// constructors return Collectors that are already registered with a
-// registry. There are two sets of constructors. The constructors in the first
-// set are top-level functions, while the constructors in the other set are
-// methods of the Factory type. The top-level function return Collectors
-// registered with the global registry (prometheus.DefaultRegisterer), while the
-// methods return Collectors registered with the registry the Factory was
-// constructed with. All constructors panic if the registration fails.
+// constructors register the Collectors with a registry before returning them.
+// There are two sets of constructors. The constructors in the first set are
+// top-level functions, while the constructors in the other set are methods of
+// the Factory type. The top-level function return Collectors registered with
+// the global registry (prometheus.DefaultRegisterer), while the methods return
+// Collectors registered with the registry the Factory was constructed with. All
+// constructors panic if the registration fails.
 //
 // The following example is a complete program to create a histogram of normally
 // distributed random numbers from the math/rand package:
 //
-//      package main
+//	package main
 //
-//      import (
-//              "math/rand"
-//              "net/http"
+//	import (
+//	        "math/rand"
+//	        "net/http"
 //
-//              "github.com/prometheus/client_golang/prometheus"
-//              "github.com/prometheus/client_golang/prometheus/promauto"
-//              "github.com/prometheus/client_golang/prometheus/promhttp"
-//      )
+//	        "github.com/prometheus/client_golang/prometheus"
+//	        "github.com/prometheus/client_golang/prometheus/promauto"
+//	        "github.com/prometheus/client_golang/prometheus/promhttp"
+//	)
 //
-//      var histogram = promauto.NewHistogram(prometheus.HistogramOpts{
-//              Name:    "random_numbers",
-//              Help:    "A histogram of normally distributed random numbers.",
-//              Buckets: prometheus.LinearBuckets(-3, .1, 61),
-//      })
+//	var histogram = promauto.NewHistogram(prometheus.HistogramOpts{
+//	        Name:    "random_numbers",
+//	        Help:    "A histogram of normally distributed random numbers.",
+//	        Buckets: prometheus.LinearBuckets(-3, .1, 61),
+//	})
 //
-//      func Random() {
-//              for {
-//                      histogram.Observe(rand.NormFloat64())
-//              }
-//      }
+//	func Random() {
+//	        for {
+//	                histogram.Observe(rand.NormFloat64())
+//	        }
+//	}
 //
-//      func main() {
-//              go Random()
-//              http.Handle("/metrics", promhttp.Handler())
-//              http.ListenAndServe(":1971", nil)
-//      }
+//	func main() {
+//	        go Random()
+//	        http.Handle("/metrics", promhttp.Handler())
+//	        http.ListenAndServe(":1971", nil)
+//	}
 //
 // Prometheus's version of a minimal hello-world program:
 //
-//      package main
+//	package main
 //
-//      import (
-//      	"fmt"
-//      	"net/http"
+//	import (
+//		"fmt"
+//		"net/http"
 //
-//      	"github.com/prometheus/client_golang/prometheus"
-//      	"github.com/prometheus/client_golang/prometheus/promauto"
-//      	"github.com/prometheus/client_golang/prometheus/promhttp"
-//      )
+//		"github.com/prometheus/client_golang/prometheus"
+//		"github.com/prometheus/client_golang/prometheus/promauto"
+//		"github.com/prometheus/client_golang/prometheus/promhttp"
+//	)
 //
-//      func main() {
-//      	http.Handle("/", promhttp.InstrumentHandlerCounter(
-//      		promauto.NewCounterVec(
-//      			prometheus.CounterOpts{
-//      				Name: "hello_requests_total",
-//      				Help: "Total number of hello-world requests by HTTP code.",
-//      			},
-//      			[]string{"code"},
-//      		),
-//      		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-//      			fmt.Fprint(w, "Hello, world!")
-//      		}),
-//      	))
-//      	http.Handle("/metrics", promhttp.Handler())
-//      	http.ListenAndServe(":1971", nil)
-//      }
+//	func main() {
+//		http.Handle("/", promhttp.InstrumentHandlerCounter(
+//			promauto.NewCounterVec(
+//				prometheus.CounterOpts{
+//					Name: "hello_requests_total",
+//					Help: "Total number of hello-world requests by HTTP code.",
+//				},
+//				[]string{"code"},
+//			),
+//			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+//				fmt.Fprint(w, "Hello, world!")
+//			}),
+//		))
+//		http.Handle("/metrics", promhttp.Handler())
+//		http.ListenAndServe(":1971", nil)
+//	}
 //
 // A Factory is created with the With(prometheus.Registerer) function, which
 // enables two usage pattern. With(prometheus.Registerer) can be called once per
 // line:
 //
-//        var (
-//        	reg           = prometheus.NewRegistry()
-//        	randomNumbers = promauto.With(reg).NewHistogram(prometheus.HistogramOpts{
-//        		Name:    "random_numbers",
-//        		Help:    "A histogram of normally distributed random numbers.",
-//        		Buckets: prometheus.LinearBuckets(-3, .1, 61),
-//        	})
-//        	requestCount = promauto.With(reg).NewCounterVec(
-//        		prometheus.CounterOpts{
-//        			Name: "http_requests_total",
-//        			Help: "Total number of HTTP requests by status code and method.",
-//        		},
-//        		[]string{"code", "method"},
-//        	)
-//        )
+//	var (
+//		reg           = prometheus.NewRegistry()
+//		randomNumbers = promauto.With(reg).NewHistogram(prometheus.HistogramOpts{
+//			Name:    "random_numbers",
+//			Help:    "A histogram of normally distributed random numbers.",
+//			Buckets: prometheus.LinearBuckets(-3, .1, 61),
+//		})
+//		requestCount = promauto.With(reg).NewCounterVec(
+//			prometheus.CounterOpts{
+//				Name: "http_requests_total",
+//				Help: "Total number of HTTP requests by status code and method.",
+//			},
+//			[]string{"code", "method"},
+//		)
+//	)
 //
 // Or it can be used to create a Factory once to be used multiple times:
 //
-//        var (
-//        	reg           = prometheus.NewRegistry()
-//        	factory       = promauto.With(reg)
-//        	randomNumbers = factory.NewHistogram(prometheus.HistogramOpts{
-//        		Name:    "random_numbers",
-//        		Help:    "A histogram of normally distributed random numbers.",
-//        		Buckets: prometheus.LinearBuckets(-3, .1, 61),
-//        	})
-//        	requestCount = factory.NewCounterVec(
-//        		prometheus.CounterOpts{
-//        			Name: "http_requests_total",
-//        			Help: "Total number of HTTP requests by status code and method.",
-//        		},
-//        		[]string{"code", "method"},
-//        	)
-//        )
+//	var (
+//		reg           = prometheus.NewRegistry()
+//		factory       = promauto.With(reg)
+//		randomNumbers = factory.NewHistogram(prometheus.HistogramOpts{
+//			Name:    "random_numbers",
+//			Help:    "A histogram of normally distributed random numbers.",
+//			Buckets: prometheus.LinearBuckets(-3, .1, 61),
+//		})
+//		requestCount = factory.NewCounterVec(
+//			prometheus.CounterOpts{
+//				Name: "http_requests_total",
+//				Help: "Total number of HTTP requests by status code and method.",
+//			},
+//			[]string{"code", "method"},
+//		)
+//	)
 //
 // This appears very handy. So why are these constructors locked away in a
 // separate package?
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go
index 57bb5f945fd5..21086781621f 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go
@@ -73,7 +73,7 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou
 	return func(r *http.Request) (*http.Response, error) {
 		resp, err := next.RoundTrip(r)
 		if err == nil {
-			exemplarAdd(
+			addWithExemplar(
 				counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)),
 				1,
 				rtOpts.getExemplarFn(r.Context()),
@@ -116,7 +116,7 @@ func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundT
 		start := time.Now()
 		resp, err := next.RoundTrip(r)
 		if err == nil {
-			exemplarObserve(
+			observeWithExemplar(
 				obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)),
 				time.Since(start).Seconds(),
 				rtOpts.getExemplarFn(r.Context()),
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go
index bfe500987798..cca67a78a90d 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go
@@ -28,7 +28,9 @@ import (
 // magicString is used for the hacky label test in checkLabels. Remove once fixed.
 const magicString = "zZgWfBxLqvG8kc8IMv3POi2Bb0tZI3vAnBx+gBaFi9FyPzB/CzKUer1yufDa"
 
-func exemplarObserve(obs prometheus.Observer, val float64, labels map[string]string) {
+// observeWithExemplar is a wrapper for [prometheus.ExemplarAdder.ExemplarObserver],
+// which falls back to [prometheus.Observer.Observe] if no labels are provided.
+func observeWithExemplar(obs prometheus.Observer, val float64, labels map[string]string) {
 	if labels == nil {
 		obs.Observe(val)
 		return
@@ -36,7 +38,9 @@ func exemplarObserve(obs prometheus.Observer, val float64, labels map[string]str
 	obs.(prometheus.ExemplarObserver).ObserveWithExemplar(val, labels)
 }
 
-func exemplarAdd(obs prometheus.Counter, val float64, labels map[string]string) {
+// addWithExemplar is a wrapper for [prometheus.ExemplarAdder.AddWithExemplar],
+// which falls back to [prometheus.Counter.Add] if no labels are provided.
+func addWithExemplar(obs prometheus.Counter, val float64, labels map[string]string) {
 	if labels == nil {
 		obs.Add(val)
 		return
@@ -91,7 +95,7 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, op
 			d := newDelegator(w, nil)
 			next.ServeHTTP(d, r)
 
-			exemplarObserve(
+			observeWithExemplar(
 				obs.With(labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)),
 				time.Since(now).Seconds(),
 				hOpts.getExemplarFn(r.Context()),
@@ -103,7 +107,7 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, op
 		now := time.Now()
 		next.ServeHTTP(w, r)
 
-		exemplarObserve(
+		observeWithExemplar(
 			obs.With(labels(code, method, r.Method, 0, hOpts.extraMethods...)),
 			time.Since(now).Seconds(),
 			hOpts.getExemplarFn(r.Context()),
@@ -141,7 +145,7 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler,
 			d := newDelegator(w, nil)
 			next.ServeHTTP(d, r)
 
-			exemplarAdd(
+			addWithExemplar(
 				counter.With(labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)),
 				1,
 				hOpts.getExemplarFn(r.Context()),
@@ -151,7 +155,7 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler,
 
 	return func(w http.ResponseWriter, r *http.Request) {
 		next.ServeHTTP(w, r)
-		exemplarAdd(
+		addWithExemplar(
 			counter.With(labels(code, method, r.Method, 0, hOpts.extraMethods...)),
 			1,
 			hOpts.getExemplarFn(r.Context()),
@@ -192,7 +196,7 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha
 	return func(w http.ResponseWriter, r *http.Request) {
 		now := time.Now()
 		d := newDelegator(w, func(status int) {
-			exemplarObserve(
+			observeWithExemplar(
 				obs.With(labels(code, method, r.Method, status, hOpts.extraMethods...)),
 				time.Since(now).Seconds(),
 				hOpts.getExemplarFn(r.Context()),
@@ -233,7 +237,7 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler,
 			d := newDelegator(w, nil)
 			next.ServeHTTP(d, r)
 			size := computeApproximateRequestSize(r)
-			exemplarObserve(
+			observeWithExemplar(
 				obs.With(labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)),
 				float64(size),
 				hOpts.getExemplarFn(r.Context()),
@@ -244,7 +248,7 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler,
 	return func(w http.ResponseWriter, r *http.Request) {
 		next.ServeHTTP(w, r)
 		size := computeApproximateRequestSize(r)
-		exemplarObserve(
+		observeWithExemplar(
 			obs.With(labels(code, method, r.Method, 0, hOpts.extraMethods...)),
 			float64(size),
 			hOpts.getExemplarFn(r.Context()),
@@ -282,7 +286,7 @@ func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		d := newDelegator(w, nil)
 		next.ServeHTTP(d, r)
-		exemplarObserve(
+		observeWithExemplar(
 			obs.With(labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)),
 			float64(d.Written()),
 			hOpts.getExemplarFn(r.Context()),
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/push/push.go b/vendor/github.com/prometheus/client_golang/prometheus/push/push.go
index 06dee376e15a..29f6cd309c91 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/push/push.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/push/push.go
@@ -15,17 +15,17 @@
 // builder approach. Create a Pusher with New and then add the various options
 // by using its methods, finally calling Add or Push, like this:
 //
-//    // Easy case:
-//    push.New("http://example.org/metrics", "my_job").Gatherer(myRegistry).Push()
+//	// Easy case:
+//	push.New("http://example.org/metrics", "my_job").Gatherer(myRegistry).Push()
 //
-//    // Complex case:
-//    push.New("http://example.org/metrics", "my_job").
-//        Collector(myCollector1).
-//        Collector(myCollector2).
-//        Grouping("zone", "xy").
-//        Client(&myHTTPClient).
-//        BasicAuth("top", "secret").
-//        Add()
+//	// Complex case:
+//	push.New("http://example.org/metrics", "my_job").
+//	    Collector(myCollector1).
+//	    Collector(myCollector2).
+//	    Grouping("zone", "xy").
+//	    Client(&myHTTPClient).
+//	    BasicAuth("top", "secret").
+//	    Add()
 //
 // See the examples section for more detailed examples.
 //
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/registry.go b/vendor/github.com/prometheus/client_golang/prometheus/registry.go
index 325f665ff675..09e34d307c97 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/registry.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/registry.go
@@ -252,9 +252,12 @@ func (errs MultiError) MaybeUnwrap() error {
 }
 
 // Registry registers Prometheus collectors, collects their metrics, and gathers
-// them into MetricFamilies for exposition. It implements both Registerer and
-// Gatherer. The zero value is not usable. Create instances with NewRegistry or
-// NewPedanticRegistry.
+// them into MetricFamilies for exposition. It implements Registerer, Gatherer,
+// and Collector. The zero value is not usable. Create instances with
+// NewRegistry or NewPedanticRegistry.
+//
+// Registry implements Collector to allow it to be used for creating groups of
+// metrics. See the Grouping example for how this can be done.
 type Registry struct {
 	mtx                   sync.RWMutex
 	collectorsByID        map[uint64]Collector // ID is a hash of the descIDs.
@@ -556,6 +559,31 @@ func (r *Registry) Gather() ([]*dto.MetricFamily, error) {
 	return internal.NormalizeMetricFamilies(metricFamiliesByName), errs.MaybeUnwrap()
 }
 
+// Describe implements Collector.
+func (r *Registry) Describe(ch chan<- *Desc) {
+	r.mtx.RLock()
+	defer r.mtx.RUnlock()
+
+	// Only report the checked Collectors; unchecked collectors don't report any
+	// Desc.
+	for _, c := range r.collectorsByID {
+		c.Describe(ch)
+	}
+}
+
+// Collect implements Collector.
+func (r *Registry) Collect(ch chan<- Metric) {
+	r.mtx.RLock()
+	defer r.mtx.RUnlock()
+
+	for _, c := range r.collectorsByID {
+		c.Collect(ch)
+	}
+	for _, c := range r.uncheckedCollectors {
+		c.Collect(ch)
+	}
+}
+
 // WriteToTextfile calls Gather on the provided Gatherer, encodes the result in the
 // Prometheus text format, and writes it to a temporary file. Upon success, the
 // temporary file is renamed to the provided filename.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/summary.go b/vendor/github.com/prometheus/client_golang/prometheus/summary.go
index c5fa8ed7c71a..7bc448a89394 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/summary.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/summary.go
@@ -603,7 +603,8 @@ func (v *SummaryVec) GetMetricWith(labels Labels) (Observer, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Observe(42.21)
+//
+//	myVec.WithLabelValues("404", "GET").Observe(42.21)
 func (v *SummaryVec) WithLabelValues(lvs ...string) Observer {
 	s, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -614,7 +615,8 @@ func (v *SummaryVec) WithLabelValues(lvs ...string) Observer {
 
 // With works as GetMetricWith, but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
 func (v *SummaryVec) With(labels Labels) Observer {
 	s, err := v.GetMetricWith(labels)
 	if err != nil {
@@ -701,7 +703,8 @@ func (s *constSummary) Write(out *dto.Metric) error {
 //
 // quantiles maps ranks to quantile values. For example, a median latency of
 // 0.23s and a 99th percentile latency of 0.56s would be expressed as:
-//     map[float64]float64{0.5: 0.23, 0.99: 0.56}
+//
+//	map[float64]float64{0.5: 0.23, 0.99: 0.56}
 //
 // NewConstSummary returns an error if the length of labelValues is not
 // consistent with the variable labels in Desc or if Desc is invalid.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/timer.go b/vendor/github.com/prometheus/client_golang/prometheus/timer.go
index 8d5f10523375..f28a76f3a62a 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/timer.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/timer.go
@@ -25,11 +25,12 @@ type Timer struct {
 // NewTimer creates a new Timer. The provided Observer is used to observe a
 // duration in seconds. Timer is usually used to time a function call in the
 // following way:
-//    func TimeMe() {
-//        timer := NewTimer(myHistogram)
-//        defer timer.ObserveDuration()
-//        // Do actual work.
-//    }
+//
+//	func TimeMe() {
+//	    timer := NewTimer(myHistogram)
+//	    defer timer.ObserveDuration()
+//	    // Do actual work.
+//	}
 func NewTimer(o Observer) *Timer {
 	return &Timer{
 		begin:    time.Now(),
diff --git a/vendor/github.com/prometheus/common/config/config.go b/vendor/github.com/prometheus/common/config/config.go
index fffda4a7ef45..0b91f20d55af 100644
--- a/vendor/github.com/prometheus/common/config/config.go
+++ b/vendor/github.com/prometheus/common/config/config.go
@@ -18,6 +18,7 @@ package config
 
 import (
 	"encoding/json"
+	"net/http"
 	"path/filepath"
 )
 
@@ -34,7 +35,7 @@ func (s Secret) MarshalYAML() (interface{}, error) {
 	return nil, nil
 }
 
-//UnmarshalYAML implements the yaml.Unmarshaler interface for Secrets.
+// UnmarshalYAML implements the yaml.Unmarshaler interface for Secrets.
 func (s *Secret) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	type plain Secret
 	return unmarshal((*plain)(s))
@@ -48,6 +49,29 @@ func (s Secret) MarshalJSON() ([]byte, error) {
 	return json.Marshal(secretToken)
 }
 
+type Header map[string][]Secret
+
+func (h *Header) HTTPHeader() http.Header {
+	if h == nil || *h == nil {
+		return nil
+	}
+
+	header := make(http.Header)
+
+	for name, values := range *h {
+		var s []string
+		if values != nil {
+			s = make([]string, 0, len(values))
+			for _, value := range values {
+				s = append(s, string(value))
+			}
+		}
+		header[name] = s
+	}
+
+	return header
+}
+
 // DirectorySetter is a config type that contains file paths that may
 // be relative to the file containing the config.
 type DirectorySetter interface {
diff --git a/vendor/github.com/prometheus/common/config/http_config.go b/vendor/github.com/prometheus/common/config/http_config.go
index b47347e4b51f..3965099972ac 100644
--- a/vendor/github.com/prometheus/common/config/http_config.go
+++ b/vendor/github.com/prometheus/common/config/http_config.go
@@ -21,10 +21,11 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -80,7 +81,7 @@ func (tv *TLSVersion) UnmarshalYAML(unmarshal func(interface{}) error) error {
 }
 
 func (tv *TLSVersion) MarshalYAML() (interface{}, error) {
-	if tv != nil || *tv == 0 {
+	if tv == nil || *tv == 0 {
 		return []byte("null"), nil
 	}
 	for s, v := range TLSVersions {
@@ -106,7 +107,7 @@ func (tv *TLSVersion) UnmarshalJSON(data []byte) error {
 
 // MarshalJSON implements the json.Marshaler interface for TLSVersion.
 func (tv *TLSVersion) MarshalJSON() ([]byte, error) {
-	if tv != nil || *tv == 0 {
+	if tv == nil || *tv == 0 {
 		return []byte("null"), nil
 	}
 	for s, v := range TLSVersions {
@@ -117,6 +118,19 @@ func (tv *TLSVersion) MarshalJSON() ([]byte, error) {
 	return nil, fmt.Errorf("unknown TLS version: %d", tv)
 }
 
+// String implements the fmt.Stringer interface for TLSVersion.
+func (tv *TLSVersion) String() string {
+	if tv == nil || *tv == 0 {
+		return ""
+	}
+	for s, v := range TLSVersions {
+		if *tv == v {
+			return s
+		}
+	}
+	return fmt.Sprintf("%d", tv)
+}
+
 // BasicAuth contains basic HTTP authentication credentials.
 type BasicAuth struct {
 	Username     string `yaml:"username" json:"username"`
@@ -235,6 +249,30 @@ func (a *OAuth2) SetDirectory(dir string) {
 	a.TLSConfig.SetDirectory(dir)
 }
 
+// LoadHTTPConfig parses the YAML input s into a HTTPClientConfig.
+func LoadHTTPConfig(s string) (*HTTPClientConfig, error) {
+	cfg := &HTTPClientConfig{}
+	err := yaml.UnmarshalStrict([]byte(s), cfg)
+	if err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+// LoadHTTPConfigFile parses the given YAML file into a HTTPClientConfig.
+func LoadHTTPConfigFile(filename string) (*HTTPClientConfig, []byte, error) {
+	content, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, nil, err
+	}
+	cfg, err := LoadHTTPConfig(string(content))
+	if err != nil {
+		return nil, nil, err
+	}
+	cfg.SetDirectory(filepath.Dir(filepath.Dir(filename)))
+	return cfg, content, nil
+}
+
 // HTTPClientConfig configures an HTTP client.
 type HTTPClientConfig struct {
 	// The HTTP basic authentication credentials for the targets.
@@ -251,6 +289,11 @@ type HTTPClientConfig struct {
 	BearerTokenFile string `yaml:"bearer_token_file,omitempty" json:"bearer_token_file,omitempty"`
 	// HTTP proxy server to use to connect to the targets.
 	ProxyURL URL `yaml:"proxy_url,omitempty" json:"proxy_url,omitempty"`
+	// ProxyConnectHeader optionally specifies headers to send to
+	// proxies during CONNECT requests. Assume that at least _some_ of
+	// these headers are going to contain secrets and use Secret as the
+	// value type instead of string.
+	ProxyConnectHeader Header `yaml:"proxy_connect_header,omitempty" json:"proxy_connect_header,omitempty"`
 	// TLSConfig to use to connect to the targets.
 	TLSConfig TLSConfig `yaml:"tls_config,omitempty" json:"tls_config,omitempty"`
 	// FollowRedirects specifies whether the client should follow HTTP 3xx redirects.
@@ -276,7 +319,8 @@ func (c *HTTPClientConfig) SetDirectory(dir string) {
 }
 
 // Validate validates the HTTPClientConfig to check only one of BearerToken,
-// BasicAuth and BearerTokenFile is configured.
+// BasicAuth and BearerTokenFile is configured. It also validates that ProxyURL
+// is set if ProxyConnectHeader is set.
 func (c *HTTPClientConfig) Validate() error {
 	// Backwards compatibility with the bearer_token field.
 	if len(c.BearerToken) > 0 && len(c.BearerTokenFile) > 0 {
@@ -334,6 +378,9 @@ func (c *HTTPClientConfig) Validate() error {
 			return fmt.Errorf("at most one of oauth2 client_secret & client_secret_file must be configured")
 		}
 	}
+	if len(c.ProxyConnectHeader) > 0 && (c.ProxyURL.URL == nil || c.ProxyURL.String() == "") {
+		return fmt.Errorf("if proxy_connect_header is configured proxy_url must also be configured")
+	}
 	return nil
 }
 
@@ -462,6 +509,7 @@ func NewRoundTripperFromConfig(cfg HTTPClientConfig, name string, optFuncs ...HT
 		// It is applied on request. So we leave out any timings here.
 		var rt http.RoundTripper = &http.Transport{
 			Proxy:                 http.ProxyURL(cfg.ProxyURL.URL),
+			ProxyConnectHeader:    cfg.ProxyConnectHeader.HTTPHeader(),
 			MaxIdleConns:          20000,
 			MaxIdleConnsPerHost:   1000, // see https://github.com/golang/go/issues/13801
 			DisableKeepAlives:     !opts.keepAlivesEnabled,
@@ -527,7 +575,7 @@ func NewRoundTripperFromConfig(cfg HTTPClientConfig, name string, optFuncs ...HT
 		return newRT(tlsConfig)
 	}
 
-	return NewTLSRoundTripper(tlsConfig, cfg.TLSConfig.CAFile, newRT)
+	return NewTLSRoundTripper(tlsConfig, cfg.TLSConfig.CAFile, cfg.TLSConfig.CertFile, cfg.TLSConfig.KeyFile, newRT)
 }
 
 type authorizationCredentialsRoundTripper struct {
@@ -571,7 +619,7 @@ func NewAuthorizationCredentialsFileRoundTripper(authType, authCredentialsFile s
 
 func (rt *authorizationCredentialsFileRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	if len(req.Header.Get("Authorization")) == 0 {
-		b, err := ioutil.ReadFile(rt.authCredentialsFile)
+		b, err := os.ReadFile(rt.authCredentialsFile)
 		if err != nil {
 			return nil, fmt.Errorf("unable to read authorization credentials file %s: %s", rt.authCredentialsFile, err)
 		}
@@ -609,7 +657,7 @@ func (rt *basicAuthRoundTripper) RoundTrip(req *http.Request) (*http.Response, e
 	}
 	req = cloneRequest(req)
 	if rt.passwordFile != "" {
-		bs, err := ioutil.ReadFile(rt.passwordFile)
+		bs, err := os.ReadFile(rt.passwordFile)
 		if err != nil {
 			return nil, fmt.Errorf("unable to read basic auth password file %s: %s", rt.passwordFile, err)
 		}
@@ -651,7 +699,7 @@ func (rt *oauth2RoundTripper) RoundTrip(req *http.Request) (*http.Response, erro
 	)
 
 	if rt.config.ClientSecretFile != "" {
-		data, err := ioutil.ReadFile(rt.config.ClientSecretFile)
+		data, err := os.ReadFile(rt.config.ClientSecretFile)
 		if err != nil {
 			return nil, fmt.Errorf("unable to read oauth2 client secret file %s: %s", rt.config.ClientSecretFile, err)
 		}
@@ -696,7 +744,7 @@ func (rt *oauth2RoundTripper) RoundTrip(req *http.Request) (*http.Response, erro
 		if len(rt.config.TLSConfig.CAFile) == 0 {
 			t, _ = tlsTransport(tlsConfig)
 		} else {
-			t, err = NewTLSRoundTripper(tlsConfig, rt.config.TLSConfig.CAFile, tlsTransport)
+			t, err = NewTLSRoundTripper(tlsConfig, rt.config.TLSConfig.CAFile, rt.config.TLSConfig.CertFile, rt.config.TLSConfig.KeyFile, tlsTransport)
 			if err != nil {
 				return nil, err
 			}
@@ -766,6 +814,13 @@ func NewTLSConfig(cfg *TLSConfig) (*tls.Config, error) {
 	tlsConfig := &tls.Config{
 		InsecureSkipVerify: cfg.InsecureSkipVerify,
 		MinVersion:         uint16(cfg.MinVersion),
+		MaxVersion:         uint16(cfg.MaxVersion),
+	}
+
+	if cfg.MaxVersion != 0 && cfg.MinVersion != 0 {
+		if cfg.MaxVersion < cfg.MinVersion {
+			return nil, fmt.Errorf("tls_config.max_version must be greater than or equal to tls_config.min_version if both are specified")
+		}
 	}
 
 	// If a CA cert is provided then let's read it in so we can validate the
@@ -813,6 +868,8 @@ type TLSConfig struct {
 	InsecureSkipVerify bool `yaml:"insecure_skip_verify" json:"insecure_skip_verify"`
 	// Minimum TLS version.
 	MinVersion TLSVersion `yaml:"min_version,omitempty" json:"min_version,omitempty"`
+	// Maximum TLS version.
+	MaxVersion TLSVersion `yaml:"max_version,omitempty" json:"max_version,omitempty"`
 }
 
 // SetDirectory joins any relative file paths with dir.
@@ -825,18 +882,45 @@ func (c *TLSConfig) SetDirectory(dir string) {
 	c.KeyFile = JoinDir(dir, c.KeyFile)
 }
 
+// UnmarshalYAML implements the yaml.Unmarshaler interface.
+func (c *TLSConfig) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	type plain TLSConfig
+	return unmarshal((*plain)(c))
+}
+
+// readCertAndKey reads the cert and key files from the disk.
+func readCertAndKey(certFile, keyFile string) ([]byte, []byte, error) {
+	certData, err := os.ReadFile(certFile)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	keyData, err := os.ReadFile(keyFile)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return certData, keyData, nil
+}
+
 // getClientCertificate reads the pair of client cert and key from disk and returns a tls.Certificate.
-func (c *TLSConfig) getClientCertificate(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
-	cert, err := tls.LoadX509KeyPair(c.CertFile, c.KeyFile)
+func (c *TLSConfig) getClientCertificate(_ *tls.CertificateRequestInfo) (*tls.Certificate, error) {
+	certData, keyData, err := readCertAndKey(c.CertFile, c.KeyFile)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read specified client cert (%s) & key (%s): %s", c.CertFile, c.KeyFile, err)
+	}
+
+	cert, err := tls.X509KeyPair(certData, keyData)
 	if err != nil {
 		return nil, fmt.Errorf("unable to use specified client cert (%s) & key (%s): %s", c.CertFile, c.KeyFile, err)
 	}
+
 	return &cert, nil
 }
 
 // readCAFile reads the CA cert file from disk.
 func readCAFile(f string) ([]byte, error) {
-	data, err := ioutil.ReadFile(f)
+	data, err := os.ReadFile(f)
 	if err != nil {
 		return nil, fmt.Errorf("unable to load specified CA cert %s: %s", f, err)
 	}
@@ -856,23 +940,30 @@ func updateRootCA(cfg *tls.Config, b []byte) bool {
 // tlsRoundTripper is a RoundTripper that updates automatically its TLS
 // configuration whenever the content of the CA file changes.
 type tlsRoundTripper struct {
-	caFile string
+	caFile   string
+	certFile string
+	keyFile  string
+
 	// newRT returns a new RoundTripper.
 	newRT func(*tls.Config) (http.RoundTripper, error)
 
-	mtx        sync.RWMutex
-	rt         http.RoundTripper
-	hashCAFile []byte
-	tlsConfig  *tls.Config
+	mtx          sync.RWMutex
+	rt           http.RoundTripper
+	hashCAFile   []byte
+	hashCertFile []byte
+	hashKeyFile  []byte
+	tlsConfig    *tls.Config
 }
 
 func NewTLSRoundTripper(
 	cfg *tls.Config,
-	caFile string,
+	caFile, certFile, keyFile string,
 	newRT func(*tls.Config) (http.RoundTripper, error),
 ) (http.RoundTripper, error) {
 	t := &tlsRoundTripper{
 		caFile:    caFile,
+		certFile:  certFile,
+		keyFile:   keyFile,
 		newRT:     newRT,
 		tlsConfig: cfg,
 	}
@@ -882,7 +973,7 @@ func NewTLSRoundTripper(
 		return nil, err
 	}
 	t.rt = rt
-	_, t.hashCAFile, err = t.getCAWithHash()
+	_, t.hashCAFile, t.hashCertFile, t.hashKeyFile, err = t.getTLSFilesWithHash()
 	if err != nil {
 		return nil, err
 	}
@@ -890,25 +981,36 @@ func NewTLSRoundTripper(
 	return t, nil
 }
 
-func (t *tlsRoundTripper) getCAWithHash() ([]byte, []byte, error) {
-	b, err := readCAFile(t.caFile)
+func (t *tlsRoundTripper) getTLSFilesWithHash() ([]byte, []byte, []byte, []byte, error) {
+	b1, err := readCAFile(t.caFile)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
+	}
+	h1 := sha256.Sum256(b1)
+
+	var h2, h3 [32]byte
+	if t.certFile != "" {
+		b2, b3, err := readCertAndKey(t.certFile, t.keyFile)
+		if err != nil {
+			return nil, nil, nil, nil, err
+		}
+		h2, h3 = sha256.Sum256(b2), sha256.Sum256(b3)
 	}
-	h := sha256.Sum256(b)
-	return b, h[:], nil
 
+	return b1, h1[:], h2[:], h3[:], nil
 }
 
 // RoundTrip implements the http.RoundTrip interface.
 func (t *tlsRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	b, h, err := t.getCAWithHash()
+	caData, caHash, certHash, keyHash, err := t.getTLSFilesWithHash()
 	if err != nil {
 		return nil, err
 	}
 
 	t.mtx.RLock()
-	equal := bytes.Equal(h[:], t.hashCAFile)
+	equal := bytes.Equal(caHash[:], t.hashCAFile) &&
+		bytes.Equal(certHash[:], t.hashCertFile) &&
+		bytes.Equal(keyHash[:], t.hashKeyFile)
 	rt := t.rt
 	t.mtx.RUnlock()
 	if equal {
@@ -917,8 +1019,10 @@ func (t *tlsRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	}
 
 	// Create a new RoundTripper.
+	// The cert and key files are read separately by the client
+	// using GetClientCertificate.
 	tlsConfig := t.tlsConfig.Clone()
-	if !updateRootCA(tlsConfig, b) {
+	if !updateRootCA(tlsConfig, caData) {
 		return nil, fmt.Errorf("unable to use specified CA cert %s", t.caFile)
 	}
 	rt, err = t.newRT(tlsConfig)
@@ -929,7 +1033,9 @@ func (t *tlsRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 
 	t.mtx.Lock()
 	t.rt = rt
-	t.hashCAFile = h[:]
+	t.hashCAFile = caHash[:]
+	t.hashCertFile = certHash[:]
+	t.hashKeyFile = keyHash[:]
 	t.mtx.Unlock()
 
 	return rt.RoundTrip(req)
diff --git a/vendor/github.com/prometheus/common/expfmt/fuzz.go b/vendor/github.com/prometheus/common/expfmt/fuzz.go
index f819e4f8b549..dfac962a4e7e 100644
--- a/vendor/github.com/prometheus/common/expfmt/fuzz.go
+++ b/vendor/github.com/prometheus/common/expfmt/fuzz.go
@@ -21,8 +21,8 @@ import "bytes"
 
 // Fuzz text metric parser with with github.com/dvyukov/go-fuzz:
 //
-//     go-fuzz-build github.com/prometheus/common/expfmt
-//     go-fuzz -bin expfmt-fuzz.zip -workdir fuzz
+//	go-fuzz-build github.com/prometheus/common/expfmt
+//	go-fuzz -bin expfmt-fuzz.zip -workdir fuzz
 //
 // Further input samples should go in the folder fuzz/corpus.
 func Fuzz(in []byte) int {
diff --git a/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go b/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go
index 9d94ae9effe3..21cdddcf0541 100644
--- a/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go
+++ b/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go
@@ -46,20 +46,20 @@ import (
 // missing features and peculiarities to avoid complications when switching from
 // Prometheus to OpenMetrics or vice versa:
 //
-// - Counters are expected to have the `_total` suffix in their metric name. In
-//   the output, the suffix will be truncated from the `# TYPE` and `# HELP`
-//   line. A counter with a missing `_total` suffix is not an error. However,
-//   its type will be set to `unknown` in that case to avoid invalid OpenMetrics
-//   output.
+//   - Counters are expected to have the `_total` suffix in their metric name. In
+//     the output, the suffix will be truncated from the `# TYPE` and `# HELP`
+//     line. A counter with a missing `_total` suffix is not an error. However,
+//     its type will be set to `unknown` in that case to avoid invalid OpenMetrics
+//     output.
 //
-// - No support for the following (optional) features: `# UNIT` line, `_created`
-//   line, info type, stateset type, gaugehistogram type.
+//   - No support for the following (optional) features: `# UNIT` line, `_created`
+//     line, info type, stateset type, gaugehistogram type.
 //
-// - The size of exemplar labels is not checked (i.e. it's possible to create
-//   exemplars that are larger than allowed by the OpenMetrics specification).
+//   - The size of exemplar labels is not checked (i.e. it's possible to create
+//     exemplars that are larger than allowed by the OpenMetrics specification).
 //
-// - The value of Counters is not checked. (OpenMetrics doesn't allow counters
-//   with a `NaN` value.)
+//   - The value of Counters is not checked. (OpenMetrics doesn't allow counters
+//     with a `NaN` value.)
 func MetricFamilyToOpenMetrics(out io.Writer, in *dto.MetricFamily) (written int, err error) {
 	name := in.GetName()
 	if name == "" {
diff --git a/vendor/github.com/prometheus/common/expfmt/text_create.go b/vendor/github.com/prometheus/common/expfmt/text_create.go
index 5ba503b06547..2946b8f1a644 100644
--- a/vendor/github.com/prometheus/common/expfmt/text_create.go
+++ b/vendor/github.com/prometheus/common/expfmt/text_create.go
@@ -17,7 +17,6 @@ import (
 	"bufio"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math"
 	"strconv"
 	"strings"
@@ -44,7 +43,7 @@ const (
 var (
 	bufPool = sync.Pool{
 		New: func() interface{} {
-			return bufio.NewWriter(ioutil.Discard)
+			return bufio.NewWriter(io.Discard)
 		},
 	}
 	numBufPool = sync.Pool{
diff --git a/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go b/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go
index 26e92288c7c0..a21b9d15dd89 100644
--- a/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go
+++ b/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go
@@ -11,18 +11,18 @@ Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 
-    Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer.
+	Redistributions of source code must retain the above copyright
+	notice, this list of conditions and the following disclaimer.
 
-    Redistributions in binary form must reproduce the above copyright
-    notice, this list of conditions and the following disclaimer in
-    the documentation and/or other materials provided with the
-    distribution.
+	Redistributions in binary form must reproduce the above copyright
+	notice, this list of conditions and the following disclaimer in
+	the documentation and/or other materials provided with the
+	distribution.
 
-    Neither the name of the Open Knowledge Foundation Ltd. nor the
-    names of its contributors may be used to endorse or promote
-    products derived from this software without specific prior written
-    permission.
+	Neither the name of the Open Knowledge Foundation Ltd. nor the
+	names of its contributors may be used to endorse or promote
+	products derived from this software without specific prior written
+	permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
@@ -35,8 +35,6 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
 */
 package goautoneg
 
diff --git a/vendor/github.com/prometheus/common/version/info.go b/vendor/github.com/prometheus/common/version/info.go
index 3e2a7ee50e4b..b3da48a17d04 100644
--- a/vendor/github.com/prometheus/common/version/info.go
+++ b/vendor/github.com/prometheus/common/version/info.go
@@ -31,6 +31,8 @@ var (
 	BuildUser string
 	BuildDate string
 	GoVersion = runtime.Version()
+	GoOS      = runtime.GOOS
+	GoArch    = runtime.GOARCH
 )
 
 // NewCollector returns a collector that exports metrics about current version
@@ -41,14 +43,16 @@ func NewCollector(program string) prometheus.Collector {
 			Namespace: program,
 			Name:      "build_info",
 			Help: fmt.Sprintf(
-				"A metric with a constant '1' value labeled by version, revision, branch, and goversion from which %s was built.",
+				"A metric with a constant '1' value labeled by version, revision, branch, goversion from which %s was built, and the goos and goarch for the build.",
 				program,
 			),
 			ConstLabels: prometheus.Labels{
 				"version":   Version,
-				"revision":  Revision,
+				"revision":  getRevision(),
 				"branch":    Branch,
 				"goversion": GoVersion,
+				"goos":      GoOS,
+				"goarch":    GoArch,
 			},
 		},
 		func() float64 { return 1 },
@@ -69,12 +73,12 @@ func Print(program string) string {
 	m := map[string]string{
 		"program":   program,
 		"version":   Version,
-		"revision":  Revision,
+		"revision":  getRevision(),
 		"branch":    Branch,
 		"buildUser": BuildUser,
 		"buildDate": BuildDate,
 		"goVersion": GoVersion,
-		"platform":  runtime.GOOS + "/" + runtime.GOARCH,
+		"platform":  GoOS + "/" + GoArch,
 	}
 	t := template.Must(template.New("version").Parse(versionInfoTmpl))
 
@@ -87,10 +91,10 @@ func Print(program string) string {
 
 // Info returns version, branch and revision information.
 func Info() string {
-	return fmt.Sprintf("(version=%s, branch=%s, revision=%s)", Version, Branch, Revision)
+	return fmt.Sprintf("(version=%s, branch=%s, revision=%s)", Version, Branch, getRevision())
 }
 
-// BuildContext returns goVersion, buildUser and buildDate information.
+// BuildContext returns goVersion, platform, buildUser and buildDate information.
 func BuildContext() string {
-	return fmt.Sprintf("(go=%s, user=%s, date=%s)", GoVersion, BuildUser, BuildDate)
+	return fmt.Sprintf("(go=%s, platform=%s, user=%s, date=%s)", GoVersion, GoOS+"/"+GoArch, BuildUser, BuildDate)
 }
diff --git a/vendor/github.com/prometheus/common/version/info_default.go b/vendor/github.com/prometheus/common/version/info_default.go
new file mode 100644
index 000000000000..2ab0be009c26
--- /dev/null
+++ b/vendor/github.com/prometheus/common/version/info_default.go
@@ -0,0 +1,21 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !go1.18
+// +build !go1.18
+
+package version
+
+func getRevision() string {
+	return Revision
+}
diff --git a/vendor/github.com/prometheus/common/version/info_go118.go b/vendor/github.com/prometheus/common/version/info_go118.go
new file mode 100644
index 000000000000..bed0f4994297
--- /dev/null
+++ b/vendor/github.com/prometheus/common/version/info_go118.go
@@ -0,0 +1,58 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build go1.18
+// +build go1.18
+
+package version
+
+import "runtime/debug"
+
+var computedRevision string
+
+func getRevision() string {
+	if Revision != "" {
+		return Revision
+	}
+	return computedRevision
+}
+
+func init() {
+	computedRevision = computeRevision()
+}
+
+func computeRevision() string {
+	var (
+		rev      = "unknown"
+		modified bool
+	)
+
+	buildInfo, ok := debug.ReadBuildInfo()
+	if !ok {
+		return rev
+	}
+	for _, v := range buildInfo.Settings {
+		if v.Key == "vcs.revision" {
+			rev = v.Value
+		}
+		if v.Key == "vcs.modified" {
+			if v.Value == "true" {
+				modified = true
+			}
+		}
+	}
+	if modified {
+		return rev + "-modified"
+	}
+	return rev
+}
diff --git a/vendor/github.com/stretchr/testify/suite/doc.go b/vendor/github.com/stretchr/testify/suite/doc.go
new file mode 100644
index 000000000000..f91a245d3f8b
--- /dev/null
+++ b/vendor/github.com/stretchr/testify/suite/doc.go
@@ -0,0 +1,65 @@
+// Package suite contains logic for creating testing suite structs
+// and running the methods on those structs as tests.  The most useful
+// piece of this package is that you can create setup/teardown methods
+// on your testing suites, which will run before/after the whole suite
+// or individual tests (depending on which interface(s) you
+// implement).
+//
+// A testing suite is usually built by first extending the built-in
+// suite functionality from suite.Suite in testify.  Alternatively,
+// you could reproduce that logic on your own if you wanted (you
+// just need to implement the TestingSuite interface from
+// suite/interfaces.go).
+//
+// After that, you can implement any of the interfaces in
+// suite/interfaces.go to add setup/teardown functionality to your
+// suite, and add any methods that start with "Test" to add tests.
+// Methods that do not match any suite interfaces and do not begin
+// with "Test" will not be run by testify, and can safely be used as
+// helper methods.
+//
+// Once you've built your testing suite, you need to run the suite
+// (using suite.Run from testify) inside any function that matches the
+// identity that "go test" is already looking for (i.e.
+// func(*testing.T)).
+//
+// Regular expression to select test suites specified command-line
+// argument "-run". Regular expression to select the methods
+// of test suites specified command-line argument "-m".
+// Suite object has assertion methods.
+//
+// A crude example:
+//     // Basic imports
+//     import (
+//         "testing"
+//         "github.com/stretchr/testify/assert"
+//         "github.com/stretchr/testify/suite"
+//     )
+//
+//     // Define the suite, and absorb the built-in basic suite
+//     // functionality from testify - including a T() method which
+//     // returns the current testing context
+//     type ExampleTestSuite struct {
+//         suite.Suite
+//         VariableThatShouldStartAtFive int
+//     }
+//
+//     // Make sure that VariableThatShouldStartAtFive is set to five
+//     // before each test
+//     func (suite *ExampleTestSuite) SetupTest() {
+//         suite.VariableThatShouldStartAtFive = 5
+//     }
+//
+//     // All methods that begin with "Test" are run as tests within a
+//     // suite.
+//     func (suite *ExampleTestSuite) TestExample() {
+//         assert.Equal(suite.T(), 5, suite.VariableThatShouldStartAtFive)
+//         suite.Equal(5, suite.VariableThatShouldStartAtFive)
+//     }
+//
+//     // In order for 'go test' to run this suite, we need to create
+//     // a normal test function and pass our suite to suite.Run
+//     func TestExampleTestSuite(t *testing.T) {
+//         suite.Run(t, new(ExampleTestSuite))
+//     }
+package suite
diff --git a/vendor/github.com/stretchr/testify/suite/interfaces.go b/vendor/github.com/stretchr/testify/suite/interfaces.go
new file mode 100644
index 000000000000..8b98a8af275f
--- /dev/null
+++ b/vendor/github.com/stretchr/testify/suite/interfaces.go
@@ -0,0 +1,53 @@
+package suite
+
+import "testing"
+
+// TestingSuite can store and return the current *testing.T context
+// generated by 'go test'.
+type TestingSuite interface {
+	T() *testing.T
+	SetT(*testing.T)
+}
+
+// SetupAllSuite has a SetupSuite method, which will run before the
+// tests in the suite are run.
+type SetupAllSuite interface {
+	SetupSuite()
+}
+
+// SetupTestSuite has a SetupTest method, which will run before each
+// test in the suite.
+type SetupTestSuite interface {
+	SetupTest()
+}
+
+// TearDownAllSuite has a TearDownSuite method, which will run after
+// all the tests in the suite have been run.
+type TearDownAllSuite interface {
+	TearDownSuite()
+}
+
+// TearDownTestSuite has a TearDownTest method, which will run after
+// each test in the suite.
+type TearDownTestSuite interface {
+	TearDownTest()
+}
+
+// BeforeTest has a function to be executed right before the test
+// starts and receives the suite and test names as input
+type BeforeTest interface {
+	BeforeTest(suiteName, testName string)
+}
+
+// AfterTest has a function to be executed right after the test
+// finishes and receives the suite and test names as input
+type AfterTest interface {
+	AfterTest(suiteName, testName string)
+}
+
+// WithStats implements HandleStats, a function that will be executed
+// when a test suite is finished. The stats contain information about
+// the execution of that suite and its tests.
+type WithStats interface {
+	HandleStats(suiteName string, stats *SuiteInformation)
+}
diff --git a/vendor/github.com/stretchr/testify/suite/stats.go b/vendor/github.com/stretchr/testify/suite/stats.go
new file mode 100644
index 000000000000..261da37f78fb
--- /dev/null
+++ b/vendor/github.com/stretchr/testify/suite/stats.go
@@ -0,0 +1,46 @@
+package suite
+
+import "time"
+
+// SuiteInformation stats stores stats for the whole suite execution.
+type SuiteInformation struct {
+	Start, End time.Time
+	TestStats  map[string]*TestInformation
+}
+
+// TestInformation stores information about the execution of each test.
+type TestInformation struct {
+	TestName   string
+	Start, End time.Time
+	Passed     bool
+}
+
+func newSuiteInformation() *SuiteInformation {
+	testStats := make(map[string]*TestInformation)
+
+	return &SuiteInformation{
+		TestStats: testStats,
+	}
+}
+
+func (s SuiteInformation) start(testName string) {
+	s.TestStats[testName] = &TestInformation{
+		TestName: testName,
+		Start:    time.Now(),
+	}
+}
+
+func (s SuiteInformation) end(testName string, passed bool) {
+	s.TestStats[testName].End = time.Now()
+	s.TestStats[testName].Passed = passed
+}
+
+func (s SuiteInformation) Passed() bool {
+	for _, stats := range s.TestStats {
+		if !stats.Passed {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/vendor/github.com/stretchr/testify/suite/suite.go b/vendor/github.com/stretchr/testify/suite/suite.go
new file mode 100644
index 000000000000..895591878bf7
--- /dev/null
+++ b/vendor/github.com/stretchr/testify/suite/suite.go
@@ -0,0 +1,226 @@
+package suite
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"reflect"
+	"regexp"
+	"runtime/debug"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var allTestsFilter = func(_, _ string) (bool, error) { return true, nil }
+var matchMethod = flag.String("testify.m", "", "regular expression to select tests of the testify suite to run")
+
+// Suite is a basic testing suite with methods for storing and
+// retrieving the current *testing.T context.
+type Suite struct {
+	*assert.Assertions
+	mu      sync.RWMutex
+	require *require.Assertions
+	t       *testing.T
+}
+
+// T retrieves the current *testing.T context.
+func (suite *Suite) T() *testing.T {
+	suite.mu.RLock()
+	defer suite.mu.RUnlock()
+	return suite.t
+}
+
+// SetT sets the current *testing.T context.
+func (suite *Suite) SetT(t *testing.T) {
+	suite.mu.Lock()
+	defer suite.mu.Unlock()
+	suite.t = t
+	suite.Assertions = assert.New(t)
+	suite.require = require.New(t)
+}
+
+// Require returns a require context for suite.
+func (suite *Suite) Require() *require.Assertions {
+	suite.mu.Lock()
+	defer suite.mu.Unlock()
+	if suite.require == nil {
+		suite.require = require.New(suite.T())
+	}
+	return suite.require
+}
+
+// Assert returns an assert context for suite.  Normally, you can call
+// `suite.NoError(expected, actual)`, but for situations where the embedded
+// methods are overridden (for example, you might want to override
+// assert.Assertions with require.Assertions), this method is provided so you
+// can call `suite.Assert().NoError()`.
+func (suite *Suite) Assert() *assert.Assertions {
+	suite.mu.Lock()
+	defer suite.mu.Unlock()
+	if suite.Assertions == nil {
+		suite.Assertions = assert.New(suite.T())
+	}
+	return suite.Assertions
+}
+
+func recoverAndFailOnPanic(t *testing.T) {
+	r := recover()
+	failOnPanic(t, r)
+}
+
+func failOnPanic(t *testing.T, r interface{}) {
+	if r != nil {
+		t.Errorf("test panicked: %v\n%s", r, debug.Stack())
+		t.FailNow()
+	}
+}
+
+// Run provides suite functionality around golang subtests.  It should be
+// called in place of t.Run(name, func(t *testing.T)) in test suite code.
+// The passed-in func will be executed as a subtest with a fresh instance of t.
+// Provides compatibility with go test pkg -run TestSuite/TestName/SubTestName.
+func (suite *Suite) Run(name string, subtest func()) bool {
+	oldT := suite.T()
+	defer suite.SetT(oldT)
+	return oldT.Run(name, func(t *testing.T) {
+		suite.SetT(t)
+		subtest()
+	})
+}
+
+// Run takes a testing suite and runs all of the tests attached
+// to it.
+func Run(t *testing.T, suite TestingSuite) {
+	defer recoverAndFailOnPanic(t)
+
+	suite.SetT(t)
+
+	var suiteSetupDone bool
+
+	var stats *SuiteInformation
+	if _, ok := suite.(WithStats); ok {
+		stats = newSuiteInformation()
+	}
+
+	tests := []testing.InternalTest{}
+	methodFinder := reflect.TypeOf(suite)
+	suiteName := methodFinder.Elem().Name()
+
+	for i := 0; i < methodFinder.NumMethod(); i++ {
+		method := methodFinder.Method(i)
+
+		ok, err := methodFilter(method.Name)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "testify: invalid regexp for -m: %s\n", err)
+			os.Exit(1)
+		}
+
+		if !ok {
+			continue
+		}
+
+		if !suiteSetupDone {
+			if stats != nil {
+				stats.Start = time.Now()
+			}
+
+			if setupAllSuite, ok := suite.(SetupAllSuite); ok {
+				setupAllSuite.SetupSuite()
+			}
+
+			suiteSetupDone = true
+		}
+
+		test := testing.InternalTest{
+			Name: method.Name,
+			F: func(t *testing.T) {
+				parentT := suite.T()
+				suite.SetT(t)
+				defer recoverAndFailOnPanic(t)
+				defer func() {
+					r := recover()
+
+					if stats != nil {
+						passed := !t.Failed() && r == nil
+						stats.end(method.Name, passed)
+					}
+
+					if afterTestSuite, ok := suite.(AfterTest); ok {
+						afterTestSuite.AfterTest(suiteName, method.Name)
+					}
+
+					if tearDownTestSuite, ok := suite.(TearDownTestSuite); ok {
+						tearDownTestSuite.TearDownTest()
+					}
+
+					suite.SetT(parentT)
+					failOnPanic(t, r)
+				}()
+
+				if setupTestSuite, ok := suite.(SetupTestSuite); ok {
+					setupTestSuite.SetupTest()
+				}
+				if beforeTestSuite, ok := suite.(BeforeTest); ok {
+					beforeTestSuite.BeforeTest(methodFinder.Elem().Name(), method.Name)
+				}
+
+				if stats != nil {
+					stats.start(method.Name)
+				}
+
+				method.Func.Call([]reflect.Value{reflect.ValueOf(suite)})
+			},
+		}
+		tests = append(tests, test)
+	}
+	if suiteSetupDone {
+		defer func() {
+			if tearDownAllSuite, ok := suite.(TearDownAllSuite); ok {
+				tearDownAllSuite.TearDownSuite()
+			}
+
+			if suiteWithStats, measureStats := suite.(WithStats); measureStats {
+				stats.End = time.Now()
+				suiteWithStats.HandleStats(suiteName, stats)
+			}
+		}()
+	}
+
+	runTests(t, tests)
+}
+
+// Filtering method according to set regular expression
+// specified command-line argument -m
+func methodFilter(name string) (bool, error) {
+	if ok, _ := regexp.MatchString("^Test", name); !ok {
+		return false, nil
+	}
+	return regexp.MatchString(*matchMethod, name)
+}
+
+func runTests(t testing.TB, tests []testing.InternalTest) {
+	if len(tests) == 0 {
+		t.Log("warning: no tests to run")
+		return
+	}
+
+	r, ok := t.(runner)
+	if !ok { // backwards compatibility with Go 1.6 and below
+		if !testing.RunTests(allTestsFilter, tests) {
+			t.Fail()
+		}
+		return
+	}
+
+	for _, test := range tests {
+		r.Run(test.Name, test.F)
+	}
+}
+
+type runner interface {
+	Run(name string, f func(t *testing.T)) bool
+}
diff --git a/vendor/github.com/yuin/gopher-lua/README.rst b/vendor/github.com/yuin/gopher-lua/README.rst
index b479e46357eb..2b6de3259ac5 100644
--- a/vendor/github.com/yuin/gopher-lua/README.rst
+++ b/vendor/github.com/yuin/gopher-lua/README.rst
@@ -870,6 +870,7 @@ Libraries for GopherLua
 - `gluaperiphery <https://github.com/BixData/gluaperiphery>`_ : A periphery library for the GopherLua VM (GPIO, SPI, I2C, MMIO, and Serial peripheral I/O for Linux).
 - `glua-async <https://github.com/CuberL/glua-async>`_ : An async/await implement for gopher-lua.
 - `gopherlua-debugger <https://github.com/edolphin-ydf/gopherlua-debugger>`_ : A debugger for gopher-lua
+- `gluamahonia <https://github.com/super1207/gluamahonia>`_ : An encoding converter for gopher-lua
 ----------------------------------------------------------------
 Donation
 ----------------------------------------------------------------
diff --git a/vendor/github.com/yuin/gopher-lua/_vm.go b/vendor/github.com/yuin/gopher-lua/_vm.go
index 874ed9aa4a72..049107e17744 100644
--- a/vendor/github.com/yuin/gopher-lua/_vm.go
+++ b/vendor/github.com/yuin/gopher-lua/_vm.go
@@ -415,7 +415,7 @@ func init() {
 					if ret.Type() == LTNumber {
 						reg.SetNumber(RA, ret.(LNumber))
 					} else {
-						reg.SetNumber(RA, LNumber(0))
+						reg.Set(RA, ret)
 					}
 				} else if lv.Type() == LTTable {
 					reg.SetNumber(RA, LNumber(lv.(*LTable).Len()))
diff --git a/vendor/github.com/yuin/gopher-lua/ast/expr.go b/vendor/github.com/yuin/gopher-lua/ast/expr.go
index ccda3279101f..388852bab367 100644
--- a/vendor/github.com/yuin/gopher-lua/ast/expr.go
+++ b/vendor/github.com/yuin/gopher-lua/ast/expr.go
@@ -52,6 +52,7 @@ type StringExpr struct {
 
 type Comma3Expr struct {
 	ExprBase
+	AdjustRet bool
 }
 
 type IdentExpr struct {
diff --git a/vendor/github.com/yuin/gopher-lua/baselib.go b/vendor/github.com/yuin/gopher-lua/baselib.go
index 06c90619eef5..aa2c08a94197 100644
--- a/vendor/github.com/yuin/gopher-lua/baselib.go
+++ b/vendor/github.com/yuin/gopher-lua/baselib.go
@@ -260,7 +260,7 @@ func basePairs(L *LState) int {
 func basePCall(L *LState) int {
 	L.CheckAny(1)
 	v := L.Get(1)
-	if v.Type() != LTFunction {
+	if v.Type() != LTFunction && L.GetMetaField(v, "__call").Type() != LTFunction {
 		L.Push(LFalse)
 		L.Push(LString("attempt to call a " + v.Type().String() + " value"))
 		return 2
@@ -321,11 +321,16 @@ func baseSelect(L *LState) int {
 	switch lv := L.Get(1).(type) {
 	case LNumber:
 		idx := int(lv)
-		num := L.reg.Top() - L.indexToReg(int(lv)) - 1
+		num := L.GetTop()
 		if idx < 0 {
-			num++
+			idx = num + idx
+		} else if idx > num {
+			idx = num
 		}
-		return num
+		if 1 > idx {
+			L.ArgError(1, "index out of range")
+		}
+		return num - idx
 	case LString:
 		if string(lv) != "#" {
 			L.ArgError(1, "invalid string '"+string(lv)+"'")
diff --git a/vendor/github.com/yuin/gopher-lua/compile.go b/vendor/github.com/yuin/gopher-lua/compile.go
index d3c665ae57c2..75c75550e42a 100644
--- a/vendor/github.com/yuin/gopher-lua/compile.go
+++ b/vendor/github.com/yuin/gopher-lua/compile.go
@@ -114,7 +114,7 @@ func isVarArgReturnExpr(expr ast.Expr) bool {
 	case *ast.FuncCallExpr:
 		return !ex.AdjustRet
 	case *ast.Comma3Expr:
-		return true
+		return !ex.AdjustRet
 	}
 	return false
 }
@@ -723,8 +723,12 @@ func compileReturnStmt(context *funcContext, stmt *ast.ReturnStmt) { // {{{
 				return
 			}
 		case *ast.FuncCallExpr:
-			reg += compileExpr(context, reg, ex, ecnone(-2))
-			code.SetOpCode(code.LastPC(), OP_TAILCALL)
+			if ex.AdjustRet { // return (func())
+				reg += compileExpr(context, reg, ex, ecnone(0))
+			} else {
+				reg += compileExpr(context, reg, ex, ecnone(-2))
+				code.SetOpCode(code.LastPC(), OP_TAILCALL)
+			}
 			code.AddABC(OP_RETURN, a, 0, 0, sline(stmt))
 			return
 		}
diff --git a/vendor/github.com/yuin/gopher-lua/config.go b/vendor/github.com/yuin/gopher-lua/config.go
index f58b59393a5c..d632188953bf 100644
--- a/vendor/github.com/yuin/gopher-lua/config.go
+++ b/vendor/github.com/yuin/gopher-lua/config.go
@@ -22,15 +22,22 @@ var LuaPath = "LUA_PATH"
 var LuaLDir string
 var LuaPathDefault string
 var LuaOS string
+var LuaDirSep string
+var LuaPathSep = ";"
+var LuaPathMark = "?"
+var LuaExecDir = "!"
+var LuaIgMark = "-"
 
 func init() {
 	if os.PathSeparator == '/' { // unix-like
 		LuaOS = "unix"
 		LuaLDir = "/usr/local/share/lua/5.1"
+		LuaDirSep = "/"
 		LuaPathDefault = "./?.lua;" + LuaLDir + "/?.lua;" + LuaLDir + "/?/init.lua"
 	} else { // windows
 		LuaOS = "windows"
 		LuaLDir = "!\\lua"
+		LuaDirSep = "\\"
 		LuaPathDefault = ".\\?.lua;" + LuaLDir + "\\?.lua;" + LuaLDir + "\\?\\init.lua"
 	}
 }
diff --git a/vendor/github.com/yuin/gopher-lua/loadlib.go b/vendor/github.com/yuin/gopher-lua/loadlib.go
index 772bb04ad880..40ce122b8fec 100644
--- a/vendor/github.com/yuin/gopher-lua/loadlib.go
+++ b/vendor/github.com/yuin/gopher-lua/loadlib.go
@@ -65,6 +65,9 @@ func OpenPackage(L *LState) int {
 	L.SetField(packagemod, "path", LString(loGetPath(LuaPath, LuaPathDefault)))
 	L.SetField(packagemod, "cpath", emptyLString)
 
+	L.SetField(packagemod, "config", LString(LuaDirSep+"\n"+LuaPathSep+
+		"\n"+LuaPathMark+"\n"+LuaExecDir+"\n"+LuaIgMark+"\n"))
+
 	L.Push(packagemod)
 	return 1
 }
diff --git a/vendor/github.com/yuin/gopher-lua/oslib.go b/vendor/github.com/yuin/gopher-lua/oslib.go
index c70a99bf136b..256c88113003 100644
--- a/vendor/github.com/yuin/gopher-lua/oslib.go
+++ b/vendor/github.com/yuin/gopher-lua/oslib.go
@@ -25,6 +25,9 @@ func getIntField(L *LState, tb *LTable, key string, v int) int {
 		if strings.HasPrefix(slv, "0") && !strings.HasPrefix(slv, "0x") && !strings.HasPrefix(slv, "0X") {
 			//Standard lua interpreter only support decimal and hexadecimal
 			slv = strings.TrimLeft(slv, "0")
+			if slv == "" {
+				return 0
+			}
 		}
 		if num, err := parseNumber(slv); err == nil {
 			return int(num)
@@ -189,20 +192,28 @@ func osTime(L *LState) int {
 	if L.GetTop() == 0 {
 		L.Push(LNumber(time.Now().Unix()))
 	} else {
-		tbl := L.CheckTable(1)
-		sec := getIntField(L, tbl, "sec", 0)
-		min := getIntField(L, tbl, "min", 0)
-		hour := getIntField(L, tbl, "hour", 12)
-		day := getIntField(L, tbl, "day", -1)
-		month := getIntField(L, tbl, "month", -1)
-		year := getIntField(L, tbl, "year", -1)
-		isdst := getBoolField(L, tbl, "isdst", false)
-		t := time.Date(year, time.Month(month), day, hour, min, sec, 0, time.Local)
-		// TODO dst
-		if false {
-			print(isdst)
+		lv := L.CheckAny(1)
+		if lv == LNil {
+			L.Push(LNumber(time.Now().Unix()))
+		} else {
+			tbl, ok := lv.(*LTable)
+			if !ok {
+				L.TypeError(1, LTTable)
+			}
+			sec := getIntField(L, tbl, "sec", 0)
+			min := getIntField(L, tbl, "min", 0)
+			hour := getIntField(L, tbl, "hour", 12)
+			day := getIntField(L, tbl, "day", -1)
+			month := getIntField(L, tbl, "month", -1)
+			year := getIntField(L, tbl, "year", -1)
+			isdst := getBoolField(L, tbl, "isdst", false)
+			t := time.Date(year, time.Month(month), day, hour, min, sec, 0, time.Local)
+			// TODO dst
+			if false {
+				print(isdst)
+			}
+			L.Push(LNumber(t.Unix()))
 		}
-		L.Push(LNumber(t.Unix()))
 	}
 	return 1
 }
diff --git a/vendor/github.com/yuin/gopher-lua/parse/Makefile b/vendor/github.com/yuin/gopher-lua/parse/Makefile
index 6dd048c165ff..9838b1393b93 100644
--- a/vendor/github.com/yuin/gopher-lua/parse/Makefile
+++ b/vendor/github.com/yuin/gopher-lua/parse/Makefile
@@ -2,3 +2,6 @@ all : parser.go
 
 parser.go : parser.go.y
 	goyacc -o $@ parser.go.y; [ -f y.output ] && ( rm -f y.output )
+
+clean:
+	rm -f parser.go
diff --git a/vendor/github.com/yuin/gopher-lua/parse/lexer.go b/vendor/github.com/yuin/gopher-lua/parse/lexer.go
index d711e78bc192..6ad57ceed7da 100644
--- a/vendor/github.com/yuin/gopher-lua/parse/lexer.go
+++ b/vendor/github.com/yuin/gopher-lua/parse/lexer.go
@@ -255,7 +255,7 @@ func (sc *Scanner) scanMultilineString(ch int, buf *bytes.Buffer) error {
 	var count1, count2 int
 	count1, ch = sc.countSep(ch)
 	if ch != '[' {
-		return sc.Error(string(ch), "invalid multiline string")
+		return sc.Error(string(rune(ch)), "invalid multiline string")
 	}
 	ch = sc.Next()
 	if ch == '\n' || ch == '\r' {
@@ -338,7 +338,7 @@ redo:
 				goto redo
 			} else {
 				tok.Type = ch
-				tok.Str = string(ch)
+				tok.Str = string(rune(ch))
 			}
 		case '"', '\'':
 			tok.Type = TString
@@ -351,7 +351,7 @@ redo:
 				tok.Str = buf.String()
 			} else {
 				tok.Type = ch
-				tok.Str = string(ch)
+				tok.Str = string(rune(ch))
 			}
 		case '=':
 			if sc.Peek() == '=' {
@@ -360,7 +360,7 @@ redo:
 				sc.Next()
 			} else {
 				tok.Type = ch
-				tok.Str = string(ch)
+				tok.Str = string(rune(ch))
 			}
 		case '~':
 			if sc.Peek() == '=' {
@@ -377,7 +377,7 @@ redo:
 				sc.Next()
 			} else {
 				tok.Type = ch
-				tok.Str = string(ch)
+				tok.Str = string(rune(ch))
 			}
 		case '>':
 			if sc.Peek() == '=' {
@@ -386,7 +386,7 @@ redo:
 				sc.Next()
 			} else {
 				tok.Type = ch
-				tok.Str = string(ch)
+				tok.Str = string(rune(ch))
 			}
 		case '.':
 			ch2 := sc.Peek()
@@ -410,7 +410,7 @@ redo:
 			tok.Str = buf.String()
 		case '+', '*', '/', '%', '^', '#', '(', ')', '{', '}', ']', ';', ':', ',':
 			tok.Type = ch
-			tok.Str = string(ch)
+			tok.Str = string(rune(ch))
 		default:
 			writeChar(buf, ch)
 			err = sc.Error(buf.String(), "Invalid token")
diff --git a/vendor/github.com/yuin/gopher-lua/parse/parser.go b/vendor/github.com/yuin/gopher-lua/parse/parser.go
index f8f59b36154c..c75658164900 100644
--- a/vendor/github.com/yuin/gopher-lua/parse/parser.go
+++ b/vendor/github.com/yuin/gopher-lua/parse/parser.go
@@ -1,9 +1,12 @@
+// Code generated by goyacc -o parser.go parser.go.y. DO NOT EDIT.
+
 //line parser.go.y:2
 package parse
 
 import __yyfmt__ "fmt"
 
 //line parser.go.y:2
+
 import (
 	"github.com/yuin/gopher-lua/ast"
 )
@@ -62,7 +65,10 @@ const TNumber = 57374
 const TString = 57375
 const UNARY = 57376
 
-var yyToknames = []string{
+var yyToknames = [...]string{
+	"$end",
+	"error",
+	"$unk",
 	"TAnd",
 	"TBreak",
 	"TDo",
@@ -93,25 +99,37 @@ var yyToknames = []string{
 	"TIdent",
 	"TNumber",
 	"TString",
-	" {",
-	" (",
-	" >",
-	" <",
-	" +",
-	" -",
-	" *",
-	" /",
-	" %",
+	"'{'",
+	"'('",
+	"'>'",
+	"'<'",
+	"'+'",
+	"'-'",
+	"'*'",
+	"'/'",
+	"'%'",
 	"UNARY",
-	" ^",
+	"'^'",
+	"';'",
+	"'='",
+	"','",
+	"':'",
+	"'.'",
+	"'['",
+	"']'",
+	"'#'",
+	"')'",
+	"'}'",
 }
-var yyStatenames = []string{}
+
+var yyStatenames = [...]string{}
 
 const yyEofCode = 1
 const yyErrCode = 2
-const yyMaxDepth = 200
+const yyInitialStackSize = 16
+
+//line parser.go.y:517
 
-//line parser.go.y:514
 func TokenName(c int) string {
 	if c >= TAnd && c-TAnd < len(yyToknames) {
 		if yyToknames[c-TAnd] != "" {
@@ -122,7 +140,7 @@ func TokenName(c int) string {
 }
 
 //line yacctab:1
-var yyExca = []int{
+var yyExca = [...]int8{
 	-1, 1,
 	1, -1,
 	-2, 0,
@@ -136,16 +154,11 @@ var yyExca = []int{
 	-2, 68,
 }
 
-const yyNprod = 95
 const yyPrivate = 57344
 
-var yyTokenNames []string
-var yyStates []string
-
 const yyLast = 579
 
-var yyAct = []int{
-
+var yyAct = [...]uint8{
 	24, 88, 50, 23, 45, 84, 56, 65, 137, 153,
 	136, 113, 52, 142, 54, 53, 33, 134, 65, 132,
 	62, 63, 32, 61, 108, 109, 48, 111, 106, 41,
@@ -205,8 +218,8 @@ var yyAct = []int{
 	0, 0, 0, 0, 21, 0, 0, 0, 20, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 5,
 }
-var yyPact = []int{
 
+var yyPact = [...]int16{
 	-1000, -1000, 533, -5, -1000, -1000, 292, -1000, -17, 152,
 	-1000, 292, -1000, 292, 107, 97, 88, -1000, -1000, -1000,
 	292, -1000, -1000, -29, 473, -1000, -1000, -1000, -1000, -1000,
@@ -227,14 +240,14 @@ var yyPact = []int{
 	311, 151, -1000, 473, 146, 392, -1000, 292, -1000, -1000,
 	-1000, 144, 365, -1000, -1000, -1000, 140, -1000,
 }
-var yyPgo = []int{
 
+var yyPgo = [...]uint8{
 	0, 190, 227, 2, 226, 223, 215, 210, 204, 203,
 	118, 6, 3, 0, 22, 107, 168, 199, 4, 197,
 	5, 195, 16, 193, 1, 182,
 }
-var yyR1 = []int{
 
+var yyR1 = [...]int8{
 	0, 1, 1, 1, 2, 2, 2, 3, 4, 4,
 	4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
 	4, 4, 5, 5, 6, 6, 6, 7, 7, 8,
@@ -246,8 +259,8 @@ var yyR1 = []int{
 	20, 20, 21, 21, 21, 22, 22, 23, 23, 23,
 	24, 24, 24, 25, 25,
 }
-var yyR2 = []int{
 
+var yyR2 = [...]int8{
 	0, 1, 2, 3, 0, 2, 2, 1, 3, 1,
 	3, 5, 4, 6, 8, 9, 11, 7, 3, 4,
 	4, 2, 0, 5, 1, 2, 1, 1, 3, 1,
@@ -259,8 +272,8 @@ var yyR2 = []int{
 	5, 4, 1, 1, 3, 2, 3, 1, 3, 2,
 	3, 5, 1, 1, 1,
 }
-var yyChk = []int{
 
+var yyChk = [...]int16{
 	-1000, -1, -2, -6, -4, 45, 19, 5, -9, -15,
 	6, 24, 20, 13, 11, 12, 15, -10, -17, -16,
 	35, 31, 45, -12, -13, 16, 10, 22, 32, 30,
@@ -281,8 +294,8 @@ var yyChk = []int{
 	-13, -3, 9, -13, -3, -13, 6, 47, 9, 9,
 	21, -3, -13, -3, 9, 6, -3, 9,
 }
-var yyDef = []int{
 
+var yyDef = [...]int8{
 	4, -2, 1, 2, 5, 6, 24, 26, 0, 9,
 	4, 0, 4, 0, 0, 0, 0, -2, 69, 70,
 	0, 33, 3, 25, 38, 40, 41, 42, 43, 44,
@@ -303,8 +316,8 @@ var yyDef = []int{
 	0, 0, 80, 91, 0, 0, 4, 0, 17, 14,
 	4, 0, 0, 23, 15, 4, 0, 16,
 }
-var yyTok1 = []int{
 
+var yyTok1 = [...]int8{
 	1, 3, 3, 3, 3, 3, 3, 3, 3, 3,
 	3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
 	3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
@@ -319,35 +332,63 @@ var yyTok1 = []int{
 	3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
 	3, 3, 3, 34, 3, 54,
 }
-var yyTok2 = []int{
 
+var yyTok2 = [...]int8{
 	2, 3, 4, 5, 6, 7, 8, 9, 10, 11,
 	12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
 	22, 23, 24, 25, 26, 27, 28, 29, 30, 31,
 	32, 33, 43,
 }
-var yyTok3 = []int{
+
+var yyTok3 = [...]int8{
 	0,
 }
 
+var yyErrorMessages = [...]struct {
+	state int
+	token int
+	msg   string
+}{}
+
 //line yaccpar:1
 
 /*	parser for yacc output	*/
 
-var yyDebug = 0
+var (
+	yyDebug        = 0
+	yyErrorVerbose = false
+)
 
 type yyLexer interface {
 	Lex(lval *yySymType) int
 	Error(s string)
 }
 
+type yyParser interface {
+	Parse(yyLexer) int
+	Lookahead() int
+}
+
+type yyParserImpl struct {
+	lval  yySymType
+	stack [yyInitialStackSize]yySymType
+	char  int
+}
+
+func (p *yyParserImpl) Lookahead() int {
+	return p.char
+}
+
+func yyNewParser() yyParser {
+	return &yyParserImpl{}
+}
+
 const yyFlag = -1000
 
 func yyTokname(c int) string {
-	// 4 is TOKSTART above
-	if c >= 4 && c-4 < len(yyToknames) {
-		if yyToknames[c-4] != "" {
-			return yyToknames[c-4]
+	if c >= 1 && c-1 < len(yyToknames) {
+		if yyToknames[c-1] != "" {
+			return yyToknames[c-1]
 		}
 	}
 	return __yyfmt__.Sprintf("tok-%v", c)
@@ -362,51 +403,127 @@ func yyStatname(s int) string {
 	return __yyfmt__.Sprintf("state-%v", s)
 }
 
-func yylex1(lex yyLexer, lval *yySymType) int {
-	c := 0
-	char := lex.Lex(lval)
+func yyErrorMessage(state, lookAhead int) string {
+	const TOKSTART = 4
+
+	if !yyErrorVerbose {
+		return "syntax error"
+	}
+
+	for _, e := range yyErrorMessages {
+		if e.state == state && e.token == lookAhead {
+			return "syntax error: " + e.msg
+		}
+	}
+
+	res := "syntax error: unexpected " + yyTokname(lookAhead)
+
+	// To match Bison, suggest at most four expected tokens.
+	expected := make([]int, 0, 4)
+
+	// Look for shiftable tokens.
+	base := int(yyPact[state])
+	for tok := TOKSTART; tok-1 < len(yyToknames); tok++ {
+		if n := base + tok; n >= 0 && n < yyLast && int(yyChk[int(yyAct[n])]) == tok {
+			if len(expected) == cap(expected) {
+				return res
+			}
+			expected = append(expected, tok)
+		}
+	}
+
+	if yyDef[state] == -2 {
+		i := 0
+		for yyExca[i] != -1 || int(yyExca[i+1]) != state {
+			i += 2
+		}
+
+		// Look for tokens that we accept or reduce.
+		for i += 2; yyExca[i] >= 0; i += 2 {
+			tok := int(yyExca[i])
+			if tok < TOKSTART || yyExca[i+1] == 0 {
+				continue
+			}
+			if len(expected) == cap(expected) {
+				return res
+			}
+			expected = append(expected, tok)
+		}
+
+		// If the default action is to accept or reduce, give up.
+		if yyExca[i+1] != 0 {
+			return res
+		}
+	}
+
+	for i, tok := range expected {
+		if i == 0 {
+			res += ", expecting "
+		} else {
+			res += " or "
+		}
+		res += yyTokname(tok)
+	}
+	return res
+}
+
+func yylex1(lex yyLexer, lval *yySymType) (char, token int) {
+	token = 0
+	char = lex.Lex(lval)
 	if char <= 0 {
-		c = yyTok1[0]
+		token = int(yyTok1[0])
 		goto out
 	}
 	if char < len(yyTok1) {
-		c = yyTok1[char]
+		token = int(yyTok1[char])
 		goto out
 	}
 	if char >= yyPrivate {
 		if char < yyPrivate+len(yyTok2) {
-			c = yyTok2[char-yyPrivate]
+			token = int(yyTok2[char-yyPrivate])
 			goto out
 		}
 	}
 	for i := 0; i < len(yyTok3); i += 2 {
-		c = yyTok3[i+0]
-		if c == char {
-			c = yyTok3[i+1]
+		token = int(yyTok3[i+0])
+		if token == char {
+			token = int(yyTok3[i+1])
 			goto out
 		}
 	}
 
 out:
-	if c == 0 {
-		c = yyTok2[1] /* unknown char */
+	if token == 0 {
+		token = int(yyTok2[1]) /* unknown char */
 	}
 	if yyDebug >= 3 {
-		__yyfmt__.Printf("lex %s(%d)\n", yyTokname(c), uint(char))
+		__yyfmt__.Printf("lex %s(%d)\n", yyTokname(token), uint(char))
 	}
-	return c
+	return char, token
 }
 
 func yyParse(yylex yyLexer) int {
+	return yyNewParser().Parse(yylex)
+}
+
+func (yyrcvr *yyParserImpl) Parse(yylex yyLexer) int {
 	var yyn int
-	var yylval yySymType
 	var yyVAL yySymType
-	yyS := make([]yySymType, yyMaxDepth)
+	var yyDollar []yySymType
+	_ = yyDollar // silence set and not used
+	yyS := yyrcvr.stack[:]
 
 	Nerrs := 0   /* number of errors */
 	Errflag := 0 /* error recovery flag */
 	yystate := 0
-	yychar := -1
+	yyrcvr.char = -1
+	yytoken := -1 // yyrcvr.char translated into internal numbering
+	defer func() {
+		// Make sure we report no lookahead when not parsing.
+		yystate = -1
+		yyrcvr.char = -1
+		yytoken = -1
+	}()
 	yyp := -1
 	goto yystack
 
@@ -419,7 +536,7 @@ ret1:
 yystack:
 	/* put a state and value onto the stack */
 	if yyDebug >= 4 {
-		__yyfmt__.Printf("char %v in %v\n", yyTokname(yychar), yyStatname(yystate))
+		__yyfmt__.Printf("char %v in %v\n", yyTokname(yytoken), yyStatname(yystate))
 	}
 
 	yyp++
@@ -432,21 +549,22 @@ yystack:
 	yyS[yyp].yys = yystate
 
 yynewstate:
-	yyn = yyPact[yystate]
+	yyn = int(yyPact[yystate])
 	if yyn <= yyFlag {
 		goto yydefault /* simple state */
 	}
-	if yychar < 0 {
-		yychar = yylex1(yylex, &yylval)
+	if yyrcvr.char < 0 {
+		yyrcvr.char, yytoken = yylex1(yylex, &yyrcvr.lval)
 	}
-	yyn += yychar
+	yyn += yytoken
 	if yyn < 0 || yyn >= yyLast {
 		goto yydefault
 	}
-	yyn = yyAct[yyn]
-	if yyChk[yyn] == yychar { /* valid shift */
-		yychar = -1
-		yyVAL = yylval
+	yyn = int(yyAct[yyn])
+	if int(yyChk[yyn]) == yytoken { /* valid shift */
+		yyrcvr.char = -1
+		yytoken = -1
+		yyVAL = yyrcvr.lval
 		yystate = yyn
 		if Errflag > 0 {
 			Errflag--
@@ -456,27 +574,27 @@ yynewstate:
 
 yydefault:
 	/* default state action */
-	yyn = yyDef[yystate]
+	yyn = int(yyDef[yystate])
 	if yyn == -2 {
-		if yychar < 0 {
-			yychar = yylex1(yylex, &yylval)
+		if yyrcvr.char < 0 {
+			yyrcvr.char, yytoken = yylex1(yylex, &yyrcvr.lval)
 		}
 
 		/* look through exception table */
 		xi := 0
 		for {
-			if yyExca[xi+0] == -1 && yyExca[xi+1] == yystate {
+			if yyExca[xi+0] == -1 && int(yyExca[xi+1]) == yystate {
 				break
 			}
 			xi += 2
 		}
 		for xi += 2; ; xi += 2 {
-			yyn = yyExca[xi+0]
-			if yyn < 0 || yyn == yychar {
+			yyn = int(yyExca[xi+0])
+			if yyn < 0 || yyn == yytoken {
 				break
 			}
 		}
-		yyn = yyExca[xi+1]
+		yyn = int(yyExca[xi+1])
 		if yyn < 0 {
 			goto ret0
 		}
@@ -485,11 +603,11 @@ yydefault:
 		/* error ... attempt to resume parsing */
 		switch Errflag {
 		case 0: /* brand new error */
-			yylex.Error("syntax error")
+			yylex.Error(yyErrorMessage(yystate, yytoken))
 			Nerrs++
 			if yyDebug >= 1 {
 				__yyfmt__.Printf("%s", yyStatname(yystate))
-				__yyfmt__.Printf(" saw %s\n", yyTokname(yychar))
+				__yyfmt__.Printf(" saw %s\n", yyTokname(yytoken))
 			}
 			fallthrough
 
@@ -498,10 +616,10 @@ yydefault:
 
 			/* find a state where "error" is a legal shift action */
 			for yyp >= 0 {
-				yyn = yyPact[yyS[yyp].yys] + yyErrCode
+				yyn = int(yyPact[yyS[yyp].yys]) + yyErrCode
 				if yyn >= 0 && yyn < yyLast {
-					yystate = yyAct[yyn] /* simulate a shift of "error" */
-					if yyChk[yystate] == yyErrCode {
+					yystate = int(yyAct[yyn]) /* simulate a shift of "error" */
+					if int(yyChk[yystate]) == yyErrCode {
 						goto yystack
 					}
 				}
@@ -517,12 +635,13 @@ yydefault:
 
 		case 3: /* no shift yet; clobber input char */
 			if yyDebug >= 2 {
-				__yyfmt__.Printf("error recovery discards %s\n", yyTokname(yychar))
+				__yyfmt__.Printf("error recovery discards %s\n", yyTokname(yytoken))
 			}
-			if yychar == yyEofCode {
+			if yytoken == yyEofCode {
 				goto ret1
 			}
-			yychar = -1
+			yyrcvr.char = -1
+			yytoken = -1
 			goto yynewstate /* try again in the same state */
 		}
 	}
@@ -536,599 +655,703 @@ yydefault:
 	yypt := yyp
 	_ = yypt // guard against "declared and not used"
 
-	yyp -= yyR2[yyn]
+	yyp -= int(yyR2[yyn])
+	// yyp is now the index of $0. Perform the default action. Iff the
+	// reduced production is ε, $1 is possibly out of range.
+	if yyp+1 >= len(yyS) {
+		nyys := make([]yySymType, len(yyS)*2)
+		copy(nyys, yyS)
+		yyS = nyys
+	}
 	yyVAL = yyS[yyp+1]
 
 	/* consult goto table to find next state */
-	yyn = yyR1[yyn]
-	yyg := yyPgo[yyn]
+	yyn = int(yyR1[yyn])
+	yyg := int(yyPgo[yyn])
 	yyj := yyg + yyS[yyp].yys + 1
 
 	if yyj >= yyLast {
-		yystate = yyAct[yyg]
+		yystate = int(yyAct[yyg])
 	} else {
-		yystate = yyAct[yyj]
-		if yyChk[yystate] != -yyn {
-			yystate = yyAct[yyg]
+		yystate = int(yyAct[yyj])
+		if int(yyChk[yystate]) != -yyn {
+			yystate = int(yyAct[yyg])
 		}
 	}
 	// dummy call; replaced with literal code
 	switch yynt {
 
 	case 1:
-		//line parser.go.y:73
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:73
 		{
-			yyVAL.stmts = yyS[yypt-0].stmts
+			yyVAL.stmts = yyDollar[1].stmts
 			if l, ok := yylex.(*Lexer); ok {
 				l.Stmts = yyVAL.stmts
 			}
 		}
 	case 2:
-		//line parser.go.y:79
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:79
 		{
-			yyVAL.stmts = append(yyS[yypt-1].stmts, yyS[yypt-0].stmt)
+			yyVAL.stmts = append(yyDollar[1].stmts, yyDollar[2].stmt)
 			if l, ok := yylex.(*Lexer); ok {
 				l.Stmts = yyVAL.stmts
 			}
 		}
 	case 3:
-		//line parser.go.y:85
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:85
 		{
-			yyVAL.stmts = append(yyS[yypt-2].stmts, yyS[yypt-1].stmt)
+			yyVAL.stmts = append(yyDollar[1].stmts, yyDollar[2].stmt)
 			if l, ok := yylex.(*Lexer); ok {
 				l.Stmts = yyVAL.stmts
 			}
 		}
 	case 4:
-		//line parser.go.y:93
+		yyDollar = yyS[yypt-0 : yypt+1]
+//line parser.go.y:93
 		{
 			yyVAL.stmts = []ast.Stmt{}
 		}
 	case 5:
-		//line parser.go.y:96
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:96
 		{
-			yyVAL.stmts = append(yyS[yypt-1].stmts, yyS[yypt-0].stmt)
+			yyVAL.stmts = append(yyDollar[1].stmts, yyDollar[2].stmt)
 		}
 	case 6:
-		//line parser.go.y:99
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:99
 		{
-			yyVAL.stmts = yyS[yypt-1].stmts
+			yyVAL.stmts = yyDollar[1].stmts
 		}
 	case 7:
-		//line parser.go.y:104
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:104
 		{
-			yyVAL.stmts = yyS[yypt-0].stmts
+			yyVAL.stmts = yyDollar[1].stmts
 		}
 	case 8:
-		//line parser.go.y:109
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:109
 		{
-			yyVAL.stmt = &ast.AssignStmt{Lhs: yyS[yypt-2].exprlist, Rhs: yyS[yypt-0].exprlist}
-			yyVAL.stmt.SetLine(yyS[yypt-2].exprlist[0].Line())
+			yyVAL.stmt = &ast.AssignStmt{Lhs: yyDollar[1].exprlist, Rhs: yyDollar[3].exprlist}
+			yyVAL.stmt.SetLine(yyDollar[1].exprlist[0].Line())
 		}
 	case 9:
-		//line parser.go.y:114
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:114
 		{
-			if _, ok := yyS[yypt-0].expr.(*ast.FuncCallExpr); !ok {
+			if _, ok := yyDollar[1].expr.(*ast.FuncCallExpr); !ok {
 				yylex.(*Lexer).Error("parse error")
 			} else {
-				yyVAL.stmt = &ast.FuncCallStmt{Expr: yyS[yypt-0].expr}
-				yyVAL.stmt.SetLine(yyS[yypt-0].expr.Line())
+				yyVAL.stmt = &ast.FuncCallStmt{Expr: yyDollar[1].expr}
+				yyVAL.stmt.SetLine(yyDollar[1].expr.Line())
 			}
 		}
 	case 10:
-		//line parser.go.y:122
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:122
 		{
-			yyVAL.stmt = &ast.DoBlockStmt{Stmts: yyS[yypt-1].stmts}
-			yyVAL.stmt.SetLine(yyS[yypt-2].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt = &ast.DoBlockStmt{Stmts: yyDollar[2].stmts}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[3].token.Pos.Line)
 		}
 	case 11:
-		//line parser.go.y:127
+		yyDollar = yyS[yypt-5 : yypt+1]
+//line parser.go.y:127
 		{
-			yyVAL.stmt = &ast.WhileStmt{Condition: yyS[yypt-3].expr, Stmts: yyS[yypt-1].stmts}
-			yyVAL.stmt.SetLine(yyS[yypt-4].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt = &ast.WhileStmt{Condition: yyDollar[2].expr, Stmts: yyDollar[4].stmts}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[5].token.Pos.Line)
 		}
 	case 12:
-		//line parser.go.y:132
+		yyDollar = yyS[yypt-4 : yypt+1]
+//line parser.go.y:132
 		{
-			yyVAL.stmt = &ast.RepeatStmt{Condition: yyS[yypt-0].expr, Stmts: yyS[yypt-2].stmts}
-			yyVAL.stmt.SetLine(yyS[yypt-3].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].expr.Line())
+			yyVAL.stmt = &ast.RepeatStmt{Condition: yyDollar[4].expr, Stmts: yyDollar[2].stmts}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[4].expr.Line())
 		}
 	case 13:
-		//line parser.go.y:137
+		yyDollar = yyS[yypt-6 : yypt+1]
+//line parser.go.y:137
 		{
-			yyVAL.stmt = &ast.IfStmt{Condition: yyS[yypt-4].expr, Then: yyS[yypt-2].stmts}
+			yyVAL.stmt = &ast.IfStmt{Condition: yyDollar[2].expr, Then: yyDollar[4].stmts}
 			cur := yyVAL.stmt
-			for _, elseif := range yyS[yypt-1].stmts {
+			for _, elseif := range yyDollar[5].stmts {
 				cur.(*ast.IfStmt).Else = []ast.Stmt{elseif}
 				cur = elseif
 			}
-			yyVAL.stmt.SetLine(yyS[yypt-5].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[6].token.Pos.Line)
 		}
 	case 14:
-		//line parser.go.y:147
+		yyDollar = yyS[yypt-8 : yypt+1]
+//line parser.go.y:147
 		{
-			yyVAL.stmt = &ast.IfStmt{Condition: yyS[yypt-6].expr, Then: yyS[yypt-4].stmts}
+			yyVAL.stmt = &ast.IfStmt{Condition: yyDollar[2].expr, Then: yyDollar[4].stmts}
 			cur := yyVAL.stmt
-			for _, elseif := range yyS[yypt-3].stmts {
+			for _, elseif := range yyDollar[5].stmts {
 				cur.(*ast.IfStmt).Else = []ast.Stmt{elseif}
 				cur = elseif
 			}
-			cur.(*ast.IfStmt).Else = yyS[yypt-1].stmts
-			yyVAL.stmt.SetLine(yyS[yypt-7].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			cur.(*ast.IfStmt).Else = yyDollar[7].stmts
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[8].token.Pos.Line)
 		}
 	case 15:
-		//line parser.go.y:158
+		yyDollar = yyS[yypt-9 : yypt+1]
+//line parser.go.y:158
 		{
-			yyVAL.stmt = &ast.NumberForStmt{Name: yyS[yypt-7].token.Str, Init: yyS[yypt-5].expr, Limit: yyS[yypt-3].expr, Stmts: yyS[yypt-1].stmts}
-			yyVAL.stmt.SetLine(yyS[yypt-8].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt = &ast.NumberForStmt{Name: yyDollar[2].token.Str, Init: yyDollar[4].expr, Limit: yyDollar[6].expr, Stmts: yyDollar[8].stmts}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[9].token.Pos.Line)
 		}
 	case 16:
-		//line parser.go.y:163
+		yyDollar = yyS[yypt-11 : yypt+1]
+//line parser.go.y:163
 		{
-			yyVAL.stmt = &ast.NumberForStmt{Name: yyS[yypt-9].token.Str, Init: yyS[yypt-7].expr, Limit: yyS[yypt-5].expr, Step: yyS[yypt-3].expr, Stmts: yyS[yypt-1].stmts}
-			yyVAL.stmt.SetLine(yyS[yypt-10].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt = &ast.NumberForStmt{Name: yyDollar[2].token.Str, Init: yyDollar[4].expr, Limit: yyDollar[6].expr, Step: yyDollar[8].expr, Stmts: yyDollar[10].stmts}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[11].token.Pos.Line)
 		}
 	case 17:
-		//line parser.go.y:168
+		yyDollar = yyS[yypt-7 : yypt+1]
+//line parser.go.y:168
 		{
-			yyVAL.stmt = &ast.GenericForStmt{Names: yyS[yypt-5].namelist, Exprs: yyS[yypt-3].exprlist, Stmts: yyS[yypt-1].stmts}
-			yyVAL.stmt.SetLine(yyS[yypt-6].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt = &ast.GenericForStmt{Names: yyDollar[2].namelist, Exprs: yyDollar[4].exprlist, Stmts: yyDollar[6].stmts}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[7].token.Pos.Line)
 		}
 	case 18:
-		//line parser.go.y:173
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:173
 		{
-			yyVAL.stmt = &ast.FuncDefStmt{Name: yyS[yypt-1].funcname, Func: yyS[yypt-0].funcexpr}
-			yyVAL.stmt.SetLine(yyS[yypt-2].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].funcexpr.LastLine())
+			yyVAL.stmt = &ast.FuncDefStmt{Name: yyDollar[2].funcname, Func: yyDollar[3].funcexpr}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[3].funcexpr.LastLine())
 		}
 	case 19:
-		//line parser.go.y:178
+		yyDollar = yyS[yypt-4 : yypt+1]
+//line parser.go.y:178
 		{
-			yyVAL.stmt = &ast.LocalAssignStmt{Names: []string{yyS[yypt-1].token.Str}, Exprs: []ast.Expr{yyS[yypt-0].funcexpr}}
-			yyVAL.stmt.SetLine(yyS[yypt-3].token.Pos.Line)
-			yyVAL.stmt.SetLastLine(yyS[yypt-0].funcexpr.LastLine())
+			yyVAL.stmt = &ast.LocalAssignStmt{Names: []string{yyDollar[3].token.Str}, Exprs: []ast.Expr{yyDollar[4].funcexpr}}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.stmt.SetLastLine(yyDollar[4].funcexpr.LastLine())
 		}
 	case 20:
-		//line parser.go.y:183
+		yyDollar = yyS[yypt-4 : yypt+1]
+//line parser.go.y:183
 		{
-			yyVAL.stmt = &ast.LocalAssignStmt{Names: yyS[yypt-2].namelist, Exprs: yyS[yypt-0].exprlist}
-			yyVAL.stmt.SetLine(yyS[yypt-3].token.Pos.Line)
+			yyVAL.stmt = &ast.LocalAssignStmt{Names: yyDollar[2].namelist, Exprs: yyDollar[4].exprlist}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 21:
-		//line parser.go.y:187
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:187
 		{
-			yyVAL.stmt = &ast.LocalAssignStmt{Names: yyS[yypt-0].namelist, Exprs: []ast.Expr{}}
-			yyVAL.stmt.SetLine(yyS[yypt-1].token.Pos.Line)
+			yyVAL.stmt = &ast.LocalAssignStmt{Names: yyDollar[2].namelist, Exprs: []ast.Expr{}}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 22:
-		//line parser.go.y:193
+		yyDollar = yyS[yypt-0 : yypt+1]
+//line parser.go.y:193
 		{
 			yyVAL.stmts = []ast.Stmt{}
 		}
 	case 23:
-		//line parser.go.y:196
+		yyDollar = yyS[yypt-5 : yypt+1]
+//line parser.go.y:196
 		{
-			yyVAL.stmts = append(yyS[yypt-4].stmts, &ast.IfStmt{Condition: yyS[yypt-2].expr, Then: yyS[yypt-0].stmts})
-			yyVAL.stmts[len(yyVAL.stmts)-1].SetLine(yyS[yypt-3].token.Pos.Line)
+			yyVAL.stmts = append(yyDollar[1].stmts, &ast.IfStmt{Condition: yyDollar[3].expr, Then: yyDollar[5].stmts})
+			yyVAL.stmts[len(yyVAL.stmts)-1].SetLine(yyDollar[2].token.Pos.Line)
 		}
 	case 24:
-		//line parser.go.y:202
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:202
 		{
 			yyVAL.stmt = &ast.ReturnStmt{Exprs: nil}
-			yyVAL.stmt.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 25:
-		//line parser.go.y:206
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:206
 		{
-			yyVAL.stmt = &ast.ReturnStmt{Exprs: yyS[yypt-0].exprlist}
-			yyVAL.stmt.SetLine(yyS[yypt-1].token.Pos.Line)
+			yyVAL.stmt = &ast.ReturnStmt{Exprs: yyDollar[2].exprlist}
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 26:
-		//line parser.go.y:210
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:210
 		{
 			yyVAL.stmt = &ast.BreakStmt{}
-			yyVAL.stmt.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.stmt.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 27:
-		//line parser.go.y:216
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:216
 		{
-			yyVAL.funcname = yyS[yypt-0].funcname
+			yyVAL.funcname = yyDollar[1].funcname
 		}
 	case 28:
-		//line parser.go.y:219
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:219
 		{
-			yyVAL.funcname = &ast.FuncName{Func: nil, Receiver: yyS[yypt-2].funcname.Func, Method: yyS[yypt-0].token.Str}
+			yyVAL.funcname = &ast.FuncName{Func: nil, Receiver: yyDollar[1].funcname.Func, Method: yyDollar[3].token.Str}
 		}
 	case 29:
-		//line parser.go.y:224
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:224
 		{
-			yyVAL.funcname = &ast.FuncName{Func: &ast.IdentExpr{Value: yyS[yypt-0].token.Str}}
-			yyVAL.funcname.Func.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.funcname = &ast.FuncName{Func: &ast.IdentExpr{Value: yyDollar[1].token.Str}}
+			yyVAL.funcname.Func.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 30:
-		//line parser.go.y:228
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:228
 		{
-			key := &ast.StringExpr{Value: yyS[yypt-0].token.Str}
-			key.SetLine(yyS[yypt-0].token.Pos.Line)
-			fn := &ast.AttrGetExpr{Object: yyS[yypt-2].funcname.Func, Key: key}
-			fn.SetLine(yyS[yypt-0].token.Pos.Line)
+			key := &ast.StringExpr{Value: yyDollar[3].token.Str}
+			key.SetLine(yyDollar[3].token.Pos.Line)
+			fn := &ast.AttrGetExpr{Object: yyDollar[1].funcname.Func, Key: key}
+			fn.SetLine(yyDollar[3].token.Pos.Line)
 			yyVAL.funcname = &ast.FuncName{Func: fn}
 		}
 	case 31:
-		//line parser.go.y:237
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:237
 		{
-			yyVAL.exprlist = []ast.Expr{yyS[yypt-0].expr}
+			yyVAL.exprlist = []ast.Expr{yyDollar[1].expr}
 		}
 	case 32:
-		//line parser.go.y:240
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:240
 		{
-			yyVAL.exprlist = append(yyS[yypt-2].exprlist, yyS[yypt-0].expr)
+			yyVAL.exprlist = append(yyDollar[1].exprlist, yyDollar[3].expr)
 		}
 	case 33:
-		//line parser.go.y:245
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:245
 		{
-			yyVAL.expr = &ast.IdentExpr{Value: yyS[yypt-0].token.Str}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr = &ast.IdentExpr{Value: yyDollar[1].token.Str}
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 34:
-		//line parser.go.y:249
+		yyDollar = yyS[yypt-4 : yypt+1]
+//line parser.go.y:249
 		{
-			yyVAL.expr = &ast.AttrGetExpr{Object: yyS[yypt-3].expr, Key: yyS[yypt-1].expr}
-			yyVAL.expr.SetLine(yyS[yypt-3].expr.Line())
+			yyVAL.expr = &ast.AttrGetExpr{Object: yyDollar[1].expr, Key: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 35:
-		//line parser.go.y:253
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:253
 		{
-			key := &ast.StringExpr{Value: yyS[yypt-0].token.Str}
-			key.SetLine(yyS[yypt-0].token.Pos.Line)
-			yyVAL.expr = &ast.AttrGetExpr{Object: yyS[yypt-2].expr, Key: key}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			key := &ast.StringExpr{Value: yyDollar[3].token.Str}
+			key.SetLine(yyDollar[3].token.Pos.Line)
+			yyVAL.expr = &ast.AttrGetExpr{Object: yyDollar[1].expr, Key: key}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 36:
-		//line parser.go.y:261
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:261
 		{
-			yyVAL.namelist = []string{yyS[yypt-0].token.Str}
+			yyVAL.namelist = []string{yyDollar[1].token.Str}
 		}
 	case 37:
-		//line parser.go.y:264
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:264
 		{
-			yyVAL.namelist = append(yyS[yypt-2].namelist, yyS[yypt-0].token.Str)
+			yyVAL.namelist = append(yyDollar[1].namelist, yyDollar[3].token.Str)
 		}
 	case 38:
-		//line parser.go.y:269
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:269
 		{
-			yyVAL.exprlist = []ast.Expr{yyS[yypt-0].expr}
+			yyVAL.exprlist = []ast.Expr{yyDollar[1].expr}
 		}
 	case 39:
-		//line parser.go.y:272
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:272
 		{
-			yyVAL.exprlist = append(yyS[yypt-2].exprlist, yyS[yypt-0].expr)
+			yyVAL.exprlist = append(yyDollar[1].exprlist, yyDollar[3].expr)
 		}
 	case 40:
-		//line parser.go.y:277
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:277
 		{
 			yyVAL.expr = &ast.NilExpr{}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 41:
-		//line parser.go.y:281
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:281
 		{
 			yyVAL.expr = &ast.FalseExpr{}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 42:
-		//line parser.go.y:285
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:285
 		{
 			yyVAL.expr = &ast.TrueExpr{}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 43:
-		//line parser.go.y:289
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:289
 		{
-			yyVAL.expr = &ast.NumberExpr{Value: yyS[yypt-0].token.Str}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr = &ast.NumberExpr{Value: yyDollar[1].token.Str}
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 44:
-		//line parser.go.y:293
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:293
 		{
 			yyVAL.expr = &ast.Comma3Expr{}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 45:
-		//line parser.go.y:297
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:297
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 46:
-		//line parser.go.y:300
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:300
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 47:
-		//line parser.go.y:303
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:303
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 48:
-		//line parser.go.y:306
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:306
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 49:
-		//line parser.go.y:309
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:309
 		{
-			yyVAL.expr = &ast.LogicalOpExpr{Lhs: yyS[yypt-2].expr, Operator: "or", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.LogicalOpExpr{Lhs: yyDollar[1].expr, Operator: "or", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 50:
-		//line parser.go.y:313
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:313
 		{
-			yyVAL.expr = &ast.LogicalOpExpr{Lhs: yyS[yypt-2].expr, Operator: "and", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.LogicalOpExpr{Lhs: yyDollar[1].expr, Operator: "and", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 51:
-		//line parser.go.y:317
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:317
 		{
-			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyS[yypt-2].expr, Operator: ">", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyDollar[1].expr, Operator: ">", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 52:
-		//line parser.go.y:321
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:321
 		{
-			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyS[yypt-2].expr, Operator: "<", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyDollar[1].expr, Operator: "<", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 53:
-		//line parser.go.y:325
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:325
 		{
-			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyS[yypt-2].expr, Operator: ">=", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyDollar[1].expr, Operator: ">=", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 54:
-		//line parser.go.y:329
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:329
 		{
-			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyS[yypt-2].expr, Operator: "<=", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyDollar[1].expr, Operator: "<=", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 55:
-		//line parser.go.y:333
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:333
 		{
-			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyS[yypt-2].expr, Operator: "==", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyDollar[1].expr, Operator: "==", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 56:
-		//line parser.go.y:337
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:337
 		{
-			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyS[yypt-2].expr, Operator: "~=", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.RelationalOpExpr{Lhs: yyDollar[1].expr, Operator: "~=", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 57:
-		//line parser.go.y:341
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:341
 		{
-			yyVAL.expr = &ast.StringConcatOpExpr{Lhs: yyS[yypt-2].expr, Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.StringConcatOpExpr{Lhs: yyDollar[1].expr, Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 58:
-		//line parser.go.y:345
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:345
 		{
-			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyS[yypt-2].expr, Operator: "+", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyDollar[1].expr, Operator: "+", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 59:
-		//line parser.go.y:349
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:349
 		{
-			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyS[yypt-2].expr, Operator: "-", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyDollar[1].expr, Operator: "-", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 60:
-		//line parser.go.y:353
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:353
 		{
-			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyS[yypt-2].expr, Operator: "*", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyDollar[1].expr, Operator: "*", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 61:
-		//line parser.go.y:357
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:357
 		{
-			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyS[yypt-2].expr, Operator: "/", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyDollar[1].expr, Operator: "/", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 62:
-		//line parser.go.y:361
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:361
 		{
-			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyS[yypt-2].expr, Operator: "%", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyDollar[1].expr, Operator: "%", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 63:
-		//line parser.go.y:365
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:365
 		{
-			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyS[yypt-2].expr, Operator: "^", Rhs: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-2].expr.Line())
+			yyVAL.expr = &ast.ArithmeticOpExpr{Lhs: yyDollar[1].expr, Operator: "^", Rhs: yyDollar[3].expr}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 64:
-		//line parser.go.y:369
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:369
 		{
-			yyVAL.expr = &ast.UnaryMinusOpExpr{Expr: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-0].expr.Line())
+			yyVAL.expr = &ast.UnaryMinusOpExpr{Expr: yyDollar[2].expr}
+			yyVAL.expr.SetLine(yyDollar[2].expr.Line())
 		}
 	case 65:
-		//line parser.go.y:373
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:373
 		{
-			yyVAL.expr = &ast.UnaryNotOpExpr{Expr: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-0].expr.Line())
+			yyVAL.expr = &ast.UnaryNotOpExpr{Expr: yyDollar[2].expr}
+			yyVAL.expr.SetLine(yyDollar[2].expr.Line())
 		}
 	case 66:
-		//line parser.go.y:377
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:377
 		{
-			yyVAL.expr = &ast.UnaryLenOpExpr{Expr: yyS[yypt-0].expr}
-			yyVAL.expr.SetLine(yyS[yypt-0].expr.Line())
+			yyVAL.expr = &ast.UnaryLenOpExpr{Expr: yyDollar[2].expr}
+			yyVAL.expr.SetLine(yyDollar[2].expr.Line())
 		}
 	case 67:
-		//line parser.go.y:383
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:383
 		{
-			yyVAL.expr = &ast.StringExpr{Value: yyS[yypt-0].token.Str}
-			yyVAL.expr.SetLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.expr = &ast.StringExpr{Value: yyDollar[1].token.Str}
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 68:
-		//line parser.go.y:389
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:389
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 69:
-		//line parser.go.y:392
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:392
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 70:
-		//line parser.go.y:395
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:395
 		{
-			yyVAL.expr = yyS[yypt-0].expr
+			yyVAL.expr = yyDollar[1].expr
 		}
 	case 71:
-		//line parser.go.y:398
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:398
 		{
-			yyVAL.expr = yyS[yypt-1].expr
-			yyVAL.expr.SetLine(yyS[yypt-2].token.Pos.Line)
+			if ex, ok := yyDollar[2].expr.(*ast.Comma3Expr); ok {
+				ex.AdjustRet = true
+			}
+			yyVAL.expr = yyDollar[2].expr
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 72:
-		//line parser.go.y:404
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:407
 		{
-			yyS[yypt-1].expr.(*ast.FuncCallExpr).AdjustRet = true
-			yyVAL.expr = yyS[yypt-1].expr
+			yyDollar[2].expr.(*ast.FuncCallExpr).AdjustRet = true
+			yyVAL.expr = yyDollar[2].expr
 		}
 	case 73:
-		//line parser.go.y:410
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:413
 		{
-			yyVAL.expr = &ast.FuncCallExpr{Func: yyS[yypt-1].expr, Args: yyS[yypt-0].exprlist}
-			yyVAL.expr.SetLine(yyS[yypt-1].expr.Line())
+			yyVAL.expr = &ast.FuncCallExpr{Func: yyDollar[1].expr, Args: yyDollar[2].exprlist}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 74:
-		//line parser.go.y:414
+		yyDollar = yyS[yypt-4 : yypt+1]
+//line parser.go.y:417
 		{
-			yyVAL.expr = &ast.FuncCallExpr{Method: yyS[yypt-1].token.Str, Receiver: yyS[yypt-3].expr, Args: yyS[yypt-0].exprlist}
-			yyVAL.expr.SetLine(yyS[yypt-3].expr.Line())
+			yyVAL.expr = &ast.FuncCallExpr{Method: yyDollar[3].token.Str, Receiver: yyDollar[1].expr, Args: yyDollar[4].exprlist}
+			yyVAL.expr.SetLine(yyDollar[1].expr.Line())
 		}
 	case 75:
-		//line parser.go.y:420
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:423
 		{
 			if yylex.(*Lexer).PNewLine {
-				yylex.(*Lexer).TokenError(yyS[yypt-1].token, "ambiguous syntax (function call x new statement)")
+				yylex.(*Lexer).TokenError(yyDollar[1].token, "ambiguous syntax (function call x new statement)")
 			}
 			yyVAL.exprlist = []ast.Expr{}
 		}
 	case 76:
-		//line parser.go.y:426
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:429
 		{
 			if yylex.(*Lexer).PNewLine {
-				yylex.(*Lexer).TokenError(yyS[yypt-2].token, "ambiguous syntax (function call x new statement)")
+				yylex.(*Lexer).TokenError(yyDollar[1].token, "ambiguous syntax (function call x new statement)")
 			}
-			yyVAL.exprlist = yyS[yypt-1].exprlist
+			yyVAL.exprlist = yyDollar[2].exprlist
 		}
 	case 77:
-		//line parser.go.y:432
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:435
 		{
-			yyVAL.exprlist = []ast.Expr{yyS[yypt-0].expr}
+			yyVAL.exprlist = []ast.Expr{yyDollar[1].expr}
 		}
 	case 78:
-		//line parser.go.y:435
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:438
 		{
-			yyVAL.exprlist = []ast.Expr{yyS[yypt-0].expr}
+			yyVAL.exprlist = []ast.Expr{yyDollar[1].expr}
 		}
 	case 79:
-		//line parser.go.y:440
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:443
 		{
-			yyVAL.expr = &ast.FunctionExpr{ParList: yyS[yypt-0].funcexpr.ParList, Stmts: yyS[yypt-0].funcexpr.Stmts}
-			yyVAL.expr.SetLine(yyS[yypt-1].token.Pos.Line)
-			yyVAL.expr.SetLastLine(yyS[yypt-0].funcexpr.LastLine())
+			yyVAL.expr = &ast.FunctionExpr{ParList: yyDollar[2].funcexpr.ParList, Stmts: yyDollar[2].funcexpr.Stmts}
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.expr.SetLastLine(yyDollar[2].funcexpr.LastLine())
 		}
 	case 80:
-		//line parser.go.y:447
+		yyDollar = yyS[yypt-5 : yypt+1]
+//line parser.go.y:450
 		{
-			yyVAL.funcexpr = &ast.FunctionExpr{ParList: yyS[yypt-3].parlist, Stmts: yyS[yypt-1].stmts}
-			yyVAL.funcexpr.SetLine(yyS[yypt-4].token.Pos.Line)
-			yyVAL.funcexpr.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.funcexpr = &ast.FunctionExpr{ParList: yyDollar[2].parlist, Stmts: yyDollar[4].stmts}
+			yyVAL.funcexpr.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.funcexpr.SetLastLine(yyDollar[5].token.Pos.Line)
 		}
 	case 81:
-		//line parser.go.y:452
+		yyDollar = yyS[yypt-4 : yypt+1]
+//line parser.go.y:455
 		{
-			yyVAL.funcexpr = &ast.FunctionExpr{ParList: &ast.ParList{HasVargs: false, Names: []string{}}, Stmts: yyS[yypt-1].stmts}
-			yyVAL.funcexpr.SetLine(yyS[yypt-3].token.Pos.Line)
-			yyVAL.funcexpr.SetLastLine(yyS[yypt-0].token.Pos.Line)
+			yyVAL.funcexpr = &ast.FunctionExpr{ParList: &ast.ParList{HasVargs: false, Names: []string{}}, Stmts: yyDollar[3].stmts}
+			yyVAL.funcexpr.SetLine(yyDollar[1].token.Pos.Line)
+			yyVAL.funcexpr.SetLastLine(yyDollar[4].token.Pos.Line)
 		}
 	case 82:
-		//line parser.go.y:459
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:462
 		{
 			yyVAL.parlist = &ast.ParList{HasVargs: true, Names: []string{}}
 		}
 	case 83:
-		//line parser.go.y:462
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:465
 		{
 			yyVAL.parlist = &ast.ParList{HasVargs: false, Names: []string{}}
-			yyVAL.parlist.Names = append(yyVAL.parlist.Names, yyS[yypt-0].namelist...)
+			yyVAL.parlist.Names = append(yyVAL.parlist.Names, yyDollar[1].namelist...)
 		}
 	case 84:
-		//line parser.go.y:466
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:469
 		{
 			yyVAL.parlist = &ast.ParList{HasVargs: true, Names: []string{}}
-			yyVAL.parlist.Names = append(yyVAL.parlist.Names, yyS[yypt-2].namelist...)
+			yyVAL.parlist.Names = append(yyVAL.parlist.Names, yyDollar[1].namelist...)
 		}
 	case 85:
-		//line parser.go.y:473
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:476
 		{
 			yyVAL.expr = &ast.TableExpr{Fields: []*ast.Field{}}
-			yyVAL.expr.SetLine(yyS[yypt-1].token.Pos.Line)
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 86:
-		//line parser.go.y:477
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:480
 		{
-			yyVAL.expr = &ast.TableExpr{Fields: yyS[yypt-1].fieldlist}
-			yyVAL.expr.SetLine(yyS[yypt-2].token.Pos.Line)
+			yyVAL.expr = &ast.TableExpr{Fields: yyDollar[2].fieldlist}
+			yyVAL.expr.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 87:
-		//line parser.go.y:484
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:487
 		{
-			yyVAL.fieldlist = []*ast.Field{yyS[yypt-0].field}
+			yyVAL.fieldlist = []*ast.Field{yyDollar[1].field}
 		}
 	case 88:
-		//line parser.go.y:487
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:490
 		{
-			yyVAL.fieldlist = append(yyS[yypt-2].fieldlist, yyS[yypt-0].field)
+			yyVAL.fieldlist = append(yyDollar[1].fieldlist, yyDollar[3].field)
 		}
 	case 89:
-		//line parser.go.y:490
+		yyDollar = yyS[yypt-2 : yypt+1]
+//line parser.go.y:493
 		{
-			yyVAL.fieldlist = yyS[yypt-1].fieldlist
+			yyVAL.fieldlist = yyDollar[1].fieldlist
 		}
 	case 90:
-		//line parser.go.y:495
+		yyDollar = yyS[yypt-3 : yypt+1]
+//line parser.go.y:498
 		{
-			yyVAL.field = &ast.Field{Key: &ast.StringExpr{Value: yyS[yypt-2].token.Str}, Value: yyS[yypt-0].expr}
-			yyVAL.field.Key.SetLine(yyS[yypt-2].token.Pos.Line)
+			yyVAL.field = &ast.Field{Key: &ast.StringExpr{Value: yyDollar[1].token.Str}, Value: yyDollar[3].expr}
+			yyVAL.field.Key.SetLine(yyDollar[1].token.Pos.Line)
 		}
 	case 91:
-		//line parser.go.y:499
+		yyDollar = yyS[yypt-5 : yypt+1]
+//line parser.go.y:502
 		{
-			yyVAL.field = &ast.Field{Key: yyS[yypt-3].expr, Value: yyS[yypt-0].expr}
+			yyVAL.field = &ast.Field{Key: yyDollar[2].expr, Value: yyDollar[5].expr}
 		}
 	case 92:
-		//line parser.go.y:502
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:505
 		{
-			yyVAL.field = &ast.Field{Value: yyS[yypt-0].expr}
+			yyVAL.field = &ast.Field{Value: yyDollar[1].expr}
 		}
 	case 93:
-		//line parser.go.y:507
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:510
 		{
 			yyVAL.fieldsep = ","
 		}
 	case 94:
-		//line parser.go.y:510
+		yyDollar = yyS[yypt-1 : yypt+1]
+//line parser.go.y:513
 		{
 			yyVAL.fieldsep = ";"
 		}
diff --git a/vendor/github.com/yuin/gopher-lua/parse/parser.go.y b/vendor/github.com/yuin/gopher-lua/parse/parser.go.y
index 956133db2924..9a9f831e6119 100644
--- a/vendor/github.com/yuin/gopher-lua/parse/parser.go.y
+++ b/vendor/github.com/yuin/gopher-lua/parse/parser.go.y
@@ -396,6 +396,9 @@ prefixexp:
             $$ = $1
         } |
         '(' expr ')' {
+            if ex, ok := $2.(*ast.Comma3Expr); ok {
+                ex.AdjustRet = true
+            }
             $$ = $2
             $$.SetLine($1.Pos.Line)
         }
diff --git a/vendor/github.com/yuin/gopher-lua/pm/pm.go b/vendor/github.com/yuin/gopher-lua/pm/pm.go
index e15bc21005dd..e5c651f942e7 100644
--- a/vendor/github.com/yuin/gopher-lua/pm/pm.go
+++ b/vendor/github.com/yuin/gopher-lua/pm/pm.go
@@ -210,7 +210,7 @@ func (pn *singleClass) Matches(ch int) bool {
 	case 'l', 'L':
 		ret = 'a' <= ch && ch <= 'z'
 	case 'p', 'P':
-		ret = (0x21 <= ch && ch <= 0x2f) || (0x30 <= ch && ch <= 0x40) || (0x5b <= ch && ch <= 0x60) || (0x7b <= ch && ch <= 0x7e)
+		ret = (0x21 <= ch && ch <= 0x2f) || (0x3a <= ch && ch <= 0x40) || (0x5b <= ch && ch <= 0x60) || (0x7b <= ch && ch <= 0x7e)
 	case 's', 'S':
 		switch ch {
 		case ' ', '\f', '\n', '\r', '\t', '\v':
diff --git a/vendor/github.com/yuin/gopher-lua/table.go b/vendor/github.com/yuin/gopher-lua/table.go
index e220bd9c3b6c..ddf14dd88fdb 100644
--- a/vendor/github.com/yuin/gopher-lua/table.go
+++ b/vendor/github.com/yuin/gopher-lua/table.go
@@ -46,7 +46,7 @@ func newLTable(acap int, hcap int) *LTable {
 	return tb
 }
 
-// Len returns length of this LTable.
+// Len returns length of this LTable without using __len.
 func (tb *LTable) Len() int {
 	if tb.array == nil {
 		return 0
diff --git a/vendor/github.com/yuin/gopher-lua/vm.go b/vendor/github.com/yuin/gopher-lua/vm.go
index f3733f1300cd..aaa04dc9aada 100644
--- a/vendor/github.com/yuin/gopher-lua/vm.go
+++ b/vendor/github.com/yuin/gopher-lua/vm.go
@@ -549,7 +549,7 @@ func init() {
 					if ret.Type() == LTNumber {
 						reg.SetNumber(RA, ret.(LNumber))
 					} else {
-						reg.SetNumber(RA, LNumber(0))
+						reg.Set(RA, ret)
 					}
 				} else if lv.Type() == LTTable {
 					reg.SetNumber(RA, LNumber(lv.(*LTable).Len()))
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/bson.go b/vendor/go.mongodb.org/mongo-driver/bson/bson.go
index 95ffc1078da1..a0d818582611 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/bson.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/bson.go
@@ -27,7 +27,7 @@ type Zeroer interface {
 //
 // Example usage:
 //
-// 		bson.D{{"foo", "bar"}, {"hello", "world"}, {"pi", 3.14159}}
+//	bson.D{{"foo", "bar"}, {"hello", "world"}, {"pi", 3.14159}}
 type D = primitive.D
 
 // E represents a BSON element for a D. It is usually used inside a D.
@@ -39,12 +39,12 @@ type E = primitive.E
 //
 // Example usage:
 //
-// 		bson.M{"foo": "bar", "hello": "world", "pi": 3.14159}
+//	bson.M{"foo": "bar", "hello": "world", "pi": 3.14159}
 type M = primitive.M
 
 // An A is an ordered representation of a BSON array.
 //
 // Example usage:
 //
-// 		bson.A{"bar", "world", 3.14159, bson.D{{"qux", 12345}}}
+//	bson.A{"bar", "world", 3.14159, bson.D{{"qux", 12345}}}
 type A = primitive.A
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/doc.go b/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/doc.go
index b0ae0e23ff2e..5f903ebea6c9 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/doc.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/doc.go
@@ -17,7 +17,7 @@
 // 2) A Registry that holds these ValueEncoders and ValueDecoders and provides methods for
 // retrieving them.
 //
-// ValueEncoders and ValueDecoders
+// # ValueEncoders and ValueDecoders
 //
 // The ValueEncoder interface is implemented by types that can encode a provided Go type to BSON.
 // The value to encode is provided as a reflect.Value and a bsonrw.ValueWriter is used within the
@@ -31,7 +31,7 @@
 // allow the use of a function with the correct signature as a ValueDecoder. A DecodeContext
 // instance is provided and serves similar functionality to the EncodeContext.
 //
-// Registry and RegistryBuilder
+// # Registry and RegistryBuilder
 //
 // A Registry is an immutable store for ValueEncoders, ValueDecoders, and a type map. See the Registry type
 // documentation for examples of registering various custom encoders and decoders. A Registry can be constructed using a
@@ -53,15 +53,15 @@
 // values decode as Go int32 and int64 instances, respectively, when decoding into a bson.D. The following code would
 // change the behavior so these values decode as Go int instances instead:
 //
-//		intType := reflect.TypeOf(int(0))
-//		registryBuilder.RegisterTypeMapEntry(bsontype.Int32, intType).RegisterTypeMapEntry(bsontype.Int64, intType)
+//	intType := reflect.TypeOf(int(0))
+//	registryBuilder.RegisterTypeMapEntry(bsontype.Int32, intType).RegisterTypeMapEntry(bsontype.Int64, intType)
 //
 // 4. Kind encoder/decoders - These can be registered using the RegisterDefaultEncoder and RegisterDefaultDecoder
 // methods. The registered codec will be invoked when encoding or decoding values whose reflect.Kind matches the
 // registered reflect.Kind as long as the value's type doesn't match a registered type or hook encoder/decoder first.
 // These methods should be used to change the behavior for all values for a specific kind.
 //
-// Registry Lookup Procedure
+// # Registry Lookup Procedure
 //
 // When looking up an encoder in a Registry, the precedence rules are as follows:
 //
@@ -79,7 +79,7 @@
 // rules apply for decoders, with the exception that an error of type ErrNoDecoder will be returned if no decoder is
 // found.
 //
-// DefaultValueEncoders and DefaultValueDecoders
+// # DefaultValueEncoders and DefaultValueDecoders
 //
 // The DefaultValueEncoders and DefaultValueDecoders types provide a full set of ValueEncoders and
 // ValueDecoders for handling a wide range of Go types, including all of the types within the
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/registry.go b/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/registry.go
index f6f3800d404a..80644023c249 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/registry.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/registry.go
@@ -254,6 +254,7 @@ func (rb *RegistryBuilder) RegisterDefaultDecoder(kind reflect.Kind, dec ValueDe
 // By default, BSON documents will decode into interface{} values as bson.D. To change the default type for BSON
 // documents, a type map entry for bsontype.EmbeddedDocument should be registered. For example, to force BSON documents
 // to decode to bson.Raw, use the following code:
+//
 //	rb.RegisterTypeMapEntry(bsontype.EmbeddedDocument, reflect.TypeOf(bson.Raw{}))
 func (rb *RegistryBuilder) RegisterTypeMapEntry(bt bsontype.Type, rt reflect.Type) *RegistryBuilder {
 	rb.typeMap[bt] = rt
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/struct_tag_parser.go b/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/struct_tag_parser.go
index 6f406c162327..62708c5c745e 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/struct_tag_parser.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/bsoncodec/struct_tag_parser.go
@@ -34,21 +34,21 @@ func (stpf StructTagParserFunc) ParseStructTags(sf reflect.StructField) (StructT
 //
 // The properties are defined below:
 //
-//     OmitEmpty  Only include the field if it's not set to the zero value for the type or to
-//                empty slices or maps.
+//	OmitEmpty  Only include the field if it's not set to the zero value for the type or to
+//	           empty slices or maps.
 //
-//     MinSize    Marshal an integer of a type larger than 32 bits value as an int32, if that's
-//                feasible while preserving the numeric value.
+//	MinSize    Marshal an integer of a type larger than 32 bits value as an int32, if that's
+//	           feasible while preserving the numeric value.
 //
-//     Truncate   When unmarshaling a BSON double, it is permitted to lose precision to fit within
-//                a float32.
+//	Truncate   When unmarshaling a BSON double, it is permitted to lose precision to fit within
+//	           a float32.
 //
-//     Inline     Inline the field, which must be a struct or a map, causing all of its fields
-//                or keys to be processed as if they were part of the outer struct. For maps,
-//                keys must not conflict with the bson keys of other struct fields.
+//	Inline     Inline the field, which must be a struct or a map, causing all of its fields
+//	           or keys to be processed as if they were part of the outer struct. For maps,
+//	           keys must not conflict with the bson keys of other struct fields.
 //
-//     Skip       This struct field should be skipped. This is usually denoted by parsing a "-"
-//                for the name.
+//	Skip       This struct field should be skipped. This is usually denoted by parsing a "-"
+//	           for the name.
 //
 // TODO(skriptble): Add tags for undefined as nil and for null as nil.
 type StructTags struct {
@@ -67,20 +67,20 @@ type StructTags struct {
 // If there is no name in the struct tag fields, the struct field name is lowercased.
 // The tag formats accepted are:
 //
-//     "[<key>][,<flag1>[,<flag2>]]"
+//	"[<key>][,<flag1>[,<flag2>]]"
 //
-//     `(...) bson:"[<key>][,<flag1>[,<flag2>]]" (...)`
+//	`(...) bson:"[<key>][,<flag1>[,<flag2>]]" (...)`
 //
 // An example:
 //
-//     type T struct {
-//         A bool
-//         B int    "myb"
-//         C string "myc,omitempty"
-//         D string `bson:",omitempty" json:"jsonkey"`
-//         E int64  ",minsize"
-//         F int64  "myf,omitempty,minsize"
-//     }
+//	type T struct {
+//	    A bool
+//	    B int    "myb"
+//	    C string "myc,omitempty"
+//	    D string `bson:",omitempty" json:"jsonkey"`
+//	    E int64  ",minsize"
+//	    F int64  "myf,omitempty,minsize"
+//	}
 //
 // A struct tag either consisting entirely of '-' or with a bson key with a
 // value consisting entirely of '-' will return a StructTags with Skip true and
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/doc.go b/vendor/go.mongodb.org/mongo-driver/bson/doc.go
index 5e3825a23124..0134006d8eaf 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/doc.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/doc.go
@@ -9,21 +9,22 @@
 // The BSON library handles marshalling and unmarshalling of values through a configurable codec system. For a description
 // of the codec system and examples of registering custom codecs, see the bsoncodec package.
 //
-// Raw BSON
+// # Raw BSON
 //
 // The Raw family of types is used to validate and retrieve elements from a slice of bytes. This
 // type is most useful when you want do lookups on BSON bytes without unmarshaling it into another
 // type.
 //
 // Example:
-// 		var raw bson.Raw = ... // bytes from somewhere
-// 		err := raw.Validate()
-// 		if err != nil { return err }
-// 		val := raw.Lookup("foo")
-// 		i32, ok := val.Int32OK()
-// 		// do something with i32...
 //
-// Native Go Types
+//	var raw bson.Raw = ... // bytes from somewhere
+//	err := raw.Validate()
+//	if err != nil { return err }
+//	val := raw.Lookup("foo")
+//	i32, ok := val.Int32OK()
+//	// do something with i32...
+//
+// # Native Go Types
 //
 // The D and M types defined in this package can be used to build representations of BSON using native Go types. D is a
 // slice and M is a map. For more information about the use cases for these types, see the documentation on the type
@@ -32,63 +33,64 @@
 // Note that a D should not be constructed with duplicate key names, as that can cause undefined server behavior.
 //
 // Example:
-// 		bson.D{{"foo", "bar"}, {"hello", "world"}, {"pi", 3.14159}}
-//		bson.M{"foo": "bar", "hello": "world", "pi": 3.14159}
+//
+//	bson.D{{"foo", "bar"}, {"hello", "world"}, {"pi", 3.14159}}
+//	bson.M{"foo": "bar", "hello": "world", "pi": 3.14159}
 //
 // When decoding BSON to a D or M, the following type mappings apply when unmarshalling:
 //
-// 		1. BSON int32 unmarshals to an int32.
-// 		2. BSON int64 unmarshals to an int64.
-// 		3. BSON double unmarshals to a float64.
-// 		4. BSON string unmarshals to a string.
-// 		5. BSON boolean unmarshals to a bool.
-// 		6. BSON embedded document unmarshals to the parent type (i.e. D for a D, M for an M).
-// 		7. BSON array unmarshals to a bson.A.
-// 		8. BSON ObjectId unmarshals to a primitive.ObjectID.
-// 		9. BSON datetime unmarshals to a primitive.DateTime.
-// 		10. BSON binary unmarshals to a primitive.Binary.
-// 		11. BSON regular expression unmarshals to a primitive.Regex.
-// 		12. BSON JavaScript unmarshals to a primitive.JavaScript.
-// 		13. BSON code with scope unmarshals to a primitive.CodeWithScope.
-// 		14. BSON timestamp unmarshals to an primitive.Timestamp.
-// 		15. BSON 128-bit decimal unmarshals to an primitive.Decimal128.
-// 		16. BSON min key unmarshals to an primitive.MinKey.
-// 		17. BSON max key unmarshals to an primitive.MaxKey.
-// 		18. BSON undefined unmarshals to a primitive.Undefined.
-// 		19. BSON null unmarshals to nil.
-// 		20. BSON DBPointer unmarshals to a primitive.DBPointer.
-// 		21. BSON symbol unmarshals to a primitive.Symbol.
+//  1. BSON int32 unmarshals to an int32.
+//  2. BSON int64 unmarshals to an int64.
+//  3. BSON double unmarshals to a float64.
+//  4. BSON string unmarshals to a string.
+//  5. BSON boolean unmarshals to a bool.
+//  6. BSON embedded document unmarshals to the parent type (i.e. D for a D, M for an M).
+//  7. BSON array unmarshals to a bson.A.
+//  8. BSON ObjectId unmarshals to a primitive.ObjectID.
+//  9. BSON datetime unmarshals to a primitive.DateTime.
+//  10. BSON binary unmarshals to a primitive.Binary.
+//  11. BSON regular expression unmarshals to a primitive.Regex.
+//  12. BSON JavaScript unmarshals to a primitive.JavaScript.
+//  13. BSON code with scope unmarshals to a primitive.CodeWithScope.
+//  14. BSON timestamp unmarshals to an primitive.Timestamp.
+//  15. BSON 128-bit decimal unmarshals to an primitive.Decimal128.
+//  16. BSON min key unmarshals to an primitive.MinKey.
+//  17. BSON max key unmarshals to an primitive.MaxKey.
+//  18. BSON undefined unmarshals to a primitive.Undefined.
+//  19. BSON null unmarshals to nil.
+//  20. BSON DBPointer unmarshals to a primitive.DBPointer.
+//  21. BSON symbol unmarshals to a primitive.Symbol.
 //
 // The above mappings also apply when marshalling a D or M to BSON. Some other useful marshalling mappings are:
 //
-//       1. time.Time marshals to a BSON datetime.
-//       2. int8, int16, and int32 marshal to a BSON int32.
-//       3. int marshals to a BSON int32 if the value is between math.MinInt32 and math.MaxInt32, inclusive, and a BSON int64
-//       otherwise.
-//       4. int64 marshals to BSON int64.
-//       5. uint8 and uint16 marshal to a BSON int32.
-//       6. uint, uint32, and uint64 marshal to a BSON int32 if the value is between math.MinInt32 and math.MaxInt32,
-//       inclusive, and BSON int64 otherwise.
-//       7. BSON null and undefined values will unmarshal into the zero value of a field (e.g. unmarshalling a BSON null or
-//       undefined value into a string will yield the empty string.).
+//  1. time.Time marshals to a BSON datetime.
+//  2. int8, int16, and int32 marshal to a BSON int32.
+//  3. int marshals to a BSON int32 if the value is between math.MinInt32 and math.MaxInt32, inclusive, and a BSON int64
+//     otherwise.
+//  4. int64 marshals to BSON int64.
+//  5. uint8 and uint16 marshal to a BSON int32.
+//  6. uint, uint32, and uint64 marshal to a BSON int32 if the value is between math.MinInt32 and math.MaxInt32,
+//     inclusive, and BSON int64 otherwise.
+//  7. BSON null and undefined values will unmarshal into the zero value of a field (e.g. unmarshalling a BSON null or
+//     undefined value into a string will yield the empty string.).
 //
-// Structs
+// # Structs
 //
 // Structs can be marshalled/unmarshalled to/from BSON or Extended JSON. When transforming structs to/from BSON or Extended
 // JSON, the following rules apply:
 //
-//     1. Only exported fields in structs will be marshalled or unmarshalled.
+//  1. Only exported fields in structs will be marshalled or unmarshalled.
 //
-//     2. When marshalling a struct, each field will be lowercased to generate the key for the corresponding BSON element.
+//  2. When marshalling a struct, each field will be lowercased to generate the key for the corresponding BSON element.
 //     For example, a struct field named "Foo" will generate key "foo". This can be overridden via a struct tag (e.g.
 //     `bson:"fooField"` to generate key "fooField" instead).
 //
-//     3. An embedded struct field is marshalled as a subdocument. The key will be the lowercased name of the field's type.
+//  3. An embedded struct field is marshalled as a subdocument. The key will be the lowercased name of the field's type.
 //
-//     4. A pointer field is marshalled as the underlying type if the pointer is non-nil. If the pointer is nil, it is
+//  4. A pointer field is marshalled as the underlying type if the pointer is non-nil. If the pointer is nil, it is
 //     marshalled as a BSON null value.
 //
-//     5. When unmarshalling, a field of type interface{} will follow the D/M type mappings listed above. BSON documents
+//  5. When unmarshalling, a field of type interface{} will follow the D/M type mappings listed above. BSON documents
 //     unmarshalled into an interface{} field will be unmarshalled as a D.
 //
 // The encoding of each struct field can be customized by the "bson" struct tag.
@@ -98,13 +100,14 @@
 // are not honored, but that can be enabled by creating a StructCodec with JSONFallbackStructTagParser, like below:
 //
 // Example:
-//      structcodec, _ := bsoncodec.NewStructCodec(bsoncodec.JSONFallbackStructTagParser)
+//
+//	structcodec, _ := bsoncodec.NewStructCodec(bsoncodec.JSONFallbackStructTagParser)
 //
 // The bson tag gives the name of the field, possibly followed by a comma-separated list of options.
 // The name may be empty in order to specify options without overriding the default field name. The following options can be used
 // to configure behavior:
 //
-//     1. omitempty: If the omitempty struct tag is specified on a field, the field will not be marshalled if it is set to
+//  1. omitempty: If the omitempty struct tag is specified on a field, the field will not be marshalled if it is set to
 //     the zero value. Fields with language primitive types such as integers, booleans, and strings are considered empty if
 //     their value is equal to the zero value for the type (i.e. 0 for integers, false for booleans, and "" for strings).
 //     Slices, maps, and arrays are considered empty if they are of length zero. Interfaces and pointers are considered
@@ -113,16 +116,16 @@
 //     never considered empty and will be marshalled as embedded documents.
 //     NOTE: It is recommended that this tag be used for all slice and map fields.
 //
-//     2. minsize: If the minsize struct tag is specified on a field of type int64, uint, uint32, or uint64 and the value of
+//  2. minsize: If the minsize struct tag is specified on a field of type int64, uint, uint32, or uint64 and the value of
 //     the field can fit in a signed int32, the field will be serialized as a BSON int32 rather than a BSON int64. For other
 //     types, this tag is ignored.
 //
-//     3. truncate: If the truncate struct tag is specified on a field with a non-float numeric type, BSON doubles unmarshalled
+//  3. truncate: If the truncate struct tag is specified on a field with a non-float numeric type, BSON doubles unmarshalled
 //     into that field will be truncated at the decimal point. For example, if 3.14 is unmarshalled into a field of type int,
 //     it will be unmarshalled as 3. If this tag is not specified, the decoder will throw an error if the value cannot be
 //     decoded without losing precision. For float64 or non-numeric types, this tag is ignored.
 //
-//     4. inline: If the inline struct tag is specified for a struct or map field, the field will be "flattened" when
+//  4. inline: If the inline struct tag is specified for a struct or map field, the field will be "flattened" when
 //     marshalling and "un-flattened" when unmarshalling. This means that all of the fields in that struct/map will be
 //     pulled up one level and will become top-level fields rather than being fields in a nested document. For example, if a
 //     map field named "Map" with value map[string]interface{}{"foo": "bar"} is inlined, the resulting document will be
@@ -132,7 +135,7 @@
 //     This tag can be used with fields that are pointers to structs. If an inlined pointer field is nil, it will not be
 //     marshalled. For fields that are not maps or structs, this tag is ignored.
 //
-// Marshalling and Unmarshalling
+// # Marshalling and Unmarshalling
 //
 // Manually marshalling and unmarshalling can be done with the Marshal and Unmarshal family of functions.
 package bson
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/primitive/decimal.go b/vendor/go.mongodb.org/mongo-driver/bson/primitive/decimal.go
index ffe4eed07ae4..ba7c9112e9b2 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/primitive/decimal.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/primitive/decimal.go
@@ -191,10 +191,9 @@ func (d Decimal128) IsNaN() bool {
 
 // IsInf returns:
 //
-//   +1 d == Infinity
-//    0 other case
-//   -1 d == -Infinity
-//
+//	+1 d == Infinity
+//	 0 other case
+//	-1 d == -Infinity
 func (d Decimal128) IsInf() int {
 	if d.h>>58&(1<<5-1) != 0x1E {
 		return 0
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/primitive/objectid.go b/vendor/go.mongodb.org/mongo-driver/bson/primitive/objectid.go
index 652898fea75c..ded3673165d2 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/primitive/objectid.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/primitive/objectid.go
@@ -61,7 +61,9 @@ func (id ObjectID) Timestamp() time.Time {
 
 // Hex returns the hex encoding of the ObjectID as a string.
 func (id ObjectID) Hex() string {
-	return hex.EncodeToString(id[:])
+	var buf [24]byte
+	hex.Encode(buf[:], id[:])
+	return string(buf[:])
 }
 
 func (id ObjectID) String() string {
diff --git a/vendor/go.mongodb.org/mongo-driver/bson/primitive/primitive.go b/vendor/go.mongodb.org/mongo-driver/bson/primitive/primitive.go
index b3cba1bf9dfc..c72ccc1c4d49 100644
--- a/vendor/go.mongodb.org/mongo-driver/bson/primitive/primitive.go
+++ b/vendor/go.mongodb.org/mongo-driver/bson/primitive/primitive.go
@@ -182,7 +182,7 @@ type MaxKey struct{}
 //
 // Example usage:
 //
-// 		bson.D{{"foo", "bar"}, {"hello", "world"}, {"pi", 3.14159}}
+//	bson.D{{"foo", "bar"}, {"hello", "world"}, {"pi", 3.14159}}
 type D []E
 
 // Map creates a map from the elements of the D.
@@ -206,12 +206,12 @@ type E struct {
 //
 // Example usage:
 //
-// 		bson.M{"foo": "bar", "hello": "world", "pi": 3.14159}
+//	bson.M{"foo": "bar", "hello": "world", "pi": 3.14159}
 type M map[string]interface{}
 
 // An A is an ordered representation of a BSON array.
 //
 // Example usage:
 //
-// 		bson.A{"bar", "world", 3.14159, bson.D{{"qux", 12345}}}
+//	bson.A{"bar", "world", 3.14159, bson.D{{"qux", 12345}}}
 type A []interface{}
diff --git a/vendor/go.mongodb.org/mongo-driver/x/bsonx/bsoncore/document_sequence.go b/vendor/go.mongodb.org/mongo-driver/x/bsonx/bsoncore/document_sequence.go
index 6c858a010992..e35bd0cd9ad3 100644
--- a/vendor/go.mongodb.org/mongo-driver/x/bsonx/bsoncore/document_sequence.go
+++ b/vendor/go.mongodb.org/mongo-driver/x/bsonx/bsoncore/document_sequence.go
@@ -96,8 +96,8 @@ func (ds *DocumentSequence) Empty() bool {
 	}
 }
 
-//ResetIterator resets the iteration point for the Next method to the beginning of the document
-//sequence.
+// ResetIterator resets the iteration point for the Next method to the beginning of the document
+// sequence.
 func (ds *DocumentSequence) ResetIterator() {
 	if ds == nil {
 		return
diff --git a/vendor/golang.org/x/net/http2/flow.go b/vendor/golang.org/x/net/http2/flow.go
index b51f0e0cf1f5..750ac52f2a52 100644
--- a/vendor/golang.org/x/net/http2/flow.go
+++ b/vendor/golang.org/x/net/http2/flow.go
@@ -6,23 +6,91 @@
 
 package http2
 
-// flow is the flow control window's size.
-type flow struct {
+// inflowMinRefresh is the minimum number of bytes we'll send for a
+// flow control window update.
+const inflowMinRefresh = 4 << 10
+
+// inflow accounts for an inbound flow control window.
+// It tracks both the latest window sent to the peer (used for enforcement)
+// and the accumulated unsent window.
+type inflow struct {
+	avail  int32
+	unsent int32
+}
+
+// set sets the initial window.
+func (f *inflow) init(n int32) {
+	f.avail = n
+}
+
+// add adds n bytes to the window, with a maximum window size of max,
+// indicating that the peer can now send us more data.
+// For example, the user read from a {Request,Response} body and consumed
+// some of the buffered data, so the peer can now send more.
+// It returns the number of bytes to send in a WINDOW_UPDATE frame to the peer.
+// Window updates are accumulated and sent when the unsent capacity
+// is at least inflowMinRefresh or will at least double the peer's available window.
+func (f *inflow) add(n int) (connAdd int32) {
+	if n < 0 {
+		panic("negative update")
+	}
+	unsent := int64(f.unsent) + int64(n)
+	// "A sender MUST NOT allow a flow-control window to exceed 2^31-1 octets."
+	// RFC 7540 Section 6.9.1.
+	const maxWindow = 1<<31 - 1
+	if unsent+int64(f.avail) > maxWindow {
+		panic("flow control update exceeds maximum window size")
+	}
+	f.unsent = int32(unsent)
+	if f.unsent < inflowMinRefresh && f.unsent < f.avail {
+		// If there aren't at least inflowMinRefresh bytes of window to send,
+		// and this update won't at least double the window, buffer the update for later.
+		return 0
+	}
+	f.avail += f.unsent
+	f.unsent = 0
+	return int32(unsent)
+}
+
+// take attempts to take n bytes from the peer's flow control window.
+// It reports whether the window has available capacity.
+func (f *inflow) take(n uint32) bool {
+	if n > uint32(f.avail) {
+		return false
+	}
+	f.avail -= int32(n)
+	return true
+}
+
+// takeInflows attempts to take n bytes from two inflows,
+// typically connection-level and stream-level flows.
+// It reports whether both windows have available capacity.
+func takeInflows(f1, f2 *inflow, n uint32) bool {
+	if n > uint32(f1.avail) || n > uint32(f2.avail) {
+		return false
+	}
+	f1.avail -= int32(n)
+	f2.avail -= int32(n)
+	return true
+}
+
+// outflow is the outbound flow control window's size.
+type outflow struct {
 	_ incomparable
 
 	// n is the number of DATA bytes we're allowed to send.
-	// A flow is kept both on a conn and a per-stream.
+	// An outflow is kept both on a conn and a per-stream.
 	n int32
 
-	// conn points to the shared connection-level flow that is
-	// shared by all streams on that conn. It is nil for the flow
+	// conn points to the shared connection-level outflow that is
+	// shared by all streams on that conn. It is nil for the outflow
 	// that's on the conn directly.
-	conn *flow
+	conn *outflow
 }
 
-func (f *flow) setConnFlow(cf *flow) { f.conn = cf }
+func (f *outflow) setConnFlow(cf *outflow) { f.conn = cf }
 
-func (f *flow) available() int32 {
+func (f *outflow) available() int32 {
 	n := f.n
 	if f.conn != nil && f.conn.n < n {
 		n = f.conn.n
@@ -30,7 +98,7 @@ func (f *flow) available() int32 {
 	return n
 }
 
-func (f *flow) take(n int32) {
+func (f *outflow) take(n int32) {
 	if n > f.available() {
 		panic("internal error: took too much")
 	}
@@ -42,7 +110,7 @@ func (f *flow) take(n int32) {
 
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
-func (f *flow) add(n int32) bool {
+func (f *outflow) add(n int32) bool {
 	sum := f.n + n
 	if (sum > n) == (f.n > 0) {
 		f.n = sum
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
index e35a76c07b73..b624dc0a705e 100644
--- a/vendor/golang.org/x/net/http2/server.go
+++ b/vendor/golang.org/x/net/http2/server.go
@@ -448,7 +448,7 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	// configured value for inflow, that will be updated when we send a
 	// WINDOW_UPDATE shortly after sending SETTINGS.
 	sc.flow.add(initialWindowSize)
-	sc.inflow.add(initialWindowSize)
+	sc.inflow.init(initialWindowSize)
 	sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf)
 	sc.hpackEncoder.SetMaxDynamicTableSizeLimit(s.maxEncoderHeaderTableSize())
 
@@ -563,8 +563,8 @@ type serverConn struct {
 	wroteFrameCh     chan frameWriteResult  // from writeFrameAsync -> serve, tickles more frame writes
 	bodyReadCh       chan bodyReadMsg       // from handlers -> serve
 	serveMsgCh       chan interface{}       // misc messages & code to send to / run on the serve loop
-	flow             flow                   // conn-wide (not stream-specific) outbound flow control
-	inflow           flow                   // conn-wide inbound flow control
+	flow             outflow                // conn-wide (not stream-specific) outbound flow control
+	inflow           inflow                 // conn-wide inbound flow control
 	tlsState         *tls.ConnectionState   // shared by all handlers, like net/http
 	remoteAddrStr    string
 	writeSched       WriteScheduler
@@ -588,6 +588,7 @@ type serverConn struct {
 	maxFrameSize                int32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
 	canonHeader                 map[string]string // http2-lower-case -> Go-Canonical-Case
+	canonHeaderKeysSize         int               // canonHeader keys size in bytes
 	writingFrame                bool              // started writing a frame (on serve goroutine or separate)
 	writingFrameAsync           bool              // started a frame on its own goroutine but haven't heard back on wroteFrameCh
 	needsFrameFlush             bool              // last frame write wasn't a flush
@@ -640,10 +641,10 @@ type stream struct {
 	cancelCtx func()
 
 	// owned by serverConn's serve loop:
-	bodyBytes        int64 // body bytes seen so far
-	declBodyBytes    int64 // or -1 if undeclared
-	flow             flow  // limits writing from Handler to client
-	inflow           flow  // what the client is allowed to POST/etc to us
+	bodyBytes        int64   // body bytes seen so far
+	declBodyBytes    int64   // or -1 if undeclared
+	flow             outflow // limits writing from Handler to client
+	inflow           inflow  // what the client is allowed to POST/etc to us
 	state            streamState
 	resetQueued      bool        // RST_STREAM queued for write; set by sc.resetStream
 	gotTrailerHeader bool        // HEADER frame for trailers was seen
@@ -766,6 +767,13 @@ func (sc *serverConn) condlogf(err error, format string, args ...interface{}) {
 	}
 }
 
+// maxCachedCanonicalHeadersKeysSize is an arbitrarily-chosen limit on the size
+// of the entries in the canonHeader cache.
+// This should be larger than the size of unique, uncommon header keys likely to
+// be sent by the peer, while not so high as to permit unreasonable memory usage
+// if the peer sends an unbounded number of unique header keys.
+const maxCachedCanonicalHeadersKeysSize = 2048
+
 func (sc *serverConn) canonicalHeader(v string) string {
 	sc.serveG.check()
 	buildCommonHeaderMapsOnce()
@@ -781,14 +789,10 @@ func (sc *serverConn) canonicalHeader(v string) string {
 		sc.canonHeader = make(map[string]string)
 	}
 	cv = http.CanonicalHeaderKey(v)
-	// maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
-	// entries in the canonHeader cache. This should be larger than the number
-	// of unique, uncommon header keys likely to be sent by the peer, while not
-	// so high as to permit unreasonable memory usage if the peer sends an unbounded
-	// number of unique header keys.
-	const maxCachedCanonicalHeaders = 32
-	if len(sc.canonHeader) < maxCachedCanonicalHeaders {
+	size := 100 + len(v)*2 // 100 bytes of map overhead + key + value
+	if sc.canonHeaderKeysSize+size <= maxCachedCanonicalHeadersKeysSize {
 		sc.canonHeader[v] = cv
+		sc.canonHeaderKeysSize += size
 	}
 	return cv
 }
@@ -1499,7 +1503,7 @@ func (sc *serverConn) processFrame(f Frame) error {
 	if sc.inGoAway && (sc.goAwayCode != ErrCodeNo || f.Header().StreamID > sc.maxClientStreamID) {
 
 		if f, ok := f.(*DataFrame); ok {
-			if sc.inflow.available() < int32(f.Length) {
+			if !sc.inflow.take(f.Length) {
 				return sc.countError("data_flow", streamError(f.Header().StreamID, ErrCodeFlowControl))
 			}
 			sc.sendWindowUpdate(nil, int(f.Length)) // conn-level
@@ -1771,14 +1775,9 @@ func (sc *serverConn) processData(f *DataFrame) error {
 		// But still enforce their connection-level flow control,
 		// and return any flow control bytes since we're not going
 		// to consume them.
-		if sc.inflow.available() < int32(f.Length) {
+		if !sc.inflow.take(f.Length) {
 			return sc.countError("data_flow", streamError(id, ErrCodeFlowControl))
 		}
-		// Deduct the flow control from inflow, since we're
-		// going to immediately add it back in
-		// sendWindowUpdate, which also schedules sending the
-		// frames.
-		sc.inflow.take(int32(f.Length))
 		sc.sendWindowUpdate(nil, int(f.Length)) // conn-level
 
 		if st != nil && st.resetQueued {
@@ -1793,10 +1792,9 @@ func (sc *serverConn) processData(f *DataFrame) error {
 
 	// Sender sending more than they'd declared?
 	if st.declBodyBytes != -1 && st.bodyBytes+int64(len(data)) > st.declBodyBytes {
-		if sc.inflow.available() < int32(f.Length) {
+		if !sc.inflow.take(f.Length) {
 			return sc.countError("data_flow", streamError(id, ErrCodeFlowControl))
 		}
-		sc.inflow.take(int32(f.Length))
 		sc.sendWindowUpdate(nil, int(f.Length)) // conn-level
 
 		st.body.CloseWithError(fmt.Errorf("sender tried to send more than declared Content-Length of %d bytes", st.declBodyBytes))
@@ -1807,10 +1805,9 @@ func (sc *serverConn) processData(f *DataFrame) error {
 	}
 	if f.Length > 0 {
 		// Check whether the client has flow control quota.
-		if st.inflow.available() < int32(f.Length) {
+		if !takeInflows(&sc.inflow, &st.inflow, f.Length) {
 			return sc.countError("flow_on_data_length", streamError(id, ErrCodeFlowControl))
 		}
-		st.inflow.take(int32(f.Length))
 
 		if len(data) > 0 {
 			wrote, err := st.body.Write(data)
@@ -1826,10 +1823,12 @@ func (sc *serverConn) processData(f *DataFrame) error {
 
 		// Return any padded flow control now, since we won't
 		// refund it later on body reads.
-		if pad := int32(f.Length) - int32(len(data)); pad > 0 {
-			sc.sendWindowUpdate32(nil, pad)
-			sc.sendWindowUpdate32(st, pad)
-		}
+		// Call sendWindowUpdate even if there is no padding,
+		// to return buffered flow control credit if the sent
+		// window has shrunk.
+		pad := int32(f.Length) - int32(len(data))
+		sc.sendWindowUpdate32(nil, pad)
+		sc.sendWindowUpdate32(st, pad)
 	}
 	if f.StreamEnded() {
 		st.endStream()
@@ -2101,8 +2100,7 @@ func (sc *serverConn) newStream(id, pusherID uint32, state streamState) *stream
 	st.cw.Init()
 	st.flow.conn = &sc.flow // link to conn-level counter
 	st.flow.add(sc.initialStreamSendWindowSize)
-	st.inflow.conn = &sc.inflow // link to conn-level counter
-	st.inflow.add(sc.srv.initialStreamRecvWindowSize())
+	st.inflow.init(sc.srv.initialStreamRecvWindowSize())
 	if sc.hs.WriteTimeout != 0 {
 		st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout)
 	}
@@ -2384,47 +2382,28 @@ func (sc *serverConn) noteBodyRead(st *stream, n int) {
 }
 
 // st may be nil for conn-level
-func (sc *serverConn) sendWindowUpdate(st *stream, n int) {
-	sc.serveG.check()
-	// "The legal range for the increment to the flow control
-	// window is 1 to 2^31-1 (2,147,483,647) octets."
-	// A Go Read call on 64-bit machines could in theory read
-	// a larger Read than this. Very unlikely, but we handle it here
-	// rather than elsewhere for now.
-	const maxUint31 = 1<<31 - 1
-	for n > maxUint31 {
-		sc.sendWindowUpdate32(st, maxUint31)
-		n -= maxUint31
-	}
-	sc.sendWindowUpdate32(st, int32(n))
+func (sc *serverConn) sendWindowUpdate32(st *stream, n int32) {
+	sc.sendWindowUpdate(st, int(n))
 }
 
 // st may be nil for conn-level
-func (sc *serverConn) sendWindowUpdate32(st *stream, n int32) {
+func (sc *serverConn) sendWindowUpdate(st *stream, n int) {
 	sc.serveG.check()
-	if n == 0 {
-		return
-	}
-	if n < 0 {
-		panic("negative update")
-	}
 	var streamID uint32
-	if st != nil {
+	var send int32
+	if st == nil {
+		send = sc.inflow.add(n)
+	} else {
 		streamID = st.id
+		send = st.inflow.add(n)
+	}
+	if send == 0 {
+		return
 	}
 	sc.writeFrame(FrameWriteRequest{
-		write:  writeWindowUpdate{streamID: streamID, n: uint32(n)},
+		write:  writeWindowUpdate{streamID: streamID, n: uint32(send)},
 		stream: st,
 	})
-	var ok bool
-	if st == nil {
-		ok = sc.inflow.add(n)
-	} else {
-		ok = st.inflow.add(n)
-	}
-	if !ok {
-		panic("internal error; sent too many window updates without decrements?")
-	}
 }
 
 // requestBody is the Handler's Request.Body type.
diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
index 30f706e6cb81..b43ec10cfed9 100644
--- a/vendor/golang.org/x/net/http2/transport.go
+++ b/vendor/golang.org/x/net/http2/transport.go
@@ -47,10 +47,6 @@ const (
 	// we buffer per stream.
 	transportDefaultStreamFlow = 4 << 20
 
-	// transportDefaultStreamMinRefresh is the minimum number of bytes we'll send
-	// a stream-level WINDOW_UPDATE for at a time.
-	transportDefaultStreamMinRefresh = 4 << 10
-
 	defaultUserAgent = "Go-http-client/2.0"
 
 	// initialMaxConcurrentStreams is a connections maxConcurrentStreams until
@@ -310,8 +306,8 @@ type ClientConn struct {
 
 	mu              sync.Mutex // guards following
 	cond            *sync.Cond // hold mu; broadcast on flow/closed changes
-	flow            flow       // our conn-level flow control quota (cs.flow is per stream)
-	inflow          flow       // peer's conn-level flow control
+	flow            outflow    // our conn-level flow control quota (cs.outflow is per stream)
+	inflow          inflow     // peer's conn-level flow control
 	doNotReuse      bool       // whether conn is marked to not be reused for any future requests
 	closing         bool
 	closed          bool
@@ -376,10 +372,10 @@ type clientStream struct {
 	respHeaderRecv chan struct{}  // closed when headers are received
 	res            *http.Response // set if respHeaderRecv is closed
 
-	flow        flow  // guarded by cc.mu
-	inflow      flow  // guarded by cc.mu
-	bytesRemain int64 // -1 means unknown; owned by transportResponseBody.Read
-	readErr     error // sticky read error; owned by transportResponseBody.Read
+	flow        outflow // guarded by cc.mu
+	inflow      inflow  // guarded by cc.mu
+	bytesRemain int64   // -1 means unknown; owned by transportResponseBody.Read
+	readErr     error   // sticky read error; owned by transportResponseBody.Read
 
 	reqBody              io.ReadCloser
 	reqBodyContentLength int64         // -1 means unknown
@@ -811,7 +807,7 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 	cc.bw.Write(clientPreface)
 	cc.fr.WriteSettings(initialSettings...)
 	cc.fr.WriteWindowUpdate(0, transportDefaultConnFlow)
-	cc.inflow.add(transportDefaultConnFlow + initialWindowSize)
+	cc.inflow.init(transportDefaultConnFlow + initialWindowSize)
 	cc.bw.Flush()
 	if cc.werr != nil {
 		cc.Close()
@@ -2073,8 +2069,7 @@ type resAndError struct {
 func (cc *ClientConn) addStreamLocked(cs *clientStream) {
 	cs.flow.add(int32(cc.initialWindowSize))
 	cs.flow.setConnFlow(&cc.flow)
-	cs.inflow.add(transportDefaultStreamFlow)
-	cs.inflow.setConnFlow(&cc.inflow)
+	cs.inflow.init(transportDefaultStreamFlow)
 	cs.ID = cc.nextStreamID
 	cc.nextStreamID += 2
 	cc.streams[cs.ID] = cs
@@ -2533,21 +2528,10 @@ func (b transportResponseBody) Read(p []byte) (n int, err error) {
 	}
 
 	cc.mu.Lock()
-	var connAdd, streamAdd int32
-	// Check the conn-level first, before the stream-level.
-	if v := cc.inflow.available(); v < transportDefaultConnFlow/2 {
-		connAdd = transportDefaultConnFlow - v
-		cc.inflow.add(connAdd)
-	}
+	connAdd := cc.inflow.add(n)
+	var streamAdd int32
 	if err == nil { // No need to refresh if the stream is over or failed.
-		// Consider any buffered body data (read from the conn but not
-		// consumed by the client) when computing flow control for this
-		// stream.
-		v := int(cs.inflow.available()) + cs.bufPipe.Len()
-		if v < transportDefaultStreamFlow-transportDefaultStreamMinRefresh {
-			streamAdd = int32(transportDefaultStreamFlow - v)
-			cs.inflow.add(streamAdd)
-		}
+		streamAdd = cs.inflow.add(n)
 	}
 	cc.mu.Unlock()
 
@@ -2575,17 +2559,15 @@ func (b transportResponseBody) Close() error {
 	if unread > 0 {
 		cc.mu.Lock()
 		// Return connection-level flow control.
-		if unread > 0 {
-			cc.inflow.add(int32(unread))
-		}
+		connAdd := cc.inflow.add(unread)
 		cc.mu.Unlock()
 
 		// TODO(dneil): Acquiring this mutex can block indefinitely.
 		// Move flow control return to a goroutine?
 		cc.wmu.Lock()
 		// Return connection-level flow control.
-		if unread > 0 {
-			cc.fr.WriteWindowUpdate(0, uint32(unread))
+		if connAdd > 0 {
+			cc.fr.WriteWindowUpdate(0, uint32(connAdd))
 		}
 		cc.bw.Flush()
 		cc.wmu.Unlock()
@@ -2628,13 +2610,18 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 		// But at least return their flow control:
 		if f.Length > 0 {
 			cc.mu.Lock()
-			cc.inflow.add(int32(f.Length))
+			ok := cc.inflow.take(f.Length)
+			connAdd := cc.inflow.add(int(f.Length))
 			cc.mu.Unlock()
-
-			cc.wmu.Lock()
-			cc.fr.WriteWindowUpdate(0, uint32(f.Length))
-			cc.bw.Flush()
-			cc.wmu.Unlock()
+			if !ok {
+				return ConnectionError(ErrCodeFlowControl)
+			}
+			if connAdd > 0 {
+				cc.wmu.Lock()
+				cc.fr.WriteWindowUpdate(0, uint32(connAdd))
+				cc.bw.Flush()
+				cc.wmu.Unlock()
+			}
 		}
 		return nil
 	}
@@ -2665,9 +2652,7 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 		}
 		// Check connection-level flow control.
 		cc.mu.Lock()
-		if cs.inflow.available() >= int32(f.Length) {
-			cs.inflow.take(int32(f.Length))
-		} else {
+		if !takeInflows(&cc.inflow, &cs.inflow, f.Length) {
 			cc.mu.Unlock()
 			return ConnectionError(ErrCodeFlowControl)
 		}
@@ -2689,19 +2674,20 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 			}
 		}
 
-		if refund > 0 {
-			cc.inflow.add(int32(refund))
-			if !didReset {
-				cs.inflow.add(int32(refund))
-			}
+		sendConn := cc.inflow.add(refund)
+		var sendStream int32
+		if !didReset {
+			sendStream = cs.inflow.add(refund)
 		}
 		cc.mu.Unlock()
 
-		if refund > 0 {
+		if sendConn > 0 || sendStream > 0 {
 			cc.wmu.Lock()
-			cc.fr.WriteWindowUpdate(0, uint32(refund))
-			if !didReset {
-				cc.fr.WriteWindowUpdate(cs.ID, uint32(refund))
+			if sendConn > 0 {
+				cc.fr.WriteWindowUpdate(0, uint32(sendConn))
+			}
+			if sendStream > 0 {
+				cc.fr.WriteWindowUpdate(cs.ID, uint32(sendStream))
 			}
 			cc.bw.Flush()
 			cc.wmu.Unlock()
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go
index e917195d53af..2bf3202b290f 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go
@@ -62,6 +62,13 @@ const (
 	// The AWS authorization header name for the auto-generated date.
 	awsDateHeader = "x-amz-date"
 
+	// Supported AWS configuration environment variables.
+	awsAccessKeyId     = "AWS_ACCESS_KEY_ID"
+	awsDefaultRegion   = "AWS_DEFAULT_REGION"
+	awsRegion          = "AWS_REGION"
+	awsSecretAccessKey = "AWS_SECRET_ACCESS_KEY"
+	awsSessionToken    = "AWS_SESSION_TOKEN"
+
 	awsTimeFormatLong  = "20060102T150405Z"
 	awsTimeFormatShort = "20060102"
 )
@@ -267,6 +274,49 @@ type awsRequest struct {
 	Headers []awsRequestHeader `json:"headers"`
 }
 
+func (cs awsCredentialSource) validateMetadataServers() error {
+	if err := cs.validateMetadataServer(cs.RegionURL, "region_url"); err != nil {
+		return err
+	}
+	if err := cs.validateMetadataServer(cs.CredVerificationURL, "url"); err != nil {
+		return err
+	}
+	return cs.validateMetadataServer(cs.IMDSv2SessionTokenURL, "imdsv2_session_token_url")
+}
+
+var validHostnames []string = []string{"169.254.169.254", "fd00:ec2::254"}
+
+func (cs awsCredentialSource) isValidMetadataServer(metadataUrl string) bool {
+	if metadataUrl == "" {
+		// Zero value means use default, which is valid.
+		return true
+	}
+
+	u, err := url.Parse(metadataUrl)
+	if err != nil {
+		// Unparseable URL means invalid
+		return false
+	}
+
+	for _, validHostname := range validHostnames {
+		if u.Hostname() == validHostname {
+			// If it's one of the valid hostnames, everything is good
+			return true
+		}
+	}
+
+	// hostname not found in our allowlist, so not valid
+	return false
+}
+
+func (cs awsCredentialSource) validateMetadataServer(metadataUrl, urlName string) error {
+	if !cs.isValidMetadataServer(metadataUrl) {
+		return fmt.Errorf("oauth2/google: invalid hostname %s for %s", metadataUrl, urlName)
+	}
+
+	return nil
+}
+
 func (cs awsCredentialSource) doRequest(req *http.Request) (*http.Response, error) {
 	if cs.client == nil {
 		cs.client = oauth2.NewClient(cs.ctx, nil)
@@ -274,16 +324,33 @@ func (cs awsCredentialSource) doRequest(req *http.Request) (*http.Response, erro
 	return cs.client.Do(req.WithContext(cs.ctx))
 }
 
+func canRetrieveRegionFromEnvironment() bool {
+	// The AWS region can be provided through AWS_REGION or AWS_DEFAULT_REGION. Only one is
+	// required.
+	return getenv(awsRegion) != "" || getenv(awsDefaultRegion) != ""
+}
+
+func canRetrieveSecurityCredentialFromEnvironment() bool {
+	// Check if both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are available.
+	return getenv(awsAccessKeyId) != "" && getenv(awsSecretAccessKey) != ""
+}
+
+func shouldUseMetadataServer() bool {
+	return !canRetrieveRegionFromEnvironment() || !canRetrieveSecurityCredentialFromEnvironment()
+}
+
 func (cs awsCredentialSource) subjectToken() (string, error) {
 	if cs.requestSigner == nil {
-		awsSessionToken, err := cs.getAWSSessionToken()
-		if err != nil {
-			return "", err
-		}
-
 		headers := make(map[string]string)
-		if awsSessionToken != "" {
-			headers[awsIMDSv2SessionTokenHeader] = awsSessionToken
+		if shouldUseMetadataServer() {
+			awsSessionToken, err := cs.getAWSSessionToken()
+			if err != nil {
+				return "", err
+			}
+
+			if awsSessionToken != "" {
+				headers[awsIMDSv2SessionTokenHeader] = awsSessionToken
+			}
 		}
 
 		awsSecurityCredentials, err := cs.getSecurityCredentials(headers)
@@ -389,11 +456,11 @@ func (cs *awsCredentialSource) getAWSSessionToken() (string, error) {
 }
 
 func (cs *awsCredentialSource) getRegion(headers map[string]string) (string, error) {
-	if envAwsRegion := getenv("AWS_REGION"); envAwsRegion != "" {
-		return envAwsRegion, nil
-	}
-	if envAwsRegion := getenv("AWS_DEFAULT_REGION"); envAwsRegion != "" {
-		return envAwsRegion, nil
+	if canRetrieveRegionFromEnvironment() {
+		if envAwsRegion := getenv(awsRegion); envAwsRegion != "" {
+			return envAwsRegion, nil
+		}
+		return getenv("AWS_DEFAULT_REGION"), nil
 	}
 
 	if cs.RegionURL == "" {
@@ -434,14 +501,12 @@ func (cs *awsCredentialSource) getRegion(headers map[string]string) (string, err
 }
 
 func (cs *awsCredentialSource) getSecurityCredentials(headers map[string]string) (result awsSecurityCredentials, err error) {
-	if accessKeyID := getenv("AWS_ACCESS_KEY_ID"); accessKeyID != "" {
-		if secretAccessKey := getenv("AWS_SECRET_ACCESS_KEY"); secretAccessKey != "" {
-			return awsSecurityCredentials{
-				AccessKeyID:     accessKeyID,
-				SecretAccessKey: secretAccessKey,
-				SecurityToken:   getenv("AWS_SESSION_TOKEN"),
-			}, nil
-		}
+	if canRetrieveSecurityCredentialFromEnvironment() {
+		return awsSecurityCredentials{
+			AccessKeyID:     getenv(awsAccessKeyId),
+			SecretAccessKey: getenv(awsSecretAccessKey),
+			SecurityToken:   getenv(awsSessionToken),
+		}, nil
 	}
 
 	roleName, err := cs.getMetadataRoleName(headers)
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go
index 9fc35535e7fe..3eab8df7ced7 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go
@@ -213,6 +213,10 @@ func (c *Config) parse(ctx context.Context) (baseCredentialSource, error) {
 				awsCredSource.IMDSv2SessionTokenURL = c.CredentialSource.IMDSv2SessionTokenURL
 			}
 
+			if err := awsCredSource.validateMetadataServers(); err != nil {
+				return nil, err
+			}
+
 			return awsCredSource, nil
 		}
 	} else if c.CredentialSource.File != "" {
diff --git a/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go b/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go
index 79a38a0b9bcc..a968b80fa6ab 100644
--- a/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go
+++ b/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go
@@ -4,6 +4,11 @@
 
 package cpu
 
+import (
+	"strings"
+	"syscall"
+)
+
 // HWCAP/HWCAP2 bits. These are exposed by Linux.
 const (
 	hwcap_FP       = 1 << 0
@@ -32,10 +37,45 @@ const (
 	hwcap_ASIMDFHM = 1 << 23
 )
 
+// linuxKernelCanEmulateCPUID reports whether we're running
+// on Linux 4.11+. Ideally we'd like to ask the question about
+// whether the current kernel contains
+// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77c97b4ee21290f5f083173d957843b615abbff2
+// but the version number will have to do.
+func linuxKernelCanEmulateCPUID() bool {
+	var un syscall.Utsname
+	syscall.Uname(&un)
+	var sb strings.Builder
+	for _, b := range un.Release[:] {
+		if b == 0 {
+			break
+		}
+		sb.WriteByte(byte(b))
+	}
+	major, minor, _, ok := parseRelease(sb.String())
+	return ok && (major > 4 || major == 4 && minor >= 11)
+}
+
 func doinit() {
 	if err := readHWCAP(); err != nil {
-		// failed to read /proc/self/auxv, try reading registers directly
-		readARM64Registers()
+		// We failed to read /proc/self/auxv. This can happen if the binary has
+		// been given extra capabilities(7) with /bin/setcap.
+		//
+		// When this happens, we have two options. If the Linux kernel is new
+		// enough (4.11+), we can read the arm64 registers directly which'll
+		// trap into the kernel and then return back to userspace.
+		//
+		// But on older kernels, such as Linux 4.4.180 as used on many Synology
+		// devices, calling readARM64Registers (specifically getisar0) will
+		// cause a SIGILL and we'll die. So for older kernels, parse /proc/cpuinfo
+		// instead.
+		//
+		// See golang/go#57336.
+		if linuxKernelCanEmulateCPUID() {
+			readARM64Registers()
+		} else {
+			readLinuxProcCPUInfo()
+		}
 		return
 	}
 
diff --git a/vendor/golang.org/x/sys/cpu/parse.go b/vendor/golang.org/x/sys/cpu/parse.go
new file mode 100644
index 000000000000..762b63d6882c
--- /dev/null
+++ b/vendor/golang.org/x/sys/cpu/parse.go
@@ -0,0 +1,43 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import "strconv"
+
+// parseRelease parses a dot-separated version number. It follows the semver
+// syntax, but allows the minor and patch versions to be elided.
+//
+// This is a copy of the Go runtime's parseRelease from
+// https://golang.org/cl/209597.
+func parseRelease(rel string) (major, minor, patch int, ok bool) {
+	// Strip anything after a dash or plus.
+	for i := 0; i < len(rel); i++ {
+		if rel[i] == '-' || rel[i] == '+' {
+			rel = rel[:i]
+			break
+		}
+	}
+
+	next := func() (int, bool) {
+		for i := 0; i < len(rel); i++ {
+			if rel[i] == '.' {
+				ver, err := strconv.Atoi(rel[:i])
+				rel = rel[i+1:]
+				return ver, err == nil
+			}
+		}
+		ver, err := strconv.Atoi(rel)
+		rel = ""
+		return ver, err == nil
+	}
+	if major, ok = next(); !ok || rel == "" {
+		return
+	}
+	if minor, ok = next(); !ok || rel == "" {
+		return
+	}
+	patch, ok = next()
+	return
+}
diff --git a/vendor/golang.org/x/sys/cpu/proc_cpuinfo_linux.go b/vendor/golang.org/x/sys/cpu/proc_cpuinfo_linux.go
new file mode 100644
index 000000000000..d87bd6b3eb05
--- /dev/null
+++ b/vendor/golang.org/x/sys/cpu/proc_cpuinfo_linux.go
@@ -0,0 +1,54 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && arm64
+// +build linux,arm64
+
+package cpu
+
+import (
+	"errors"
+	"io"
+	"os"
+	"strings"
+)
+
+func readLinuxProcCPUInfo() error {
+	f, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	var buf [1 << 10]byte // enough for first CPU
+	n, err := io.ReadFull(f, buf[:])
+	if err != nil && err != io.ErrUnexpectedEOF {
+		return err
+	}
+	in := string(buf[:n])
+	const features = "\nFeatures	: "
+	i := strings.Index(in, features)
+	if i == -1 {
+		return errors.New("no CPU features found")
+	}
+	in = in[i+len(features):]
+	if i := strings.Index(in, "\n"); i != -1 {
+		in = in[:i]
+	}
+	m := map[string]*bool{}
+
+	initOptions() // need it early here; it's harmless to call twice
+	for _, o := range options {
+		m[o.Name] = o.Feature
+	}
+	// The EVTSTRM field has alias "evstrm" in Go, but Linux calls it "evtstrm".
+	m["evtstrm"] = &ARM64.HasEVTSTRM
+
+	for _, f := range strings.Fields(in) {
+		if p, ok := m[f]; ok {
+			*p = true
+		}
+	}
+	return nil
+}
diff --git a/vendor/golang.org/x/sys/unix/gccgo.go b/vendor/golang.org/x/sys/unix/gccgo.go
index 0dee23222ca8..b06f52d748f6 100644
--- a/vendor/golang.org/x/sys/unix/gccgo.go
+++ b/vendor/golang.org/x/sys/unix/gccgo.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build gccgo && !aix
-// +build gccgo,!aix
+//go:build gccgo && !aix && !hurd
+// +build gccgo,!aix,!hurd
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/gccgo_c.c b/vendor/golang.org/x/sys/unix/gccgo_c.c
index 2cb1fefac640..c4fce0e70036 100644
--- a/vendor/golang.org/x/sys/unix/gccgo_c.c
+++ b/vendor/golang.org/x/sys/unix/gccgo_c.c
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build gccgo
-// +build !aix
+// +build gccgo,!hurd
+// +build !aix,!hurd
 
 #include <errno.h>
 #include <stdint.h>
diff --git a/vendor/golang.org/x/sys/unix/ioctl.go b/vendor/golang.org/x/sys/unix/ioctl.go
index 6c7ad052e6b3..1c51b0ec2bcd 100644
--- a/vendor/golang.org/x/sys/unix/ioctl.go
+++ b/vendor/golang.org/x/sys/unix/ioctl.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+//go:build aix || darwin || dragonfly || freebsd || hurd || linux || netbsd || openbsd || solaris
+// +build aix darwin dragonfly freebsd hurd linux netbsd openbsd solaris
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/mkall.sh b/vendor/golang.org/x/sys/unix/mkall.sh
index 727cba212704..8e3947c3686c 100644
--- a/vendor/golang.org/x/sys/unix/mkall.sh
+++ b/vendor/golang.org/x/sys/unix/mkall.sh
@@ -174,10 +174,10 @@ openbsd_arm64)
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
 	;;
 openbsd_mips64)
+	mkasm="go run mkasm.go"
 	mkerrors="$mkerrors -m64"
-	mksyscall="go run mksyscall.go -openbsd"
+	mksyscall="go run mksyscall.go -openbsd -libc"
 	mksysctl="go run mksysctl_openbsd.go"
-	mksysnum="go run mksysnum.go 'https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master'"
 	# Let the type of C char be signed for making the bare syscall
 	# API consistent across platforms.
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
diff --git a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
index 61c0d0de15d5..a41111a794e2 100644
--- a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
+++ b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
@@ -255,6 +255,7 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd.go b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
index de7c23e0648a..d50b9dc250b7 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
@@ -319,6 +319,7 @@ func PtraceSingleStep(pid int) (err error) {
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_hurd.go b/vendor/golang.org/x/sys/unix/syscall_hurd.go
new file mode 100644
index 000000000000..4ffb64808d75
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_hurd.go
@@ -0,0 +1,22 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build hurd
+// +build hurd
+
+package unix
+
+/*
+#include <stdint.h>
+int ioctl(int, unsigned long int, uintptr_t);
+*/
+import "C"
+
+func ioctl(fd int, req uint, arg uintptr) (err error) {
+	r0, er := C.ioctl(C.int(fd), C.ulong(req), C.uintptr_t(arg))
+	if r0 == -1 && er != nil {
+		err = er
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_hurd_386.go b/vendor/golang.org/x/sys/unix/syscall_hurd_386.go
new file mode 100644
index 000000000000..7cf54a3e4f10
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_hurd_386.go
@@ -0,0 +1,29 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build 386 && hurd
+// +build 386,hurd
+
+package unix
+
+const (
+	TIOCGETA = 0x62251713
+)
+
+type Winsize struct {
+	Row    uint16
+	Col    uint16
+	Xpixel uint16
+	Ypixel uint16
+}
+
+type Termios struct {
+	Iflag  uint32
+	Oflag  uint32
+	Cflag  uint32
+	Lflag  uint32
+	Cc     [20]uint8
+	Ispeed int32
+	Ospeed int32
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go
index c5a98440eca1..d839962e6633 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -1973,36 +1973,46 @@ func Signalfd(fd int, sigmask *Sigset_t, flags int) (newfd int, err error) {
 //sys	preadv2(fd int, iovs []Iovec, offs_l uintptr, offs_h uintptr, flags int) (n int, err error) = SYS_PREADV2
 //sys	pwritev2(fd int, iovs []Iovec, offs_l uintptr, offs_h uintptr, flags int) (n int, err error) = SYS_PWRITEV2
 
-func bytes2iovec(bs [][]byte) []Iovec {
-	iovecs := make([]Iovec, len(bs))
-	for i, b := range bs {
-		iovecs[i].SetLen(len(b))
+// minIovec is the size of the small initial allocation used by
+// Readv, Writev, etc.
+//
+// This small allocation gets stack allocated, which lets the
+// common use case of len(iovs) <= minIovs avoid more expensive
+// heap allocations.
+const minIovec = 8
+
+// appendBytes converts bs to Iovecs and appends them to vecs.
+func appendBytes(vecs []Iovec, bs [][]byte) []Iovec {
+	for _, b := range bs {
+		var v Iovec
+		v.SetLen(len(b))
 		if len(b) > 0 {
-			iovecs[i].Base = &b[0]
+			v.Base = &b[0]
 		} else {
-			iovecs[i].Base = (*byte)(unsafe.Pointer(&_zero))
+			v.Base = (*byte)(unsafe.Pointer(&_zero))
 		}
+		vecs = append(vecs, v)
 	}
-	return iovecs
+	return vecs
 }
 
-// offs2lohi splits offs into its lower and upper unsigned long. On 64-bit
-// systems, hi will always be 0. On 32-bit systems, offs will be split in half.
-// preadv/pwritev chose this calling convention so they don't need to add a
-// padding-register for alignment on ARM.
+// offs2lohi splits offs into its low and high order bits.
 func offs2lohi(offs int64) (lo, hi uintptr) {
-	return uintptr(offs), uintptr(uint64(offs) >> SizeofLong)
+	const longBits = SizeofLong * 8
+	return uintptr(offs), uintptr(uint64(offs) >> longBits)
 }
 
 func Readv(fd int, iovs [][]byte) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	n, err = readv(fd, iovecs)
 	readvRacedetect(iovecs, n, err)
 	return n, err
 }
 
 func Preadv(fd int, iovs [][]byte, offset int64) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	lo, hi := offs2lohi(offset)
 	n, err = preadv(fd, iovecs, lo, hi)
 	readvRacedetect(iovecs, n, err)
@@ -2010,7 +2020,8 @@ func Preadv(fd int, iovs [][]byte, offset int64) (n int, err error) {
 }
 
 func Preadv2(fd int, iovs [][]byte, offset int64, flags int) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	lo, hi := offs2lohi(offset)
 	n, err = preadv2(fd, iovecs, lo, hi, flags)
 	readvRacedetect(iovecs, n, err)
@@ -2037,7 +2048,8 @@ func readvRacedetect(iovecs []Iovec, n int, err error) {
 }
 
 func Writev(fd int, iovs [][]byte) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
 	}
@@ -2047,7 +2059,8 @@ func Writev(fd int, iovs [][]byte) (n int, err error) {
 }
 
 func Pwritev(fd int, iovs [][]byte, offset int64) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
 	}
@@ -2058,7 +2071,8 @@ func Pwritev(fd int, iovs [][]byte, offset int64) (n int, err error) {
 }
 
 func Pwritev2(fd int, iovs [][]byte, offset int64, flags int) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
 	}
diff --git a/vendor/golang.org/x/sys/unix/syscall_netbsd.go b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
index 666f0a1b33d2..35a3ad758f59 100644
--- a/vendor/golang.org/x/sys/unix/syscall_netbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
@@ -110,6 +110,20 @@ func direntNamlen(buf []byte) (uint64, bool) {
 	return readInt(buf, unsafe.Offsetof(Dirent{}.Namlen), unsafe.Sizeof(Dirent{}.Namlen))
 }
 
+func SysctlUvmexp(name string) (*Uvmexp, error) {
+	mib, err := sysctlmib(name)
+	if err != nil {
+		return nil, err
+	}
+
+	n := uintptr(SizeofUvmexp)
+	var u Uvmexp
+	if err := sysctl(mib, (*byte)(unsafe.Pointer(&u)), &n, nil, 0); err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
 func Pipe(p []int) (err error) {
 	return Pipe2(p, 0)
 }
@@ -245,6 +259,7 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd.go b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
index 78daceb338bc..9b67b908e5f9 100644
--- a/vendor/golang.org/x/sys/unix/syscall_openbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
@@ -220,6 +220,7 @@ func Uname(uname *Utsname) error {
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go b/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go
index e23c5394eff3..04aa43f41b25 100644
--- a/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build openbsd && !mips64
-// +build openbsd,!mips64
+//go:build openbsd
+// +build openbsd
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_solaris.go b/vendor/golang.org/x/sys/unix/syscall_solaris.go
index 2109e569ccef..07ac56109a05 100644
--- a/vendor/golang.org/x/sys/unix/syscall_solaris.go
+++ b/vendor/golang.org/x/sys/unix/syscall_solaris.go
@@ -590,6 +590,7 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Creat(path string, mode uint32) (fd int, err error)
 //sys	Dup(fd int) (nfd int, err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_unix.go b/vendor/golang.org/x/sys/unix/syscall_unix.go
index 00bafda86545..a386f8897df3 100644
--- a/vendor/golang.org/x/sys/unix/syscall_unix.go
+++ b/vendor/golang.org/x/sys/unix/syscall_unix.go
@@ -331,6 +331,19 @@ func Recvfrom(fd int, p []byte, flags int) (n int, from Sockaddr, err error) {
 	return
 }
 
+// Recvmsg receives a message from a socket using the recvmsg system call. The
+// received non-control data will be written to p, and any "out of band"
+// control data will be written to oob. The flags are passed to recvmsg.
+//
+// The results are:
+//   - n is the number of non-control data bytes read into p
+//   - oobn is the number of control data bytes read into oob; this may be interpreted using [ParseSocketControlMessage]
+//   - recvflags is flags returned by recvmsg
+//   - from is the address of the sender
+//
+// If the underlying socket type is not SOCK_DGRAM, a received message
+// containing oob data and a single '\0' of non-control data is treated as if
+// the message contained only control data, i.e. n will be zero on return.
 func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
 	var iov [1]Iovec
 	if len(p) > 0 {
@@ -346,13 +359,9 @@ func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from
 	return
 }
 
-// RecvmsgBuffers receives a message from a socket using the recvmsg
-// system call. The flags are passed to recvmsg. Any non-control data
-// read is scattered into the buffers slices. The results are:
-//   - n is the number of non-control data read into bufs
-//   - oobn is the number of control data read into oob; this may be interpreted using [ParseSocketControlMessage]
-//   - recvflags is flags returned by recvmsg
-//   - from is the address of the sender
+// RecvmsgBuffers receives a message from a socket using the recvmsg system
+// call. This function is equivalent to Recvmsg, but non-control data read is
+// scattered into the buffers slices.
 func RecvmsgBuffers(fd int, buffers [][]byte, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
 	iov := make([]Iovec, len(buffers))
 	for i := range buffers {
@@ -371,11 +380,38 @@ func RecvmsgBuffers(fd int, buffers [][]byte, oob []byte, flags int) (n, oobn in
 	return
 }
 
+// Sendmsg sends a message on a socket to an address using the sendmsg system
+// call. This function is equivalent to SendmsgN, but does not return the
+// number of bytes actually sent.
 func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
 	_, err = SendmsgN(fd, p, oob, to, flags)
 	return
 }
 
+// SendmsgN sends a message on a socket to an address using the sendmsg system
+// call. p contains the non-control data to send, and oob contains the "out of
+// band" control data. The flags are passed to sendmsg. The number of
+// non-control bytes actually written to the socket is returned.
+//
+// Some socket types do not support sending control data without accompanying
+// non-control data. If p is empty, and oob contains control data, and the
+// underlying socket type is not SOCK_DGRAM, p will be treated as containing a
+// single '\0' and the return value will indicate zero bytes sent.
+//
+// The Go function Recvmsg, if called with an empty p and a non-empty oob,
+// will read and ignore this additional '\0'.  If the message is received by
+// code that does not use Recvmsg, or that does not use Go at all, that code
+// will need to be written to expect and ignore the additional '\0'.
+//
+// If you need to send non-empty oob with p actually empty, and if the
+// underlying socket type supports it, you can do so via a raw system call as
+// follows:
+//
+//	msg := &unix.Msghdr{
+//	    Control: &oob[0],
+//	}
+//	msg.SetControllen(len(oob))
+//	n, _, errno := unix.Syscall(unix.SYS_SENDMSG, uintptr(fd), uintptr(unsafe.Pointer(msg)), flags)
 func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error) {
 	var iov [1]Iovec
 	if len(p) > 0 {
@@ -394,9 +430,8 @@ func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error)
 }
 
 // SendmsgBuffers sends a message on a socket to an address using the sendmsg
-// system call. The flags are passed to sendmsg. Any non-control data written
-// is gathered from buffers. The function returns the number of bytes written
-// to the socket.
+// system call. This function is equivalent to SendmsgN, but the non-control
+// data is gathered from buffers.
 func SendmsgBuffers(fd int, buffers [][]byte, oob []byte, to Sockaddr, flags int) (n int, err error) {
 	iov := make([]Iovec, len(buffers))
 	for i := range buffers {
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go
index 6d56edc05ac3..af20e474b388 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go
@@ -46,6 +46,7 @@ const (
 	AF_SNA                            = 0xb
 	AF_UNIX                           = 0x1
 	AF_UNSPEC                         = 0x0
+	ALTWERASE                         = 0x200
 	ARPHRD_ETHER                      = 0x1
 	ARPHRD_FRELAY                     = 0xf
 	ARPHRD_IEEE1394                   = 0x18
@@ -108,6 +109,15 @@ const (
 	BPF_DIRECTION_IN                  = 0x1
 	BPF_DIRECTION_OUT                 = 0x2
 	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -136,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -147,6 +158,12 @@ const (
 	BRKINT                            = 0x2
 	CFLUSH                            = 0xf
 	CLOCAL                            = 0x8000
+	CLOCK_BOOTTIME                    = 0x6
+	CLOCK_MONOTONIC                   = 0x3
+	CLOCK_PROCESS_CPUTIME_ID          = 0x2
+	CLOCK_REALTIME                    = 0x0
+	CLOCK_THREAD_CPUTIME_ID           = 0x4
+	CLOCK_UPTIME                      = 0x5
 	CPUSTATES                         = 0x6
 	CP_IDLE                           = 0x5
 	CP_INTR                           = 0x4
@@ -170,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc100445d
+	DIOCADDRULE                       = 0xccc84404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xccc8441a
+	DIOCCLRIFFLAG                     = 0xc024445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0d04412
+	DIOCCLRSTATUS                     = 0xc0244416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1084460
+	DIOCGETQUEUE                      = 0xc100445f
+	DIOCGETQUEUES                     = 0xc100445e
+	DIOCGETRULE                       = 0xccc84407
+	DIOCGETRULES                      = 0xccc84406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0084454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0084419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0244457
+	DIOCKILLSRCNODES                  = 0xc068445b
+	DIOCKILLSTATES                    = 0xc0d04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc084444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0844450
+	DIOCRADDADDRS                     = 0xc44c4443
+	DIOCRADDTABLES                    = 0xc44c443d
+	DIOCRCLRADDRS                     = 0xc44c4442
+	DIOCRCLRASTATS                    = 0xc44c4448
+	DIOCRCLRTABLES                    = 0xc44c443c
+	DIOCRCLRTSTATS                    = 0xc44c4441
+	DIOCRDELADDRS                     = 0xc44c4444
+	DIOCRDELTABLES                    = 0xc44c443e
+	DIOCRGETADDRS                     = 0xc44c4446
+	DIOCRGETASTATS                    = 0xc44c4447
+	DIOCRGETTABLES                    = 0xc44c443f
+	DIOCRGETTSTATS                    = 0xc44c4440
+	DIOCRINADEFINE                    = 0xc44c444d
+	DIOCRSETADDRS                     = 0xc44c4445
+	DIOCRSETTFLAGS                    = 0xc44c444a
+	DIOCRTSTADDRS                     = 0xc44c4449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0244459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0244414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc00c4451
+	DIOCXCOMMIT                       = 0xc00c4452
+	DIOCXROLLBACK                     = 0xc00c4453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -186,6 +261,7 @@ const (
 	DLT_LOOP                          = 0xc
 	DLT_MPLS                          = 0xdb
 	DLT_NULL                          = 0x0
+	DLT_OPENFLOW                      = 0x10b
 	DLT_PFLOG                         = 0x75
 	DLT_PFSYNC                        = 0x12
 	DLT_PPP                           = 0x9
@@ -196,6 +272,23 @@ const (
 	DLT_RAW                           = 0xe
 	DLT_SLIP                          = 0x8
 	DLT_SLIP_BSDOS                    = 0xf
+	DLT_USBPCAP                       = 0xf9
+	DLT_USER0                         = 0x93
+	DLT_USER1                         = 0x94
+	DLT_USER10                        = 0x9d
+	DLT_USER11                        = 0x9e
+	DLT_USER12                        = 0x9f
+	DLT_USER13                        = 0xa0
+	DLT_USER14                        = 0xa1
+	DLT_USER15                        = 0xa2
+	DLT_USER2                         = 0x95
+	DLT_USER3                         = 0x96
+	DLT_USER4                         = 0x97
+	DLT_USER5                         = 0x98
+	DLT_USER6                         = 0x99
+	DLT_USER7                         = 0x9a
+	DLT_USER8                         = 0x9b
+	DLT_USER9                         = 0x9c
 	DT_BLK                            = 0x6
 	DT_CHR                            = 0x2
 	DT_DIR                            = 0x4
@@ -215,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -267,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -298,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -326,15 +423,17 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
+	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
 	ETHERTYPE_PPP                     = 0x880b
@@ -409,28 +508,40 @@ const (
 	ETHER_CRC_POLY_LE                 = 0xedb88320
 	ETHER_HDR_LEN                     = 0xe
 	ETHER_MAX_DIX_LEN                 = 0x600
+	ETHER_MAX_HARDMTU_LEN             = 0xff9b
 	ETHER_MAX_LEN                     = 0x5ee
 	ETHER_MIN_LEN                     = 0x40
 	ETHER_TYPE_LEN                    = 0x2
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
+	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x7
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
+	EVL_ENCAPLEN                      = 0x4
+	EVL_PRIO_BITS                     = 0xd
+	EVL_PRIO_MAX                      = 0x7
+	EVL_VLID_MASK                     = 0xfff
+	EVL_VLID_MAX                      = 0xffe
+	EVL_VLID_MIN                      = 0x1
+	EVL_VLID_NULL                     = 0x0
 	EV_ADD                            = 0x1
 	EV_CLEAR                          = 0x20
 	EV_DELETE                         = 0x2
 	EV_DISABLE                        = 0x8
+	EV_DISPATCH                       = 0x80
 	EV_ENABLE                         = 0x4
 	EV_EOF                            = 0x8000
 	EV_ERROR                          = 0x4000
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
-	EV_SYSFLAGS                       = 0xf000
+	EV_RECEIPT                        = 0x40
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -443,6 +554,7 @@ const (
 	F_GETFL                           = 0x3
 	F_GETLK                           = 0x7
 	F_GETOWN                          = 0x5
+	F_ISATTY                          = 0xb
 	F_OK                              = 0x0
 	F_RDLCK                           = 0x1
 	F_SETFD                           = 0x2
@@ -460,7 +572,6 @@ const (
 	IEXTEN                            = 0x400
 	IFAN_ARRIVAL                      = 0x0
 	IFAN_DEPARTURE                    = 0x1
-	IFA_ROUTE                         = 0x1
 	IFF_ALLMULTI                      = 0x200
 	IFF_BROADCAST                     = 0x2
 	IFF_CANTCHANGE                    = 0x8e52
@@ -471,12 +582,12 @@ const (
 	IFF_LOOPBACK                      = 0x8
 	IFF_MULTICAST                     = 0x8000
 	IFF_NOARP                         = 0x80
-	IFF_NOTRAILERS                    = 0x20
 	IFF_OACTIVE                       = 0x400
 	IFF_POINTOPOINT                   = 0x10
 	IFF_PROMISC                       = 0x100
 	IFF_RUNNING                       = 0x40
 	IFF_SIMPLEX                       = 0x800
+	IFF_STATICARP                     = 0x20
 	IFF_UP                            = 0x1
 	IFNAMSIZ                          = 0x10
 	IFT_1822                          = 0x2
@@ -605,6 +716,7 @@ const (
 	IFT_LINEGROUP                     = 0xd2
 	IFT_LOCALTALK                     = 0x2a
 	IFT_LOOP                          = 0x18
+	IFT_MBIM                          = 0xfa
 	IFT_MEDIAMAILOVERIP               = 0x8b
 	IFT_MFSIGLINK                     = 0xa7
 	IFT_MIOX25                        = 0x26
@@ -695,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -729,8 +842,6 @@ const (
 	IPPROTO_AH                        = 0x33
 	IPPROTO_CARP                      = 0x70
 	IPPROTO_DIVERT                    = 0x102
-	IPPROTO_DIVERT_INIT               = 0x2
-	IPPROTO_DIVERT_RESP               = 0x1
 	IPPROTO_DONE                      = 0x101
 	IPPROTO_DSTOPTS                   = 0x3c
 	IPPROTO_EGP                       = 0x8
@@ -762,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -787,6 +900,7 @@ const (
 	IPV6_LEAVE_GROUP                  = 0xd
 	IPV6_MAXHLIM                      = 0xff
 	IPV6_MAXPACKET                    = 0xffff
+	IPV6_MINHOPCOUNT                  = 0x41
 	IPV6_MMTU                         = 0x500
 	IPV6_MULTICAST_HOPS               = 0xa
 	IPV6_MULTICAST_IF                 = 0x9
@@ -826,12 +940,12 @@ const (
 	IP_DEFAULT_MULTICAST_LOOP         = 0x1
 	IP_DEFAULT_MULTICAST_TTL          = 0x1
 	IP_DF                             = 0x4000
-	IP_DIVERTFL                       = 0x1022
 	IP_DROP_MEMBERSHIP                = 0xd
 	IP_ESP_NETWORK_LEVEL              = 0x16
 	IP_ESP_TRANS_LEVEL                = 0x15
 	IP_HDRINCL                        = 0x2
 	IP_IPCOMP_LEVEL                   = 0x1d
+	IP_IPDEFTTL                       = 0x25
 	IP_IPSECFLOWINFO                  = 0x24
 	IP_IPSEC_LOCAL_AUTH               = 0x1b
 	IP_IPSEC_LOCAL_CRED               = 0x19
@@ -865,10 +979,15 @@ const (
 	IP_RETOPTS                        = 0x8
 	IP_RF                             = 0x8000
 	IP_RTABLE                         = 0x1021
+	IP_SENDSRCADDR                    = 0x7
 	IP_TOS                            = 0x3
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
+	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
 	IXON                              = 0x200
@@ -900,10 +1019,11 @@ const (
 	MAP_INHERIT_COPY                  = 0x1
 	MAP_INHERIT_NONE                  = 0x2
 	MAP_INHERIT_SHARE                 = 0x0
-	MAP_NOEXTEND                      = 0x100
-	MAP_NORESERVE                     = 0x40
+	MAP_INHERIT_ZERO                  = 0x3
+	MAP_NOEXTEND                      = 0x0
+	MAP_NORESERVE                     = 0x0
 	MAP_PRIVATE                       = 0x2
-	MAP_RENAME                        = 0x20
+	MAP_RENAME                        = 0x0
 	MAP_SHARED                        = 0x1
 	MAP_STACK                         = 0x4000
 	MAP_TRYFIXED                      = 0x0
@@ -922,6 +1042,7 @@ const (
 	MNT_NOATIME                       = 0x8000
 	MNT_NODEV                         = 0x10
 	MNT_NOEXEC                        = 0x4
+	MNT_NOPERM                        = 0x20
 	MNT_NOSUID                        = 0x8
 	MNT_NOWAIT                        = 0x2
 	MNT_QUOTA                         = 0x2000
@@ -929,13 +1050,29 @@ const (
 	MNT_RELOAD                        = 0x40000
 	MNT_ROOTFS                        = 0x4000
 	MNT_SOFTDEP                       = 0x4000000
+	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
 	MNT_SYNCHRONOUS                   = 0x2
 	MNT_UPDATE                        = 0x10000
 	MNT_VISFLAGMASK                   = 0x400ffff
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
+	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
 	MSG_DONTROUTE                     = 0x4
 	MSG_DONTWAIT                      = 0x80
@@ -946,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -953,12 +1091,16 @@ const (
 	NET_RT_DUMP                       = 0x1
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
-	NET_RT_MAXID                      = 0x6
+	NET_RT_IFNAMES                    = 0x6
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
 	NOFLSH                            = 0x80000000
+	NOKERNINFO                        = 0x2000000
 	NOTE_ATTRIB                       = 0x8
+	NOTE_CHANGE                       = 0x1
 	NOTE_CHILD                        = 0x4
 	NOTE_DELETE                       = 0x1
 	NOTE_EOF                          = 0x2
@@ -968,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -977,11 +1120,13 @@ const (
 	NOTE_TRUNCATE                     = 0x80
 	NOTE_WRITE                        = 0x2
 	OCRNL                             = 0x10
+	OLCUC                             = 0x20
 	ONLCR                             = 0x2
 	ONLRET                            = 0x80
 	ONOCR                             = 0x40
 	ONOEOT                            = 0x8
 	OPOST                             = 0x1
+	OXTABS                            = 0x4
 	O_ACCMODE                         = 0x3
 	O_APPEND                          = 0x8
 	O_ASYNC                           = 0x40
@@ -1015,7 +1160,6 @@ const (
 	PROT_NONE                         = 0x0
 	PROT_READ                         = 0x1
 	PROT_WRITE                        = 0x2
-	PT_MASK                           = 0x3ff000
 	RLIMIT_CORE                       = 0x4
 	RLIMIT_CPU                        = 0x0
 	RLIMIT_DATA                       = 0x2
@@ -1027,19 +1171,25 @@ const (
 	RLIMIT_STACK                      = 0x3
 	RLIM_INFINITY                     = 0x7fffffffffffffff
 	RTAX_AUTHOR                       = 0x6
+	RTAX_BFD                          = 0xb
 	RTAX_BRD                          = 0x7
+	RTAX_DNS                          = 0xc
 	RTAX_DST                          = 0x0
 	RTAX_GATEWAY                      = 0x1
 	RTAX_GENMASK                      = 0x3
 	RTAX_IFA                          = 0x5
 	RTAX_IFP                          = 0x4
 	RTAX_LABEL                        = 0xa
-	RTAX_MAX                          = 0xb
+	RTAX_MAX                          = 0xf
 	RTAX_NETMASK                      = 0x2
+	RTAX_SEARCH                       = 0xe
 	RTAX_SRC                          = 0x8
 	RTAX_SRCMASK                      = 0x9
+	RTAX_STATIC                       = 0xd
 	RTA_AUTHOR                        = 0x40
+	RTA_BFD                           = 0x800
 	RTA_BRD                           = 0x80
+	RTA_DNS                           = 0x1000
 	RTA_DST                           = 0x1
 	RTA_GATEWAY                       = 0x2
 	RTA_GENMASK                       = 0x8
@@ -1047,49 +1197,57 @@ const (
 	RTA_IFP                           = 0x10
 	RTA_LABEL                         = 0x400
 	RTA_NETMASK                       = 0x4
+	RTA_SEARCH                        = 0x4000
 	RTA_SRC                           = 0x100
 	RTA_SRCMASK                       = 0x200
+	RTA_STATIC                        = 0x2000
 	RTF_ANNOUNCE                      = 0x4000
+	RTF_BFD                           = 0x1000000
 	RTF_BLACKHOLE                     = 0x1000
+	RTF_BROADCAST                     = 0x400000
+	RTF_CACHED                        = 0x20000
 	RTF_CLONED                        = 0x10000
 	RTF_CLONING                       = 0x100
+	RTF_CONNECTED                     = 0x800000
 	RTF_DONE                          = 0x40
 	RTF_DYNAMIC                       = 0x10
-	RTF_FMASK                         = 0x10f808
+	RTF_FMASK                         = 0x110fc08
 	RTF_GATEWAY                       = 0x2
 	RTF_HOST                          = 0x4
 	RTF_LLINFO                        = 0x400
-	RTF_MASK                          = 0x80
+	RTF_LOCAL                         = 0x200000
 	RTF_MODIFIED                      = 0x20
 	RTF_MPATH                         = 0x40000
 	RTF_MPLS                          = 0x100000
+	RTF_MULTICAST                     = 0x200
 	RTF_PERMANENT_ARP                 = 0x2000
 	RTF_PROTO1                        = 0x8000
 	RTF_PROTO2                        = 0x4000
 	RTF_PROTO3                        = 0x2000
 	RTF_REJECT                        = 0x8
-	RTF_SOURCE                        = 0x20000
 	RTF_STATIC                        = 0x800
-	RTF_TUNNEL                        = 0x100000
 	RTF_UP                            = 0x1
 	RTF_USETRAILERS                   = 0x8000
-	RTF_XRESOLVE                      = 0x200
+	RTM_80211INFO                     = 0x15
 	RTM_ADD                           = 0x1
+	RTM_BFD                           = 0x12
 	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
 	RTM_DELADDR                       = 0xd
 	RTM_DELETE                        = 0x2
 	RTM_DESYNC                        = 0x10
 	RTM_GET                           = 0x4
 	RTM_IFANNOUNCE                    = 0xf
 	RTM_IFINFO                        = 0xe
-	RTM_LOCK                          = 0x8
+	RTM_INVALIDATE                    = 0x11
 	RTM_LOSING                        = 0x5
 	RTM_MAXSIZE                       = 0x800
 	RTM_MISS                          = 0x7
 	RTM_NEWADDR                       = 0xc
+	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1099,67 +1257,74 @@ const (
 	RTV_RTTVAR                        = 0x80
 	RTV_SPIPE                         = 0x10
 	RTV_SSTHRESH                      = 0x20
+	RT_TABLEID_BITS                   = 0x8
+	RT_TABLEID_MASK                   = 0xff
 	RT_TABLEID_MAX                    = 0xff
 	RUSAGE_CHILDREN                   = -0x1
 	RUSAGE_SELF                       = 0x0
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
 	SIOCADDMULTI                      = 0x80206931
 	SIOCAIFADDR                       = 0x8040691a
 	SIOCAIFGROUP                      = 0x80246987
-	SIOCALIFADDR                      = 0x8218691c
 	SIOCATMARK                        = 0x40047307
-	SIOCBRDGADD                       = 0x8054693c
-	SIOCBRDGADDS                      = 0x80546941
-	SIOCBRDGARL                       = 0x806e694d
+	SIOCBRDGADD                       = 0x805c693c
+	SIOCBRDGADDL                      = 0x805c6949
+	SIOCBRDGADDS                      = 0x805c6941
+	SIOCBRDGARL                       = 0x808c694d
 	SIOCBRDGDADDR                     = 0x81286947
-	SIOCBRDGDEL                       = 0x8054693d
-	SIOCBRDGDELS                      = 0x80546942
-	SIOCBRDGFLUSH                     = 0x80546948
-	SIOCBRDGFRL                       = 0x806e694e
+	SIOCBRDGDEL                       = 0x805c693d
+	SIOCBRDGDELS                      = 0x805c6942
+	SIOCBRDGFLUSH                     = 0x805c6948
+	SIOCBRDGFRL                       = 0x808c694e
 	SIOCBRDGGCACHE                    = 0xc0146941
 	SIOCBRDGGFD                       = 0xc0146952
 	SIOCBRDGGHT                       = 0xc0146951
-	SIOCBRDGGIFFLGS                   = 0xc054693e
+	SIOCBRDGGIFFLGS                   = 0xc05c693e
 	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc03c6958
 	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc028694f
-	SIOCBRDGGSIFS                     = 0xc054693c
 	SIOCBRDGGTO                       = 0xc0146946
-	SIOCBRDGIFS                       = 0xc0546942
+	SIOCBRDGIFS                       = 0xc05c6942
 	SIOCBRDGRTS                       = 0xc0186943
 	SIOCBRDGSADDR                     = 0xc1286944
 	SIOCBRDGSCACHE                    = 0x80146940
 	SIOCBRDGSFD                       = 0x80146952
 	SIOCBRDGSHT                       = 0x80146951
-	SIOCBRDGSIFCOST                   = 0x80546955
-	SIOCBRDGSIFFLGS                   = 0x8054693f
-	SIOCBRDGSIFPRIO                   = 0x80546954
+	SIOCBRDGSIFCOST                   = 0x805c6955
+	SIOCBRDGSIFFLGS                   = 0x805c693f
+	SIOCBRDGSIFPRIO                   = 0x805c6954
+	SIOCBRDGSIFPROT                   = 0x805c694a
 	SIOCBRDGSMA                       = 0x80146953
 	SIOCBRDGSPRI                      = 0x80146950
 	SIOCBRDGSPROTO                    = 0x8014695a
 	SIOCBRDGSTO                       = 0x80146945
 	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
 	SIOCDIFGROUP                      = 0x80246989
+	SIOCDIFPARENT                     = 0x802069b4
 	SIOCDIFPHYADDR                    = 0x80206949
-	SIOCDLIFADDR                      = 0x8218691e
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
+	SIOCDVNETID                       = 0x802069af
 	SIOCGETKALIVE                     = 0xc01869a4
 	SIOCGETLABEL                      = 0x8020699a
+	SIOCGETMPWCFG                     = 0xc02069ae
 	SIOCGETPFLOW                      = 0xc02069fe
 	SIOCGETPFSYNC                     = 0xc02069f8
 	SIOCGETSGCNT                      = 0xc0147534
 	SIOCGETVIFCNT                     = 0xc0147533
 	SIOCGETVLAN                       = 0xc0206990
-	SIOCGHIWAT                        = 0x40047301
 	SIOCGIFADDR                       = 0xc0206921
-	SIOCGIFASYNCMAP                   = 0xc020697c
 	SIOCGIFBRDADDR                    = 0xc0206923
 	SIOCGIFCONF                       = 0xc0086924
 	SIOCGIFDATA                       = 0xc020691b
@@ -1168,40 +1333,53 @@ const (
 	SIOCGIFFLAGS                      = 0xc0206911
 	SIOCGIFGATTR                      = 0xc024698b
 	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc024698d
 	SIOCGIFGMEMB                      = 0xc024698a
 	SIOCGIFGROUP                      = 0xc0246988
 	SIOCGIFHARDMTU                    = 0xc02069a5
-	SIOCGIFMEDIA                      = 0xc0286936
+	SIOCGIFLLPRIO                     = 0xc02069b6
+	SIOCGIFMEDIA                      = 0xc0386938
 	SIOCGIFMETRIC                     = 0xc0206917
 	SIOCGIFMTU                        = 0xc020697e
 	SIOCGIFNETMASK                    = 0xc0206925
-	SIOCGIFPDSTADDR                   = 0xc0206948
+	SIOCGIFPAIR                       = 0xc02069b1
+	SIOCGIFPARENT                     = 0xc02069b3
 	SIOCGIFPRIORITY                   = 0xc020699c
-	SIOCGIFPSRCADDR                   = 0xc0206947
 	SIOCGIFRDOMAIN                    = 0xc02069a0
 	SIOCGIFRTLABEL                    = 0xc0206983
-	SIOCGIFTIMESLOT                   = 0xc0206986
+	SIOCGIFRXR                        = 0x802069aa
+	SIOCGIFSFFPAGE                    = 0xc1126939
 	SIOCGIFXFLAGS                     = 0xc020699e
-	SIOCGLIFADDR                      = 0xc218691d
 	SIOCGLIFPHYADDR                   = 0xc218694b
+	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
 	SIOCGLIFPHYRTABLE                 = 0xc02069a2
 	SIOCGLIFPHYTTL                    = 0xc02069a9
-	SIOCGLOWAT                        = 0x40047303
 	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
+	SIOCGUMBINFO                      = 0xc02069be
+	SIOCGUMBPARAM                     = 0xc02069c0
 	SIOCGVH                           = 0xc02069f6
+	SIOCGVNETFLOWID                   = 0xc02069c4
 	SIOCGVNETID                       = 0xc02069a7
+	SIOCIFAFATTACH                    = 0x801169ab
+	SIOCIFAFDETACH                    = 0x801169ac
 	SIOCIFCREATE                      = 0x8020697a
 	SIOCIFDESTROY                     = 0x80206979
 	SIOCIFGCLONERS                    = 0xc00c6978
 	SIOCSETKALIVE                     = 0x801869a3
 	SIOCSETLABEL                      = 0x80206999
+	SIOCSETMPWCFG                     = 0x802069ad
 	SIOCSETPFLOW                      = 0x802069fd
 	SIOCSETPFSYNC                     = 0x802069f7
 	SIOCSETVLAN                       = 0x8020698f
-	SIOCSHIWAT                        = 0x80047300
 	SIOCSIFADDR                       = 0x8020690c
-	SIOCSIFASYNCMAP                   = 0x8020697d
 	SIOCSIFBRDADDR                    = 0x80206913
 	SIOCSIFDESCR                      = 0x80206980
 	SIOCSIFDSTADDR                    = 0x8020690e
@@ -1209,25 +1387,37 @@ const (
 	SIOCSIFGATTR                      = 0x8024698c
 	SIOCSIFGENERIC                    = 0x80206939
 	SIOCSIFLLADDR                     = 0x8020691f
-	SIOCSIFMEDIA                      = 0xc0206935
+	SIOCSIFLLPRIO                     = 0x802069b5
+	SIOCSIFMEDIA                      = 0xc0206937
 	SIOCSIFMETRIC                     = 0x80206918
 	SIOCSIFMTU                        = 0x8020697f
 	SIOCSIFNETMASK                    = 0x80206916
-	SIOCSIFPHYADDR                    = 0x80406946
+	SIOCSIFPAIR                       = 0x802069b0
+	SIOCSIFPARENT                     = 0x802069b2
 	SIOCSIFPRIORITY                   = 0x8020699b
 	SIOCSIFRDOMAIN                    = 0x8020699f
 	SIOCSIFRTLABEL                    = 0x80206982
-	SIOCSIFTIMESLOT                   = 0x80206985
 	SIOCSIFXFLAGS                     = 0x8020699d
 	SIOCSLIFPHYADDR                   = 0x8218694a
+	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
 	SIOCSLIFPHYRTABLE                 = 0x802069a1
 	SIOCSLIFPHYTTL                    = 0x802069a8
-	SIOCSLOWAT                        = 0x80047302
 	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
+	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
+	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
+	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
+	SOCK_DNS                          = 0x1000
+	SOCK_NONBLOCK                     = 0x4000
 	SOCK_RAW                          = 0x3
 	SOCK_RDM                          = 0x4
 	SOCK_SEQPACKET                    = 0x5
@@ -1238,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1245,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1258,6 +1450,7 @@ const (
 	SO_TIMESTAMP                      = 0x800
 	SO_TYPE                           = 0x1008
 	SO_USELOOPBACK                    = 0x40
+	SO_ZEROIZE                        = 0x2000
 	S_BLKSIZE                         = 0x200
 	S_IEXEC                           = 0x40
 	S_IFBLK                           = 0x6000
@@ -1287,9 +1480,24 @@ const (
 	S_IXOTH                           = 0x1
 	S_IXUSR                           = 0x40
 	TCIFLUSH                          = 0x1
+	TCIOFF                            = 0x3
 	TCIOFLUSH                         = 0x3
+	TCION                             = 0x4
 	TCOFLUSH                          = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCOOFF                            = 0x1
+	TCOON                             = 0x2
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1298,11 +1506,15 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
-	TCP_NSTATES                       = 0xb
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
 	TIOCCBRK                          = 0x2000747a
 	TIOCCDTR                          = 0x20007478
+	TIOCCHKVERAUTH                    = 0x2000741e
+	TIOCCLRVERAUTH                    = 0x2000741d
 	TIOCCONS                          = 0x80047462
 	TIOCDRAIN                         = 0x2000745e
 	TIOCEXCL                          = 0x2000740d
@@ -1357,17 +1569,21 @@ const (
 	TIOCSETAF                         = 0x802c7416
 	TIOCSETAW                         = 0x802c7415
 	TIOCSETD                          = 0x8004741b
+	TIOCSETVERAUTH                    = 0x8004741c
 	TIOCSFLAGS                        = 0x8004745c
 	TIOCSIG                           = 0x8004745f
 	TIOCSPGRP                         = 0x80047476
 	TIOCSTART                         = 0x2000746e
-	TIOCSTAT                          = 0x80047465
-	TIOCSTI                           = 0x80017472
+	TIOCSTAT                          = 0x20007465
 	TIOCSTOP                          = 0x2000746f
 	TIOCSTSTAMP                       = 0x8008745a
 	TIOCSWINSZ                        = 0x80087467
 	TIOCUCNTL                         = 0x80047466
+	TIOCUCNTL_CBRK                    = 0x7a
+	TIOCUCNTL_SBRK                    = 0x7b
 	TOSTOP                            = 0x400000
+	UTIME_NOW                         = -0x2
+	UTIME_OMIT                        = -0x1
 	VDISCARD                          = 0xf
 	VDSUSP                            = 0xb
 	VEOF                              = 0x0
@@ -1378,6 +1594,19 @@ const (
 	VKILL                             = 0x5
 	VLNEXT                            = 0xe
 	VMIN                              = 0x10
+	VM_ANONMIN                        = 0x7
+	VM_LOADAVG                        = 0x2
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
+	VM_MAXSLP                         = 0xa
+	VM_METER                          = 0x1
+	VM_NKMEMPAGES                     = 0x6
+	VM_PSSTRINGS                      = 0x3
+	VM_SWAPENCRYPT                    = 0x5
+	VM_USPACE                         = 0xb
+	VM_UVMEXP                         = 0x4
+	VM_VNODEMIN                       = 0x9
+	VM_VTEXTMIN                       = 0x8
 	VQUIT                             = 0x9
 	VREPRINT                          = 0x6
 	VSTART                            = 0xc
@@ -1390,8 +1619,8 @@ const (
 	WCONTINUED                        = 0x8
 	WCOREFLAG                         = 0x80
 	WNOHANG                           = 0x1
-	WSTOPPED                          = 0x7f
 	WUNTRACED                         = 0x2
+	XCASE                             = 0x1000000
 )
 
 // Errors
@@ -1405,6 +1634,7 @@ const (
 	EALREADY        = syscall.Errno(0x25)
 	EAUTH           = syscall.Errno(0x50)
 	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x5c)
 	EBADRPC         = syscall.Errno(0x48)
 	EBUSY           = syscall.Errno(0x10)
 	ECANCELED       = syscall.Errno(0x58)
@@ -1431,7 +1661,7 @@ const (
 	EIPSEC          = syscall.Errno(0x52)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x5b)
+	ELAST           = syscall.Errno(0x5f)
 	ELOOP           = syscall.Errno(0x3e)
 	EMEDIUMTYPE     = syscall.Errno(0x56)
 	EMFILE          = syscall.Errno(0x18)
@@ -1459,12 +1689,14 @@ const (
 	ENOTCONN        = syscall.Errno(0x39)
 	ENOTDIR         = syscall.Errno(0x14)
 	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5d)
 	ENOTSOCK        = syscall.Errno(0x26)
 	ENOTSUP         = syscall.Errno(0x5b)
 	ENOTTY          = syscall.Errno(0x19)
 	ENXIO           = syscall.Errno(0x6)
 	EOPNOTSUPP      = syscall.Errno(0x2d)
 	EOVERFLOW       = syscall.Errno(0x57)
+	EOWNERDEAD      = syscall.Errno(0x5e)
 	EPERM           = syscall.Errno(0x1)
 	EPFNOSUPPORT    = syscall.Errno(0x2e)
 	EPIPE           = syscall.Errno(0x20)
@@ -1472,6 +1704,7 @@ const (
 	EPROCUNAVAIL    = syscall.Errno(0x4c)
 	EPROGMISMATCH   = syscall.Errno(0x4b)
 	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5f)
 	EPROTONOSUPPORT = syscall.Errno(0x2b)
 	EPROTOTYPE      = syscall.Errno(0x29)
 	ERANGE          = syscall.Errno(0x22)
@@ -1568,7 +1801,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
+	{35, "EAGAIN", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1624,7 +1857,11 @@ var errorList = [...]struct {
 	{88, "ECANCELED", "operation canceled"},
 	{89, "EIDRM", "identifier removed"},
 	{90, "ENOMSG", "no message of desired type"},
-	{91, "ELAST", "not supported"},
+	{91, "ENOTSUP", "not supported"},
+	{92, "EBADMSG", "bad message"},
+	{93, "ENOTRECOVERABLE", "state not recoverable"},
+	{94, "EOWNERDEAD", "previous owner died"},
+	{95, "ELAST", "protocol error"},
 }
 
 // Signal table
@@ -1638,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1665,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go
index 25cb6094813c..6015fcb2bf69 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go
@@ -109,6 +109,15 @@ const (
 	BPF_DIRECTION_IN                  = 0x1
 	BPF_DIRECTION_OUT                 = 0x2
 	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -137,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -177,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc110445d
+	DIOCADDRULE                       = 0xcd604404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcd60441a
+	DIOCCLRIFFLAG                     = 0xc028445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0e04412
+	DIOCCLRSTATUS                     = 0xc0284416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1204460
+	DIOCGETQUEUE                      = 0xc110445f
+	DIOCGETQUEUES                     = 0xc110445e
+	DIOCGETRULE                       = 0xcd604407
+	DIOCGETRULES                      = 0xcd604406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0104454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0104419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0284457
+	DIOCKILLSRCNODES                  = 0xc080445b
+	DIOCKILLSTATES                    = 0xc0e04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc4504443
+	DIOCRADDTABLES                    = 0xc450443d
+	DIOCRCLRADDRS                     = 0xc4504442
+	DIOCRCLRASTATS                    = 0xc4504448
+	DIOCRCLRTABLES                    = 0xc450443c
+	DIOCRCLRTSTATS                    = 0xc4504441
+	DIOCRDELADDRS                     = 0xc4504444
+	DIOCRDELTABLES                    = 0xc450443e
+	DIOCRGETADDRS                     = 0xc4504446
+	DIOCRGETASTATS                    = 0xc4504447
+	DIOCRGETTABLES                    = 0xc450443f
+	DIOCRGETTSTATS                    = 0xc4504440
+	DIOCRINADEFINE                    = 0xc450444d
+	DIOCRSETADDRS                     = 0xc4504445
+	DIOCRSETTFLAGS                    = 0xc450444a
+	DIOCRTSTADDRS                     = 0xc4504449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0284459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0284414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc0104451
+	DIOCXCOMMIT                       = 0xc0104452
+	DIOCXROLLBACK                     = 0xc0104453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -240,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -292,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -323,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -351,15 +423,17 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
+	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
 	ETHERTYPE_PPP                     = 0x880b
@@ -441,10 +515,11 @@ const (
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
 	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x8
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
@@ -466,7 +541,7 @@ const (
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
 	EV_RECEIPT                        = 0x40
-	EV_SYSFLAGS                       = 0xf000
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -732,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -797,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -906,6 +984,9 @@ const (
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
 	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
@@ -970,12 +1051,26 @@ const (
 	MNT_ROOTFS                        = 0x4000
 	MNT_SOFTDEP                       = 0x4000000
 	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
 	MNT_SYNCHRONOUS                   = 0x2
 	MNT_UPDATE                        = 0x10000
 	MNT_VISFLAGMASK                   = 0x400ffff
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -988,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -996,7 +1092,8 @@ const (
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
 	NET_RT_IFNAMES                    = 0x6
-	NET_RT_MAXID                      = 0x7
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
@@ -1013,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -1130,9 +1228,11 @@ const (
 	RTF_STATIC                        = 0x800
 	RTF_UP                            = 0x1
 	RTF_USETRAILERS                   = 0x8000
+	RTM_80211INFO                     = 0x15
 	RTM_ADD                           = 0x1
 	RTM_BFD                           = 0x12
 	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
 	RTM_DELADDR                       = 0xd
 	RTM_DELETE                        = 0x2
 	RTM_DESYNC                        = 0x10
@@ -1140,7 +1240,6 @@ const (
 	RTM_IFANNOUNCE                    = 0xf
 	RTM_IFINFO                        = 0xe
 	RTM_INVALIDATE                    = 0x11
-	RTM_LOCK                          = 0x8
 	RTM_LOSING                        = 0x5
 	RTM_MAXSIZE                       = 0x800
 	RTM_MISS                          = 0x7
@@ -1148,7 +1247,7 @@ const (
 	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1166,6 +1265,9 @@ const (
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
@@ -1182,35 +1284,37 @@ const (
 	SIOCBRDGDELS                      = 0x80606942
 	SIOCBRDGFLUSH                     = 0x80606948
 	SIOCBRDGFRL                       = 0x808c694e
-	SIOCBRDGGCACHE                    = 0xc0186941
-	SIOCBRDGGFD                       = 0xc0186952
-	SIOCBRDGGHT                       = 0xc0186951
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
 	SIOCBRDGGIFFLGS                   = 0xc060693e
-	SIOCBRDGGMA                       = 0xc0186953
+	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc0406958
-	SIOCBRDGGPRI                      = 0xc0186950
+	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc030694f
-	SIOCBRDGGTO                       = 0xc0186946
+	SIOCBRDGGTO                       = 0xc0146946
 	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0206943
 	SIOCBRDGSADDR                     = 0xc1286944
-	SIOCBRDGSCACHE                    = 0x80186940
-	SIOCBRDGSFD                       = 0x80186952
-	SIOCBRDGSHT                       = 0x80186951
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
 	SIOCBRDGSIFCOST                   = 0x80606955
 	SIOCBRDGSIFFLGS                   = 0x8060693f
 	SIOCBRDGSIFPRIO                   = 0x80606954
 	SIOCBRDGSIFPROT                   = 0x8060694a
-	SIOCBRDGSMA                       = 0x80186953
-	SIOCBRDGSPRI                      = 0x80186950
-	SIOCBRDGSPROTO                    = 0x8018695a
-	SIOCBRDGSTO                       = 0x80186945
-	SIOCBRDGSTXHC                     = 0x80186959
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
 	SIOCDIFGROUP                      = 0x80286989
 	SIOCDIFPARENT                     = 0x802069b4
 	SIOCDIFPHYADDR                    = 0x80206949
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
 	SIOCDVNETID                       = 0x802069af
 	SIOCGETKALIVE                     = 0xc01869a4
 	SIOCGETLABEL                      = 0x8020699a
@@ -1229,6 +1333,7 @@ const (
 	SIOCGIFFLAGS                      = 0xc0206911
 	SIOCGIFGATTR                      = 0xc028698b
 	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc028698d
 	SIOCGIFGMEMB                      = 0xc028698a
 	SIOCGIFGROUP                      = 0xc0286988
 	SIOCGIFHARDMTU                    = 0xc02069a5
@@ -1243,13 +1348,21 @@ const (
 	SIOCGIFRDOMAIN                    = 0xc02069a0
 	SIOCGIFRTLABEL                    = 0xc0206983
 	SIOCGIFRXR                        = 0x802069aa
+	SIOCGIFSFFPAGE                    = 0xc1126939
 	SIOCGIFXFLAGS                     = 0xc020699e
 	SIOCGLIFPHYADDR                   = 0xc218694b
 	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
 	SIOCGLIFPHYRTABLE                 = 0xc02069a2
 	SIOCGLIFPHYTTL                    = 0xc02069a9
 	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
 	SIOCGUMBINFO                      = 0xc02069be
 	SIOCGUMBPARAM                     = 0xc02069c0
 	SIOCGVH                           = 0xc02069f6
@@ -1287,19 +1400,20 @@ const (
 	SIOCSIFXFLAGS                     = 0x8020699d
 	SIOCSLIFPHYADDR                   = 0x8218694a
 	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
 	SIOCSLIFPHYRTABLE                 = 0x802069a1
 	SIOCSLIFPHYTTL                    = 0x802069a8
 	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
 	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
 	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
-	SIOCSWGDPID                       = 0xc018695b
-	SIOCSWGMAXFLOW                    = 0xc0186960
-	SIOCSWGMAXGROUP                   = 0xc018695d
-	SIOCSWSDPID                       = 0x8018695c
-	SIOCSWSPORTNO                     = 0xc060695f
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
 	SOCK_DNS                          = 0x1000
@@ -1314,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1321,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1370,7 +1486,18 @@ const (
 	TCOFLUSH                          = 0x2
 	TCOOFF                            = 0x1
 	TCOON                             = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1379,8 +1506,11 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
 	TIOCCBRK                          = 0x2000747a
 	TIOCCDTR                          = 0x20007478
 	TIOCCHKVERAUTH                    = 0x2000741e
@@ -1445,7 +1575,6 @@ const (
 	TIOCSPGRP                         = 0x80047476
 	TIOCSTART                         = 0x2000746e
 	TIOCSTAT                          = 0x20007465
-	TIOCSTI                           = 0x80017472
 	TIOCSTOP                          = 0x2000746f
 	TIOCSTSTAMP                       = 0x8008745a
 	TIOCSWINSZ                        = 0x80087467
@@ -1467,7 +1596,8 @@ const (
 	VMIN                              = 0x10
 	VM_ANONMIN                        = 0x7
 	VM_LOADAVG                        = 0x2
-	VM_MAXID                          = 0xc
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
 	VM_MAXSLP                         = 0xa
 	VM_METER                          = 0x1
 	VM_NKMEMPAGES                     = 0x6
@@ -1745,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1772,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go
index aef6c085609a..8d44955e44d8 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go
@@ -46,6 +46,7 @@ const (
 	AF_SNA                            = 0xb
 	AF_UNIX                           = 0x1
 	AF_UNSPEC                         = 0x0
+	ALTWERASE                         = 0x200
 	ARPHRD_ETHER                      = 0x1
 	ARPHRD_FRELAY                     = 0xf
 	ARPHRD_IEEE1394                   = 0x18
@@ -82,7 +83,7 @@ const (
 	BIOCGFILDROP                      = 0x40044278
 	BIOCGHDRCMPLT                     = 0x40044274
 	BIOCGRSIG                         = 0x40044273
-	BIOCGRTIMEOUT                     = 0x400c426e
+	BIOCGRTIMEOUT                     = 0x4010426e
 	BIOCGSTATS                        = 0x4008426f
 	BIOCIMMEDIATE                     = 0x80044270
 	BIOCLOCK                          = 0x20004276
@@ -96,7 +97,7 @@ const (
 	BIOCSFILDROP                      = 0x80044279
 	BIOCSHDRCMPLT                     = 0x80044275
 	BIOCSRSIG                         = 0x80044272
-	BIOCSRTIMEOUT                     = 0x800c426d
+	BIOCSRTIMEOUT                     = 0x8010426d
 	BIOCVERSION                       = 0x40044271
 	BPF_A                             = 0x10
 	BPF_ABS                           = 0x20
@@ -108,6 +109,15 @@ const (
 	BPF_DIRECTION_IN                  = 0x1
 	BPF_DIRECTION_OUT                 = 0x2
 	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -136,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -147,6 +158,12 @@ const (
 	BRKINT                            = 0x2
 	CFLUSH                            = 0xf
 	CLOCAL                            = 0x8000
+	CLOCK_BOOTTIME                    = 0x6
+	CLOCK_MONOTONIC                   = 0x3
+	CLOCK_PROCESS_CPUTIME_ID          = 0x2
+	CLOCK_REALTIME                    = 0x0
+	CLOCK_THREAD_CPUTIME_ID           = 0x4
+	CLOCK_UPTIME                      = 0x5
 	CPUSTATES                         = 0x6
 	CP_IDLE                           = 0x5
 	CP_INTR                           = 0x4
@@ -170,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc100445d
+	DIOCADDRULE                       = 0xcce04404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcce0441a
+	DIOCCLRIFFLAG                     = 0xc024445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0d04412
+	DIOCCLRSTATUS                     = 0xc0244416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1084460
+	DIOCGETQUEUE                      = 0xc100445f
+	DIOCGETQUEUES                     = 0xc100445e
+	DIOCGETRULE                       = 0xcce04407
+	DIOCGETRULES                      = 0xcce04406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0084454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0084419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0244457
+	DIOCKILLSRCNODES                  = 0xc068445b
+	DIOCKILLSTATES                    = 0xc0d04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc44c4443
+	DIOCRADDTABLES                    = 0xc44c443d
+	DIOCRCLRADDRS                     = 0xc44c4442
+	DIOCRCLRASTATS                    = 0xc44c4448
+	DIOCRCLRTABLES                    = 0xc44c443c
+	DIOCRCLRTSTATS                    = 0xc44c4441
+	DIOCRDELADDRS                     = 0xc44c4444
+	DIOCRDELTABLES                    = 0xc44c443e
+	DIOCRGETADDRS                     = 0xc44c4446
+	DIOCRGETASTATS                    = 0xc44c4447
+	DIOCRGETTABLES                    = 0xc44c443f
+	DIOCRGETTSTATS                    = 0xc44c4440
+	DIOCRINADEFINE                    = 0xc44c444d
+	DIOCRSETADDRS                     = 0xc44c4445
+	DIOCRSETTFLAGS                    = 0xc44c444a
+	DIOCRTSTADDRS                     = 0xc44c4449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0244459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0244414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc00c4451
+	DIOCXCOMMIT                       = 0xc00c4452
+	DIOCXROLLBACK                     = 0xc00c4453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -186,6 +261,7 @@ const (
 	DLT_LOOP                          = 0xc
 	DLT_MPLS                          = 0xdb
 	DLT_NULL                          = 0x0
+	DLT_OPENFLOW                      = 0x10b
 	DLT_PFLOG                         = 0x75
 	DLT_PFSYNC                        = 0x12
 	DLT_PPP                           = 0x9
@@ -196,6 +272,23 @@ const (
 	DLT_RAW                           = 0xe
 	DLT_SLIP                          = 0x8
 	DLT_SLIP_BSDOS                    = 0xf
+	DLT_USBPCAP                       = 0xf9
+	DLT_USER0                         = 0x93
+	DLT_USER1                         = 0x94
+	DLT_USER10                        = 0x9d
+	DLT_USER11                        = 0x9e
+	DLT_USER12                        = 0x9f
+	DLT_USER13                        = 0xa0
+	DLT_USER14                        = 0xa1
+	DLT_USER15                        = 0xa2
+	DLT_USER2                         = 0x95
+	DLT_USER3                         = 0x96
+	DLT_USER4                         = 0x97
+	DLT_USER5                         = 0x98
+	DLT_USER6                         = 0x99
+	DLT_USER7                         = 0x9a
+	DLT_USER8                         = 0x9b
+	DLT_USER9                         = 0x9c
 	DT_BLK                            = 0x6
 	DT_CHR                            = 0x2
 	DT_DIR                            = 0x4
@@ -215,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -267,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -298,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -326,15 +423,17 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
+	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
 	ETHERTYPE_PPP                     = 0x880b
@@ -409,28 +508,40 @@ const (
 	ETHER_CRC_POLY_LE                 = 0xedb88320
 	ETHER_HDR_LEN                     = 0xe
 	ETHER_MAX_DIX_LEN                 = 0x600
+	ETHER_MAX_HARDMTU_LEN             = 0xff9b
 	ETHER_MAX_LEN                     = 0x5ee
 	ETHER_MIN_LEN                     = 0x40
 	ETHER_TYPE_LEN                    = 0x2
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
+	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x7
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
+	EVL_ENCAPLEN                      = 0x4
+	EVL_PRIO_BITS                     = 0xd
+	EVL_PRIO_MAX                      = 0x7
+	EVL_VLID_MASK                     = 0xfff
+	EVL_VLID_MAX                      = 0xffe
+	EVL_VLID_MIN                      = 0x1
+	EVL_VLID_NULL                     = 0x0
 	EV_ADD                            = 0x1
 	EV_CLEAR                          = 0x20
 	EV_DELETE                         = 0x2
 	EV_DISABLE                        = 0x8
+	EV_DISPATCH                       = 0x80
 	EV_ENABLE                         = 0x4
 	EV_EOF                            = 0x8000
 	EV_ERROR                          = 0x4000
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
-	EV_SYSFLAGS                       = 0xf000
+	EV_RECEIPT                        = 0x40
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -443,6 +554,8 @@ const (
 	F_GETFL                           = 0x3
 	F_GETLK                           = 0x7
 	F_GETOWN                          = 0x5
+	F_ISATTY                          = 0xb
+	F_OK                              = 0x0
 	F_RDLCK                           = 0x1
 	F_SETFD                           = 0x2
 	F_SETFL                           = 0x4
@@ -459,7 +572,6 @@ const (
 	IEXTEN                            = 0x400
 	IFAN_ARRIVAL                      = 0x0
 	IFAN_DEPARTURE                    = 0x1
-	IFA_ROUTE                         = 0x1
 	IFF_ALLMULTI                      = 0x200
 	IFF_BROADCAST                     = 0x2
 	IFF_CANTCHANGE                    = 0x8e52
@@ -470,12 +582,12 @@ const (
 	IFF_LOOPBACK                      = 0x8
 	IFF_MULTICAST                     = 0x8000
 	IFF_NOARP                         = 0x80
-	IFF_NOTRAILERS                    = 0x20
 	IFF_OACTIVE                       = 0x400
 	IFF_POINTOPOINT                   = 0x10
 	IFF_PROMISC                       = 0x100
 	IFF_RUNNING                       = 0x40
 	IFF_SIMPLEX                       = 0x800
+	IFF_STATICARP                     = 0x20
 	IFF_UP                            = 0x1
 	IFNAMSIZ                          = 0x10
 	IFT_1822                          = 0x2
@@ -604,6 +716,7 @@ const (
 	IFT_LINEGROUP                     = 0xd2
 	IFT_LOCALTALK                     = 0x2a
 	IFT_LOOP                          = 0x18
+	IFT_MBIM                          = 0xfa
 	IFT_MEDIAMAILOVERIP               = 0x8b
 	IFT_MFSIGLINK                     = 0xa7
 	IFT_MIOX25                        = 0x26
@@ -694,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -728,8 +842,6 @@ const (
 	IPPROTO_AH                        = 0x33
 	IPPROTO_CARP                      = 0x70
 	IPPROTO_DIVERT                    = 0x102
-	IPPROTO_DIVERT_INIT               = 0x2
-	IPPROTO_DIVERT_RESP               = 0x1
 	IPPROTO_DONE                      = 0x101
 	IPPROTO_DSTOPTS                   = 0x3c
 	IPPROTO_EGP                       = 0x8
@@ -761,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -786,6 +900,7 @@ const (
 	IPV6_LEAVE_GROUP                  = 0xd
 	IPV6_MAXHLIM                      = 0xff
 	IPV6_MAXPACKET                    = 0xffff
+	IPV6_MINHOPCOUNT                  = 0x41
 	IPV6_MMTU                         = 0x500
 	IPV6_MULTICAST_HOPS               = 0xa
 	IPV6_MULTICAST_IF                 = 0x9
@@ -825,12 +940,12 @@ const (
 	IP_DEFAULT_MULTICAST_LOOP         = 0x1
 	IP_DEFAULT_MULTICAST_TTL          = 0x1
 	IP_DF                             = 0x4000
-	IP_DIVERTFL                       = 0x1022
 	IP_DROP_MEMBERSHIP                = 0xd
 	IP_ESP_NETWORK_LEVEL              = 0x16
 	IP_ESP_TRANS_LEVEL                = 0x15
 	IP_HDRINCL                        = 0x2
 	IP_IPCOMP_LEVEL                   = 0x1d
+	IP_IPDEFTTL                       = 0x25
 	IP_IPSECFLOWINFO                  = 0x24
 	IP_IPSEC_LOCAL_AUTH               = 0x1b
 	IP_IPSEC_LOCAL_CRED               = 0x19
@@ -864,10 +979,15 @@ const (
 	IP_RETOPTS                        = 0x8
 	IP_RF                             = 0x8000
 	IP_RTABLE                         = 0x1021
+	IP_SENDSRCADDR                    = 0x7
 	IP_TOS                            = 0x3
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
+	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
 	IXON                              = 0x200
@@ -922,6 +1042,7 @@ const (
 	MNT_NOATIME                       = 0x8000
 	MNT_NODEV                         = 0x10
 	MNT_NOEXEC                        = 0x4
+	MNT_NOPERM                        = 0x20
 	MNT_NOSUID                        = 0x8
 	MNT_NOWAIT                        = 0x2
 	MNT_QUOTA                         = 0x2000
@@ -929,12 +1050,27 @@ const (
 	MNT_RELOAD                        = 0x40000
 	MNT_ROOTFS                        = 0x4000
 	MNT_SOFTDEP                       = 0x4000000
+	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
 	MNT_SYNCHRONOUS                   = 0x2
 	MNT_UPDATE                        = 0x10000
 	MNT_VISFLAGMASK                   = 0x400ffff
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -947,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -954,12 +1091,16 @@ const (
 	NET_RT_DUMP                       = 0x1
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
-	NET_RT_MAXID                      = 0x6
+	NET_RT_IFNAMES                    = 0x6
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
 	NOFLSH                            = 0x80000000
+	NOKERNINFO                        = 0x2000000
 	NOTE_ATTRIB                       = 0x8
+	NOTE_CHANGE                       = 0x1
 	NOTE_CHILD                        = 0x4
 	NOTE_DELETE                       = 0x1
 	NOTE_EOF                          = 0x2
@@ -969,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -978,11 +1120,13 @@ const (
 	NOTE_TRUNCATE                     = 0x80
 	NOTE_WRITE                        = 0x2
 	OCRNL                             = 0x10
+	OLCUC                             = 0x20
 	ONLCR                             = 0x2
 	ONLRET                            = 0x80
 	ONOCR                             = 0x40
 	ONOEOT                            = 0x8
 	OPOST                             = 0x1
+	OXTABS                            = 0x4
 	O_ACCMODE                         = 0x3
 	O_APPEND                          = 0x8
 	O_ASYNC                           = 0x40
@@ -1027,19 +1171,25 @@ const (
 	RLIMIT_STACK                      = 0x3
 	RLIM_INFINITY                     = 0x7fffffffffffffff
 	RTAX_AUTHOR                       = 0x6
+	RTAX_BFD                          = 0xb
 	RTAX_BRD                          = 0x7
+	RTAX_DNS                          = 0xc
 	RTAX_DST                          = 0x0
 	RTAX_GATEWAY                      = 0x1
 	RTAX_GENMASK                      = 0x3
 	RTAX_IFA                          = 0x5
 	RTAX_IFP                          = 0x4
 	RTAX_LABEL                        = 0xa
-	RTAX_MAX                          = 0xb
+	RTAX_MAX                          = 0xf
 	RTAX_NETMASK                      = 0x2
+	RTAX_SEARCH                       = 0xe
 	RTAX_SRC                          = 0x8
 	RTAX_SRCMASK                      = 0x9
+	RTAX_STATIC                       = 0xd
 	RTA_AUTHOR                        = 0x40
+	RTA_BFD                           = 0x800
 	RTA_BRD                           = 0x80
+	RTA_DNS                           = 0x1000
 	RTA_DST                           = 0x1
 	RTA_GATEWAY                       = 0x2
 	RTA_GENMASK                       = 0x8
@@ -1047,24 +1197,29 @@ const (
 	RTA_IFP                           = 0x10
 	RTA_LABEL                         = 0x400
 	RTA_NETMASK                       = 0x4
+	RTA_SEARCH                        = 0x4000
 	RTA_SRC                           = 0x100
 	RTA_SRCMASK                       = 0x200
+	RTA_STATIC                        = 0x2000
 	RTF_ANNOUNCE                      = 0x4000
+	RTF_BFD                           = 0x1000000
 	RTF_BLACKHOLE                     = 0x1000
 	RTF_BROADCAST                     = 0x400000
+	RTF_CACHED                        = 0x20000
 	RTF_CLONED                        = 0x10000
 	RTF_CLONING                       = 0x100
+	RTF_CONNECTED                     = 0x800000
 	RTF_DONE                          = 0x40
 	RTF_DYNAMIC                       = 0x10
-	RTF_FMASK                         = 0x70f808
+	RTF_FMASK                         = 0x110fc08
 	RTF_GATEWAY                       = 0x2
 	RTF_HOST                          = 0x4
 	RTF_LLINFO                        = 0x400
 	RTF_LOCAL                         = 0x200000
-	RTF_MASK                          = 0x80
 	RTF_MODIFIED                      = 0x20
 	RTF_MPATH                         = 0x40000
 	RTF_MPLS                          = 0x100000
+	RTF_MULTICAST                     = 0x200
 	RTF_PERMANENT_ARP                 = 0x2000
 	RTF_PROTO1                        = 0x8000
 	RTF_PROTO2                        = 0x4000
@@ -1073,23 +1228,26 @@ const (
 	RTF_STATIC                        = 0x800
 	RTF_UP                            = 0x1
 	RTF_USETRAILERS                   = 0x8000
-	RTF_XRESOLVE                      = 0x200
+	RTM_80211INFO                     = 0x15
 	RTM_ADD                           = 0x1
+	RTM_BFD                           = 0x12
 	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
 	RTM_DELADDR                       = 0xd
 	RTM_DELETE                        = 0x2
 	RTM_DESYNC                        = 0x10
 	RTM_GET                           = 0x4
 	RTM_IFANNOUNCE                    = 0xf
 	RTM_IFINFO                        = 0xe
-	RTM_LOCK                          = 0x8
+	RTM_INVALIDATE                    = 0x11
 	RTM_LOSING                        = 0x5
 	RTM_MAXSIZE                       = 0x800
 	RTM_MISS                          = 0x7
 	RTM_NEWADDR                       = 0xc
+	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1099,67 +1257,74 @@ const (
 	RTV_RTTVAR                        = 0x80
 	RTV_SPIPE                         = 0x10
 	RTV_SSTHRESH                      = 0x20
+	RT_TABLEID_BITS                   = 0x8
+	RT_TABLEID_MASK                   = 0xff
 	RT_TABLEID_MAX                    = 0xff
 	RUSAGE_CHILDREN                   = -0x1
 	RUSAGE_SELF                       = 0x0
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
 	SIOCADDMULTI                      = 0x80206931
 	SIOCAIFADDR                       = 0x8040691a
 	SIOCAIFGROUP                      = 0x80246987
-	SIOCALIFADDR                      = 0x8218691c
 	SIOCATMARK                        = 0x40047307
-	SIOCBRDGADD                       = 0x8054693c
-	SIOCBRDGADDS                      = 0x80546941
-	SIOCBRDGARL                       = 0x806e694d
+	SIOCBRDGADD                       = 0x8060693c
+	SIOCBRDGADDL                      = 0x80606949
+	SIOCBRDGADDS                      = 0x80606941
+	SIOCBRDGARL                       = 0x808c694d
 	SIOCBRDGDADDR                     = 0x81286947
-	SIOCBRDGDEL                       = 0x8054693d
-	SIOCBRDGDELS                      = 0x80546942
-	SIOCBRDGFLUSH                     = 0x80546948
-	SIOCBRDGFRL                       = 0x806e694e
+	SIOCBRDGDEL                       = 0x8060693d
+	SIOCBRDGDELS                      = 0x80606942
+	SIOCBRDGFLUSH                     = 0x80606948
+	SIOCBRDGFRL                       = 0x808c694e
 	SIOCBRDGGCACHE                    = 0xc0146941
 	SIOCBRDGGFD                       = 0xc0146952
 	SIOCBRDGGHT                       = 0xc0146951
-	SIOCBRDGGIFFLGS                   = 0xc054693e
+	SIOCBRDGGIFFLGS                   = 0xc060693e
 	SIOCBRDGGMA                       = 0xc0146953
-	SIOCBRDGGPARAM                    = 0xc03c6958
+	SIOCBRDGGPARAM                    = 0xc0406958
 	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc028694f
-	SIOCBRDGGSIFS                     = 0xc054693c
 	SIOCBRDGGTO                       = 0xc0146946
-	SIOCBRDGIFS                       = 0xc0546942
+	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0186943
 	SIOCBRDGSADDR                     = 0xc1286944
 	SIOCBRDGSCACHE                    = 0x80146940
 	SIOCBRDGSFD                       = 0x80146952
 	SIOCBRDGSHT                       = 0x80146951
-	SIOCBRDGSIFCOST                   = 0x80546955
-	SIOCBRDGSIFFLGS                   = 0x8054693f
-	SIOCBRDGSIFPRIO                   = 0x80546954
+	SIOCBRDGSIFCOST                   = 0x80606955
+	SIOCBRDGSIFFLGS                   = 0x8060693f
+	SIOCBRDGSIFPRIO                   = 0x80606954
+	SIOCBRDGSIFPROT                   = 0x8060694a
 	SIOCBRDGSMA                       = 0x80146953
 	SIOCBRDGSPRI                      = 0x80146950
 	SIOCBRDGSPROTO                    = 0x8014695a
 	SIOCBRDGSTO                       = 0x80146945
 	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
 	SIOCDIFGROUP                      = 0x80246989
+	SIOCDIFPARENT                     = 0x802069b4
 	SIOCDIFPHYADDR                    = 0x80206949
-	SIOCDLIFADDR                      = 0x8218691e
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
+	SIOCDVNETID                       = 0x802069af
 	SIOCGETKALIVE                     = 0xc01869a4
 	SIOCGETLABEL                      = 0x8020699a
+	SIOCGETMPWCFG                     = 0xc02069ae
 	SIOCGETPFLOW                      = 0xc02069fe
 	SIOCGETPFSYNC                     = 0xc02069f8
 	SIOCGETSGCNT                      = 0xc0147534
 	SIOCGETVIFCNT                     = 0xc0147533
 	SIOCGETVLAN                       = 0xc0206990
-	SIOCGHIWAT                        = 0x40047301
 	SIOCGIFADDR                       = 0xc0206921
-	SIOCGIFASYNCMAP                   = 0xc020697c
 	SIOCGIFBRDADDR                    = 0xc0206923
 	SIOCGIFCONF                       = 0xc0086924
 	SIOCGIFDATA                       = 0xc020691b
@@ -1168,41 +1333,53 @@ const (
 	SIOCGIFFLAGS                      = 0xc0206911
 	SIOCGIFGATTR                      = 0xc024698b
 	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc024698d
 	SIOCGIFGMEMB                      = 0xc024698a
 	SIOCGIFGROUP                      = 0xc0246988
 	SIOCGIFHARDMTU                    = 0xc02069a5
-	SIOCGIFMEDIA                      = 0xc0286936
+	SIOCGIFLLPRIO                     = 0xc02069b6
+	SIOCGIFMEDIA                      = 0xc0386938
 	SIOCGIFMETRIC                     = 0xc0206917
 	SIOCGIFMTU                        = 0xc020697e
 	SIOCGIFNETMASK                    = 0xc0206925
-	SIOCGIFPDSTADDR                   = 0xc0206948
+	SIOCGIFPAIR                       = 0xc02069b1
+	SIOCGIFPARENT                     = 0xc02069b3
 	SIOCGIFPRIORITY                   = 0xc020699c
-	SIOCGIFPSRCADDR                   = 0xc0206947
 	SIOCGIFRDOMAIN                    = 0xc02069a0
 	SIOCGIFRTLABEL                    = 0xc0206983
 	SIOCGIFRXR                        = 0x802069aa
-	SIOCGIFTIMESLOT                   = 0xc0206986
+	SIOCGIFSFFPAGE                    = 0xc1126939
 	SIOCGIFXFLAGS                     = 0xc020699e
-	SIOCGLIFADDR                      = 0xc218691d
 	SIOCGLIFPHYADDR                   = 0xc218694b
+	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
 	SIOCGLIFPHYRTABLE                 = 0xc02069a2
 	SIOCGLIFPHYTTL                    = 0xc02069a9
-	SIOCGLOWAT                        = 0x40047303
 	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
+	SIOCGUMBINFO                      = 0xc02069be
+	SIOCGUMBPARAM                     = 0xc02069c0
 	SIOCGVH                           = 0xc02069f6
+	SIOCGVNETFLOWID                   = 0xc02069c4
 	SIOCGVNETID                       = 0xc02069a7
+	SIOCIFAFATTACH                    = 0x801169ab
+	SIOCIFAFDETACH                    = 0x801169ac
 	SIOCIFCREATE                      = 0x8020697a
 	SIOCIFDESTROY                     = 0x80206979
 	SIOCIFGCLONERS                    = 0xc00c6978
 	SIOCSETKALIVE                     = 0x801869a3
 	SIOCSETLABEL                      = 0x80206999
+	SIOCSETMPWCFG                     = 0x802069ad
 	SIOCSETPFLOW                      = 0x802069fd
 	SIOCSETPFSYNC                     = 0x802069f7
 	SIOCSETVLAN                       = 0x8020698f
-	SIOCSHIWAT                        = 0x80047300
 	SIOCSIFADDR                       = 0x8020690c
-	SIOCSIFASYNCMAP                   = 0x8020697d
 	SIOCSIFBRDADDR                    = 0x80206913
 	SIOCSIFDESCR                      = 0x80206980
 	SIOCSIFDSTADDR                    = 0x8020690e
@@ -1210,26 +1387,36 @@ const (
 	SIOCSIFGATTR                      = 0x8024698c
 	SIOCSIFGENERIC                    = 0x80206939
 	SIOCSIFLLADDR                     = 0x8020691f
-	SIOCSIFMEDIA                      = 0xc0206935
+	SIOCSIFLLPRIO                     = 0x802069b5
+	SIOCSIFMEDIA                      = 0xc0206937
 	SIOCSIFMETRIC                     = 0x80206918
 	SIOCSIFMTU                        = 0x8020697f
 	SIOCSIFNETMASK                    = 0x80206916
-	SIOCSIFPHYADDR                    = 0x80406946
+	SIOCSIFPAIR                       = 0x802069b0
+	SIOCSIFPARENT                     = 0x802069b2
 	SIOCSIFPRIORITY                   = 0x8020699b
 	SIOCSIFRDOMAIN                    = 0x8020699f
 	SIOCSIFRTLABEL                    = 0x80206982
-	SIOCSIFTIMESLOT                   = 0x80206985
 	SIOCSIFXFLAGS                     = 0x8020699d
 	SIOCSLIFPHYADDR                   = 0x8218694a
+	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
 	SIOCSLIFPHYRTABLE                 = 0x802069a1
 	SIOCSLIFPHYTTL                    = 0x802069a8
-	SIOCSLOWAT                        = 0x80047302
 	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
+	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
+	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
+	SOCK_DNS                          = 0x1000
 	SOCK_NONBLOCK                     = 0x4000
 	SOCK_RAW                          = 0x3
 	SOCK_RDM                          = 0x4
@@ -1241,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1248,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1261,6 +1450,7 @@ const (
 	SO_TIMESTAMP                      = 0x800
 	SO_TYPE                           = 0x1008
 	SO_USELOOPBACK                    = 0x40
+	SO_ZEROIZE                        = 0x2000
 	S_BLKSIZE                         = 0x200
 	S_IEXEC                           = 0x40
 	S_IFBLK                           = 0x6000
@@ -1290,9 +1480,24 @@ const (
 	S_IXOTH                           = 0x1
 	S_IXUSR                           = 0x40
 	TCIFLUSH                          = 0x1
+	TCIOFF                            = 0x3
 	TCIOFLUSH                         = 0x3
+	TCION                             = 0x4
 	TCOFLUSH                          = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCOOFF                            = 0x1
+	TCOON                             = 0x2
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1301,11 +1506,15 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
-	TCP_NSTATES                       = 0xb
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
 	TIOCCBRK                          = 0x2000747a
 	TIOCCDTR                          = 0x20007478
+	TIOCCHKVERAUTH                    = 0x2000741e
+	TIOCCLRVERAUTH                    = 0x2000741d
 	TIOCCONS                          = 0x80047462
 	TIOCDRAIN                         = 0x2000745e
 	TIOCEXCL                          = 0x2000740d
@@ -1321,7 +1530,7 @@ const (
 	TIOCGFLAGS                        = 0x4004745d
 	TIOCGPGRP                         = 0x40047477
 	TIOCGSID                          = 0x40047463
-	TIOCGTSTAMP                       = 0x400c745b
+	TIOCGTSTAMP                       = 0x4010745b
 	TIOCGWINSZ                        = 0x40087468
 	TIOCMBIC                          = 0x8004746b
 	TIOCMBIS                          = 0x8004746c
@@ -1360,17 +1569,21 @@ const (
 	TIOCSETAF                         = 0x802c7416
 	TIOCSETAW                         = 0x802c7415
 	TIOCSETD                          = 0x8004741b
+	TIOCSETVERAUTH                    = 0x8004741c
 	TIOCSFLAGS                        = 0x8004745c
 	TIOCSIG                           = 0x8004745f
 	TIOCSPGRP                         = 0x80047476
 	TIOCSTART                         = 0x2000746e
-	TIOCSTAT                          = 0x80047465
-	TIOCSTI                           = 0x80017472
+	TIOCSTAT                          = 0x20007465
 	TIOCSTOP                          = 0x2000746f
 	TIOCSTSTAMP                       = 0x8008745a
 	TIOCSWINSZ                        = 0x80087467
 	TIOCUCNTL                         = 0x80047466
+	TIOCUCNTL_CBRK                    = 0x7a
+	TIOCUCNTL_SBRK                    = 0x7b
 	TOSTOP                            = 0x400000
+	UTIME_NOW                         = -0x2
+	UTIME_OMIT                        = -0x1
 	VDISCARD                          = 0xf
 	VDSUSP                            = 0xb
 	VEOF                              = 0x0
@@ -1381,6 +1594,19 @@ const (
 	VKILL                             = 0x5
 	VLNEXT                            = 0xe
 	VMIN                              = 0x10
+	VM_ANONMIN                        = 0x7
+	VM_LOADAVG                        = 0x2
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
+	VM_MAXSLP                         = 0xa
+	VM_METER                          = 0x1
+	VM_NKMEMPAGES                     = 0x6
+	VM_PSSTRINGS                      = 0x3
+	VM_SWAPENCRYPT                    = 0x5
+	VM_USPACE                         = 0xb
+	VM_UVMEXP                         = 0x4
+	VM_VNODEMIN                       = 0x9
+	VM_VTEXTMIN                       = 0x8
 	VQUIT                             = 0x9
 	VREPRINT                          = 0x6
 	VSTART                            = 0xc
@@ -1394,6 +1620,7 @@ const (
 	WCOREFLAG                         = 0x80
 	WNOHANG                           = 0x1
 	WUNTRACED                         = 0x2
+	XCASE                             = 0x1000000
 )
 
 // Errors
@@ -1407,6 +1634,7 @@ const (
 	EALREADY        = syscall.Errno(0x25)
 	EAUTH           = syscall.Errno(0x50)
 	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x5c)
 	EBADRPC         = syscall.Errno(0x48)
 	EBUSY           = syscall.Errno(0x10)
 	ECANCELED       = syscall.Errno(0x58)
@@ -1433,7 +1661,7 @@ const (
 	EIPSEC          = syscall.Errno(0x52)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x5b)
+	ELAST           = syscall.Errno(0x5f)
 	ELOOP           = syscall.Errno(0x3e)
 	EMEDIUMTYPE     = syscall.Errno(0x56)
 	EMFILE          = syscall.Errno(0x18)
@@ -1461,12 +1689,14 @@ const (
 	ENOTCONN        = syscall.Errno(0x39)
 	ENOTDIR         = syscall.Errno(0x14)
 	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5d)
 	ENOTSOCK        = syscall.Errno(0x26)
 	ENOTSUP         = syscall.Errno(0x5b)
 	ENOTTY          = syscall.Errno(0x19)
 	ENXIO           = syscall.Errno(0x6)
 	EOPNOTSUPP      = syscall.Errno(0x2d)
 	EOVERFLOW       = syscall.Errno(0x57)
+	EOWNERDEAD      = syscall.Errno(0x5e)
 	EPERM           = syscall.Errno(0x1)
 	EPFNOSUPPORT    = syscall.Errno(0x2e)
 	EPIPE           = syscall.Errno(0x20)
@@ -1474,6 +1704,7 @@ const (
 	EPROCUNAVAIL    = syscall.Errno(0x4c)
 	EPROGMISMATCH   = syscall.Errno(0x4b)
 	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5f)
 	EPROTONOSUPPORT = syscall.Errno(0x2b)
 	EPROTOTYPE      = syscall.Errno(0x29)
 	ERANGE          = syscall.Errno(0x22)
@@ -1570,7 +1801,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
+	{35, "EAGAIN", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1626,7 +1857,11 @@ var errorList = [...]struct {
 	{88, "ECANCELED", "operation canceled"},
 	{89, "EIDRM", "identifier removed"},
 	{90, "ENOMSG", "no message of desired type"},
-	{91, "ELAST", "not supported"},
+	{91, "ENOTSUP", "not supported"},
+	{92, "EBADMSG", "bad message"},
+	{93, "ENOTRECOVERABLE", "state not recoverable"},
+	{94, "EOWNERDEAD", "previous owner died"},
+	{95, "ELAST", "protocol error"},
 }
 
 // Signal table
@@ -1640,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1667,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go
index 90de7dfc33a3..ae16fe7542ae 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go
@@ -112,6 +112,12 @@ const (
 	BPF_FILDROP_CAPTURE               = 0x1
 	BPF_FILDROP_DROP                  = 0x2
 	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -140,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -180,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc110445d
+	DIOCADDRULE                       = 0xcd604404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcd60441a
+	DIOCCLRIFFLAG                     = 0xc028445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0e04412
+	DIOCCLRSTATUS                     = 0xc0284416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1204460
+	DIOCGETQUEUE                      = 0xc110445f
+	DIOCGETQUEUES                     = 0xc110445e
+	DIOCGETRULE                       = 0xcd604407
+	DIOCGETRULES                      = 0xcd604406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0104454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0104419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0284457
+	DIOCKILLSRCNODES                  = 0xc080445b
+	DIOCKILLSTATES                    = 0xc0e04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc4504443
+	DIOCRADDTABLES                    = 0xc450443d
+	DIOCRCLRADDRS                     = 0xc4504442
+	DIOCRCLRASTATS                    = 0xc4504448
+	DIOCRCLRTABLES                    = 0xc450443c
+	DIOCRCLRTSTATS                    = 0xc4504441
+	DIOCRDELADDRS                     = 0xc4504444
+	DIOCRDELTABLES                    = 0xc450443e
+	DIOCRGETADDRS                     = 0xc4504446
+	DIOCRGETASTATS                    = 0xc4504447
+	DIOCRGETTABLES                    = 0xc450443f
+	DIOCRGETTSTATS                    = 0xc4504440
+	DIOCRINADEFINE                    = 0xc450444d
+	DIOCRSETADDRS                     = 0xc4504445
+	DIOCRSETTFLAGS                    = 0xc450444a
+	DIOCRTSTADDRS                     = 0xc4504449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0284459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0284414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc0104451
+	DIOCXCOMMIT                       = 0xc0104452
+	DIOCXROLLBACK                     = 0xc0104453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -243,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -295,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -326,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -354,15 +423,16 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
 	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
@@ -445,10 +515,11 @@ const (
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
 	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x8
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
@@ -470,7 +541,7 @@ const (
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
 	EV_RECEIPT                        = 0x40
-	EV_SYSFLAGS                       = 0xf000
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -736,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -801,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -910,6 +984,9 @@ const (
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
 	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
@@ -981,6 +1058,19 @@ const (
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -993,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -1001,7 +1092,8 @@ const (
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
 	NET_RT_IFNAMES                    = 0x6
-	NET_RT_MAXID                      = 0x7
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
@@ -1018,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -1154,7 +1247,7 @@ const (
 	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1172,6 +1265,9 @@ const (
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
@@ -1188,30 +1284,30 @@ const (
 	SIOCBRDGDELS                      = 0x80606942
 	SIOCBRDGFLUSH                     = 0x80606948
 	SIOCBRDGFRL                       = 0x808c694e
-	SIOCBRDGGCACHE                    = 0xc0186941
-	SIOCBRDGGFD                       = 0xc0186952
-	SIOCBRDGGHT                       = 0xc0186951
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
 	SIOCBRDGGIFFLGS                   = 0xc060693e
-	SIOCBRDGGMA                       = 0xc0186953
+	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc0406958
-	SIOCBRDGGPRI                      = 0xc0186950
+	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc030694f
-	SIOCBRDGGTO                       = 0xc0186946
+	SIOCBRDGGTO                       = 0xc0146946
 	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0206943
 	SIOCBRDGSADDR                     = 0xc1286944
-	SIOCBRDGSCACHE                    = 0x80186940
-	SIOCBRDGSFD                       = 0x80186952
-	SIOCBRDGSHT                       = 0x80186951
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
 	SIOCBRDGSIFCOST                   = 0x80606955
 	SIOCBRDGSIFFLGS                   = 0x8060693f
 	SIOCBRDGSIFPRIO                   = 0x80606954
 	SIOCBRDGSIFPROT                   = 0x8060694a
-	SIOCBRDGSMA                       = 0x80186953
-	SIOCBRDGSPRI                      = 0x80186950
-	SIOCBRDGSPROTO                    = 0x8018695a
-	SIOCBRDGSTO                       = 0x80186945
-	SIOCBRDGSTXHC                     = 0x80186959
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
 	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
@@ -1264,6 +1360,7 @@ const (
 	SIOCGPWE3CTRLWORD                 = 0xc02069dc
 	SIOCGPWE3FAT                      = 0xc02069dd
 	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
 	SIOCGTXHPRIO                      = 0xc02069c6
 	SIOCGUMBINFO                      = 0xc02069be
@@ -1310,17 +1407,13 @@ const (
 	SIOCSPWE3CTRLWORD                 = 0x802069dc
 	SIOCSPWE3FAT                      = 0x802069dd
 	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
 	SIOCSTXHPRIO                      = 0x802069c5
 	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
 	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
-	SIOCSWGDPID                       = 0xc018695b
-	SIOCSWGMAXFLOW                    = 0xc0186960
-	SIOCSWGMAXGROUP                   = 0xc018695d
-	SIOCSWSDPID                       = 0x8018695c
-	SIOCSWSPORTNO                     = 0xc060695f
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
 	SOCK_DNS                          = 0x1000
@@ -1335,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1342,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1391,7 +1486,18 @@ const (
 	TCOFLUSH                          = 0x2
 	TCOOFF                            = 0x1
 	TCOON                             = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1400,6 +1506,7 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
 	TIMER_ABSTIME                     = 0x1
@@ -1768,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1795,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go
index f1154ff56f6c..03d90fe35501 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go
@@ -112,6 +112,12 @@ const (
 	BPF_FILDROP_CAPTURE               = 0x1
 	BPF_FILDROP_DROP                  = 0x2
 	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -140,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -301,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -353,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -413,15 +423,16 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
 	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
@@ -504,10 +515,11 @@ const (
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
 	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x8
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
@@ -529,7 +541,7 @@ const (
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
 	EV_RECEIPT                        = 0x40
-	EV_SYSFLAGS                       = 0xf000
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -795,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -860,6 +873,7 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
@@ -970,6 +984,9 @@ const (
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
 	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
@@ -1041,6 +1058,19 @@ const (
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -1053,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -1061,7 +1092,8 @@ const (
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
 	NET_RT_IFNAMES                    = 0x6
-	NET_RT_MAXID                      = 0x7
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
@@ -1078,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -1214,7 +1247,7 @@ const (
 	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1232,6 +1265,9 @@ const (
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
@@ -1248,30 +1284,30 @@ const (
 	SIOCBRDGDELS                      = 0x80606942
 	SIOCBRDGFLUSH                     = 0x80606948
 	SIOCBRDGFRL                       = 0x808c694e
-	SIOCBRDGGCACHE                    = 0xc0186941
-	SIOCBRDGGFD                       = 0xc0186952
-	SIOCBRDGGHT                       = 0xc0186951
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
 	SIOCBRDGGIFFLGS                   = 0xc060693e
-	SIOCBRDGGMA                       = 0xc0186953
+	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc0406958
-	SIOCBRDGGPRI                      = 0xc0186950
+	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc030694f
-	SIOCBRDGGTO                       = 0xc0186946
+	SIOCBRDGGTO                       = 0xc0146946
 	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0206943
 	SIOCBRDGSADDR                     = 0xc1286944
-	SIOCBRDGSCACHE                    = 0x80186940
-	SIOCBRDGSFD                       = 0x80186952
-	SIOCBRDGSHT                       = 0x80186951
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
 	SIOCBRDGSIFCOST                   = 0x80606955
 	SIOCBRDGSIFFLGS                   = 0x8060693f
 	SIOCBRDGSIFPRIO                   = 0x80606954
 	SIOCBRDGSIFPROT                   = 0x8060694a
-	SIOCBRDGSMA                       = 0x80186953
-	SIOCBRDGSPRI                      = 0x80186950
-	SIOCBRDGSPROTO                    = 0x8018695a
-	SIOCBRDGSTO                       = 0x80186945
-	SIOCBRDGSTXHC                     = 0x80186959
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
 	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
@@ -1378,11 +1414,6 @@ const (
 	SIOCSVH                           = 0xc02069f5
 	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
-	SIOCSWGDPID                       = 0xc018695b
-	SIOCSWGMAXFLOW                    = 0xc0186960
-	SIOCSWGMAXGROUP                   = 0xc018695d
-	SIOCSWSDPID                       = 0x8018695c
-	SIOCSWSPORTNO                     = 0xc060695f
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
 	SOCK_DNS                          = 0x1000
@@ -1455,7 +1486,18 @@ const (
 	TCOFLUSH                          = 0x2
 	TCOOFF                            = 0x1
 	TCOON                             = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1833,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1860,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{81920, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
index 1b6eedfa6115..54749f9c5ed7 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
@@ -552,6 +552,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
index 039c4aa06c2c..77479d458155 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
@@ -544,6 +544,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
index 0535d3cfdf2b..2e966d4d7a6c 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
@@ -544,6 +544,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
index 1018b5221704..d65a7c0fa6e9 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
@@ -544,6 +544,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
index 3802f4b379a5..6f0b97c6db3a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
@@ -544,6 +544,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
index 8a2db7da9f3e..e1c23b527236 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
@@ -544,6 +544,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
index 4af561a48d8c..79f7389963ec 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
@@ -521,6 +521,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
index 3b90e9448add..fb161f3a2636 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
@@ -521,6 +521,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
index 890f4ccd131c..4c8ac993a880 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
@@ -521,6 +521,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
index c79f071fc6a8..76dd8ec4fdb9 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
@@ -521,6 +521,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
index 2925fe0a7b73..caeb807bd4e8 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
@@ -696,6 +696,20 @@ var libc_chroot_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
index 75eb2f5f3f72..087444250c9a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
@@ -5,792 +5,665 @@
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getgroups_trampoline_addr(SB)/4, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setgroups_trampoline_addr(SB)/4, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $4
 DATA	·libc_wait4_trampoline_addr(SB)/4, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $4
 DATA	·libc_accept_trampoline_addr(SB)/4, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $4
 DATA	·libc_bind_trampoline_addr(SB)/4, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $4
 DATA	·libc_connect_trampoline_addr(SB)/4, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $4
 DATA	·libc_socket_trampoline_addr(SB)/4, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getsockopt_trampoline_addr(SB)/4, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setsockopt_trampoline_addr(SB)/4, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpeername_trampoline_addr(SB)/4, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getsockname_trampoline_addr(SB)/4, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_shutdown_trampoline_addr(SB)/4, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $4
 DATA	·libc_socketpair_trampoline_addr(SB)/4, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $4
 DATA	·libc_recvfrom_trampoline_addr(SB)/4, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sendto_trampoline_addr(SB)/4, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $4
 DATA	·libc_recvmsg_trampoline_addr(SB)/4, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sendmsg_trampoline_addr(SB)/4, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $4
 DATA	·libc_kevent_trampoline_addr(SB)/4, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $4
 DATA	·libc_utimes_trampoline_addr(SB)/4, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $4
 DATA	·libc_futimes_trampoline_addr(SB)/4, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $4
 DATA	·libc_poll_trampoline_addr(SB)/4, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $4
 DATA	·libc_madvise_trampoline_addr(SB)/4, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mlock_trampoline_addr(SB)/4, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mlockall_trampoline_addr(SB)/4, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mprotect_trampoline_addr(SB)/4, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $4
 DATA	·libc_msync_trampoline_addr(SB)/4, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $4
 DATA	·libc_munlock_trampoline_addr(SB)/4, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $4
 DATA	·libc_munlockall_trampoline_addr(SB)/4, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe2(SB)
-
 GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pipe2_trampoline_addr(SB)/4, $libc_pipe2_trampoline<>(SB)
 
 TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdents(SB)
-
 GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getdents_trampoline_addr(SB)/4, $libc_getdents_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getcwd_trampoline_addr(SB)/4, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $4
 DATA	·libc_ioctl_trampoline_addr(SB)/4, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sysctl_trampoline_addr(SB)/4, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ppoll(SB)
-
 GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $4
 DATA	·libc_ppoll_trampoline_addr(SB)/4, $libc_ppoll_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $4
 DATA	·libc_access_trampoline_addr(SB)/4, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $4
 DATA	·libc_adjtime_trampoline_addr(SB)/4, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chdir_trampoline_addr(SB)/4, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chflags_trampoline_addr(SB)/4, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chmod_trampoline_addr(SB)/4, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chown_trampoline_addr(SB)/4, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chroot_trampoline_addr(SB)/4, $libc_chroot_trampoline<>(SB)
 
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $4
+DATA	·libc_clock_gettime_trampoline_addr(SB)/4, $libc_clock_gettime_trampoline<>(SB)
+
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $4
 DATA	·libc_close_trampoline_addr(SB)/4, $libc_close_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $4
 DATA	·libc_dup_trampoline_addr(SB)/4, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $4
 DATA	·libc_dup2_trampoline_addr(SB)/4, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup3(SB)
-
 GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $4
 DATA	·libc_dup3_trampoline_addr(SB)/4, $libc_dup3_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $4
 DATA	·libc_exit_trampoline_addr(SB)/4, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_faccessat_trampoline_addr(SB)/4, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchdir_trampoline_addr(SB)/4, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchflags_trampoline_addr(SB)/4, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchmod_trampoline_addr(SB)/4, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchmodat_trampoline_addr(SB)/4, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchown_trampoline_addr(SB)/4, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchownat_trampoline_addr(SB)/4, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $4
 DATA	·libc_flock_trampoline_addr(SB)/4, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fpathconf_trampoline_addr(SB)/4, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fstat_trampoline_addr(SB)/4, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fstatat_trampoline_addr(SB)/4, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fstatfs_trampoline_addr(SB)/4, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fsync_trampoline_addr(SB)/4, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $4
 DATA	·libc_ftruncate_trampoline_addr(SB)/4, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getegid_trampoline_addr(SB)/4, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_geteuid_trampoline_addr(SB)/4, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getgid_trampoline_addr(SB)/4, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpgid_trampoline_addr(SB)/4, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpgrp_trampoline_addr(SB)/4, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpid_trampoline_addr(SB)/4, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getppid_trampoline_addr(SB)/4, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpriority_trampoline_addr(SB)/4, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getrlimit_trampoline_addr(SB)/4, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrtable(SB)
-
 GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getrtable_trampoline_addr(SB)/4, $libc_getrtable_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getrusage_trampoline_addr(SB)/4, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getsid_trampoline_addr(SB)/4, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $4
 DATA	·libc_gettimeofday_trampoline_addr(SB)/4, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getuid_trampoline_addr(SB)/4, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_issetugid_trampoline_addr(SB)/4, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $4
 DATA	·libc_kill_trampoline_addr(SB)/4, $libc_kill_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $4
 DATA	·libc_kqueue_trampoline_addr(SB)/4, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_lchown_trampoline_addr(SB)/4, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $4
 DATA	·libc_link_trampoline_addr(SB)/4, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_linkat_trampoline_addr(SB)/4, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $4
 DATA	·libc_listen_trampoline_addr(SB)/4, $libc_listen_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_lstat_trampoline_addr(SB)/4, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkdir_trampoline_addr(SB)/4, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkdirat_trampoline_addr(SB)/4, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkfifo_trampoline_addr(SB)/4, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifoat(SB)
-
 GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkfifoat_trampoline_addr(SB)/4, $libc_mkfifoat_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mknod_trampoline_addr(SB)/4, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknodat(SB)
-
 GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mknodat_trampoline_addr(SB)/4, $libc_mknodat_trampoline<>(SB)
 
 TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_nanosleep(SB)
-
 GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $4
 DATA	·libc_nanosleep_trampoline_addr(SB)/4, $libc_nanosleep_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $4
 DATA	·libc_open_trampoline_addr(SB)/4, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_openat_trampoline_addr(SB)/4, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pathconf_trampoline_addr(SB)/4, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pread_trampoline_addr(SB)/4, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pwrite_trampoline_addr(SB)/4, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $4
 DATA	·libc_read_trampoline_addr(SB)/4, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $4
 DATA	·libc_readlink_trampoline_addr(SB)/4, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_readlinkat_trampoline_addr(SB)/4, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $4
 DATA	·libc_rename_trampoline_addr(SB)/4, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_renameat_trampoline_addr(SB)/4, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $4
 DATA	·libc_revoke_trampoline_addr(SB)/4, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_rmdir_trampoline_addr(SB)/4, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $4
 DATA	·libc_lseek_trampoline_addr(SB)/4, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $4
 DATA	·libc_select_trampoline_addr(SB)/4, $libc_select_trampoline<>(SB)
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setegid_trampoline_addr(SB)/4, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_seteuid_trampoline_addr(SB)/4, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setgid_trampoline_addr(SB)/4, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setlogin_trampoline_addr(SB)/4, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setpgid_trampoline_addr(SB)/4, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setpriority_trampoline_addr(SB)/4, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setregid_trampoline_addr(SB)/4, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setreuid_trampoline_addr(SB)/4, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresgid(SB)
-
 GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setresgid_trampoline_addr(SB)/4, $libc_setresgid_trampoline<>(SB)
 
 TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresuid(SB)
-
 GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setresuid_trampoline_addr(SB)/4, $libc_setresuid_trampoline<>(SB)
 
 TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrlimit(SB)
-
 GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setrlimit_trampoline_addr(SB)/4, $libc_setrlimit_trampoline<>(SB)
 
 TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrtable(SB)
-
 GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setrtable_trampoline_addr(SB)/4, $libc_setrtable_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setsid_trampoline_addr(SB)/4, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $4
 DATA	·libc_settimeofday_trampoline_addr(SB)/4, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setuid_trampoline_addr(SB)/4, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_stat_trampoline_addr(SB)/4, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $4
 DATA	·libc_statfs_trampoline_addr(SB)/4, $libc_statfs_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $4
 DATA	·libc_symlink_trampoline_addr(SB)/4, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_symlinkat_trampoline_addr(SB)/4, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sync_trampoline_addr(SB)/4, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $4
 DATA	·libc_truncate_trampoline_addr(SB)/4, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $4
 DATA	·libc_umask_trampoline_addr(SB)/4, $libc_umask_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $4
 DATA	·libc_unlink_trampoline_addr(SB)/4, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_unlinkat_trampoline_addr(SB)/4, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $4
 DATA	·libc_unmount_trampoline_addr(SB)/4, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $4
 DATA	·libc_write_trampoline_addr(SB)/4, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mmap_trampoline_addr(SB)/4, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $4
 DATA	·libc_munmap_trampoline_addr(SB)/4, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_utimensat_trampoline_addr(SB)/4, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
index 98446d2b9540..a05e5f4fff6d 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
@@ -696,6 +696,20 @@ var libc_chroot_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
index 243a6663ce67..5782cd108447 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
@@ -5,792 +5,665 @@
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe2(SB)
-
 GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
 
 TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdents(SB)
-
 GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ppoll(SB)
-
 GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup3(SB)
-
 GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrtable(SB)
-
 GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifoat(SB)
-
 GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknodat(SB)
-
 GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
 
 TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_nanosleep(SB)
-
 GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
 DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresgid(SB)
-
 GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
 
 TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresuid(SB)
-
 GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
 
 TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrlimit(SB)
-
 GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
 
 TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrtable(SB)
-
 GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
index 8da6791d1e33..b2da8e50cc7a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
@@ -696,6 +696,20 @@ var libc_chroot_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
index 9ad116d9fbdd..cf310420c942 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
@@ -5,792 +5,665 @@
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getgroups_trampoline_addr(SB)/4, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setgroups_trampoline_addr(SB)/4, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $4
 DATA	·libc_wait4_trampoline_addr(SB)/4, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $4
 DATA	·libc_accept_trampoline_addr(SB)/4, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $4
 DATA	·libc_bind_trampoline_addr(SB)/4, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $4
 DATA	·libc_connect_trampoline_addr(SB)/4, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $4
 DATA	·libc_socket_trampoline_addr(SB)/4, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getsockopt_trampoline_addr(SB)/4, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setsockopt_trampoline_addr(SB)/4, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpeername_trampoline_addr(SB)/4, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getsockname_trampoline_addr(SB)/4, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_shutdown_trampoline_addr(SB)/4, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $4
 DATA	·libc_socketpair_trampoline_addr(SB)/4, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $4
 DATA	·libc_recvfrom_trampoline_addr(SB)/4, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sendto_trampoline_addr(SB)/4, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $4
 DATA	·libc_recvmsg_trampoline_addr(SB)/4, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sendmsg_trampoline_addr(SB)/4, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $4
 DATA	·libc_kevent_trampoline_addr(SB)/4, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $4
 DATA	·libc_utimes_trampoline_addr(SB)/4, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $4
 DATA	·libc_futimes_trampoline_addr(SB)/4, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $4
 DATA	·libc_poll_trampoline_addr(SB)/4, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $4
 DATA	·libc_madvise_trampoline_addr(SB)/4, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mlock_trampoline_addr(SB)/4, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mlockall_trampoline_addr(SB)/4, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mprotect_trampoline_addr(SB)/4, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $4
 DATA	·libc_msync_trampoline_addr(SB)/4, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $4
 DATA	·libc_munlock_trampoline_addr(SB)/4, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $4
 DATA	·libc_munlockall_trampoline_addr(SB)/4, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe2(SB)
-
 GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pipe2_trampoline_addr(SB)/4, $libc_pipe2_trampoline<>(SB)
 
 TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdents(SB)
-
 GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getdents_trampoline_addr(SB)/4, $libc_getdents_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getcwd_trampoline_addr(SB)/4, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $4
 DATA	·libc_ioctl_trampoline_addr(SB)/4, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sysctl_trampoline_addr(SB)/4, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ppoll(SB)
-
 GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $4
 DATA	·libc_ppoll_trampoline_addr(SB)/4, $libc_ppoll_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $4
 DATA	·libc_access_trampoline_addr(SB)/4, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $4
 DATA	·libc_adjtime_trampoline_addr(SB)/4, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chdir_trampoline_addr(SB)/4, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chflags_trampoline_addr(SB)/4, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chmod_trampoline_addr(SB)/4, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chown_trampoline_addr(SB)/4, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $4
 DATA	·libc_chroot_trampoline_addr(SB)/4, $libc_chroot_trampoline<>(SB)
 
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $4
+DATA	·libc_clock_gettime_trampoline_addr(SB)/4, $libc_clock_gettime_trampoline<>(SB)
+
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $4
 DATA	·libc_close_trampoline_addr(SB)/4, $libc_close_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $4
 DATA	·libc_dup_trampoline_addr(SB)/4, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $4
 DATA	·libc_dup2_trampoline_addr(SB)/4, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup3(SB)
-
 GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $4
 DATA	·libc_dup3_trampoline_addr(SB)/4, $libc_dup3_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $4
 DATA	·libc_exit_trampoline_addr(SB)/4, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_faccessat_trampoline_addr(SB)/4, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchdir_trampoline_addr(SB)/4, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchflags_trampoline_addr(SB)/4, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchmod_trampoline_addr(SB)/4, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchmodat_trampoline_addr(SB)/4, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchown_trampoline_addr(SB)/4, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fchownat_trampoline_addr(SB)/4, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $4
 DATA	·libc_flock_trampoline_addr(SB)/4, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fpathconf_trampoline_addr(SB)/4, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fstat_trampoline_addr(SB)/4, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fstatat_trampoline_addr(SB)/4, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fstatfs_trampoline_addr(SB)/4, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $4
 DATA	·libc_fsync_trampoline_addr(SB)/4, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $4
 DATA	·libc_ftruncate_trampoline_addr(SB)/4, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getegid_trampoline_addr(SB)/4, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_geteuid_trampoline_addr(SB)/4, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getgid_trampoline_addr(SB)/4, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpgid_trampoline_addr(SB)/4, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpgrp_trampoline_addr(SB)/4, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpid_trampoline_addr(SB)/4, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getppid_trampoline_addr(SB)/4, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getpriority_trampoline_addr(SB)/4, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getrlimit_trampoline_addr(SB)/4, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrtable(SB)
-
 GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getrtable_trampoline_addr(SB)/4, $libc_getrtable_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getrusage_trampoline_addr(SB)/4, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getsid_trampoline_addr(SB)/4, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $4
 DATA	·libc_gettimeofday_trampoline_addr(SB)/4, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getuid_trampoline_addr(SB)/4, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_issetugid_trampoline_addr(SB)/4, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $4
 DATA	·libc_kill_trampoline_addr(SB)/4, $libc_kill_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $4
 DATA	·libc_kqueue_trampoline_addr(SB)/4, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $4
 DATA	·libc_lchown_trampoline_addr(SB)/4, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $4
 DATA	·libc_link_trampoline_addr(SB)/4, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_linkat_trampoline_addr(SB)/4, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $4
 DATA	·libc_listen_trampoline_addr(SB)/4, $libc_listen_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_lstat_trampoline_addr(SB)/4, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkdir_trampoline_addr(SB)/4, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkdirat_trampoline_addr(SB)/4, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkfifo_trampoline_addr(SB)/4, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifoat(SB)
-
 GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mkfifoat_trampoline_addr(SB)/4, $libc_mkfifoat_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mknod_trampoline_addr(SB)/4, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknodat(SB)
-
 GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mknodat_trampoline_addr(SB)/4, $libc_mknodat_trampoline<>(SB)
 
 TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_nanosleep(SB)
-
 GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $4
 DATA	·libc_nanosleep_trampoline_addr(SB)/4, $libc_nanosleep_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $4
 DATA	·libc_open_trampoline_addr(SB)/4, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_openat_trampoline_addr(SB)/4, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pathconf_trampoline_addr(SB)/4, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pread_trampoline_addr(SB)/4, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $4
 DATA	·libc_pwrite_trampoline_addr(SB)/4, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $4
 DATA	·libc_read_trampoline_addr(SB)/4, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $4
 DATA	·libc_readlink_trampoline_addr(SB)/4, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_readlinkat_trampoline_addr(SB)/4, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $4
 DATA	·libc_rename_trampoline_addr(SB)/4, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_renameat_trampoline_addr(SB)/4, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $4
 DATA	·libc_revoke_trampoline_addr(SB)/4, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $4
 DATA	·libc_rmdir_trampoline_addr(SB)/4, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $4
 DATA	·libc_lseek_trampoline_addr(SB)/4, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $4
 DATA	·libc_select_trampoline_addr(SB)/4, $libc_select_trampoline<>(SB)
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setegid_trampoline_addr(SB)/4, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_seteuid_trampoline_addr(SB)/4, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setgid_trampoline_addr(SB)/4, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setlogin_trampoline_addr(SB)/4, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setpgid_trampoline_addr(SB)/4, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setpriority_trampoline_addr(SB)/4, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setregid_trampoline_addr(SB)/4, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setreuid_trampoline_addr(SB)/4, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresgid(SB)
-
 GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setresgid_trampoline_addr(SB)/4, $libc_setresgid_trampoline<>(SB)
 
 TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresuid(SB)
-
 GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setresuid_trampoline_addr(SB)/4, $libc_setresuid_trampoline<>(SB)
 
 TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrlimit(SB)
-
 GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setrlimit_trampoline_addr(SB)/4, $libc_setrlimit_trampoline<>(SB)
 
 TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrtable(SB)
-
 GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setrtable_trampoline_addr(SB)/4, $libc_setrtable_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setsid_trampoline_addr(SB)/4, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $4
 DATA	·libc_settimeofday_trampoline_addr(SB)/4, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $4
 DATA	·libc_setuid_trampoline_addr(SB)/4, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_stat_trampoline_addr(SB)/4, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $4
 DATA	·libc_statfs_trampoline_addr(SB)/4, $libc_statfs_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $4
 DATA	·libc_symlink_trampoline_addr(SB)/4, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_symlinkat_trampoline_addr(SB)/4, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $4
 DATA	·libc_sync_trampoline_addr(SB)/4, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $4
 DATA	·libc_truncate_trampoline_addr(SB)/4, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $4
 DATA	·libc_umask_trampoline_addr(SB)/4, $libc_umask_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $4
 DATA	·libc_unlink_trampoline_addr(SB)/4, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_unlinkat_trampoline_addr(SB)/4, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $4
 DATA	·libc_unmount_trampoline_addr(SB)/4, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $4
 DATA	·libc_write_trampoline_addr(SB)/4, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $4
 DATA	·libc_mmap_trampoline_addr(SB)/4, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $4
 DATA	·libc_munmap_trampoline_addr(SB)/4, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $4
 DATA	·libc_utimensat_trampoline_addr(SB)/4, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
index 800aab6e3e79..048b2655e6f8 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
@@ -696,6 +696,20 @@ var libc_chroot_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
index 4efeff9abbf4..484bb42e0a89 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
@@ -5,792 +5,665 @@
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe2(SB)
-
 GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
 
 TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdents(SB)
-
 GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ppoll(SB)
-
 GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup3(SB)
-
 GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrtable(SB)
-
 GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifoat(SB)
-
 GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknodat(SB)
-
 GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
 
 TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_nanosleep(SB)
-
 GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
 DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresgid(SB)
-
 GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
 
 TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresuid(SB)
-
 GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
 
 TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrlimit(SB)
-
 GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
 
 TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrtable(SB)
-
 GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
index 016d959bc664..6f33e37e723f 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -openbsd -tags openbsd,mips64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_mips64.go
+// go run mksyscall.go -openbsd -libc -tags openbsd,mips64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_mips64.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build openbsd && mips64
@@ -16,7 +16,7 @@ var _ syscall.Errno
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -24,20 +24,28 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	return
 }
 
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setgroups(ngid int, gid *_Gid_t) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
-	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -45,10 +53,14 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 	return
 }
 
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -56,30 +68,42 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	return
 }
 
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socket(domain int, typ int, proto int) (fd int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -87,66 +111,94 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	return
 }
 
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
-	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
-	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Shutdown(s int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
-	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
@@ -156,7 +208,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -164,6 +216,10 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	return
 }
 
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
@@ -173,17 +229,21 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -191,10 +251,14 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -202,10 +266,14 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -213,6 +281,10 @@ func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, ne
 	return
 }
 
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func utimes(path string, timeval *[2]Timeval) (err error) {
@@ -221,27 +293,35 @@ func utimes(path string, timeval *[2]Timeval) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func futimes(fd int, timeval *[2]Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -249,6 +329,10 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	return
 }
 
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Madvise(b []byte, behav int) (err error) {
@@ -258,13 +342,17 @@ func Madvise(b []byte, behav int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlock(b []byte) (err error) {
@@ -274,23 +362,31 @@ func Mlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlockall(flags int) (err error) {
-	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mprotect(b []byte, prot int) (err error) {
@@ -300,13 +396,17 @@ func Mprotect(b []byte, prot int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Msync(b []byte, flags int) (err error) {
@@ -316,13 +416,17 @@ func Msync(b []byte, flags int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlock(b []byte) (err error) {
@@ -332,33 +436,45 @@ func Munlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlockall() (err error) {
-	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -368,7 +484,7 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_GETDENTS, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -376,6 +492,10 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getcwd(buf []byte) (n int, err error) {
@@ -385,7 +505,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -393,16 +513,24 @@ func Getcwd(buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -412,17 +540,21 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -430,6 +562,10 @@ func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int,
 	return
 }
 
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Access(path string, mode uint32) (err error) {
@@ -438,23 +574,31 @@ func Access(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chdir(path string) (err error) {
@@ -463,13 +607,17 @@ func Chdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chflags(path string, flags int) (err error) {
@@ -478,13 +626,17 @@ func Chflags(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chmod(path string, mode uint32) (err error) {
@@ -493,13 +645,17 @@ func Chmod(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chown(path string, uid int, gid int) (err error) {
@@ -508,13 +664,17 @@ func Chown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chroot(path string) (err error) {
@@ -523,27 +683,49 @@ func Chroot(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Close(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup(fd int) (nfd int, err error) {
-	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -551,33 +733,49 @@ func Dup(fd int) (nfd int, err error) {
 	return
 }
 
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup2(from int, to int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup3(from int, to int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP3, uintptr(from), uintptr(to), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Exit(code int) {
-	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
 	return
 }
 
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -586,43 +784,59 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchdir(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchflags(fd int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmod(fd int, mode uint32) (err error) {
-	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -631,23 +845,31 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchown(fd int, uid int, gid int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
@@ -656,27 +878,35 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Flock(fd int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fpathconf(fd int, name int) (val int, err error) {
-	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -684,16 +914,24 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	return
 }
 
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
@@ -702,71 +940,99 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatfs(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fsync(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Ftruncate(fd int, length int64) (err error) {
-	_, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getegid() (egid int) {
-	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
 	egid = int(r0)
 	return
 }
 
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Geteuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getgid() (gid int) {
-	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
 	gid = int(r0)
 	return
 }
 
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgid(pid int) (pgid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -774,34 +1040,50 @@ func Getpgid(pid int) (pgid int, err error) {
 	return
 }
 
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgrp() (pgrp int) {
-	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
 	pgrp = int(r0)
 	return
 }
 
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpid() (pid int) {
-	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	return
 }
 
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getppid() (ppid int) {
-	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
 	ppid = int(r0)
 	return
 }
 
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpriority(which int, who int) (prio int, err error) {
-	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
 	prio = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -809,20 +1091,28 @@ func Getpriority(which int, who int) (prio int, err error) {
 	return
 }
 
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrtable() (rtable int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETRTABLE, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
 	rtable = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -830,20 +1120,28 @@ func Getrtable() (rtable int, err error) {
 	return
 }
 
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrusage(who int, rusage *Rusage) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getsid(pid int) (sid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -851,46 +1149,66 @@ func Getsid(pid int) (sid int, err error) {
 	return
 }
 
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Gettimeofday(tv *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Issetugid() (tainted bool) {
-	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
 	tainted = bool(r0 != 0)
 	return
 }
 
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kill(pid int, signum syscall.Signal) (err error) {
-	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kqueue() (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -898,6 +1216,10 @@ func Kqueue() (fd int, err error) {
 	return
 }
 
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lchown(path string, uid int, gid int) (err error) {
@@ -906,13 +1228,17 @@ func Lchown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Link(path string, link string) (err error) {
@@ -926,13 +1252,17 @@ func Link(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
@@ -946,23 +1276,31 @@ func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err er
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Listen(s int, backlog int) (err error) {
-	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lstat(path string, stat *Stat_t) (err error) {
@@ -971,13 +1309,17 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdir(path string, mode uint32) (err error) {
@@ -986,13 +1328,17 @@ func Mkdir(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdirat(dirfd int, path string, mode uint32) (err error) {
@@ -1001,13 +1347,17 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifo(path string, mode uint32) (err error) {
@@ -1016,13 +1366,17 @@ func Mkfifo(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
@@ -1031,13 +1385,17 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFOAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknod(path string, mode uint32, dev int) (err error) {
@@ -1046,13 +1404,17 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
@@ -1061,23 +1423,31 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
-	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Open(path string, mode int, perm uint32) (fd int, err error) {
@@ -1086,7 +1456,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1094,6 +1464,10 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
@@ -1102,7 +1476,7 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1110,6 +1484,10 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Pathconf(path string, name int) (val int, err error) {
@@ -1118,7 +1496,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1126,6 +1504,10 @@ func Pathconf(path string, name int) (val int, err error) {
 	return
 }
 
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pread(fd int, p []byte, offset int64) (n int, err error) {
@@ -1135,7 +1517,7 @@ func pread(fd int, p []byte, offset int64) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1143,6 +1525,10 @@ func pread(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pwrite(fd int, p []byte, offset int64) (n int, err error) {
@@ -1152,7 +1538,7 @@ func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1160,6 +1546,10 @@ func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func read(fd int, p []byte) (n int, err error) {
@@ -1169,7 +1559,7 @@ func read(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1177,6 +1567,10 @@ func read(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlink(path string, buf []byte) (n int, err error) {
@@ -1191,7 +1585,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1199,6 +1593,10 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
@@ -1213,7 +1611,7 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1221,6 +1619,10 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rename(from string, to string) (err error) {
@@ -1234,13 +1636,17 @@ func Rename(from string, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Renameat(fromfd int, from string, tofd int, to string) (err error) {
@@ -1254,13 +1660,17 @@ func Renameat(fromfd int, from string, tofd int, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Revoke(path string) (err error) {
@@ -1269,13 +1679,17 @@ func Revoke(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rmdir(path string) (err error) {
@@ -1284,17 +1698,21 @@ func Rmdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
-	r0, _, e1 := Syscall6(SYS_LSEEK, uintptr(fd), 0, uintptr(offset), uintptr(whence), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(whence))
 	newoffset = int64(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1302,10 +1720,14 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return
 }
 
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1313,36 +1735,52 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	return
 }
 
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setegid(egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seteuid(euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setgid(gid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setlogin(name string) (err error) {
@@ -1351,97 +1789,133 @@ func Setlogin(name string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpgid(pid int, pgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpriority(which int, who int, prio int) (err error) {
-	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrlimit setrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrtable(rtable int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRTABLE, uintptr(rtable), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setsid() (pid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1449,26 +1923,38 @@ func Setsid() (pid int, err error) {
 	return
 }
 
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Settimeofday(tp *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setuid(uid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Stat(path string, stat *Stat_t) (err error) {
@@ -1477,13 +1963,17 @@ func Stat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Statfs(path string, stat *Statfs_t) (err error) {
@@ -1492,13 +1982,17 @@ func Statfs(path string, stat *Statfs_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlink(path string, link string) (err error) {
@@ -1512,13 +2006,17 @@ func Symlink(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
@@ -1532,23 +2030,31 @@ func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Sync() (err error) {
-	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Truncate(path string, length int64) (err error) {
@@ -1557,21 +2063,29 @@ func Truncate(path string, length int64) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Umask(newmask int) (oldmask int) {
-	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
 	oldmask = int(r0)
 	return
 }
 
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlink(path string) (err error) {
@@ -1580,13 +2094,17 @@ func Unlink(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlinkat(dirfd int, path string, flags int) (err error) {
@@ -1595,13 +2113,17 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unmount(path string, flags int) (err error) {
@@ -1610,13 +2132,17 @@ func Unmount(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func write(fd int, p []byte) (n int, err error) {
@@ -1626,7 +2152,7 @@ func write(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1634,10 +2160,14 @@ func write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
-	r0, _, e1 := Syscall9(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
 	ret = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1645,20 +2175,28 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	return
 }
 
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func munmap(addr uintptr, length uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1669,7 +2207,7 @@ func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1685,9 +2223,13 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
new file mode 100644
index 000000000000..55af27263ad7
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
@@ -0,0 +1,669 @@
+// go run mkasm.go openbsd mips64
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
+DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
+DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
+DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
+DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
+DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
+DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
+DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
+DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
+DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
+DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
+DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
+DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
+DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrlimit(SB)
+GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
+DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
+DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
index c85de2d9766b..330cf7f7ac66 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
@@ -696,6 +696,20 @@ var libc_chroot_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
index 7c9223b64187..4028255b0d5b 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
@@ -249,6 +249,12 @@ TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_clock_gettime(SB)
+	RET
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	CALL	libc_close(SB)
 	RET
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
index 8e3e7873f893..5f24de0d9d76 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
@@ -696,6 +696,20 @@ var libc_chroot_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
index 7dba789271ca..e1fbd4dfa8c8 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
@@ -5,792 +5,665 @@
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe2(SB)
-
 GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
 
 TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdents(SB)
-
 GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ppoll(SB)
-
 GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup3(SB)
-
 GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrtable(SB)
-
 GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifoat(SB)
-
 GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknodat(SB)
-
 GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
 
 TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_nanosleep(SB)
-
 GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
 DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresgid(SB)
-
 GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
 
 TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setresuid(SB)
-
 GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
 
 TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrlimit(SB)
-
 GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
 
 TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setrtable(SB)
-
 GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
index 91f5a2bde282..78d4a4240e9c 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
@@ -38,6 +38,7 @@ import (
 //go:cgo_import_dynamic libc_chmod chmod "libc.so"
 //go:cgo_import_dynamic libc_chown chown "libc.so"
 //go:cgo_import_dynamic libc_chroot chroot "libc.so"
+//go:cgo_import_dynamic libc_clockgettime clockgettime "libc.so"
 //go:cgo_import_dynamic libc_close close "libc.so"
 //go:cgo_import_dynamic libc_creat creat "libc.so"
 //go:cgo_import_dynamic libc_dup dup "libc.so"
@@ -177,6 +178,7 @@ import (
 //go:linkname procChmod libc_chmod
 //go:linkname procChown libc_chown
 //go:linkname procChroot libc_chroot
+//go:linkname procClockGettime libc_clockgettime
 //go:linkname procClose libc_close
 //go:linkname procCreat libc_creat
 //go:linkname procDup libc_dup
@@ -317,6 +319,7 @@ var (
 	procChmod,
 	procChown,
 	procChroot,
+	procClockGettime,
 	procClose,
 	procCreat,
 	procDup,
@@ -750,6 +753,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClockGettime)), 2, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0, 0, 0, 0)
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClose)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go
index 9e9d0b2a9c45..55e0484719c4 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go
@@ -17,6 +17,7 @@ var sysctlMib = []mibentry{
 	{"ddb.max_line", []_C_int{9, 3}},
 	{"ddb.max_width", []_C_int{9, 2}},
 	{"ddb.panic", []_C_int{9, 5}},
+	{"ddb.profile", []_C_int{9, 9}},
 	{"ddb.radix", []_C_int{9, 1}},
 	{"ddb.tab_stop_width", []_C_int{9, 4}},
 	{"ddb.trigger", []_C_int{9, 8}},
@@ -33,29 +34,37 @@ var sysctlMib = []mibentry{
 	{"hw.ncpufound", []_C_int{6, 21}},
 	{"hw.ncpuonline", []_C_int{6, 25}},
 	{"hw.pagesize", []_C_int{6, 7}},
+	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
 	{"hw.usermem", []_C_int{6, 20}},
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
-	{"kern.arandom", []_C_int{1, 37}},
+	{"kern.allowdt", []_C_int{1, 65}},
+	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
 	{"kern.boottime", []_C_int{1, 21}},
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
-	{"kern.cryptodevallowsoft", []_C_int{1, 53}},
+	{"kern.cpustats", []_C_int{1, 85}},
 	{"kern.domainname", []_C_int{1, 22}},
 	{"kern.file", []_C_int{1, 73}},
 	{"kern.forkstat", []_C_int{1, 42}},
 	{"kern.fscale", []_C_int{1, 46}},
 	{"kern.fsync", []_C_int{1, 33}},
+	{"kern.global_ptrace", []_C_int{1, 81}},
 	{"kern.hostid", []_C_int{1, 11}},
 	{"kern.hostname", []_C_int{1, 10}},
 	{"kern.intrcnt.nintrcnt", []_C_int{1, 63, 1}},
@@ -78,17 +87,16 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
-	{"kern.random", []_C_int{1, 31}},
 	{"kern.rawpartition", []_C_int{1, 24}},
 	{"kern.saved_ids", []_C_int{1, 20}},
 	{"kern.securelevel", []_C_int{1, 9}},
@@ -106,21 +114,20 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
-	{"kern.tty.maxptys", []_C_int{1, 44, 6}},
-	{"kern.tty.nptys", []_C_int{1, 44, 7}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
-	{"kern.userasymcrypto", []_C_int{1, 60}},
-	{"kern.usercrypto", []_C_int{1, 52}},
-	{"kern.usermount", []_C_int{1, 30}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
-	{"kern.vnode", []_C_int{1, 13}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
+	{"kern.wxabort", []_C_int{1, 74}},
 	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
 	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
 	{"net.inet.ah.enable", []_C_int{4, 2, 51, 1}},
@@ -148,7 +155,9 @@ var sysctlMib = []mibentry{
 	{"net.inet.icmp.stats", []_C_int{4, 2, 1, 7}},
 	{"net.inet.icmp.tstamprepl", []_C_int{4, 2, 1, 6}},
 	{"net.inet.igmp.stats", []_C_int{4, 2, 2, 1}},
+	{"net.inet.ip.arpdown", []_C_int{4, 2, 0, 40}},
 	{"net.inet.ip.arpqueued", []_C_int{4, 2, 0, 36}},
+	{"net.inet.ip.arptimeout", []_C_int{4, 2, 0, 39}},
 	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
 	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
 	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
@@ -157,8 +166,10 @@ var sysctlMib = []mibentry{
 	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
 	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},
 	{"net.inet.ip.mforwarding", []_C_int{4, 2, 0, 31}},
+	{"net.inet.ip.mrtmfc", []_C_int{4, 2, 0, 37}},
 	{"net.inet.ip.mrtproto", []_C_int{4, 2, 0, 34}},
 	{"net.inet.ip.mrtstats", []_C_int{4, 2, 0, 35}},
+	{"net.inet.ip.mrtvif", []_C_int{4, 2, 0, 38}},
 	{"net.inet.ip.mtu", []_C_int{4, 2, 0, 4}},
 	{"net.inet.ip.mtudisc", []_C_int{4, 2, 0, 27}},
 	{"net.inet.ip.mtudisctimeout", []_C_int{4, 2, 0, 28}},
@@ -175,9 +186,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
-	{"net.inet.pim.stats", []_C_int{4, 2, 103, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
 	{"net.inet.tcp.baddynamic", []_C_int{4, 2, 6, 6}},
@@ -191,6 +200,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.reasslimit", []_C_int{4, 2, 6, 18}},
 	{"net.inet.tcp.rfc1323", []_C_int{4, 2, 6, 1}},
 	{"net.inet.tcp.rfc3390", []_C_int{4, 2, 6, 17}},
+	{"net.inet.tcp.rootonly", []_C_int{4, 2, 6, 24}},
 	{"net.inet.tcp.rstppslimit", []_C_int{4, 2, 6, 12}},
 	{"net.inet.tcp.sack", []_C_int{4, 2, 6, 10}},
 	{"net.inet.tcp.sackholelimit", []_C_int{4, 2, 6, 20}},
@@ -198,9 +208,12 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.stats", []_C_int{4, 2, 6, 21}},
 	{"net.inet.tcp.synbucketlimit", []_C_int{4, 2, 6, 16}},
 	{"net.inet.tcp.syncachelimit", []_C_int{4, 2, 6, 15}},
+	{"net.inet.tcp.synhashsize", []_C_int{4, 2, 6, 25}},
+	{"net.inet.tcp.synuselimit", []_C_int{4, 2, 6, 23}},
 	{"net.inet.udp.baddynamic", []_C_int{4, 2, 17, 2}},
 	{"net.inet.udp.checksum", []_C_int{4, 2, 17, 1}},
 	{"net.inet.udp.recvspace", []_C_int{4, 2, 17, 3}},
+	{"net.inet.udp.rootonly", []_C_int{4, 2, 17, 6}},
 	{"net.inet.udp.sendspace", []_C_int{4, 2, 17, 4}},
 	{"net.inet.udp.stats", []_C_int{4, 2, 17, 5}},
 	{"net.inet6.divert.recvspace", []_C_int{4, 24, 86, 1}},
@@ -213,13 +226,8 @@ var sysctlMib = []mibentry{
 	{"net.inet6.icmp6.nd6_delay", []_C_int{4, 24, 30, 8}},
 	{"net.inet6.icmp6.nd6_maxnudhint", []_C_int{4, 24, 30, 15}},
 	{"net.inet6.icmp6.nd6_mmaxtries", []_C_int{4, 24, 30, 10}},
-	{"net.inet6.icmp6.nd6_prune", []_C_int{4, 24, 30, 6}},
 	{"net.inet6.icmp6.nd6_umaxtries", []_C_int{4, 24, 30, 9}},
-	{"net.inet6.icmp6.nd6_useloopback", []_C_int{4, 24, 30, 11}},
-	{"net.inet6.icmp6.nodeinfo", []_C_int{4, 24, 30, 13}},
-	{"net.inet6.icmp6.rediraccept", []_C_int{4, 24, 30, 2}},
 	{"net.inet6.icmp6.redirtimeout", []_C_int{4, 24, 30, 3}},
-	{"net.inet6.ip6.accept_rtadv", []_C_int{4, 24, 17, 12}},
 	{"net.inet6.ip6.auto_flowlabel", []_C_int{4, 24, 17, 17}},
 	{"net.inet6.ip6.dad_count", []_C_int{4, 24, 17, 16}},
 	{"net.inet6.ip6.dad_pending", []_C_int{4, 24, 17, 49}},
@@ -232,20 +240,19 @@ var sysctlMib = []mibentry{
 	{"net.inet6.ip6.maxdynroutes", []_C_int{4, 24, 17, 48}},
 	{"net.inet6.ip6.maxfragpackets", []_C_int{4, 24, 17, 9}},
 	{"net.inet6.ip6.maxfrags", []_C_int{4, 24, 17, 41}},
-	{"net.inet6.ip6.maxifdefrouters", []_C_int{4, 24, 17, 47}},
-	{"net.inet6.ip6.maxifprefixes", []_C_int{4, 24, 17, 46}},
 	{"net.inet6.ip6.mforwarding", []_C_int{4, 24, 17, 42}},
+	{"net.inet6.ip6.mrtmfc", []_C_int{4, 24, 17, 53}},
+	{"net.inet6.ip6.mrtmif", []_C_int{4, 24, 17, 52}},
 	{"net.inet6.ip6.mrtproto", []_C_int{4, 24, 17, 8}},
 	{"net.inet6.ip6.mtudisctimeout", []_C_int{4, 24, 17, 50}},
 	{"net.inet6.ip6.multicast_mtudisc", []_C_int{4, 24, 17, 44}},
 	{"net.inet6.ip6.multipath", []_C_int{4, 24, 17, 43}},
 	{"net.inet6.ip6.neighborgcthresh", []_C_int{4, 24, 17, 45}},
 	{"net.inet6.ip6.redirect", []_C_int{4, 24, 17, 2}},
-	{"net.inet6.ip6.rr_prune", []_C_int{4, 24, 17, 22}},
+	{"net.inet6.ip6.soiikey", []_C_int{4, 24, 17, 54}},
 	{"net.inet6.ip6.sourcecheck", []_C_int{4, 24, 17, 10}},
 	{"net.inet6.ip6.sourcecheck_logint", []_C_int{4, 24, 17, 11}},
 	{"net.inet6.ip6.use_deprecated", []_C_int{4, 24, 17, 21}},
-	{"net.inet6.ip6.v6only", []_C_int{4, 24, 17, 24}},
 	{"net.key.sadb_dump", []_C_int{4, 30, 1}},
 	{"net.key.spd_dump", []_C_int{4, 30, 2}},
 	{"net.mpls.ifq.congestion", []_C_int{4, 33, 3, 4}},
@@ -254,12 +261,12 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
 	{"vm.anonmin", []_C_int{2, 7}},
 	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
 	{"vm.maxslp", []_C_int{2, 10}},
 	{"vm.nkmempages", []_C_int{2, 6}},
 	{"vm.psstrings", []_C_int{2, 3}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go
index adecd09667d0..d2243cf83f5b 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go
@@ -36,23 +36,29 @@ var sysctlMib = []mibentry{
 	{"hw.pagesize", []_C_int{6, 7}},
 	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
 	{"hw.usermem", []_C_int{6, 20}},
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
+	{"kern.allowdt", []_C_int{1, 65}},
 	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
 	{"kern.boottime", []_C_int{1, 21}},
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
-	{"kern.dnsjackport", []_C_int{1, 13}},
+	{"kern.cpustats", []_C_int{1, 85}},
 	{"kern.domainname", []_C_int{1, 22}},
 	{"kern.file", []_C_int{1, 73}},
 	{"kern.forkstat", []_C_int{1, 42}},
@@ -81,13 +87,13 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
@@ -108,15 +114,19 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
 	{"kern.wxabort", []_C_int{1, 74}},
 	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
 	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
@@ -176,7 +186,6 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
@@ -252,12 +261,12 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
 	{"vm.anonmin", []_C_int{2, 7}},
 	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
 	{"vm.maxslp", []_C_int{2, 10}},
 	{"vm.nkmempages", []_C_int{2, 6}},
 	{"vm.psstrings", []_C_int{2, 3}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go
index 8ea52a4a1810..82dc51bd8b57 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go
@@ -17,6 +17,7 @@ var sysctlMib = []mibentry{
 	{"ddb.max_line", []_C_int{9, 3}},
 	{"ddb.max_width", []_C_int{9, 2}},
 	{"ddb.panic", []_C_int{9, 5}},
+	{"ddb.profile", []_C_int{9, 9}},
 	{"ddb.radix", []_C_int{9, 1}},
 	{"ddb.tab_stop_width", []_C_int{9, 4}},
 	{"ddb.trigger", []_C_int{9, 8}},
@@ -33,29 +34,37 @@ var sysctlMib = []mibentry{
 	{"hw.ncpufound", []_C_int{6, 21}},
 	{"hw.ncpuonline", []_C_int{6, 25}},
 	{"hw.pagesize", []_C_int{6, 7}},
+	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
 	{"hw.usermem", []_C_int{6, 20}},
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
-	{"kern.arandom", []_C_int{1, 37}},
+	{"kern.allowdt", []_C_int{1, 65}},
+	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
 	{"kern.boottime", []_C_int{1, 21}},
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
-	{"kern.cryptodevallowsoft", []_C_int{1, 53}},
+	{"kern.cpustats", []_C_int{1, 85}},
 	{"kern.domainname", []_C_int{1, 22}},
 	{"kern.file", []_C_int{1, 73}},
 	{"kern.forkstat", []_C_int{1, 42}},
 	{"kern.fscale", []_C_int{1, 46}},
 	{"kern.fsync", []_C_int{1, 33}},
+	{"kern.global_ptrace", []_C_int{1, 81}},
 	{"kern.hostid", []_C_int{1, 11}},
 	{"kern.hostname", []_C_int{1, 10}},
 	{"kern.intrcnt.nintrcnt", []_C_int{1, 63, 1}},
@@ -78,17 +87,16 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
-	{"kern.random", []_C_int{1, 31}},
 	{"kern.rawpartition", []_C_int{1, 24}},
 	{"kern.saved_ids", []_C_int{1, 20}},
 	{"kern.securelevel", []_C_int{1, 9}},
@@ -106,21 +114,20 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
-	{"kern.tty.maxptys", []_C_int{1, 44, 6}},
-	{"kern.tty.nptys", []_C_int{1, 44, 7}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
-	{"kern.userasymcrypto", []_C_int{1, 60}},
-	{"kern.usercrypto", []_C_int{1, 52}},
-	{"kern.usermount", []_C_int{1, 30}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
-	{"kern.vnode", []_C_int{1, 13}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
+	{"kern.wxabort", []_C_int{1, 74}},
 	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
 	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
 	{"net.inet.ah.enable", []_C_int{4, 2, 51, 1}},
@@ -148,7 +155,9 @@ var sysctlMib = []mibentry{
 	{"net.inet.icmp.stats", []_C_int{4, 2, 1, 7}},
 	{"net.inet.icmp.tstamprepl", []_C_int{4, 2, 1, 6}},
 	{"net.inet.igmp.stats", []_C_int{4, 2, 2, 1}},
+	{"net.inet.ip.arpdown", []_C_int{4, 2, 0, 40}},
 	{"net.inet.ip.arpqueued", []_C_int{4, 2, 0, 36}},
+	{"net.inet.ip.arptimeout", []_C_int{4, 2, 0, 39}},
 	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
 	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
 	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
@@ -157,8 +166,10 @@ var sysctlMib = []mibentry{
 	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
 	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},
 	{"net.inet.ip.mforwarding", []_C_int{4, 2, 0, 31}},
+	{"net.inet.ip.mrtmfc", []_C_int{4, 2, 0, 37}},
 	{"net.inet.ip.mrtproto", []_C_int{4, 2, 0, 34}},
 	{"net.inet.ip.mrtstats", []_C_int{4, 2, 0, 35}},
+	{"net.inet.ip.mrtvif", []_C_int{4, 2, 0, 38}},
 	{"net.inet.ip.mtu", []_C_int{4, 2, 0, 4}},
 	{"net.inet.ip.mtudisc", []_C_int{4, 2, 0, 27}},
 	{"net.inet.ip.mtudisctimeout", []_C_int{4, 2, 0, 28}},
@@ -175,9 +186,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
-	{"net.inet.pim.stats", []_C_int{4, 2, 103, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
 	{"net.inet.tcp.baddynamic", []_C_int{4, 2, 6, 6}},
@@ -191,6 +200,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.reasslimit", []_C_int{4, 2, 6, 18}},
 	{"net.inet.tcp.rfc1323", []_C_int{4, 2, 6, 1}},
 	{"net.inet.tcp.rfc3390", []_C_int{4, 2, 6, 17}},
+	{"net.inet.tcp.rootonly", []_C_int{4, 2, 6, 24}},
 	{"net.inet.tcp.rstppslimit", []_C_int{4, 2, 6, 12}},
 	{"net.inet.tcp.sack", []_C_int{4, 2, 6, 10}},
 	{"net.inet.tcp.sackholelimit", []_C_int{4, 2, 6, 20}},
@@ -198,9 +208,12 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.stats", []_C_int{4, 2, 6, 21}},
 	{"net.inet.tcp.synbucketlimit", []_C_int{4, 2, 6, 16}},
 	{"net.inet.tcp.syncachelimit", []_C_int{4, 2, 6, 15}},
+	{"net.inet.tcp.synhashsize", []_C_int{4, 2, 6, 25}},
+	{"net.inet.tcp.synuselimit", []_C_int{4, 2, 6, 23}},
 	{"net.inet.udp.baddynamic", []_C_int{4, 2, 17, 2}},
 	{"net.inet.udp.checksum", []_C_int{4, 2, 17, 1}},
 	{"net.inet.udp.recvspace", []_C_int{4, 2, 17, 3}},
+	{"net.inet.udp.rootonly", []_C_int{4, 2, 17, 6}},
 	{"net.inet.udp.sendspace", []_C_int{4, 2, 17, 4}},
 	{"net.inet.udp.stats", []_C_int{4, 2, 17, 5}},
 	{"net.inet6.divert.recvspace", []_C_int{4, 24, 86, 1}},
@@ -213,13 +226,8 @@ var sysctlMib = []mibentry{
 	{"net.inet6.icmp6.nd6_delay", []_C_int{4, 24, 30, 8}},
 	{"net.inet6.icmp6.nd6_maxnudhint", []_C_int{4, 24, 30, 15}},
 	{"net.inet6.icmp6.nd6_mmaxtries", []_C_int{4, 24, 30, 10}},
-	{"net.inet6.icmp6.nd6_prune", []_C_int{4, 24, 30, 6}},
 	{"net.inet6.icmp6.nd6_umaxtries", []_C_int{4, 24, 30, 9}},
-	{"net.inet6.icmp6.nd6_useloopback", []_C_int{4, 24, 30, 11}},
-	{"net.inet6.icmp6.nodeinfo", []_C_int{4, 24, 30, 13}},
-	{"net.inet6.icmp6.rediraccept", []_C_int{4, 24, 30, 2}},
 	{"net.inet6.icmp6.redirtimeout", []_C_int{4, 24, 30, 3}},
-	{"net.inet6.ip6.accept_rtadv", []_C_int{4, 24, 17, 12}},
 	{"net.inet6.ip6.auto_flowlabel", []_C_int{4, 24, 17, 17}},
 	{"net.inet6.ip6.dad_count", []_C_int{4, 24, 17, 16}},
 	{"net.inet6.ip6.dad_pending", []_C_int{4, 24, 17, 49}},
@@ -232,20 +240,19 @@ var sysctlMib = []mibentry{
 	{"net.inet6.ip6.maxdynroutes", []_C_int{4, 24, 17, 48}},
 	{"net.inet6.ip6.maxfragpackets", []_C_int{4, 24, 17, 9}},
 	{"net.inet6.ip6.maxfrags", []_C_int{4, 24, 17, 41}},
-	{"net.inet6.ip6.maxifdefrouters", []_C_int{4, 24, 17, 47}},
-	{"net.inet6.ip6.maxifprefixes", []_C_int{4, 24, 17, 46}},
 	{"net.inet6.ip6.mforwarding", []_C_int{4, 24, 17, 42}},
+	{"net.inet6.ip6.mrtmfc", []_C_int{4, 24, 17, 53}},
+	{"net.inet6.ip6.mrtmif", []_C_int{4, 24, 17, 52}},
 	{"net.inet6.ip6.mrtproto", []_C_int{4, 24, 17, 8}},
 	{"net.inet6.ip6.mtudisctimeout", []_C_int{4, 24, 17, 50}},
 	{"net.inet6.ip6.multicast_mtudisc", []_C_int{4, 24, 17, 44}},
 	{"net.inet6.ip6.multipath", []_C_int{4, 24, 17, 43}},
 	{"net.inet6.ip6.neighborgcthresh", []_C_int{4, 24, 17, 45}},
 	{"net.inet6.ip6.redirect", []_C_int{4, 24, 17, 2}},
-	{"net.inet6.ip6.rr_prune", []_C_int{4, 24, 17, 22}},
+	{"net.inet6.ip6.soiikey", []_C_int{4, 24, 17, 54}},
 	{"net.inet6.ip6.sourcecheck", []_C_int{4, 24, 17, 10}},
 	{"net.inet6.ip6.sourcecheck_logint", []_C_int{4, 24, 17, 11}},
 	{"net.inet6.ip6.use_deprecated", []_C_int{4, 24, 17, 21}},
-	{"net.inet6.ip6.v6only", []_C_int{4, 24, 17, 24}},
 	{"net.key.sadb_dump", []_C_int{4, 30, 1}},
 	{"net.key.spd_dump", []_C_int{4, 30, 2}},
 	{"net.mpls.ifq.congestion", []_C_int{4, 33, 3, 4}},
@@ -254,12 +261,12 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
 	{"vm.anonmin", []_C_int{2, 7}},
 	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
 	{"vm.maxslp", []_C_int{2, 10}},
 	{"vm.nkmempages", []_C_int{2, 6}},
 	{"vm.psstrings", []_C_int{2, 3}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go
index 154b57ae3e2a..cbdda1a4ae24 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go
@@ -36,6 +36,7 @@ var sysctlMib = []mibentry{
 	{"hw.pagesize", []_C_int{6, 7}},
 	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
@@ -44,6 +45,7 @@ var sysctlMib = []mibentry{
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
+	{"kern.allowdt", []_C_int{1, 65}},
 	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
 	{"kern.audio", []_C_int{1, 84}},
@@ -51,6 +53,8 @@ var sysctlMib = []mibentry{
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
@@ -83,13 +87,13 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
@@ -110,13 +114,16 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
 	{"kern.witnesswatch", []_C_int{1, 53}},
@@ -179,7 +186,6 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
@@ -255,7 +261,6 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go
index d96bb2ba4db6..f55eae1a8211 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go
@@ -36,6 +36,7 @@ var sysctlMib = []mibentry{
 	{"hw.pagesize", []_C_int{6, 7}},
 	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
@@ -86,7 +87,6 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
@@ -123,6 +123,7 @@ var sysctlMib = []mibentry{
 	{"kern.ttycount", []_C_int{1, 57}},
 	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
 	{"kern.witnesswatch", []_C_int{1, 53}},
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go
index a37f77375636..01c43a01fda7 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go
@@ -6,6 +6,7 @@
 
 package unix
 
+// Deprecated: Use libc wrappers instead of direct syscalls.
 const (
 	SYS_EXIT           = 1   // { void sys_exit(int rval); }
 	SYS_FORK           = 2   // { int sys_fork(void); }
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go
index 2fd2060e617a..9bc4c8f9d889 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go
@@ -491,6 +491,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go
index 6a5a1a8ae556..bb05f655d225 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go
@@ -499,6 +499,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
index 84cc8d01e656..db40e3a19c66 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
@@ -496,6 +496,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go
index c844e7096ff5..11121151ccf0 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go
@@ -499,6 +499,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go
index 2ed718ca06a7..26eba23b729f 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go
@@ -58,22 +58,22 @@ type Rlimit struct {
 type _Gid_t uint32
 
 type Stat_t struct {
-	Mode           uint32
-	Dev            int32
-	Ino            uint64
-	Nlink          uint32
-	Uid            uint32
-	Gid            uint32
-	Rdev           int32
-	Atim           Timespec
-	Mtim           Timespec
-	Ctim           Timespec
-	Size           int64
-	Blocks         int64
-	Blksize        uint32
-	Flags          uint32
-	Gen            uint32
-	X__st_birthtim Timespec
+	Mode    uint32
+	Dev     int32
+	Ino     uint64
+	Nlink   uint32
+	Uid     uint32
+	Gid     uint32
+	Rdev    int32
+	Atim    Timespec
+	Mtim    Timespec
+	Ctim    Timespec
+	Size    int64
+	Blocks  int64
+	Blksize int32
+	Flags   uint32
+	Gen     uint32
+	_       Timespec
 }
 
 type Statfs_t struct {
@@ -98,7 +98,7 @@ type Statfs_t struct {
 	F_mntonname   [90]byte
 	F_mntfromname [90]byte
 	F_mntfromspec [90]byte
-	Pad_cgo_0     [2]byte
+	_             [2]byte
 	Mount_info    [160]byte
 }
 
@@ -111,13 +111,13 @@ type Flock_t struct {
 }
 
 type Dirent struct {
-	Fileno       uint64
-	Off          int64
-	Reclen       uint16
-	Type         uint8
-	Namlen       uint8
-	X__d_padding [4]uint8
-	Name         [256]int8
+	Fileno uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Namlen uint8
+	_      [4]uint8
+	Name   [256]int8
 }
 
 type Fsid struct {
@@ -262,8 +262,8 @@ type FdSet struct {
 }
 
 const (
-	SizeofIfMsghdr         = 0xec
-	SizeofIfData           = 0xd4
+	SizeofIfMsghdr         = 0xa0
+	SizeofIfData           = 0x88
 	SizeofIfaMsghdr        = 0x18
 	SizeofIfAnnounceMsghdr = 0x1a
 	SizeofRtMsghdr         = 0x60
@@ -292,7 +292,7 @@ type IfData struct {
 	Link_state   uint8
 	Mtu          uint32
 	Metric       uint32
-	Pad          uint32
+	Rdomain      uint32
 	Baudrate     uint64
 	Ipackets     uint64
 	Ierrors      uint64
@@ -304,10 +304,10 @@ type IfData struct {
 	Imcasts      uint64
 	Omcasts      uint64
 	Iqdrops      uint64
+	Oqdrops      uint64
 	Noproto      uint64
 	Capabilities uint32
 	Lastchange   Timeval
-	Mclpool      [7]Mclpool
 }
 
 type IfaMsghdr struct {
@@ -368,20 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct {
-	Grown int32
-	Alive uint16
-	Hwm   uint16
-	Cwm   uint16
-	Lwm   uint16
-}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x8
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -407,11 +399,14 @@ type BpfInsn struct {
 }
 
 type BpfHdr struct {
-	Tstamp    BpfTimeval
-	Caplen    uint32
-	Datalen   uint32
-	Hdrlen    uint16
-	Pad_cgo_0 [2]byte
+	Tstamp  BpfTimeval
+	Caplen  uint32
+	Datalen uint32
+	Hdrlen  uint16
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
@@ -488,7 +483,7 @@ type Uvmexp struct {
 	Zeropages          int32
 	Reserve_pagedaemon int32
 	Reserve_kernel     int32
-	Anonpages          int32
+	Unused01           int32
 	Vnodepages         int32
 	Vtextpages         int32
 	Freemin            int32
@@ -507,8 +502,8 @@ type Uvmexp struct {
 	Swpgonly           int32
 	Nswget             int32
 	Nanon              int32
-	Nanonneeded        int32
-	Nfreeanon          int32
+	Unused05           int32
+	Unused06           int32
 	Faults             int32
 	Traps              int32
 	Intrs              int32
@@ -516,8 +511,8 @@ type Uvmexp struct {
 	Softs              int32
 	Syscalls           int32
 	Pageins            int32
-	Obsolete_swapins   int32
-	Obsolete_swapouts  int32
+	Unused07           int32
+	Unused08           int32
 	Pgswapin           int32
 	Pgswapout          int32
 	Forks              int32
@@ -525,7 +520,7 @@ type Uvmexp struct {
 	Forks_sharevm      int32
 	Pga_zerohit        int32
 	Pga_zeromiss       int32
-	Zeroaborts         int32
+	Unused09           int32
 	Fltnoram           int32
 	Fltnoanon          int32
 	Fltnoamap          int32
@@ -557,9 +552,9 @@ type Uvmexp struct {
 	Pdpageouts         int32
 	Pdpending          int32
 	Pddeact            int32
-	Pdreanon           int32
-	Pdrevnode          int32
-	Pdrevtext          int32
+	Unused11           int32
+	Unused12           int32
+	Unused13           int32
 	Fpswtch            int32
 	Kmapent            int32
 }
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go
index b4fb97ebe650..5a5479886989 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go
@@ -73,7 +73,6 @@ type Stat_t struct {
 	Blksize int32
 	Flags   uint32
 	Gen     uint32
-	_       [4]byte
 	_       Timespec
 }
 
@@ -81,7 +80,6 @@ type Statfs_t struct {
 	F_flags       uint32
 	F_bsize       uint32
 	F_iosize      uint32
-	_             [4]byte
 	F_blocks      uint64
 	F_bfree       uint64
 	F_bavail      int64
@@ -200,10 +198,8 @@ type IPv6Mreq struct {
 type Msghdr struct {
 	Name       *byte
 	Namelen    uint32
-	_          [4]byte
 	Iov        *Iovec
 	Iovlen     uint32
-	_          [4]byte
 	Control    *byte
 	Controllen uint32
 	Flags      int32
@@ -311,7 +307,6 @@ type IfData struct {
 	Oqdrops      uint64
 	Noproto      uint64
 	Capabilities uint32
-	_            [4]byte
 	Lastchange   Timeval
 }
 
@@ -373,14 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x10
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -395,7 +388,6 @@ type BpfStat struct {
 
 type BpfProgram struct {
 	Len   uint32
-	_     [4]byte
 	Insns *BpfInsn
 }
 
@@ -411,7 +403,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
@@ -488,7 +483,7 @@ type Uvmexp struct {
 	Zeropages          int32
 	Reserve_pagedaemon int32
 	Reserve_kernel     int32
-	Anonpages          int32
+	Unused01           int32
 	Vnodepages         int32
 	Vtextpages         int32
 	Freemin            int32
@@ -507,8 +502,8 @@ type Uvmexp struct {
 	Swpgonly           int32
 	Nswget             int32
 	Nanon              int32
-	Nanonneeded        int32
-	Nfreeanon          int32
+	Unused05           int32
+	Unused06           int32
 	Faults             int32
 	Traps              int32
 	Intrs              int32
@@ -516,8 +511,8 @@ type Uvmexp struct {
 	Softs              int32
 	Syscalls           int32
 	Pageins            int32
-	Obsolete_swapins   int32
-	Obsolete_swapouts  int32
+	Unused07           int32
+	Unused08           int32
 	Pgswapin           int32
 	Pgswapout          int32
 	Forks              int32
@@ -525,7 +520,7 @@ type Uvmexp struct {
 	Forks_sharevm      int32
 	Pga_zerohit        int32
 	Pga_zeromiss       int32
-	Zeroaborts         int32
+	Unused09           int32
 	Fltnoram           int32
 	Fltnoanon          int32
 	Fltnoamap          int32
@@ -557,9 +552,9 @@ type Uvmexp struct {
 	Pdpageouts         int32
 	Pdpending          int32
 	Pddeact            int32
-	Pdreanon           int32
-	Pdrevnode          int32
-	Pdrevtext          int32
+	Unused11           int32
+	Unused12           int32
+	Unused13           int32
 	Fpswtch            int32
 	Kmapent            int32
 }
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go
index 2c4675040ef3..be58c4e1ff8b 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go
@@ -375,14 +375,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x8
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -412,7 +410,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go
index ddee04514708..52338266cb3e 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go
@@ -368,14 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x10
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -405,7 +403,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go
index eb13d4e8bfc2..605cfdb12b1d 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go
@@ -368,14 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x10
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -405,7 +403,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
diff --git a/vendor/golang.org/x/time/rate/rate.go b/vendor/golang.org/x/time/rate/rate.go
index 8f7c29f156aa..f0e0cf3cb1db 100644
--- a/vendor/golang.org/x/time/rate/rate.go
+++ b/vendor/golang.org/x/time/rate/rate.go
@@ -83,7 +83,7 @@ func (lim *Limiter) Burst() int {
 // TokensAt returns the number of tokens available at time t.
 func (lim *Limiter) TokensAt(t time.Time) float64 {
 	lim.mu.Lock()
-	_, _, tokens := lim.advance(t) // does not mutute lim
+	_, tokens := lim.advance(t) // does not mutate lim
 	lim.mu.Unlock()
 	return tokens
 }
@@ -183,7 +183,7 @@ func (r *Reservation) CancelAt(t time.Time) {
 		return
 	}
 	// advance time to now
-	t, _, tokens := r.lim.advance(t)
+	t, tokens := r.lim.advance(t)
 	// calculate new number of tokens
 	tokens += restoreTokens
 	if burst := float64(r.lim.burst); tokens > burst {
@@ -304,7 +304,7 @@ func (lim *Limiter) SetLimitAt(t time.Time, newLimit Limit) {
 	lim.mu.Lock()
 	defer lim.mu.Unlock()
 
-	t, _, tokens := lim.advance(t)
+	t, tokens := lim.advance(t)
 
 	lim.last = t
 	lim.tokens = tokens
@@ -321,7 +321,7 @@ func (lim *Limiter) SetBurstAt(t time.Time, newBurst int) {
 	lim.mu.Lock()
 	defer lim.mu.Unlock()
 
-	t, _, tokens := lim.advance(t)
+	t, tokens := lim.advance(t)
 
 	lim.last = t
 	lim.tokens = tokens
@@ -356,7 +356,7 @@ func (lim *Limiter) reserveN(t time.Time, n int, maxFutureReserve time.Duration)
 		}
 	}
 
-	t, last, tokens := lim.advance(t)
+	t, tokens := lim.advance(t)
 
 	// Calculate the remaining number of tokens resulting from the request.
 	tokens -= float64(n)
@@ -379,15 +379,11 @@ func (lim *Limiter) reserveN(t time.Time, n int, maxFutureReserve time.Duration)
 	if ok {
 		r.tokens = n
 		r.timeToAct = t.Add(waitDuration)
-	}
 
-	// Update state
-	if ok {
+		// Update state
 		lim.last = t
 		lim.tokens = tokens
 		lim.lastEvent = r.timeToAct
-	} else {
-		lim.last = last
 	}
 
 	return r
@@ -396,7 +392,7 @@ func (lim *Limiter) reserveN(t time.Time, n int, maxFutureReserve time.Duration)
 // advance calculates and returns an updated state for lim resulting from the passage of time.
 // lim is not changed.
 // advance requires that lim.mu is held.
-func (lim *Limiter) advance(t time.Time) (newT time.Time, newLast time.Time, newTokens float64) {
+func (lim *Limiter) advance(t time.Time) (newT time.Time, newTokens float64) {
 	last := lim.last
 	if t.Before(last) {
 		last = t
@@ -409,7 +405,7 @@ func (lim *Limiter) advance(t time.Time) (newT time.Time, newLast time.Time, new
 	if burst := float64(lim.burst); tokens > burst {
 		tokens = burst
 	}
-	return t, last, tokens
+	return t, tokens
 }
 
 // durationFromTokens is a unit conversion function from the number of tokens to the duration
diff --git a/vendor/golang.org/x/time/rate/sometimes.go b/vendor/golang.org/x/time/rate/sometimes.go
new file mode 100644
index 000000000000..6ba99ddb67b1
--- /dev/null
+++ b/vendor/golang.org/x/time/rate/sometimes.go
@@ -0,0 +1,67 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package rate
+
+import (
+	"sync"
+	"time"
+)
+
+// Sometimes will perform an action occasionally.  The First, Every, and
+// Interval fields govern the behavior of Do, which performs the action.
+// A zero Sometimes value will perform an action exactly once.
+//
+// # Example: logging with rate limiting
+//
+//	var sometimes = rate.Sometimes{First: 3, Interval: 10*time.Second}
+//	func Spammy() {
+//	        sometimes.Do(func() { log.Info("here I am!") })
+//	}
+type Sometimes struct {
+	First    int           // if non-zero, the first N calls to Do will run f.
+	Every    int           // if non-zero, every Nth call to Do will run f.
+	Interval time.Duration // if non-zero and Interval has elapsed since f's last run, Do will run f.
+
+	mu    sync.Mutex
+	count int       // number of Do calls
+	last  time.Time // last time f was run
+}
+
+// Do runs the function f as allowed by First, Every, and Interval.
+//
+// The model is a union (not intersection) of filters.  The first call to Do
+// always runs f.  Subsequent calls to Do run f if allowed by First or Every or
+// Interval.
+//
+// A non-zero First:N causes the first N Do(f) calls to run f.
+//
+// A non-zero Every:M causes every Mth Do(f) call, starting with the first, to
+// run f.
+//
+// A non-zero Interval causes Do(f) to run f if Interval has elapsed since
+// Do last ran f.
+//
+// Specifying multiple filters produces the union of these execution streams.
+// For example, specifying both First:N and Every:M causes the first N Do(f)
+// calls and every Mth Do(f) call, starting with the first, to run f.  See
+// Examples for more.
+//
+// If Do is called multiple times simultaneously, the calls will block and run
+// serially.  Therefore, Do is intended for lightweight operations.
+//
+// Because a call to Do may block until f returns, if f causes Do to be called,
+// it will deadlock.
+func (s *Sometimes) Do(f func()) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.count == 0 ||
+		(s.First > 0 && s.count < s.First) ||
+		(s.Every > 0 && s.count%s.Every == 0) ||
+		(s.Interval > 0 && time.Since(s.last) >= s.Interval) {
+		f()
+		s.last = time.Now()
+	}
+	s.count++
+}
diff --git a/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go b/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go
index 42adb8f697b0..620446207e2f 100644
--- a/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go
+++ b/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go
@@ -30,7 +30,7 @@ import (
 	"io/ioutil"
 	"os/exec"
 
-	"golang.org/x/tools/go/internal/gcimporter"
+	"golang.org/x/tools/internal/gcimporter"
 )
 
 // Find returns the name of an object (.o) or archive (.a) file
diff --git a/vendor/golang.org/x/tools/go/packages/golist.go b/vendor/golang.org/x/tools/go/packages/golist.go
index d9a7915bab05..6bb7168d2e34 100644
--- a/vendor/golang.org/x/tools/go/packages/golist.go
+++ b/vendor/golang.org/x/tools/go/packages/golist.go
@@ -604,17 +604,12 @@ func (state *golistState) createDriverResponse(words ...string) (*driverResponse
 
 		// Work around https://golang.org/issue/28749:
 		// cmd/go puts assembly, C, and C++ files in CompiledGoFiles.
-		// Filter out any elements of CompiledGoFiles that are also in OtherFiles.
-		// We have to keep this workaround in place until go1.12 is a distant memory.
-		if len(pkg.OtherFiles) > 0 {
-			other := make(map[string]bool, len(pkg.OtherFiles))
-			for _, f := range pkg.OtherFiles {
-				other[f] = true
-			}
-
+		// Remove files from CompiledGoFiles that are non-go files
+		// (or are not files that look like they are from the cache).
+		if len(pkg.CompiledGoFiles) > 0 {
 			out := pkg.CompiledGoFiles[:0]
 			for _, f := range pkg.CompiledGoFiles {
-				if other[f] {
+				if ext := filepath.Ext(f); ext != ".go" && ext != "" { // ext == "" means the file is from the cache, so probably cgo-processed file
 					continue
 				}
 				out = append(out, f)
diff --git a/vendor/golang.org/x/tools/go/packages/packages.go b/vendor/golang.org/x/tools/go/packages/packages.go
index 54d880d206e4..9df20919ba24 100644
--- a/vendor/golang.org/x/tools/go/packages/packages.go
+++ b/vendor/golang.org/x/tools/go/packages/packages.go
@@ -303,6 +303,9 @@ type Package struct {
 	// of the package, or while parsing or type-checking its files.
 	Errors []Error
 
+	// TypeErrors contains the subset of errors produced during type checking.
+	TypeErrors []types.Error
+
 	// GoFiles lists the absolute file paths of the package's Go source files.
 	GoFiles []string
 
@@ -911,6 +914,7 @@ func (ld *loader) loadPackage(lpkg *loaderPackage) {
 
 		case types.Error:
 			// from type checker
+			lpkg.TypeErrors = append(lpkg.TypeErrors, err)
 			errs = append(errs, Error{
 				Pos:  err.Fset.Position(err.Pos).String(),
 				Msg:  err.Msg,
@@ -1017,7 +1021,7 @@ func (ld *loader) loadPackage(lpkg *loaderPackage) {
 	tc := &types.Config{
 		Importer: importer,
 
-		// Type-check bodies of functions only in non-initial packages.
+		// Type-check bodies of functions only in initial packages.
 		// Example: for import graph A->B->C and initial packages {A,C},
 		// we can ignore function bodies in B.
 		IgnoreFuncBodies: ld.Mode&NeedDeps == 0 && !lpkg.initial,
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/bexport.go b/vendor/golang.org/x/tools/internal/gcimporter/bexport.go
similarity index 99%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/bexport.go
rename to vendor/golang.org/x/tools/internal/gcimporter/bexport.go
index 196cb3f9b41a..30582ed6d3d7 100644
--- a/vendor/golang.org/x/tools/go/internal/gcimporter/bexport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/bexport.go
@@ -12,7 +12,6 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
-	"go/ast"
 	"go/constant"
 	"go/token"
 	"go/types"
@@ -145,7 +144,7 @@ func BExportData(fset *token.FileSet, pkg *types.Package) (b []byte, err error)
 	objcount := 0
 	scope := pkg.Scope()
 	for _, name := range scope.Names() {
-		if !ast.IsExported(name) {
+		if !token.IsExported(name) {
 			continue
 		}
 		if trace {
@@ -482,7 +481,7 @@ func (p *exporter) method(m *types.Func) {
 
 	p.pos(m)
 	p.string(m.Name())
-	if m.Name() != "_" && !ast.IsExported(m.Name()) {
+	if m.Name() != "_" && !token.IsExported(m.Name()) {
 		p.pkg(m.Pkg(), false)
 	}
 
@@ -501,7 +500,7 @@ func (p *exporter) fieldName(f *types.Var) {
 		// 3) field name doesn't match base type name (alias name)
 		bname := basetypeName(f.Type())
 		if name == bname {
-			if ast.IsExported(name) {
+			if token.IsExported(name) {
 				name = "" // 1) we don't need to know the field name or package
 			} else {
 				name = "?" // 2) use unexported name "?" to force package export
@@ -514,7 +513,7 @@ func (p *exporter) fieldName(f *types.Var) {
 	}
 
 	p.string(name)
-	if name != "" && !ast.IsExported(name) {
+	if name != "" && !token.IsExported(name) {
 		p.pkg(f.Pkg(), false)
 	}
 }
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/bimport.go b/vendor/golang.org/x/tools/internal/gcimporter/bimport.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/bimport.go
rename to vendor/golang.org/x/tools/internal/gcimporter/bimport.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/exportdata.go b/vendor/golang.org/x/tools/internal/gcimporter/exportdata.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/exportdata.go
rename to vendor/golang.org/x/tools/internal/gcimporter/exportdata.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/gcimporter.go b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
similarity index 95%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/gcimporter.go
rename to vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
index e96c39600d16..1faaa365260f 100644
--- a/vendor/golang.org/x/tools/go/internal/gcimporter/gcimporter.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
@@ -9,10 +9,11 @@
 // Package gcimporter provides various functions for reading
 // gc-generated object files that can be used to implement the
 // Importer interface defined by the Go 1.5 standard library package.
-package gcimporter // import "golang.org/x/tools/go/internal/gcimporter"
+package gcimporter // import "golang.org/x/tools/internal/gcimporter"
 
 import (
 	"bufio"
+	"bytes"
 	"errors"
 	"fmt"
 	"go/build"
@@ -22,10 +23,12 @@ import (
 	"io"
 	"io/ioutil"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"text/scanner"
 )
 
@@ -38,6 +41,47 @@ const (
 	trace = false
 )
 
+var exportMap sync.Map // package dir → func() (string, bool)
+
+// lookupGorootExport returns the location of the export data
+// (normally found in the build cache, but located in GOROOT/pkg
+// in prior Go releases) for the package located in pkgDir.
+//
+// (We use the package's directory instead of its import path
+// mainly to simplify handling of the packages in src/vendor
+// and cmd/vendor.)
+func lookupGorootExport(pkgDir string) (string, bool) {
+	f, ok := exportMap.Load(pkgDir)
+	if !ok {
+		var (
+			listOnce   sync.Once
+			exportPath string
+		)
+		f, _ = exportMap.LoadOrStore(pkgDir, func() (string, bool) {
+			listOnce.Do(func() {
+				cmd := exec.Command("go", "list", "-export", "-f", "{{.Export}}", pkgDir)
+				cmd.Dir = build.Default.GOROOT
+				var output []byte
+				output, err := cmd.Output()
+				if err != nil {
+					return
+				}
+
+				exports := strings.Split(string(bytes.TrimSpace(output)), "\n")
+				if len(exports) != 1 {
+					return
+				}
+
+				exportPath = exports[0]
+			})
+
+			return exportPath, exportPath != ""
+		})
+	}
+
+	return f.(func() (string, bool))()
+}
+
 var pkgExts = [...]string{".a", ".o"}
 
 // FindPkg returns the filename and unique package id for an import
@@ -60,11 +104,18 @@ func FindPkg(path, srcDir string) (filename, id string) {
 		}
 		bp, _ := build.Import(path, srcDir, build.FindOnly|build.AllowBinary)
 		if bp.PkgObj == "" {
-			id = path // make sure we have an id to print in error message
-			return
+			var ok bool
+			if bp.Goroot && bp.Dir != "" {
+				filename, ok = lookupGorootExport(bp.Dir)
+			}
+			if !ok {
+				id = path // make sure we have an id to print in error message
+				return
+			}
+		} else {
+			noext = strings.TrimSuffix(bp.PkgObj, ".a")
+			id = bp.ImportPath
 		}
-		noext = strings.TrimSuffix(bp.PkgObj, ".a")
-		id = bp.ImportPath
 
 	case build.IsLocalImport(path):
 		// "./x" -> "/this/directory/x.ext", "/this/directory/x"
@@ -85,6 +136,12 @@ func FindPkg(path, srcDir string) (filename, id string) {
 		}
 	}
 
+	if filename != "" {
+		if f, err := os.Stat(filename); err == nil && !f.IsDir() {
+			return
+		}
+	}
+
 	// try extensions
 	for _, ext := range pkgExts {
 		filename = noext + ext
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/iexport.go b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
similarity index 90%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/iexport.go
rename to vendor/golang.org/x/tools/internal/gcimporter/iexport.go
index 9a4ff329e128..7d90f00f323a 100644
--- a/vendor/golang.org/x/tools/go/internal/gcimporter/iexport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
@@ -12,7 +12,6 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
-	"go/ast"
 	"go/constant"
 	"go/token"
 	"go/types"
@@ -26,6 +25,41 @@ import (
 	"golang.org/x/tools/internal/typeparams"
 )
 
+// IExportShallow encodes "shallow" export data for the specified package.
+//
+// No promises are made about the encoding other than that it can be
+// decoded by the same version of IIExportShallow. If you plan to save
+// export data in the file system, be sure to include a cryptographic
+// digest of the executable in the key to avoid version skew.
+func IExportShallow(fset *token.FileSet, pkg *types.Package) ([]byte, error) {
+	// In principle this operation can only fail if out.Write fails,
+	// but that's impossible for bytes.Buffer---and as a matter of
+	// fact iexportCommon doesn't even check for I/O errors.
+	// TODO(adonovan): handle I/O errors properly.
+	// TODO(adonovan): use byte slices throughout, avoiding copying.
+	const bundle, shallow = false, true
+	var out bytes.Buffer
+	err := iexportCommon(&out, fset, bundle, shallow, iexportVersion, []*types.Package{pkg})
+	return out.Bytes(), err
+}
+
+// IImportShallow decodes "shallow" types.Package data encoded by IExportShallow
+// in the same executable. This function cannot import data from
+// cmd/compile or gcexportdata.Write.
+func IImportShallow(fset *token.FileSet, imports map[string]*types.Package, data []byte, path string, insert InsertType) (*types.Package, error) {
+	const bundle = false
+	pkgs, err := iimportCommon(fset, imports, data, bundle, path, insert)
+	if err != nil {
+		return nil, err
+	}
+	return pkgs[0], nil
+}
+
+// InsertType is the type of a function that creates a types.TypeName
+// object for a named type and inserts it into the scope of the
+// specified Package.
+type InsertType = func(pkg *types.Package, name string)
+
 // Current bundled export format version. Increase with each format change.
 // 0: initial implementation
 const bundleVersion = 0
@@ -36,15 +70,17 @@ const bundleVersion = 0
 // The package path of the top-level package will not be recorded,
 // so that calls to IImportData can override with a provided package path.
 func IExportData(out io.Writer, fset *token.FileSet, pkg *types.Package) error {
-	return iexportCommon(out, fset, false, iexportVersion, []*types.Package{pkg})
+	const bundle, shallow = false, false
+	return iexportCommon(out, fset, bundle, shallow, iexportVersion, []*types.Package{pkg})
 }
 
 // IExportBundle writes an indexed export bundle for pkgs to out.
 func IExportBundle(out io.Writer, fset *token.FileSet, pkgs []*types.Package) error {
-	return iexportCommon(out, fset, true, iexportVersion, pkgs)
+	const bundle, shallow = true, false
+	return iexportCommon(out, fset, bundle, shallow, iexportVersion, pkgs)
 }
 
-func iexportCommon(out io.Writer, fset *token.FileSet, bundle bool, version int, pkgs []*types.Package) (err error) {
+func iexportCommon(out io.Writer, fset *token.FileSet, bundle, shallow bool, version int, pkgs []*types.Package) (err error) {
 	if !debug {
 		defer func() {
 			if e := recover(); e != nil {
@@ -61,6 +97,7 @@ func iexportCommon(out io.Writer, fset *token.FileSet, bundle bool, version int,
 	p := iexporter{
 		fset:        fset,
 		version:     version,
+		shallow:     shallow,
 		allPkgs:     map[*types.Package]bool{},
 		stringIndex: map[string]uint64{},
 		declIndex:   map[types.Object]uint64{},
@@ -82,7 +119,7 @@ func iexportCommon(out io.Writer, fset *token.FileSet, bundle bool, version int,
 	for _, pkg := range pkgs {
 		scope := pkg.Scope()
 		for _, name := range scope.Names() {
-			if ast.IsExported(name) {
+			if token.IsExported(name) {
 				p.pushDecl(scope.Lookup(name))
 			}
 		}
@@ -205,7 +242,8 @@ type iexporter struct {
 	out     *bytes.Buffer
 	version int
 
-	localpkg *types.Package
+	shallow  bool           // don't put types from other packages in the index
+	localpkg *types.Package // (nil in bundle mode)
 
 	// allPkgs tracks all packages that have been referenced by
 	// the export data, so we can ensure to include them in the
@@ -256,6 +294,11 @@ func (p *iexporter) pushDecl(obj types.Object) {
 		panic("cannot export package unsafe")
 	}
 
+	// Shallow export data: don't index decls from other packages.
+	if p.shallow && obj.Pkg() != p.localpkg {
+		return
+	}
+
 	if _, ok := p.declIndex[obj]; ok {
 		return
 	}
@@ -497,7 +540,7 @@ func (w *exportWriter) pkg(pkg *types.Package) {
 	w.string(w.exportPath(pkg))
 }
 
-func (w *exportWriter) qualifiedIdent(obj types.Object) {
+func (w *exportWriter) qualifiedType(obj *types.TypeName) {
 	name := w.p.exportName(obj)
 
 	// Ensure any referenced declarations are written out too.
@@ -556,11 +599,11 @@ func (w *exportWriter) doTyp(t types.Type, pkg *types.Package) {
 			return
 		}
 		w.startType(definedType)
-		w.qualifiedIdent(t.Obj())
+		w.qualifiedType(t.Obj())
 
 	case *typeparams.TypeParam:
 		w.startType(typeParamType)
-		w.qualifiedIdent(t.Obj())
+		w.qualifiedType(t.Obj())
 
 	case *types.Pointer:
 		w.startType(pointerType)
@@ -602,14 +645,17 @@ func (w *exportWriter) doTyp(t types.Type, pkg *types.Package) {
 
 	case *types.Struct:
 		w.startType(structType)
-		w.setPkg(pkg, true)
-
 		n := t.NumFields()
+		if n > 0 {
+			w.setPkg(t.Field(0).Pkg(), true) // qualifying package for field objects
+		} else {
+			w.setPkg(pkg, true)
+		}
 		w.uint64(uint64(n))
 		for i := 0; i < n; i++ {
 			f := t.Field(i)
 			w.pos(f.Pos())
-			w.string(f.Name())
+			w.string(f.Name()) // unexported fields implicitly qualified by prior setPkg
 			w.typ(f.Type(), pkg)
 			w.bool(f.Anonymous())
 			w.string(t.Tag(i)) // note (or tag)
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/iimport.go b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
similarity index 96%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/iimport.go
rename to vendor/golang.org/x/tools/internal/gcimporter/iimport.go
index 6e4c066b69b4..a1c46965350b 100644
--- a/vendor/golang.org/x/tools/go/internal/gcimporter/iimport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
@@ -85,7 +85,7 @@ const (
 // If the export data version is not recognized or the format is otherwise
 // compromised, an error is returned.
 func IImportData(fset *token.FileSet, imports map[string]*types.Package, data []byte, path string) (int, *types.Package, error) {
-	pkgs, err := iimportCommon(fset, imports, data, false, path)
+	pkgs, err := iimportCommon(fset, imports, data, false, path, nil)
 	if err != nil {
 		return 0, nil, err
 	}
@@ -94,10 +94,10 @@ func IImportData(fset *token.FileSet, imports map[string]*types.Package, data []
 
 // IImportBundle imports a set of packages from the serialized package bundle.
 func IImportBundle(fset *token.FileSet, imports map[string]*types.Package, data []byte) ([]*types.Package, error) {
-	return iimportCommon(fset, imports, data, true, "")
+	return iimportCommon(fset, imports, data, true, "", nil)
 }
 
-func iimportCommon(fset *token.FileSet, imports map[string]*types.Package, data []byte, bundle bool, path string) (pkgs []*types.Package, err error) {
+func iimportCommon(fset *token.FileSet, imports map[string]*types.Package, data []byte, bundle bool, path string, insert InsertType) (pkgs []*types.Package, err error) {
 	const currentVersion = iexportVersionCurrent
 	version := int64(-1)
 	if !debug {
@@ -147,6 +147,7 @@ func iimportCommon(fset *token.FileSet, imports map[string]*types.Package, data
 	p := iimporter{
 		version: int(version),
 		ipath:   path,
+		insert:  insert,
 
 		stringData:  stringData,
 		stringCache: make(map[uint64]string),
@@ -187,11 +188,18 @@ func iimportCommon(fset *token.FileSet, imports map[string]*types.Package, data
 		} else if pkg.Name() != pkgName {
 			errorf("conflicting names %s and %s for package %q", pkg.Name(), pkgName, path)
 		}
+		if i == 0 && !bundle {
+			p.localpkg = pkg
+		}
 
 		p.pkgCache[pkgPathOff] = pkg
 
+		// Read index for package.
 		nameIndex := make(map[string]uint64)
-		for nSyms := r.uint64(); nSyms > 0; nSyms-- {
+		nSyms := r.uint64()
+		// In shallow mode we don't expect an index for other packages.
+		assert(nSyms == 0 || p.localpkg == pkg || p.insert == nil)
+		for ; nSyms > 0; nSyms-- {
 			name := p.stringAt(r.uint64())
 			nameIndex[name] = r.uint64()
 		}
@@ -267,6 +275,9 @@ type iimporter struct {
 	version int
 	ipath   string
 
+	localpkg *types.Package
+	insert   func(pkg *types.Package, name string) // "shallow" mode only
+
 	stringData  []byte
 	stringCache map[uint64]string
 	pkgCache    map[uint64]*types.Package
@@ -310,6 +321,13 @@ func (p *iimporter) doDecl(pkg *types.Package, name string) {
 
 	off, ok := p.pkgIndex[pkg][name]
 	if !ok {
+		// In "shallow" mode, call back to the application to
+		// find the object and insert it into the package scope.
+		if p.insert != nil {
+			assert(pkg != p.localpkg)
+			p.insert(pkg, name) // "can't fail"
+			return
+		}
 		errorf("%v.%v not in index", pkg, name)
 	}
 
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/newInterface10.go b/vendor/golang.org/x/tools/internal/gcimporter/newInterface10.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/newInterface10.go
rename to vendor/golang.org/x/tools/internal/gcimporter/newInterface10.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/newInterface11.go b/vendor/golang.org/x/tools/internal/gcimporter/newInterface11.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/newInterface11.go
rename to vendor/golang.org/x/tools/internal/gcimporter/newInterface11.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/support_go117.go b/vendor/golang.org/x/tools/internal/gcimporter/support_go117.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/support_go117.go
rename to vendor/golang.org/x/tools/internal/gcimporter/support_go117.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/support_go118.go b/vendor/golang.org/x/tools/internal/gcimporter/support_go118.go
similarity index 62%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/support_go118.go
rename to vendor/golang.org/x/tools/internal/gcimporter/support_go118.go
index a993843230c1..edbe6ea7041d 100644
--- a/vendor/golang.org/x/tools/go/internal/gcimporter/support_go118.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/support_go118.go
@@ -21,3 +21,17 @@ func additionalPredeclared() []types.Type {
 		types.Universe.Lookup("any").Type(),
 	}
 }
+
+// See cmd/compile/internal/types.SplitVargenSuffix.
+func splitVargenSuffix(name string) (base, suffix string) {
+	i := len(name)
+	for i > 0 && name[i-1] >= '0' && name[i-1] <= '9' {
+		i--
+	}
+	const dot = "·"
+	if i >= len(dot) && name[i-len(dot):i] == dot {
+		i -= len(dot)
+		return name[:i], name[i:]
+	}
+	return name, ""
+}
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/unified_no.go b/vendor/golang.org/x/tools/internal/gcimporter/unified_no.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/unified_no.go
rename to vendor/golang.org/x/tools/internal/gcimporter/unified_no.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/unified_yes.go b/vendor/golang.org/x/tools/internal/gcimporter/unified_yes.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/unified_yes.go
rename to vendor/golang.org/x/tools/internal/gcimporter/unified_yes.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/ureader_no.go b/vendor/golang.org/x/tools/internal/gcimporter/ureader_no.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/ureader_no.go
rename to vendor/golang.org/x/tools/internal/gcimporter/ureader_no.go
diff --git a/vendor/golang.org/x/tools/go/internal/gcimporter/ureader_yes.go b/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
similarity index 87%
rename from vendor/golang.org/x/tools/go/internal/gcimporter/ureader_yes.go
rename to vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
index 2d421c9619da..20b99903c51b 100644
--- a/vendor/golang.org/x/tools/go/internal/gcimporter/ureader_yes.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
@@ -14,7 +14,7 @@ import (
 	"go/types"
 	"strings"
 
-	"golang.org/x/tools/go/internal/pkgbits"
+	"golang.org/x/tools/internal/pkgbits"
 )
 
 // A pkgReader holds the shared state for reading a unified IR package
@@ -158,6 +158,17 @@ func (pr *pkgReader) newReader(k pkgbits.RelocKind, idx pkgbits.Index, marker pk
 	}
 }
 
+func (pr *pkgReader) tempReader(k pkgbits.RelocKind, idx pkgbits.Index, marker pkgbits.SyncMarker) *reader {
+	return &reader{
+		Decoder: pr.TempDecoder(k, idx, marker),
+		p:       pr,
+	}
+}
+
+func (pr *pkgReader) retireReader(r *reader) {
+	pr.RetireDecoder(&r.Decoder)
+}
+
 // @@@ Positions
 
 func (r *reader) pos() token.Pos {
@@ -182,26 +193,29 @@ func (pr *pkgReader) posBaseIdx(idx pkgbits.Index) string {
 		return b
 	}
 
-	r := pr.newReader(pkgbits.RelocPosBase, idx, pkgbits.SyncPosBase)
+	var filename string
+	{
+		r := pr.tempReader(pkgbits.RelocPosBase, idx, pkgbits.SyncPosBase)
 
-	// Within types2, position bases have a lot more details (e.g.,
-	// keeping track of where //line directives appeared exactly).
-	//
-	// For go/types, we just track the file name.
+		// Within types2, position bases have a lot more details (e.g.,
+		// keeping track of where //line directives appeared exactly).
+		//
+		// For go/types, we just track the file name.
 
-	filename := r.String()
+		filename = r.String()
 
-	if r.Bool() { // file base
-		// Was: "b = token.NewTrimmedFileBase(filename, true)"
-	} else { // line base
-		pos := r.pos()
-		line := r.Uint()
-		col := r.Uint()
+		if r.Bool() { // file base
+			// Was: "b = token.NewTrimmedFileBase(filename, true)"
+		} else { // line base
+			pos := r.pos()
+			line := r.Uint()
+			col := r.Uint()
 
-		// Was: "b = token.NewLineBase(pos, filename, true, line, col)"
-		_, _, _ = pos, line, col
+			// Was: "b = token.NewLineBase(pos, filename, true, line, col)"
+			_, _, _ = pos, line, col
+		}
+		pr.retireReader(r)
 	}
-
 	b := filename
 	pr.posBases[idx] = b
 	return b
@@ -259,22 +273,22 @@ func (r *reader) doPkg() *types.Package {
 // packages rooted from pkgs.
 func flattenImports(pkgs []*types.Package) []*types.Package {
 	var res []*types.Package
-
-	seen := make(map[*types.Package]bool)
-	var add func(pkg *types.Package)
-	add = func(pkg *types.Package) {
-		if seen[pkg] {
-			return
+	seen := make(map[*types.Package]struct{})
+	for _, pkg := range pkgs {
+		if _, ok := seen[pkg]; ok {
+			continue
 		}
-		seen[pkg] = true
+		seen[pkg] = struct{}{}
 		res = append(res, pkg)
-		for _, imp := range pkg.Imports() {
-			add(imp)
-		}
-	}
 
-	for _, pkg := range pkgs {
-		add(pkg)
+		// pkg.Imports() is already flattened.
+		for _, pkg := range pkg.Imports() {
+			if _, ok := seen[pkg]; ok {
+				continue
+			}
+			seen[pkg] = struct{}{}
+			res = append(res, pkg)
+		}
 	}
 	return res
 }
@@ -307,12 +321,15 @@ func (pr *pkgReader) typIdx(info typeInfo, dict *readerDict) types.Type {
 		return typ
 	}
 
-	r := pr.newReader(pkgbits.RelocType, idx, pkgbits.SyncTypeIdx)
-	r.dict = dict
-
-	typ := r.doTyp()
-	assert(typ != nil)
+	var typ types.Type
+	{
+		r := pr.tempReader(pkgbits.RelocType, idx, pkgbits.SyncTypeIdx)
+		r.dict = dict
 
+		typ = r.doTyp()
+		assert(typ != nil)
+		pr.retireReader(r)
+	}
 	// See comment in pkgReader.typIdx explaining how this happens.
 	if prev := *where; prev != nil {
 		return prev
@@ -478,18 +495,30 @@ func (r *reader) obj() (types.Object, []types.Type) {
 }
 
 func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
-	rname := pr.newReader(pkgbits.RelocName, idx, pkgbits.SyncObject1)
 
-	objPkg, objName := rname.qualifiedIdent()
-	assert(objName != "")
+	var objPkg *types.Package
+	var objName string
+	var tag pkgbits.CodeObj
+	{
+		rname := pr.tempReader(pkgbits.RelocName, idx, pkgbits.SyncObject1)
 
-	tag := pkgbits.CodeObj(rname.Code(pkgbits.SyncCodeObj))
+		objPkg, objName = rname.qualifiedIdent()
+		assert(objName != "")
+
+		tag = pkgbits.CodeObj(rname.Code(pkgbits.SyncCodeObj))
+		pr.retireReader(rname)
+	}
 
 	if tag == pkgbits.ObjStub {
 		assert(objPkg == nil || objPkg == types.Unsafe)
 		return objPkg, objName
 	}
 
+	// Ignore local types promoted to global scope (#55110).
+	if _, suffix := splitVargenSuffix(objName); suffix != "" {
+		return objPkg, objName
+	}
+
 	if objPkg.Scope().Lookup(objName) == nil {
 		dict := pr.objDictIdx(idx)
 
@@ -583,25 +612,28 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 }
 
 func (pr *pkgReader) objDictIdx(idx pkgbits.Index) *readerDict {
-	r := pr.newReader(pkgbits.RelocObjDict, idx, pkgbits.SyncObject1)
 
 	var dict readerDict
 
-	if implicits := r.Len(); implicits != 0 {
-		errorf("unexpected object with %v implicit type parameter(s)", implicits)
-	}
+	{
+		r := pr.tempReader(pkgbits.RelocObjDict, idx, pkgbits.SyncObject1)
+		if implicits := r.Len(); implicits != 0 {
+			errorf("unexpected object with %v implicit type parameter(s)", implicits)
+		}
 
-	dict.bounds = make([]typeInfo, r.Len())
-	for i := range dict.bounds {
-		dict.bounds[i] = r.typInfo()
-	}
+		dict.bounds = make([]typeInfo, r.Len())
+		for i := range dict.bounds {
+			dict.bounds[i] = r.typInfo()
+		}
 
-	dict.derived = make([]derivedInfo, r.Len())
-	dict.derivedTypes = make([]types.Type, len(dict.derived))
-	for i := range dict.derived {
-		dict.derived[i] = derivedInfo{r.Reloc(pkgbits.RelocType), r.Bool()}
-	}
+		dict.derived = make([]derivedInfo, r.Len())
+		dict.derivedTypes = make([]types.Type, len(dict.derived))
+		for i := range dict.derived {
+			dict.derived[i] = derivedInfo{r.Reloc(pkgbits.RelocType), r.Bool()}
+		}
 
+		pr.retireReader(r)
+	}
 	// function references follow, but reader doesn't need those
 
 	return &dict
diff --git a/vendor/golang.org/x/tools/internal/gocommand/version.go b/vendor/golang.org/x/tools/internal/gocommand/version.go
index 8db5ceb9d51d..98e834f74d3b 100644
--- a/vendor/golang.org/x/tools/internal/gocommand/version.go
+++ b/vendor/golang.org/x/tools/internal/gocommand/version.go
@@ -7,6 +7,7 @@ package gocommand
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 )
 
@@ -56,3 +57,23 @@ func GoVersion(ctx context.Context, inv Invocation, r *Runner) (int, error) {
 	}
 	return 0, fmt.Errorf("no parseable ReleaseTags in %v", tags)
 }
+
+// GoVersionString reports the go version string as shown in `go version` command output.
+// When `go version` outputs in non-standard form, this returns an empty string.
+func GoVersionString(ctx context.Context, inv Invocation, r *Runner) (string, error) {
+	inv.Verb = "version"
+	goVersion, err := r.Run(ctx, inv)
+	if err != nil {
+		return "", err
+	}
+	return parseGoVersionOutput(goVersion.Bytes()), nil
+}
+
+func parseGoVersionOutput(data []byte) string {
+	re := regexp.MustCompile(`^go version (go\S+|devel \S+)`)
+	m := re.FindSubmatch(data)
+	if len(m) != 2 {
+		return "" // unrecognized version
+	}
+	return string(m[1])
+}
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/codes.go b/vendor/golang.org/x/tools/internal/pkgbits/codes.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/codes.go
rename to vendor/golang.org/x/tools/internal/pkgbits/codes.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/decoder.go b/vendor/golang.org/x/tools/internal/pkgbits/decoder.go
similarity index 84%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/decoder.go
rename to vendor/golang.org/x/tools/internal/pkgbits/decoder.go
index e08099c66351..3205c9a16c56 100644
--- a/vendor/golang.org/x/tools/go/internal/pkgbits/decoder.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/decoder.go
@@ -6,6 +6,7 @@ package pkgbits
 
 import (
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"go/constant"
 	"go/token"
@@ -52,6 +53,8 @@ type PkgDecoder struct {
 	// For example, section K's end positions start at elemEndsEnds[K-1]
 	// (or 0, if K==0) and end at elemEndsEnds[K].
 	elemEndsEnds [numRelocs]uint32
+
+	scratchRelocEnt []RelocEnt
 }
 
 // PkgPath returns the package path for the package
@@ -165,6 +168,21 @@ func (pr *PkgDecoder) NewDecoder(k RelocKind, idx Index, marker SyncMarker) Deco
 	return r
 }
 
+// TempDecoder returns a Decoder for the given (section, index) pair,
+// and decodes the given SyncMarker from the element bitstream.
+// If possible the Decoder should be RetireDecoder'd when it is no longer
+// needed, this will avoid heap allocations.
+func (pr *PkgDecoder) TempDecoder(k RelocKind, idx Index, marker SyncMarker) Decoder {
+	r := pr.TempDecoderRaw(k, idx)
+	r.Sync(marker)
+	return r
+}
+
+func (pr *PkgDecoder) RetireDecoder(d *Decoder) {
+	pr.scratchRelocEnt = d.Relocs
+	d.Relocs = nil
+}
+
 // NewDecoderRaw returns a Decoder for the given (section, index) pair.
 //
 // Most callers should use NewDecoder instead.
@@ -188,6 +206,30 @@ func (pr *PkgDecoder) NewDecoderRaw(k RelocKind, idx Index) Decoder {
 	return r
 }
 
+func (pr *PkgDecoder) TempDecoderRaw(k RelocKind, idx Index) Decoder {
+	r := Decoder{
+		common: pr,
+		k:      k,
+		Idx:    idx,
+	}
+
+	r.Data.Reset(pr.DataIdx(k, idx))
+	r.Sync(SyncRelocs)
+	l := r.Len()
+	if cap(pr.scratchRelocEnt) >= l {
+		r.Relocs = pr.scratchRelocEnt[:l]
+		pr.scratchRelocEnt = nil
+	} else {
+		r.Relocs = make([]RelocEnt, l)
+	}
+	for i := range r.Relocs {
+		r.Sync(SyncReloc)
+		r.Relocs[i] = RelocEnt{RelocKind(r.Len()), Index(r.Len())}
+	}
+
+	return r
+}
+
 // A Decoder provides methods for decoding an individual element's
 // bitstream data.
 type Decoder struct {
@@ -207,11 +249,39 @@ func (r *Decoder) checkErr(err error) {
 }
 
 func (r *Decoder) rawUvarint() uint64 {
-	x, err := binary.ReadUvarint(&r.Data)
+	x, err := readUvarint(&r.Data)
 	r.checkErr(err)
 	return x
 }
 
+// readUvarint is a type-specialized copy of encoding/binary.ReadUvarint.
+// This avoids the interface conversion and thus has better escape properties,
+// which flows up the stack.
+func readUvarint(r *strings.Reader) (uint64, error) {
+	var x uint64
+	var s uint
+	for i := 0; i < binary.MaxVarintLen64; i++ {
+		b, err := r.ReadByte()
+		if err != nil {
+			if i > 0 && err == io.EOF {
+				err = io.ErrUnexpectedEOF
+			}
+			return x, err
+		}
+		if b < 0x80 {
+			if i == binary.MaxVarintLen64-1 && b > 1 {
+				return x, overflow
+			}
+			return x | uint64(b)<<s, nil
+		}
+		x |= uint64(b&0x7f) << s
+		s += 7
+	}
+	return x, overflow
+}
+
+var overflow = errors.New("pkgbits: readUvarint overflows a 64-bit integer")
+
 func (r *Decoder) rawVarint() int64 {
 	ux := r.rawUvarint()
 
@@ -410,8 +480,12 @@ func (r *Decoder) bigFloat() *big.Float {
 // PeekPkgPath returns the package path for the specified package
 // index.
 func (pr *PkgDecoder) PeekPkgPath(idx Index) string {
-	r := pr.NewDecoder(RelocPkg, idx, SyncPkgDef)
-	path := r.String()
+	var path string
+	{
+		r := pr.TempDecoder(RelocPkg, idx, SyncPkgDef)
+		path = r.String()
+		pr.RetireDecoder(&r)
+	}
 	if path == "" {
 		path = pr.pkgPath
 	}
@@ -421,14 +495,23 @@ func (pr *PkgDecoder) PeekPkgPath(idx Index) string {
 // PeekObj returns the package path, object name, and CodeObj for the
 // specified object index.
 func (pr *PkgDecoder) PeekObj(idx Index) (string, string, CodeObj) {
-	r := pr.NewDecoder(RelocName, idx, SyncObject1)
-	r.Sync(SyncSym)
-	r.Sync(SyncPkg)
-	path := pr.PeekPkgPath(r.Reloc(RelocPkg))
-	name := r.String()
+	var ridx Index
+	var name string
+	var rcode int
+	{
+		r := pr.TempDecoder(RelocName, idx, SyncObject1)
+		r.Sync(SyncSym)
+		r.Sync(SyncPkg)
+		ridx = r.Reloc(RelocPkg)
+		name = r.String()
+		rcode = r.Code(SyncCodeObj)
+		pr.RetireDecoder(&r)
+	}
+
+	path := pr.PeekPkgPath(ridx)
 	assert(name != "")
 
-	tag := CodeObj(r.Code(SyncCodeObj))
+	tag := CodeObj(rcode)
 
 	return path, name, tag
 }
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/doc.go b/vendor/golang.org/x/tools/internal/pkgbits/doc.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/doc.go
rename to vendor/golang.org/x/tools/internal/pkgbits/doc.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/encoder.go b/vendor/golang.org/x/tools/internal/pkgbits/encoder.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/encoder.go
rename to vendor/golang.org/x/tools/internal/pkgbits/encoder.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/flags.go b/vendor/golang.org/x/tools/internal/pkgbits/flags.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/flags.go
rename to vendor/golang.org/x/tools/internal/pkgbits/flags.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/frames_go1.go b/vendor/golang.org/x/tools/internal/pkgbits/frames_go1.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/frames_go1.go
rename to vendor/golang.org/x/tools/internal/pkgbits/frames_go1.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/frames_go17.go b/vendor/golang.org/x/tools/internal/pkgbits/frames_go17.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/frames_go17.go
rename to vendor/golang.org/x/tools/internal/pkgbits/frames_go17.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/reloc.go b/vendor/golang.org/x/tools/internal/pkgbits/reloc.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/reloc.go
rename to vendor/golang.org/x/tools/internal/pkgbits/reloc.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/support.go b/vendor/golang.org/x/tools/internal/pkgbits/support.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/support.go
rename to vendor/golang.org/x/tools/internal/pkgbits/support.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/sync.go b/vendor/golang.org/x/tools/internal/pkgbits/sync.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/sync.go
rename to vendor/golang.org/x/tools/internal/pkgbits/sync.go
diff --git a/vendor/golang.org/x/tools/go/internal/pkgbits/syncmarker_string.go b/vendor/golang.org/x/tools/internal/pkgbits/syncmarker_string.go
similarity index 100%
rename from vendor/golang.org/x/tools/go/internal/pkgbits/syncmarker_string.go
rename to vendor/golang.org/x/tools/internal/pkgbits/syncmarker_string.go
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/errorcode.go b/vendor/golang.org/x/tools/internal/typesinternal/errorcode.go
index d38ee3c27cd6..07484073a57d 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/errorcode.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/errorcode.go
@@ -30,6 +30,12 @@ type ErrorCode int
 // convention that "bad" implies a problem with syntax, and "invalid" implies a
 // problem with types.
 
+const (
+	// InvalidSyntaxTree occurs if an invalid syntax tree is provided
+	// to the type checker. It should never happen.
+	InvalidSyntaxTree ErrorCode = -1
+)
+
 const (
 	_ ErrorCode = iota
 
@@ -153,12 +159,12 @@ const (
 
 	/* decls > var (+ other variable assignment codes) */
 
-	// UntypedNil occurs when the predeclared (untyped) value nil is used to
+	// UntypedNilUse occurs when the predeclared (untyped) value nil is used to
 	// initialize a variable declared without an explicit type.
 	//
 	// Example:
 	//  var x = nil
-	UntypedNil
+	UntypedNilUse
 
 	// WrongAssignCount occurs when the number of values on the right-hand side
 	// of an assignment or or initialization expression does not match the number
@@ -1523,4 +1529,32 @@ const (
 	// Example:
 	//  type T[P any] struct{ *P }
 	MisplacedTypeParam
+
+	// InvalidUnsafeSliceData occurs when unsafe.SliceData is called with
+	// an argument that is not of slice type. It also occurs if it is used
+	// in a package compiled for a language version before go1.20.
+	//
+	// Example:
+	//  import "unsafe"
+	//
+	//  var x int
+	//  var _ = unsafe.SliceData(x)
+	InvalidUnsafeSliceData
+
+	// InvalidUnsafeString occurs when unsafe.String is called with
+	// a length argument that is not of integer type, negative, or
+	// out of bounds. It also occurs if it is used in a package
+	// compiled for a language version before go1.20.
+	//
+	// Example:
+	//  import "unsafe"
+	//
+	//  var b [10]byte
+	//  var _ = unsafe.String(&b[0], -1)
+	InvalidUnsafeString
+
+	// InvalidUnsafeStringData occurs if it is used in a package
+	// compiled for a language version before go1.20.
+	_ // not used anymore
+
 )
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/errorcode_string.go b/vendor/golang.org/x/tools/internal/typesinternal/errorcode_string.go
index de90e9515ae5..15ecf7c5ded9 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/errorcode_string.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/errorcode_string.go
@@ -8,6 +8,7 @@ func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
 	// Re-run the stringer command to generate them again.
 	var x [1]struct{}
+	_ = x[InvalidSyntaxTree - -1]
 	_ = x[Test-1]
 	_ = x[BlankPkgName-2]
 	_ = x[MismatchedPkgName-3]
@@ -23,7 +24,7 @@ func _() {
 	_ = x[InvalidConstInit-13]
 	_ = x[InvalidConstVal-14]
 	_ = x[InvalidConstType-15]
-	_ = x[UntypedNil-16]
+	_ = x[UntypedNilUse-16]
 	_ = x[WrongAssignCount-17]
 	_ = x[UnassignableOperand-18]
 	_ = x[NoNewVar-19]
@@ -152,16 +153,27 @@ func _() {
 	_ = x[MisplacedConstraintIface-142]
 	_ = x[InvalidMethodTypeParams-143]
 	_ = x[MisplacedTypeParam-144]
+	_ = x[InvalidUnsafeSliceData-145]
+	_ = x[InvalidUnsafeString-146]
 }
 
-const _ErrorCode_name = "TestBlankPkgNameMismatchedPkgNameInvalidPkgUseBadImportPathBrokenImportImportCRenamedUnusedImportInvalidInitCycleDuplicateDeclInvalidDeclCycleInvalidTypeCycleInvalidConstInitInvalidConstValInvalidConstTypeUntypedNilWrongAssignCountUnassignableOperandNoNewVarMultiValAssignOpInvalidIfaceAssignInvalidChanAssignIncompatibleAssignUnaddressableFieldAssignNotATypeInvalidArrayLenBlankIfaceMethodIncomparableMapKeyInvalidIfaceEmbedInvalidPtrEmbedBadRecvInvalidRecvDuplicateFieldAndMethodDuplicateMethodInvalidBlankInvalidIotaMissingInitBodyInvalidInitSigInvalidInitDeclInvalidMainDeclTooManyValuesNotAnExprTruncatedFloatNumericOverflowUndefinedOpMismatchedTypesDivByZeroNonNumericIncDecUnaddressableOperandInvalidIndirectionNonIndexableOperandInvalidIndexSwappedSliceIndicesNonSliceableOperandInvalidSliceExprInvalidShiftCountInvalidShiftOperandInvalidReceiveInvalidSendDuplicateLitKeyMissingLitKeyInvalidLitIndexOversizeArrayLitMixedStructLitInvalidStructLitMissingLitFieldDuplicateLitFieldUnexportedLitFieldInvalidLitFieldUntypedLitInvalidLitAmbiguousSelectorUndeclaredImportedNameUnexportedNameUndeclaredNameMissingFieldOrMethodBadDotDotDotSyntaxNonVariadicDotDotDotMisplacedDotDotDotInvalidDotDotDotOperandInvalidDotDotDotUncalledBuiltinInvalidAppendInvalidCapInvalidCloseInvalidCopyInvalidComplexInvalidDeleteInvalidImagInvalidLenSwappedMakeArgsInvalidMakeInvalidRealInvalidAssertImpossibleAssertInvalidConversionInvalidUntypedConversionBadOffsetofSyntaxInvalidOffsetofUnusedExprUnusedVarMissingReturnWrongResultCountOutOfScopeResultInvalidCondInvalidPostDeclInvalidChanRangeInvalidIterVarInvalidRangeExprMisplacedBreakMisplacedContinueMisplacedFallthroughDuplicateCaseDuplicateDefaultBadTypeKeywordInvalidTypeSwitchInvalidExprSwitchInvalidSelectCaseUndeclaredLabelDuplicateLabelMisplacedLabelUnusedLabelJumpOverDeclJumpIntoBlockInvalidMethodExprWrongArgCountInvalidCallUnusedResultsInvalidDeferInvalidGoBadDeclRepeatedDeclInvalidUnsafeAddInvalidUnsafeSliceUnsupportedFeatureNotAGenericTypeWrongTypeArgCountCannotInferTypeArgsInvalidTypeArgInvalidInstanceCycleInvalidUnionMisplacedConstraintIfaceInvalidMethodTypeParamsMisplacedTypeParam"
+const (
+	_ErrorCode_name_0 = "InvalidSyntaxTree"
+	_ErrorCode_name_1 = "TestBlankPkgNameMismatchedPkgNameInvalidPkgUseBadImportPathBrokenImportImportCRenamedUnusedImportInvalidInitCycleDuplicateDeclInvalidDeclCycleInvalidTypeCycleInvalidConstInitInvalidConstValInvalidConstTypeUntypedNilUseWrongAssignCountUnassignableOperandNoNewVarMultiValAssignOpInvalidIfaceAssignInvalidChanAssignIncompatibleAssignUnaddressableFieldAssignNotATypeInvalidArrayLenBlankIfaceMethodIncomparableMapKeyInvalidIfaceEmbedInvalidPtrEmbedBadRecvInvalidRecvDuplicateFieldAndMethodDuplicateMethodInvalidBlankInvalidIotaMissingInitBodyInvalidInitSigInvalidInitDeclInvalidMainDeclTooManyValuesNotAnExprTruncatedFloatNumericOverflowUndefinedOpMismatchedTypesDivByZeroNonNumericIncDecUnaddressableOperandInvalidIndirectionNonIndexableOperandInvalidIndexSwappedSliceIndicesNonSliceableOperandInvalidSliceExprInvalidShiftCountInvalidShiftOperandInvalidReceiveInvalidSendDuplicateLitKeyMissingLitKeyInvalidLitIndexOversizeArrayLitMixedStructLitInvalidStructLitMissingLitFieldDuplicateLitFieldUnexportedLitFieldInvalidLitFieldUntypedLitInvalidLitAmbiguousSelectorUndeclaredImportedNameUnexportedNameUndeclaredNameMissingFieldOrMethodBadDotDotDotSyntaxNonVariadicDotDotDotMisplacedDotDotDotInvalidDotDotDotOperandInvalidDotDotDotUncalledBuiltinInvalidAppendInvalidCapInvalidCloseInvalidCopyInvalidComplexInvalidDeleteInvalidImagInvalidLenSwappedMakeArgsInvalidMakeInvalidRealInvalidAssertImpossibleAssertInvalidConversionInvalidUntypedConversionBadOffsetofSyntaxInvalidOffsetofUnusedExprUnusedVarMissingReturnWrongResultCountOutOfScopeResultInvalidCondInvalidPostDeclInvalidChanRangeInvalidIterVarInvalidRangeExprMisplacedBreakMisplacedContinueMisplacedFallthroughDuplicateCaseDuplicateDefaultBadTypeKeywordInvalidTypeSwitchInvalidExprSwitchInvalidSelectCaseUndeclaredLabelDuplicateLabelMisplacedLabelUnusedLabelJumpOverDeclJumpIntoBlockInvalidMethodExprWrongArgCountInvalidCallUnusedResultsInvalidDeferInvalidGoBadDeclRepeatedDeclInvalidUnsafeAddInvalidUnsafeSliceUnsupportedFeatureNotAGenericTypeWrongTypeArgCountCannotInferTypeArgsInvalidTypeArgInvalidInstanceCycleInvalidUnionMisplacedConstraintIfaceInvalidMethodTypeParamsMisplacedTypeParamInvalidUnsafeSliceDataInvalidUnsafeString"
+)
 
-var _ErrorCode_index = [...]uint16{0, 4, 16, 33, 46, 59, 71, 85, 97, 113, 126, 142, 158, 174, 189, 205, 215, 231, 250, 258, 274, 292, 309, 327, 351, 359, 374, 390, 408, 425, 440, 447, 458, 481, 496, 508, 519, 534, 548, 563, 578, 591, 600, 614, 629, 640, 655, 664, 680, 700, 718, 737, 749, 768, 787, 803, 820, 839, 853, 864, 879, 892, 907, 923, 937, 953, 968, 985, 1003, 1018, 1028, 1038, 1055, 1077, 1091, 1105, 1125, 1143, 1163, 1181, 1204, 1220, 1235, 1248, 1258, 1270, 1281, 1295, 1308, 1319, 1329, 1344, 1355, 1366, 1379, 1395, 1412, 1436, 1453, 1468, 1478, 1487, 1500, 1516, 1532, 1543, 1558, 1574, 1588, 1604, 1618, 1635, 1655, 1668, 1684, 1698, 1715, 1732, 1749, 1764, 1778, 1792, 1803, 1815, 1828, 1845, 1858, 1869, 1882, 1894, 1903, 1910, 1922, 1938, 1956, 1974, 1989, 2006, 2025, 2039, 2059, 2071, 2095, 2118, 2136}
+var (
+	_ErrorCode_index_1 = [...]uint16{0, 4, 16, 33, 46, 59, 71, 85, 97, 113, 126, 142, 158, 174, 189, 205, 218, 234, 253, 261, 277, 295, 312, 330, 354, 362, 377, 393, 411, 428, 443, 450, 461, 484, 499, 511, 522, 537, 551, 566, 581, 594, 603, 617, 632, 643, 658, 667, 683, 703, 721, 740, 752, 771, 790, 806, 823, 842, 856, 867, 882, 895, 910, 926, 940, 956, 971, 988, 1006, 1021, 1031, 1041, 1058, 1080, 1094, 1108, 1128, 1146, 1166, 1184, 1207, 1223, 1238, 1251, 1261, 1273, 1284, 1298, 1311, 1322, 1332, 1347, 1358, 1369, 1382, 1398, 1415, 1439, 1456, 1471, 1481, 1490, 1503, 1519, 1535, 1546, 1561, 1577, 1591, 1607, 1621, 1638, 1658, 1671, 1687, 1701, 1718, 1735, 1752, 1767, 1781, 1795, 1806, 1818, 1831, 1848, 1861, 1872, 1885, 1897, 1906, 1913, 1925, 1941, 1959, 1977, 1992, 2009, 2028, 2042, 2062, 2074, 2098, 2121, 2139, 2161, 2180}
+)
 
 func (i ErrorCode) String() string {
-	i -= 1
-	if i < 0 || i >= ErrorCode(len(_ErrorCode_index)-1) {
-		return "ErrorCode(" + strconv.FormatInt(int64(i+1), 10) + ")"
+	switch {
+	case i == -1:
+		return _ErrorCode_name_0
+	case 1 <= i && i <= 146:
+		i -= 1
+		return _ErrorCode_name_1[_ErrorCode_index_1[i]:_ErrorCode_index_1[i+1]]
+	default:
+		return "ErrorCode(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _ErrorCode_name[_ErrorCode_index[i]:_ErrorCode_index[i+1]]
 }
diff --git a/vendor/google.golang.org/grpc/balancer/balancer.go b/vendor/google.golang.org/grpc/balancer/balancer.go
index bcc6f5451c90..f4f9408f3852 100644
--- a/vendor/google.golang.org/grpc/balancer/balancer.go
+++ b/vendor/google.golang.org/grpc/balancer/balancer.go
@@ -27,6 +27,7 @@ import (
 	"net"
 	"strings"
 
+	"google.golang.org/grpc/channelz"
 	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal"
@@ -192,7 +193,7 @@ type BuildOptions struct {
 	// server can ignore this field.
 	Authority string
 	// ChannelzParentID is the parent ClientConn's channelz ID.
-	ChannelzParentID int64
+	ChannelzParentID *channelz.Identifier
 	// CustomUserAgent is the custom user agent set on the parent ClientConn.
 	// The balancer should set the same custom user agent if it creates a
 	// ClientConn.
@@ -243,7 +244,7 @@ type DoneInfo struct {
 	// ServerLoad is the load received from server. It's usually sent as part of
 	// trailing metadata.
 	//
-	// The only supported type now is *orca_v1.LoadReport.
+	// The only supported type now is *orca_v3.LoadReport.
 	ServerLoad interface{}
 }
 
@@ -370,56 +371,3 @@ type ClientConnState struct {
 // ErrBadResolverState may be returned by UpdateClientConnState to indicate a
 // problem with the provided name resolver data.
 var ErrBadResolverState = errors.New("bad resolver state")
-
-// ConnectivityStateEvaluator takes the connectivity states of multiple SubConns
-// and returns one aggregated connectivity state.
-//
-// It's not thread safe.
-type ConnectivityStateEvaluator struct {
-	numReady            uint64 // Number of addrConns in ready state.
-	numConnecting       uint64 // Number of addrConns in connecting state.
-	numTransientFailure uint64 // Number of addrConns in transient failure state.
-	numIdle             uint64 // Number of addrConns in idle state.
-}
-
-// RecordTransition records state change happening in subConn and based on that
-// it evaluates what aggregated state should be.
-//
-//  - If at least one SubConn in Ready, the aggregated state is Ready;
-//  - Else if at least one SubConn in Connecting, the aggregated state is Connecting;
-//  - Else if at least one SubConn is TransientFailure, the aggregated state is Transient Failure;
-//  - Else if at least one SubConn is Idle, the aggregated state is Idle;
-//  - Else there are no subconns and the aggregated state is Transient Failure
-//
-// Shutdown is not considered.
-func (cse *ConnectivityStateEvaluator) RecordTransition(oldState, newState connectivity.State) connectivity.State {
-	// Update counters.
-	for idx, state := range []connectivity.State{oldState, newState} {
-		updateVal := 2*uint64(idx) - 1 // -1 for oldState and +1 for new.
-		switch state {
-		case connectivity.Ready:
-			cse.numReady += updateVal
-		case connectivity.Connecting:
-			cse.numConnecting += updateVal
-		case connectivity.TransientFailure:
-			cse.numTransientFailure += updateVal
-		case connectivity.Idle:
-			cse.numIdle += updateVal
-		}
-	}
-
-	// Evaluate.
-	if cse.numReady > 0 {
-		return connectivity.Ready
-	}
-	if cse.numConnecting > 0 {
-		return connectivity.Connecting
-	}
-	if cse.numTransientFailure > 0 {
-		return connectivity.TransientFailure
-	}
-	if cse.numIdle > 0 {
-		return connectivity.Idle
-	}
-	return connectivity.TransientFailure
-}
diff --git a/vendor/google.golang.org/grpc/balancer/base/balancer.go b/vendor/google.golang.org/grpc/balancer/base/balancer.go
index a67074a3ad06..e8dfc828aaac 100644
--- a/vendor/google.golang.org/grpc/balancer/base/balancer.go
+++ b/vendor/google.golang.org/grpc/balancer/base/balancer.go
@@ -45,6 +45,7 @@ func (bb *baseBuilder) Build(cc balancer.ClientConn, opt balancer.BuildOptions)
 		scStates: make(map[balancer.SubConn]connectivity.State),
 		csEvltr:  &balancer.ConnectivityStateEvaluator{},
 		config:   bb.config,
+		state:    connectivity.Connecting,
 	}
 	// Initialize picker to a picker that always returns
 	// ErrNoSubConnAvailable, because when state of a SubConn changes, we
@@ -134,6 +135,9 @@ func (b *baseBalancer) UpdateClientConnState(s balancer.ClientConnState) error {
 		b.ResolverError(errors.New("produced zero addresses"))
 		return balancer.ErrBadResolverState
 	}
+
+	b.regeneratePicker()
+	b.cc.UpdateState(balancer.State{ConnectivityState: b.state, Picker: b.picker})
 	return nil
 }
 
diff --git a/vendor/google.golang.org/grpc/balancer/conn_state_evaluator.go b/vendor/google.golang.org/grpc/balancer/conn_state_evaluator.go
new file mode 100644
index 000000000000..a87b6809af38
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/conn_state_evaluator.go
@@ -0,0 +1,70 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package balancer
+
+import "google.golang.org/grpc/connectivity"
+
+// ConnectivityStateEvaluator takes the connectivity states of multiple SubConns
+// and returns one aggregated connectivity state.
+//
+// It's not thread safe.
+type ConnectivityStateEvaluator struct {
+	numReady            uint64 // Number of addrConns in ready state.
+	numConnecting       uint64 // Number of addrConns in connecting state.
+	numTransientFailure uint64 // Number of addrConns in transient failure state.
+	numIdle             uint64 // Number of addrConns in idle state.
+}
+
+// RecordTransition records state change happening in subConn and based on that
+// it evaluates what aggregated state should be.
+//
+//  - If at least one SubConn in Ready, the aggregated state is Ready;
+//  - Else if at least one SubConn in Connecting, the aggregated state is Connecting;
+//  - Else if at least one SubConn is Idle, the aggregated state is Idle;
+//  - Else if at least one SubConn is TransientFailure (or there are no SubConns), the aggregated state is Transient Failure.
+//
+// Shutdown is not considered.
+func (cse *ConnectivityStateEvaluator) RecordTransition(oldState, newState connectivity.State) connectivity.State {
+	// Update counters.
+	for idx, state := range []connectivity.State{oldState, newState} {
+		updateVal := 2*uint64(idx) - 1 // -1 for oldState and +1 for new.
+		switch state {
+		case connectivity.Ready:
+			cse.numReady += updateVal
+		case connectivity.Connecting:
+			cse.numConnecting += updateVal
+		case connectivity.TransientFailure:
+			cse.numTransientFailure += updateVal
+		case connectivity.Idle:
+			cse.numIdle += updateVal
+		}
+	}
+
+	// Evaluate.
+	if cse.numReady > 0 {
+		return connectivity.Ready
+	}
+	if cse.numConnecting > 0 {
+		return connectivity.Connecting
+	}
+	if cse.numIdle > 0 {
+		return connectivity.Idle
+	}
+	return connectivity.TransientFailure
+}
diff --git a/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go b/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go
index cb4b3c203c51..cf1034830d58 100644
--- a/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go
+++ b/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go
@@ -1,3 +1,22 @@
+// Copyright 2015 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This file defines the GRPCLB LoadBalancing protocol.
+//
+// The canonical version of this proto can be found at
+// https://github.com/grpc/grpc-proto/blob/master/grpc/lb/v1/load_balancer.proto
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.2.0
diff --git a/vendor/google.golang.org/grpc/balancer/grpclb/grpclb_remote_balancer.go b/vendor/google.golang.org/grpc/balancer/grpclb/grpclb_remote_balancer.go
index 805bbbb789ae..dab1959418e1 100644
--- a/vendor/google.golang.org/grpc/balancer/grpclb/grpclb_remote_balancer.go
+++ b/vendor/google.golang.org/grpc/balancer/grpclb/grpclb_remote_balancer.go
@@ -35,7 +35,6 @@ import (
 	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/internal/backoff"
-	"google.golang.org/grpc/internal/channelz"
 	imetadata "google.golang.org/grpc/internal/metadata"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
@@ -240,9 +239,7 @@ func (lb *lbBalancer) newRemoteBalancerCCWrapper() {
 	// Explicitly set pickfirst as the balancer.
 	dopts = append(dopts, grpc.WithDefaultServiceConfig(`{"loadBalancingPolicy":"pick_first"}`))
 	dopts = append(dopts, grpc.WithResolvers(lb.manualResolver))
-	if channelz.IsOn() {
-		dopts = append(dopts, grpc.WithChannelzParentID(lb.opt.ChannelzParentID))
-	}
+	dopts = append(dopts, grpc.WithChannelzParentID(lb.opt.ChannelzParentID))
 
 	// Enable Keepalive for grpclb client.
 	dopts = append(dopts, grpc.WithKeepaliveParams(keepalive.ClientParameters{
diff --git a/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go b/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go
index 274eb2f85802..f7031ad2251b 100644
--- a/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go
+++ b/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go
@@ -22,7 +22,7 @@
 package roundrobin
 
 import (
-	"sync"
+	"sync/atomic"
 
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/balancer/base"
@@ -60,7 +60,7 @@ func (*rrPickerBuilder) Build(info base.PickerBuildInfo) balancer.Picker {
 		// Start at a random index, as the same RR balancer rebuilds a new
 		// picker when SubConn states change, and we don't want to apply excess
 		// load to the first server in the list.
-		next: grpcrand.Intn(len(scs)),
+		next: uint32(grpcrand.Intn(len(scs))),
 	}
 }
 
@@ -69,15 +69,13 @@ type rrPicker struct {
 	// created. The slice is immutable. Each Get() will do a round robin
 	// selection from it and return the selected SubConn.
 	subConns []balancer.SubConn
-
-	mu   sync.Mutex
-	next int
+	next     uint32
 }
 
 func (p *rrPicker) Pick(balancer.PickInfo) (balancer.PickResult, error) {
-	p.mu.Lock()
-	sc := p.subConns[p.next]
-	p.next = (p.next + 1) % len(p.subConns)
-	p.mu.Unlock()
+	subConnsLen := uint32(len(p.subConns))
+	nextIndex := atomic.AddUint32(&p.next, 1)
+
+	sc := p.subConns[nextIndex%subConnsLen]
 	return balancer.PickResult{SubConn: sc}, nil
 }
diff --git a/vendor/google.golang.org/grpc/balancer/weightedroundrobin/weightedroundrobin.go b/vendor/google.golang.org/grpc/balancer/weightedroundrobin/weightedroundrobin.go
index f15dddb56218..d82b714e0701 100644
--- a/vendor/google.golang.org/grpc/balancer/weightedroundrobin/weightedroundrobin.go
+++ b/vendor/google.golang.org/grpc/balancer/weightedroundrobin/weightedroundrobin.go
@@ -26,12 +26,12 @@ import (
 // Name is the name of weighted_round_robin balancer.
 const Name = "weighted_round_robin"
 
-// attributeKey is the type used as the key to store AddrInfo in the Attributes
-// field of resolver.Address.
+// attributeKey is the type used as the key to store AddrInfo in the
+// BalancerAttributes field of resolver.Address.
 type attributeKey struct{}
 
-// AddrInfo will be stored inside Address metadata in order to use weighted
-// roundrobin balancer.
+// AddrInfo will be stored in the BalancerAttributes field of Address in order
+// to use weighted roundrobin balancer.
 type AddrInfo struct {
 	Weight uint32
 }
@@ -42,8 +42,8 @@ func (a AddrInfo) Equal(o interface{}) bool {
 	return ok && oa.Weight == a.Weight
 }
 
-// SetAddrInfo returns a copy of addr in which the Attributes field is updated
-// with addrInfo.
+// SetAddrInfo returns a copy of addr in which the BalancerAttributes field is
+// updated with addrInfo.
 //
 // Experimental
 //
@@ -54,7 +54,8 @@ func SetAddrInfo(addr resolver.Address, addrInfo AddrInfo) resolver.Address {
 	return addr
 }
 
-// GetAddrInfo returns the AddrInfo stored in the Attributes fields of addr.
+// GetAddrInfo returns the AddrInfo stored in the BalancerAttributes field of
+// addr.
 //
 // Experimental
 //
diff --git a/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedaggregator/aggregator.go b/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedaggregator/aggregator.go
index 7e1d106e9ff9..38bd9b223f80 100644
--- a/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedaggregator/aggregator.go
+++ b/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedaggregator/aggregator.go
@@ -68,6 +68,11 @@ type Aggregator struct {
 	//
 	// If an ID is not in map, it's either removed or never added.
 	idToPickerState map[string]*weightedPickerState
+	// Set when UpdateState call propagation is paused.
+	pauseUpdateState bool
+	// Set when UpdateState call propagation is paused and an UpdateState call
+	// is suppressed.
+	needUpdateStateOnResume bool
 }
 
 // New creates a new weighted balancer state aggregator.
@@ -141,6 +146,27 @@ func (wbsa *Aggregator) UpdateWeight(id string, newWeight uint32) {
 	pState.weight = newWeight
 }
 
+// PauseStateUpdates causes UpdateState calls to not propagate to the parent
+// ClientConn.  The last state will be remembered and propagated when
+// ResumeStateUpdates is called.
+func (wbsa *Aggregator) PauseStateUpdates() {
+	wbsa.mu.Lock()
+	defer wbsa.mu.Unlock()
+	wbsa.pauseUpdateState = true
+	wbsa.needUpdateStateOnResume = false
+}
+
+// ResumeStateUpdates will resume propagating UpdateState calls to the parent,
+// and call UpdateState on the parent if any UpdateState call was suppressed.
+func (wbsa *Aggregator) ResumeStateUpdates() {
+	wbsa.mu.Lock()
+	defer wbsa.mu.Unlock()
+	wbsa.pauseUpdateState = false
+	if wbsa.needUpdateStateOnResume {
+		wbsa.cc.UpdateState(wbsa.build())
+	}
+}
+
 // UpdateState is called to report a balancer state change from sub-balancer.
 // It's usually called by the balancer group.
 //
@@ -166,6 +192,14 @@ func (wbsa *Aggregator) UpdateState(id string, newState balancer.State) {
 	if !wbsa.started {
 		return
 	}
+
+	if wbsa.pauseUpdateState {
+		// If updates are paused, do not call UpdateState, but remember that we
+		// need to call it when they are resumed.
+		wbsa.needUpdateStateOnResume = true
+		return
+	}
+
 	wbsa.cc.UpdateState(wbsa.build())
 }
 
@@ -191,6 +225,13 @@ func (wbsa *Aggregator) BuildAndUpdate() {
 	if !wbsa.started {
 		return
 	}
+	if wbsa.pauseUpdateState {
+		// If updates are paused, do not call UpdateState, but remember that we
+		// need to call it when they are resumed.
+		wbsa.needUpdateStateOnResume = true
+		return
+	}
+
 	wbsa.cc.UpdateState(wbsa.build())
 }
 
diff --git a/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedtarget.go b/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedtarget.go
index b6fa532b5120..2582c84c5488 100644
--- a/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedtarget.go
+++ b/vendor/google.golang.org/grpc/balancer/weightedtarget/weightedtarget.go
@@ -90,6 +90,9 @@ func (b *weightedTargetBalancer) UpdateClientConnState(s balancer.ClientConnStat
 
 	var rebuildStateAndPicker bool
 
+	b.stateAggregator.PauseStateUpdates()
+	defer b.stateAggregator.ResumeStateUpdates()
+
 	// Remove sub-pickers and sub-balancers that are not in the new config.
 	for name := range b.targets {
 		if _, ok := newConfig.Targets[name]; !ok {
diff --git a/vendor/google.golang.org/grpc/balancer_conn_wrappers.go b/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
index f4ea61746823..b1c23eaae0db 100644
--- a/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
+++ b/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
@@ -20,130 +20,178 @@ package grpc
 
 import (
 	"fmt"
+	"strings"
 	"sync"
 
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/internal/balancer/gracefulswitch"
 	"google.golang.org/grpc/internal/buffer"
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/resolver"
 )
 
-// scStateUpdate contains the subConn and the new state it changed to.
-type scStateUpdate struct {
-	sc    balancer.SubConn
-	state connectivity.State
-	err   error
-}
+// ccBalancerWrapper sits between the ClientConn and the Balancer.
+//
+// ccBalancerWrapper implements methods corresponding to the ones on the
+// balancer.Balancer interface. The ClientConn is free to call these methods
+// concurrently and the ccBalancerWrapper ensures that calls from the ClientConn
+// to the Balancer happen synchronously and in order.
+//
+// ccBalancerWrapper also implements the balancer.ClientConn interface and is
+// passed to the Balancer implementations. It invokes unexported methods on the
+// ClientConn to handle these calls from the Balancer.
+//
+// It uses the gracefulswitch.Balancer internally to ensure that balancer
+// switches happen in a graceful manner.
+type ccBalancerWrapper struct {
+	cc *ClientConn
 
-// exitIdle contains no data and is just a signal sent on the updateCh in
-// ccBalancerWrapper to instruct the balancer to exit idle.
-type exitIdle struct{}
+	// Since these fields are accessed only from handleXxx() methods which are
+	// synchronized by the watcher goroutine, we do not need a mutex to protect
+	// these fields.
+	balancer        *gracefulswitch.Balancer
+	curBalancerName string
 
-// ccBalancerWrapper is a wrapper on top of cc for balancers.
-// It implements balancer.ClientConn interface.
-type ccBalancerWrapper struct {
-	cc          *ClientConn
-	balancerMu  sync.Mutex // synchronizes calls to the balancer
-	balancer    balancer.Balancer
-	hasExitIdle bool
-	updateCh    *buffer.Unbounded
-	closed      *grpcsync.Event
-	done        *grpcsync.Event
-
-	mu       sync.Mutex
-	subConns map[*acBalancerWrapper]struct{}
+	updateCh *buffer.Unbounded // Updates written on this channel are processed by watcher().
+	resultCh *buffer.Unbounded // Results of calls to UpdateClientConnState() are pushed here.
+	closed   *grpcsync.Event   // Indicates if close has been called.
+	done     *grpcsync.Event   // Indicates if close has completed its work.
 }
 
-func newCCBalancerWrapper(cc *ClientConn, b balancer.Builder, bopts balancer.BuildOptions) *ccBalancerWrapper {
+// newCCBalancerWrapper creates a new balancer wrapper. The underlying balancer
+// is not created until the switchTo() method is invoked.
+func newCCBalancerWrapper(cc *ClientConn, bopts balancer.BuildOptions) *ccBalancerWrapper {
 	ccb := &ccBalancerWrapper{
 		cc:       cc,
 		updateCh: buffer.NewUnbounded(),
+		resultCh: buffer.NewUnbounded(),
 		closed:   grpcsync.NewEvent(),
 		done:     grpcsync.NewEvent(),
-		subConns: make(map[*acBalancerWrapper]struct{}),
 	}
 	go ccb.watcher()
-	ccb.balancer = b.Build(ccb, bopts)
-	_, ccb.hasExitIdle = ccb.balancer.(balancer.ExitIdler)
+	ccb.balancer = gracefulswitch.NewBalancer(ccb, bopts)
 	return ccb
 }
 
-// watcher balancer functions sequentially, so the balancer can be implemented
-// lock-free.
+// The following xxxUpdate structs wrap the arguments received as part of the
+// corresponding update. The watcher goroutine uses the 'type' of the update to
+// invoke the appropriate handler routine to handle the update.
+
+type ccStateUpdate struct {
+	ccs *balancer.ClientConnState
+}
+
+type scStateUpdate struct {
+	sc    balancer.SubConn
+	state connectivity.State
+	err   error
+}
+
+type exitIdleUpdate struct{}
+
+type resolverErrorUpdate struct {
+	err error
+}
+
+type switchToUpdate struct {
+	name string
+}
+
+type subConnUpdate struct {
+	acbw *acBalancerWrapper
+}
+
+// watcher is a long-running goroutine which reads updates from a channel and
+// invokes corresponding methods on the underlying balancer. It ensures that
+// these methods are invoked in a synchronous fashion. It also ensures that
+// these methods are invoked in the order in which the updates were received.
 func (ccb *ccBalancerWrapper) watcher() {
 	for {
 		select {
-		case t := <-ccb.updateCh.Get():
+		case u := <-ccb.updateCh.Get():
 			ccb.updateCh.Load()
 			if ccb.closed.HasFired() {
 				break
 			}
-			switch u := t.(type) {
+			switch update := u.(type) {
+			case *ccStateUpdate:
+				ccb.handleClientConnStateChange(update.ccs)
 			case *scStateUpdate:
-				ccb.balancerMu.Lock()
-				ccb.balancer.UpdateSubConnState(u.sc, balancer.SubConnState{ConnectivityState: u.state, ConnectionError: u.err})
-				ccb.balancerMu.Unlock()
-			case *acBalancerWrapper:
-				ccb.mu.Lock()
-				if ccb.subConns != nil {
-					delete(ccb.subConns, u)
-					ccb.cc.removeAddrConn(u.getAddrConn(), errConnDrain)
-				}
-				ccb.mu.Unlock()
-			case exitIdle:
-				if ccb.cc.GetState() == connectivity.Idle {
-					if ei, ok := ccb.balancer.(balancer.ExitIdler); ok {
-						// We already checked that the balancer implements
-						// ExitIdle before pushing the event to updateCh, but
-						// check conditionally again as defensive programming.
-						ccb.balancerMu.Lock()
-						ei.ExitIdle()
-						ccb.balancerMu.Unlock()
-					}
-				}
+				ccb.handleSubConnStateChange(update)
+			case *exitIdleUpdate:
+				ccb.handleExitIdle()
+			case *resolverErrorUpdate:
+				ccb.handleResolverError(update.err)
+			case *switchToUpdate:
+				ccb.handleSwitchTo(update.name)
+			case *subConnUpdate:
+				ccb.handleRemoveSubConn(update.acbw)
 			default:
-				logger.Errorf("ccBalancerWrapper.watcher: unknown update %+v, type %T", t, t)
+				logger.Errorf("ccBalancerWrapper.watcher: unknown update %+v, type %T", update, update)
 			}
 		case <-ccb.closed.Done():
 		}
 
 		if ccb.closed.HasFired() {
-			ccb.balancerMu.Lock()
-			ccb.balancer.Close()
-			ccb.balancerMu.Unlock()
-			ccb.mu.Lock()
-			scs := ccb.subConns
-			ccb.subConns = nil
-			ccb.mu.Unlock()
-			ccb.UpdateState(balancer.State{ConnectivityState: connectivity.Connecting, Picker: nil})
-			ccb.done.Fire()
-			// Fire done before removing the addr conns.  We can safely unblock
-			// ccb.close and allow the removeAddrConns to happen
-			// asynchronously.
-			for acbw := range scs {
-				ccb.cc.removeAddrConn(acbw.getAddrConn(), errConnDrain)
-			}
+			ccb.handleClose()
 			return
 		}
 	}
 }
 
-func (ccb *ccBalancerWrapper) close() {
-	ccb.closed.Fire()
-	<-ccb.done.Done()
+// updateClientConnState is invoked by grpc to push a ClientConnState update to
+// the underlying balancer.
+//
+// Unlike other methods invoked by grpc to push updates to the underlying
+// balancer, this method cannot simply push the update onto the update channel
+// and return. It needs to return the error returned by the underlying balancer
+// back to grpc which propagates that to the resolver.
+func (ccb *ccBalancerWrapper) updateClientConnState(ccs *balancer.ClientConnState) error {
+	ccb.updateCh.Put(&ccStateUpdate{ccs: ccs})
+
+	var res interface{}
+	select {
+	case res = <-ccb.resultCh.Get():
+		ccb.resultCh.Load()
+	case <-ccb.closed.Done():
+		// Return early if the balancer wrapper is closed while we are waiting for
+		// the underlying balancer to process a ClientConnState update.
+		return nil
+	}
+	// If the returned error is nil, attempting to type assert to error leads to
+	// panic. So, this needs to handled separately.
+	if res == nil {
+		return nil
+	}
+	return res.(error)
 }
 
-func (ccb *ccBalancerWrapper) exitIdle() bool {
-	if !ccb.hasExitIdle {
-		return false
+// handleClientConnStateChange handles a ClientConnState update from the update
+// channel and invokes the appropriate method on the underlying balancer.
+//
+// If the addresses specified in the update contain addresses of type "grpclb"
+// and the selected LB policy is not "grpclb", these addresses will be filtered
+// out and ccs will be modified with the updated address list.
+func (ccb *ccBalancerWrapper) handleClientConnStateChange(ccs *balancer.ClientConnState) {
+	if ccb.curBalancerName != grpclbName {
+		// Filter any grpclb addresses since we don't have the grpclb balancer.
+		var addrs []resolver.Address
+		for _, addr := range ccs.ResolverState.Addresses {
+			if addr.Type == resolver.GRPCLB {
+				continue
+			}
+			addrs = append(addrs, addr)
+		}
+		ccs.ResolverState.Addresses = addrs
 	}
-	ccb.updateCh.Put(exitIdle{})
-	return true
+	ccb.resultCh.Put(ccb.balancer.UpdateClientConnState(*ccs))
 }
 
-func (ccb *ccBalancerWrapper) handleSubConnStateChange(sc balancer.SubConn, s connectivity.State, err error) {
+// updateSubConnState is invoked by grpc to push a subConn state update to the
+// underlying balancer.
+func (ccb *ccBalancerWrapper) updateSubConnState(sc balancer.SubConn, s connectivity.State, err error) {
 	// When updating addresses for a SubConn, if the address in use is not in
 	// the new addresses, the old ac will be tearDown() and a new ac will be
 	// created. tearDown() generates a state change with Shutdown state, we
@@ -161,44 +209,125 @@ func (ccb *ccBalancerWrapper) handleSubConnStateChange(sc balancer.SubConn, s co
 	})
 }
 
-func (ccb *ccBalancerWrapper) updateClientConnState(ccs *balancer.ClientConnState) error {
-	ccb.balancerMu.Lock()
-	defer ccb.balancerMu.Unlock()
-	return ccb.balancer.UpdateClientConnState(*ccs)
+// handleSubConnStateChange handles a SubConnState update from the update
+// channel and invokes the appropriate method on the underlying balancer.
+func (ccb *ccBalancerWrapper) handleSubConnStateChange(update *scStateUpdate) {
+	ccb.balancer.UpdateSubConnState(update.sc, balancer.SubConnState{ConnectivityState: update.state, ConnectionError: update.err})
+}
+
+func (ccb *ccBalancerWrapper) exitIdle() {
+	ccb.updateCh.Put(&exitIdleUpdate{})
+}
+
+func (ccb *ccBalancerWrapper) handleExitIdle() {
+	if ccb.cc.GetState() != connectivity.Idle {
+		return
+	}
+	ccb.balancer.ExitIdle()
 }
 
 func (ccb *ccBalancerWrapper) resolverError(err error) {
-	ccb.balancerMu.Lock()
-	defer ccb.balancerMu.Unlock()
+	ccb.updateCh.Put(&resolverErrorUpdate{err: err})
+}
+
+func (ccb *ccBalancerWrapper) handleResolverError(err error) {
 	ccb.balancer.ResolverError(err)
 }
 
+// switchTo is invoked by grpc to instruct the balancer wrapper to switch to the
+// LB policy identified by name.
+//
+// ClientConn calls newCCBalancerWrapper() at creation time. Upon receipt of the
+// first good update from the name resolver, it determines the LB policy to use
+// and invokes the switchTo() method. Upon receipt of every subsequent update
+// from the name resolver, it invokes this method.
+//
+// the ccBalancerWrapper keeps track of the current LB policy name, and skips
+// the graceful balancer switching process if the name does not change.
+func (ccb *ccBalancerWrapper) switchTo(name string) {
+	ccb.updateCh.Put(&switchToUpdate{name: name})
+}
+
+// handleSwitchTo handles a balancer switch update from the update channel. It
+// calls the SwitchTo() method on the gracefulswitch.Balancer with a
+// balancer.Builder corresponding to name. If no balancer.Builder is registered
+// for the given name, it uses the default LB policy which is "pick_first".
+func (ccb *ccBalancerWrapper) handleSwitchTo(name string) {
+	// TODO: Other languages use case-insensitive balancer registries. We should
+	// switch as well. See: https://github.com/grpc/grpc-go/issues/5288.
+	if strings.EqualFold(ccb.curBalancerName, name) {
+		return
+	}
+
+	// TODO: Ensure that name is a registered LB policy when we get here.
+	// We currently only validate the `loadBalancingConfig` field. We need to do
+	// the same for the `loadBalancingPolicy` field and reject the service config
+	// if the specified policy is not registered.
+	builder := balancer.Get(name)
+	if builder == nil {
+		channelz.Warningf(logger, ccb.cc.channelzID, "Channel switches to new LB policy %q, since the specified LB policy %q was not registered", PickFirstBalancerName, name)
+		builder = newPickfirstBuilder()
+	} else {
+		channelz.Infof(logger, ccb.cc.channelzID, "Channel switches to new LB policy %q", name)
+	}
+
+	if err := ccb.balancer.SwitchTo(builder); err != nil {
+		channelz.Errorf(logger, ccb.cc.channelzID, "Channel failed to build new LB policy %q: %v", name, err)
+		return
+	}
+	ccb.curBalancerName = builder.Name()
+}
+
+// handleRemoveSucConn handles a request from the underlying balancer to remove
+// a subConn.
+//
+// See comments in RemoveSubConn() for more details.
+func (ccb *ccBalancerWrapper) handleRemoveSubConn(acbw *acBalancerWrapper) {
+	ccb.cc.removeAddrConn(acbw.getAddrConn(), errConnDrain)
+}
+
+func (ccb *ccBalancerWrapper) close() {
+	ccb.closed.Fire()
+	<-ccb.done.Done()
+}
+
+func (ccb *ccBalancerWrapper) handleClose() {
+	ccb.balancer.Close()
+	ccb.done.Fire()
+}
+
 func (ccb *ccBalancerWrapper) NewSubConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (balancer.SubConn, error) {
 	if len(addrs) <= 0 {
 		return nil, fmt.Errorf("grpc: cannot create SubConn with empty address list")
 	}
-	ccb.mu.Lock()
-	defer ccb.mu.Unlock()
-	if ccb.subConns == nil {
-		return nil, fmt.Errorf("grpc: ClientConn balancer wrapper was closed")
-	}
 	ac, err := ccb.cc.newAddrConn(addrs, opts)
 	if err != nil {
+		channelz.Warningf(logger, ccb.cc.channelzID, "acBalancerWrapper: NewSubConn: failed to newAddrConn: %v", err)
 		return nil, err
 	}
 	acbw := &acBalancerWrapper{ac: ac}
 	acbw.ac.mu.Lock()
 	ac.acbw = acbw
 	acbw.ac.mu.Unlock()
-	ccb.subConns[acbw] = struct{}{}
 	return acbw, nil
 }
 
 func (ccb *ccBalancerWrapper) RemoveSubConn(sc balancer.SubConn) {
-	// The RemoveSubConn() is handled in the run() goroutine, to avoid deadlock
-	// during switchBalancer() if the old balancer calls RemoveSubConn() in its
-	// Close().
-	ccb.updateCh.Put(sc)
+	// Before we switched the ccBalancerWrapper to use gracefulswitch.Balancer, it
+	// was required to handle the RemoveSubConn() method asynchronously by pushing
+	// the update onto the update channel. This was done to avoid a deadlock as
+	// switchBalancer() was holding cc.mu when calling Close() on the old
+	// balancer, which would in turn call RemoveSubConn().
+	//
+	// With the use of gracefulswitch.Balancer in ccBalancerWrapper, handling this
+	// asynchronously is probably not required anymore since the switchTo() method
+	// handles the balancer switch by pushing the update onto the channel.
+	// TODO(easwars): Handle this inline.
+	acbw, ok := sc.(*acBalancerWrapper)
+	if !ok {
+		return
+	}
+	ccb.updateCh.Put(&subConnUpdate{acbw: acbw})
 }
 
 func (ccb *ccBalancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resolver.Address) {
@@ -210,11 +339,6 @@ func (ccb *ccBalancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resol
 }
 
 func (ccb *ccBalancerWrapper) UpdateState(s balancer.State) {
-	ccb.mu.Lock()
-	defer ccb.mu.Unlock()
-	if ccb.subConns == nil {
-		return
-	}
 	// Update picker before updating state.  Even though the ordering here does
 	// not matter, it can lead to multiple calls of Pick in the common start-up
 	// case where we wait for ready and then perform an RPC.  If the picker is
diff --git a/vendor/google.golang.org/grpc/channelz/channelz.go b/vendor/google.golang.org/grpc/channelz/channelz.go
new file mode 100644
index 000000000000..a220c47c59a5
--- /dev/null
+++ b/vendor/google.golang.org/grpc/channelz/channelz.go
@@ -0,0 +1,36 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package channelz exports internals of the channelz implementation as required
+// by other gRPC packages.
+//
+// The implementation of the channelz spec as defined in
+// https://github.com/grpc/proposal/blob/master/A14-channelz.md, is provided by
+// the `internal/channelz` package.
+//
+// Experimental
+//
+// Notice: All APIs in this package are experimental and may be removed in a
+// later release.
+package channelz
+
+import "google.golang.org/grpc/internal/channelz"
+
+// Identifier is an opaque identifier which uniquely identifies an entity in the
+// channelz database.
+type Identifier = channelz.Identifier
diff --git a/vendor/google.golang.org/grpc/clientconn.go b/vendor/google.golang.org/grpc/clientconn.go
index f9af78913710..779b03bca1c3 100644
--- a/vendor/google.golang.org/grpc/clientconn.go
+++ b/vendor/google.golang.org/grpc/clientconn.go
@@ -146,6 +146,10 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 	cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{nil})
 	cc.ctx, cc.cancel = context.WithCancel(context.Background())
 
+	for _, opt := range extraDialOptions {
+		opt.apply(&cc.dopts)
+	}
+
 	for _, opt := range opts {
 		opt.apply(&cc.dopts)
 	}
@@ -159,23 +163,20 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		}
 	}()
 
-	if channelz.IsOn() {
-		if cc.dopts.channelzParentID != 0 {
-			cc.channelzID = channelz.RegisterChannel(&channelzChannel{cc}, cc.dopts.channelzParentID, target)
-			channelz.AddTraceEvent(logger, cc.channelzID, 0, &channelz.TraceEventDesc{
-				Desc:     "Channel Created",
-				Severity: channelz.CtInfo,
-				Parent: &channelz.TraceEventDesc{
-					Desc:     fmt.Sprintf("Nested Channel(id:%d) created", cc.channelzID),
-					Severity: channelz.CtInfo,
-				},
-			})
-		} else {
-			cc.channelzID = channelz.RegisterChannel(&channelzChannel{cc}, 0, target)
-			channelz.Info(logger, cc.channelzID, "Channel Created")
+	pid := cc.dopts.channelzParentID
+	cc.channelzID = channelz.RegisterChannel(&channelzChannel{cc}, pid, target)
+	ted := &channelz.TraceEventDesc{
+		Desc:     "Channel created",
+		Severity: channelz.CtInfo,
+	}
+	if cc.dopts.channelzParentID != nil {
+		ted.Parent = &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Nested Channel(id:%d) created", cc.channelzID.Int()),
+			Severity: channelz.CtInfo,
 		}
-		cc.csMgr.channelzID = cc.channelzID
 	}
+	channelz.AddTraceEvent(logger, cc.channelzID, 1, ted)
+	cc.csMgr.channelzID = cc.channelzID
 
 	if cc.dopts.copts.TransportCredentials == nil && cc.dopts.copts.CredsBundle == nil {
 		return nil, errNoTransportSecurity
@@ -281,7 +282,7 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 	if creds := cc.dopts.copts.TransportCredentials; creds != nil {
 		credsClone = creds.Clone()
 	}
-	cc.balancerBuildOpts = balancer.BuildOptions{
+	cc.balancerWrapper = newCCBalancerWrapper(cc, balancer.BuildOptions{
 		DialCreds:        credsClone,
 		CredsBundle:      cc.dopts.copts.CredsBundle,
 		Dialer:           cc.dopts.copts.Dialer,
@@ -289,7 +290,7 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		CustomUserAgent:  cc.dopts.copts.UserAgent,
 		ChannelzParentID: cc.channelzID,
 		Target:           cc.parsedTarget,
-	}
+	})
 
 	// Build the resolver.
 	rWrapper, err := newCCResolverWrapper(cc, resolverBuilder)
@@ -398,7 +399,7 @@ type connectivityStateManager struct {
 	mu         sync.Mutex
 	state      connectivity.State
 	notifyChan chan struct{}
-	channelzID int64
+	channelzID *channelz.Identifier
 }
 
 // updateState updates the connectivity.State of ClientConn.
@@ -464,34 +465,36 @@ var _ ClientConnInterface = (*ClientConn)(nil)
 // handshakes. It also handles errors on established connections by
 // re-resolving the name and reconnecting.
 type ClientConn struct {
-	ctx    context.Context
-	cancel context.CancelFunc
-
-	target       string
-	parsedTarget resolver.Target
-	authority    string
-	dopts        dialOptions
-	csMgr        *connectivityStateManager
-
-	balancerBuildOpts balancer.BuildOptions
-	blockingpicker    *pickerWrapper
-
+	ctx    context.Context    // Initialized using the background context at dial time.
+	cancel context.CancelFunc // Cancelled on close.
+
+	// The following are initialized at dial time, and are read-only after that.
+	target          string               // User's dial target.
+	parsedTarget    resolver.Target      // See parseTargetAndFindResolver().
+	authority       string               // See determineAuthority().
+	dopts           dialOptions          // Default and user specified dial options.
+	channelzID      *channelz.Identifier // Channelz identifier for the channel.
+	balancerWrapper *ccBalancerWrapper   // Uses gracefulswitch.balancer underneath.
+
+	// The following provide their own synchronization, and therefore don't
+	// require cc.mu to be held to access them.
+	csMgr              *connectivityStateManager
+	blockingpicker     *pickerWrapper
 	safeConfigSelector iresolver.SafeConfigSelector
+	czData             *channelzData
+	retryThrottler     atomic.Value // Updated from service config.
 
-	mu              sync.RWMutex
-	resolverWrapper *ccResolverWrapper
-	sc              *ServiceConfig
-	conns           map[*addrConn]struct{}
-	// Keepalive parameter can be updated if a GoAway is received.
-	mkp             keepalive.ClientParameters
-	curBalancerName string
-	balancerWrapper *ccBalancerWrapper
-	retryThrottler  atomic.Value
-
+	// firstResolveEvent is used to track whether the name resolver sent us at
+	// least one update. RPCs block on this event.
 	firstResolveEvent *grpcsync.Event
 
-	channelzID int64 // channelz unique identification number
-	czData     *channelzData
+	// mu protects the following fields.
+	// TODO: split mu so the same mutex isn't used for everything.
+	mu              sync.RWMutex
+	resolverWrapper *ccResolverWrapper         // Initialized in Dial; cleared in Close.
+	sc              *ServiceConfig             // Latest service config received from the resolver.
+	conns           map[*addrConn]struct{}     // Set to nil on close.
+	mkp             keepalive.ClientParameters // May be updated upon receipt of a GoAway.
 
 	lceMu               sync.Mutex // protects lastConnectionError
 	lastConnectionError error
@@ -536,14 +539,7 @@ func (cc *ClientConn) GetState() connectivity.State {
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a later
 // release.
 func (cc *ClientConn) Connect() {
-	cc.mu.Lock()
-	defer cc.mu.Unlock()
-	if cc.balancerWrapper != nil && cc.balancerWrapper.exitIdle() {
-		return
-	}
-	for ac := range cc.conns {
-		go ac.connect()
-	}
+	cc.balancerWrapper.exitIdle()
 }
 
 func (cc *ClientConn) scWatcher() {
@@ -623,9 +619,7 @@ func (cc *ClientConn) updateResolverState(s resolver.State, err error) error {
 		// with the new addresses.
 		cc.maybeApplyDefaultServiceConfig(nil)
 
-		if cc.balancerWrapper != nil {
-			cc.balancerWrapper.resolverError(err)
-		}
+		cc.balancerWrapper.resolverError(err)
 
 		// No addresses are valid with err set; return early.
 		cc.mu.Unlock()
@@ -653,16 +647,10 @@ func (cc *ClientConn) updateResolverState(s resolver.State, err error) error {
 			cc.applyServiceConfigAndBalancer(sc, configSelector, s.Addresses)
 		} else {
 			ret = balancer.ErrBadResolverState
-			if cc.balancerWrapper == nil {
-				var err error
-				if s.ServiceConfig.Err != nil {
-					err = status.Errorf(codes.Unavailable, "error parsing service config: %v", s.ServiceConfig.Err)
-				} else {
-					err = status.Errorf(codes.Unavailable, "illegal service config type: %T", s.ServiceConfig.Config)
-				}
-				cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{cc.sc})
-				cc.blockingpicker.updatePicker(base.NewErrPicker(err))
-				cc.csMgr.updateState(connectivity.TransientFailure)
+			if cc.sc == nil {
+				// Apply the failing LB only if we haven't received valid service config
+				// from the name resolver in the past.
+				cc.applyFailingLB(s.ServiceConfig)
 				cc.mu.Unlock()
 				return ret
 			}
@@ -670,24 +658,12 @@ func (cc *ClientConn) updateResolverState(s resolver.State, err error) error {
 	}
 
 	var balCfg serviceconfig.LoadBalancingConfig
-	if cc.dopts.balancerBuilder == nil && cc.sc != nil && cc.sc.lbConfig != nil {
+	if cc.sc != nil && cc.sc.lbConfig != nil {
 		balCfg = cc.sc.lbConfig.cfg
 	}
-
-	cbn := cc.curBalancerName
 	bw := cc.balancerWrapper
 	cc.mu.Unlock()
-	if cbn != grpclbName {
-		// Filter any grpclb addresses since we don't have the grpclb balancer.
-		for i := 0; i < len(s.Addresses); {
-			if s.Addresses[i].Type == resolver.GRPCLB {
-				copy(s.Addresses[i:], s.Addresses[i+1:])
-				s.Addresses = s.Addresses[:len(s.Addresses)-1]
-				continue
-			}
-			i++
-		}
-	}
+
 	uccsErr := bw.updateClientConnState(&balancer.ClientConnState{ResolverState: s, BalancerConfig: balCfg})
 	if ret == nil {
 		ret = uccsErr // prefer ErrBadResolver state since any other error is
@@ -696,56 +672,28 @@ func (cc *ClientConn) updateResolverState(s resolver.State, err error) error {
 	return ret
 }
 
-// switchBalancer starts the switching from current balancer to the balancer
-// with the given name.
-//
-// It will NOT send the current address list to the new balancer. If needed,
-// caller of this function should send address list to the new balancer after
-// this function returns.
+// applyFailingLB is akin to configuring an LB policy on the channel which
+// always fails RPCs. Here, an actual LB policy is not configured, but an always
+// erroring picker is configured, which returns errors with information about
+// what was invalid in the received service config. A config selector with no
+// service config is configured, and the connectivity state of the channel is
+// set to TransientFailure.
 //
 // Caller must hold cc.mu.
-func (cc *ClientConn) switchBalancer(name string) {
-	if strings.EqualFold(cc.curBalancerName, name) {
-		return
-	}
-
-	channelz.Infof(logger, cc.channelzID, "ClientConn switching balancer to %q", name)
-	if cc.dopts.balancerBuilder != nil {
-		channelz.Info(logger, cc.channelzID, "ignoring balancer switching: Balancer DialOption used instead")
-		return
-	}
-	if cc.balancerWrapper != nil {
-		// Don't hold cc.mu while closing the balancers. The balancers may call
-		// methods that require cc.mu (e.g. cc.NewSubConn()). Holding the mutex
-		// would cause a deadlock in that case.
-		cc.mu.Unlock()
-		cc.balancerWrapper.close()
-		cc.mu.Lock()
-	}
-
-	builder := balancer.Get(name)
-	if builder == nil {
-		channelz.Warningf(logger, cc.channelzID, "Channel switches to new LB policy %q due to fallback from invalid balancer name", PickFirstBalancerName)
-		channelz.Infof(logger, cc.channelzID, "failed to get balancer builder for: %v, using pick_first instead", name)
-		builder = newPickfirstBuilder()
+func (cc *ClientConn) applyFailingLB(sc *serviceconfig.ParseResult) {
+	var err error
+	if sc.Err != nil {
+		err = status.Errorf(codes.Unavailable, "error parsing service config: %v", sc.Err)
 	} else {
-		channelz.Infof(logger, cc.channelzID, "Channel switches to new LB policy %q", name)
+		err = status.Errorf(codes.Unavailable, "illegal service config type: %T", sc.Config)
 	}
-
-	cc.curBalancerName = builder.Name()
-	cc.balancerWrapper = newCCBalancerWrapper(cc, builder, cc.balancerBuildOpts)
+	cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{nil})
+	cc.blockingpicker.updatePicker(base.NewErrPicker(err))
+	cc.csMgr.updateState(connectivity.TransientFailure)
 }
 
 func (cc *ClientConn) handleSubConnStateChange(sc balancer.SubConn, s connectivity.State, err error) {
-	cc.mu.Lock()
-	if cc.conns == nil {
-		cc.mu.Unlock()
-		return
-	}
-	// TODO(bar switching) send updates to all balancer wrappers when balancer
-	// gracefully switching is supported.
-	cc.balancerWrapper.handleSubConnStateChange(sc, s, err)
-	cc.mu.Unlock()
+	cc.balancerWrapper.updateSubConnState(sc, s, err)
 }
 
 // newAddrConn creates an addrConn for addrs and adds it to cc.conns.
@@ -764,23 +712,26 @@ func (cc *ClientConn) newAddrConn(addrs []resolver.Address, opts balancer.NewSub
 	ac.ctx, ac.cancel = context.WithCancel(cc.ctx)
 	// Track ac in cc. This needs to be done before any getTransport(...) is called.
 	cc.mu.Lock()
+	defer cc.mu.Unlock()
 	if cc.conns == nil {
-		cc.mu.Unlock()
 		return nil, ErrClientConnClosing
 	}
-	if channelz.IsOn() {
-		ac.channelzID = channelz.RegisterSubChannel(ac, cc.channelzID, "")
-		channelz.AddTraceEvent(logger, ac.channelzID, 0, &channelz.TraceEventDesc{
-			Desc:     "Subchannel Created",
-			Severity: channelz.CtInfo,
-			Parent: &channelz.TraceEventDesc{
-				Desc:     fmt.Sprintf("Subchannel(id:%d) created", ac.channelzID),
-				Severity: channelz.CtInfo,
-			},
-		})
+
+	var err error
+	ac.channelzID, err = channelz.RegisterSubChannel(ac, cc.channelzID, "")
+	if err != nil {
+		return nil, err
 	}
+	channelz.AddTraceEvent(logger, ac.channelzID, 0, &channelz.TraceEventDesc{
+		Desc:     "Subchannel created",
+		Severity: channelz.CtInfo,
+		Parent: &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Subchannel(id:%d) created", ac.channelzID.Int()),
+			Severity: channelz.CtInfo,
+		},
+	})
+
 	cc.conns[ac] = struct{}{}
-	cc.mu.Unlock()
 	return ac, nil
 }
 
@@ -853,16 +804,31 @@ func (ac *addrConn) connect() error {
 	return nil
 }
 
+func equalAddresses(a, b []resolver.Address) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i, v := range a {
+		if !v.Equal(b[i]) {
+			return false
+		}
+	}
+	return true
+}
+
 // tryUpdateAddrs tries to update ac.addrs with the new addresses list.
 //
-// If ac is Connecting, it returns false. The caller should tear down the ac and
-// create a new one. Note that the backoff will be reset when this happens.
-//
 // If ac is TransientFailure, it updates ac.addrs and returns true. The updated
 // addresses will be picked up by retry in the next iteration after backoff.
 //
 // If ac is Shutdown or Idle, it updates ac.addrs and returns true.
 //
+// If the addresses is the same as the old list, it does nothing and returns
+// true.
+//
+// If ac is Connecting, it returns false. The caller should tear down the ac and
+// create a new one. Note that the backoff will be reset when this happens.
+//
 // If ac is Ready, it checks whether current connected address of ac is in the
 // new addrs list.
 //  - If true, it updates ac.addrs and returns true. The ac will keep using
@@ -879,6 +845,10 @@ func (ac *addrConn) tryUpdateAddrs(addrs []resolver.Address) bool {
 		return true
 	}
 
+	if equalAddresses(ac.addrs, addrs) {
+		return true
+	}
+
 	if ac.state == connectivity.Connecting {
 		return false
 	}
@@ -959,14 +929,10 @@ func (cc *ClientConn) healthCheckConfig() *healthCheckConfig {
 }
 
 func (cc *ClientConn) getTransport(ctx context.Context, failfast bool, method string) (transport.ClientTransport, func(balancer.DoneInfo), error) {
-	t, done, err := cc.blockingpicker.pick(ctx, failfast, balancer.PickInfo{
+	return cc.blockingpicker.pick(ctx, failfast, balancer.PickInfo{
 		Ctx:            ctx,
 		FullMethodName: method,
 	})
-	if err != nil {
-		return nil, nil, toRPCErr(err)
-	}
-	return t, done, nil
 }
 
 func (cc *ClientConn) applyServiceConfigAndBalancer(sc *ServiceConfig, configSelector iresolver.ConfigSelector, addrs []resolver.Address) {
@@ -991,35 +957,26 @@ func (cc *ClientConn) applyServiceConfigAndBalancer(sc *ServiceConfig, configSel
 		cc.retryThrottler.Store((*retryThrottler)(nil))
 	}
 
-	if cc.dopts.balancerBuilder == nil {
-		// Only look at balancer types and switch balancer if balancer dial
-		// option is not set.
-		var newBalancerName string
-		if cc.sc != nil && cc.sc.lbConfig != nil {
-			newBalancerName = cc.sc.lbConfig.name
-		} else {
-			var isGRPCLB bool
-			for _, a := range addrs {
-				if a.Type == resolver.GRPCLB {
-					isGRPCLB = true
-					break
-				}
-			}
-			if isGRPCLB {
-				newBalancerName = grpclbName
-			} else if cc.sc != nil && cc.sc.LB != nil {
-				newBalancerName = *cc.sc.LB
-			} else {
-				newBalancerName = PickFirstBalancerName
+	var newBalancerName string
+	if cc.sc != nil && cc.sc.lbConfig != nil {
+		newBalancerName = cc.sc.lbConfig.name
+	} else {
+		var isGRPCLB bool
+		for _, a := range addrs {
+			if a.Type == resolver.GRPCLB {
+				isGRPCLB = true
+				break
 			}
 		}
-		cc.switchBalancer(newBalancerName)
-	} else if cc.balancerWrapper == nil {
-		// Balancer dial option was set, and this is the first time handling
-		// resolved addresses. Build a balancer with dopts.balancerBuilder.
-		cc.curBalancerName = cc.dopts.balancerBuilder.Name()
-		cc.balancerWrapper = newCCBalancerWrapper(cc, cc.dopts.balancerBuilder, cc.balancerBuildOpts)
+		if isGRPCLB {
+			newBalancerName = grpclbName
+		} else if cc.sc != nil && cc.sc.LB != nil {
+			newBalancerName = *cc.sc.LB
+		} else {
+			newBalancerName = PickFirstBalancerName
+		}
 	}
+	cc.balancerWrapper.switchTo(newBalancerName)
 }
 
 func (cc *ClientConn) resolveNow(o resolver.ResolveNowOptions) {
@@ -1070,11 +1027,11 @@ func (cc *ClientConn) Close() error {
 	rWrapper := cc.resolverWrapper
 	cc.resolverWrapper = nil
 	bWrapper := cc.balancerWrapper
-	cc.balancerWrapper = nil
 	cc.mu.Unlock()
 
+	// The order of closing matters here since the balancer wrapper assumes the
+	// picker is closed before it is closed.
 	cc.blockingpicker.close()
-
 	if bWrapper != nil {
 		bWrapper.close()
 	}
@@ -1085,22 +1042,22 @@ func (cc *ClientConn) Close() error {
 	for ac := range conns {
 		ac.tearDown(ErrClientConnClosing)
 	}
-	if channelz.IsOn() {
-		ted := &channelz.TraceEventDesc{
-			Desc:     "Channel Deleted",
+	ted := &channelz.TraceEventDesc{
+		Desc:     "Channel deleted",
+		Severity: channelz.CtInfo,
+	}
+	if cc.dopts.channelzParentID != nil {
+		ted.Parent = &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Nested channel(id:%d) deleted", cc.channelzID.Int()),
 			Severity: channelz.CtInfo,
 		}
-		if cc.dopts.channelzParentID != 0 {
-			ted.Parent = &channelz.TraceEventDesc{
-				Desc:     fmt.Sprintf("Nested channel(id:%d) deleted", cc.channelzID),
-				Severity: channelz.CtInfo,
-			}
-		}
-		channelz.AddTraceEvent(logger, cc.channelzID, 0, ted)
-		// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add trace reference to
-		// the entity being deleted, and thus prevent it from being deleted right away.
-		channelz.RemoveEntry(cc.channelzID)
 	}
+	channelz.AddTraceEvent(logger, cc.channelzID, 0, ted)
+	// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add
+	// trace reference to the entity being deleted, and thus prevent it from being
+	// deleted right away.
+	channelz.RemoveEntry(cc.channelzID)
+
 	return nil
 }
 
@@ -1130,7 +1087,7 @@ type addrConn struct {
 	backoffIdx   int // Needs to be stateful for resetConnectBackoff.
 	resetBackoff chan struct{}
 
-	channelzID int64 // channelz unique identification number.
+	channelzID *channelz.Identifier
 	czData     *channelzData
 }
 
@@ -1284,6 +1241,7 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 		ac.mu.Lock()
 		defer ac.mu.Unlock()
 		defer connClosed.Fire()
+		defer hcancel()
 		if !hcStarted || hctx.Err() != nil {
 			// We didn't start the health check or set the state to READY, so
 			// no need to do anything else here.
@@ -1294,7 +1252,6 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 			// state, since there may be a new transport in this addrConn.
 			return
 		}
-		hcancel()
 		ac.transport = nil
 		// Refresh the name resolver
 		ac.cc.resolveNow(resolver.ResolveNowOptions{})
@@ -1312,14 +1269,13 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 
 	connectCtx, cancel := context.WithDeadline(ac.ctx, connectDeadline)
 	defer cancel()
-	if channelz.IsOn() {
-		copts.ChannelzParentID = ac.channelzID
-	}
+	copts.ChannelzParentID = ac.channelzID
 
 	newTr, err := transport.NewClientTransport(connectCtx, ac.cc.ctx, addr, copts, func() { prefaceReceived.Fire() }, onGoAway, onClose)
 	if err != nil {
 		// newTr is either nil, or closed.
-		channelz.Warningf(logger, ac.channelzID, "grpc: addrConn.createTransport failed to connect to %v. Err: %v", addr, err)
+		hcancel()
+		channelz.Warningf(logger, ac.channelzID, "grpc: addrConn.createTransport failed to connect to %s. Err: %v", addr, err)
 		return err
 	}
 
@@ -1332,7 +1288,7 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 		newTr.Close(transport.ErrConnClosing)
 		if connectCtx.Err() == context.DeadlineExceeded {
 			err := errors.New("failed to receive server preface within timeout")
-			channelz.Warningf(logger, ac.channelzID, "grpc: addrConn.createTransport failed to connect to %v: %v", addr, err)
+			channelz.Warningf(logger, ac.channelzID, "grpc: addrConn.createTransport failed to connect to %s: %v", addr, err)
 			return err
 		}
 		return nil
@@ -1497,19 +1453,18 @@ func (ac *addrConn) tearDown(err error) {
 		curTr.GracefulClose()
 		ac.mu.Lock()
 	}
-	if channelz.IsOn() {
-		channelz.AddTraceEvent(logger, ac.channelzID, 0, &channelz.TraceEventDesc{
-			Desc:     "Subchannel Deleted",
+	channelz.AddTraceEvent(logger, ac.channelzID, 0, &channelz.TraceEventDesc{
+		Desc:     "Subchannel deleted",
+		Severity: channelz.CtInfo,
+		Parent: &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Subchannel(id:%d) deleted", ac.channelzID.Int()),
 			Severity: channelz.CtInfo,
-			Parent: &channelz.TraceEventDesc{
-				Desc:     fmt.Sprintf("Subchanel(id:%d) deleted", ac.channelzID),
-				Severity: channelz.CtInfo,
-			},
-		})
-		// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add trace reference to
-		// the entity being deleted, and thus prevent it from being deleted right away.
-		channelz.RemoveEntry(ac.channelzID)
-	}
+		},
+	})
+	// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add
+	// trace reference to the entity being deleted, and thus prevent it from
+	// being deleted right away.
+	channelz.RemoveEntry(ac.channelzID)
 	ac.mu.Unlock()
 }
 
diff --git a/vendor/google.golang.org/grpc/credentials/alts/internal/handshaker/handshaker.go b/vendor/google.golang.org/grpc/credentials/alts/internal/handshaker/handshaker.go
index 8bc7ceee0aff..7b953a520e5b 100644
--- a/vendor/google.golang.org/grpc/credentials/alts/internal/handshaker/handshaker.go
+++ b/vendor/google.golang.org/grpc/credentials/alts/internal/handshaker/handshaker.go
@@ -158,7 +158,7 @@ type altsHandshaker struct {
 // stub created using the passed conn and used to talk to the ALTS Handshaker
 // service in the metadata server.
 func NewClientHandshaker(ctx context.Context, conn *grpc.ClientConn, c net.Conn, opts *ClientHandshakerOptions) (core.Handshaker, error) {
-	stream, err := altsgrpc.NewHandshakerServiceClient(conn).DoHandshake(ctx, grpc.WaitForReady(true))
+	stream, err := altsgrpc.NewHandshakerServiceClient(conn).DoHandshake(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -174,7 +174,7 @@ func NewClientHandshaker(ctx context.Context, conn *grpc.ClientConn, c net.Conn,
 // stub created using the passed conn and used to talk to the ALTS Handshaker
 // service in the metadata server.
 func NewServerHandshaker(ctx context.Context, conn *grpc.ClientConn, c net.Conn, opts *ServerHandshakerOptions) (core.Handshaker, error) {
-	stream, err := altsgrpc.NewHandshakerServiceClient(conn).DoHandshake(ctx, grpc.WaitForReady(true))
+	stream, err := altsgrpc.NewHandshakerServiceClient(conn).DoHandshake(ctx)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go b/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go
index fd55176b9b69..d3562c6d5e62 100644
--- a/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go
+++ b/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go
@@ -1,3 +1,20 @@
+// Copyright 2018 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// The canonical version of this proto can be found at
+// https://github.com/grpc/grpc-proto/blob/master/grpc/gcp/handshaker.proto
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.2.0
diff --git a/vendor/google.golang.org/grpc/credentials/google/xds.go b/vendor/google.golang.org/grpc/credentials/google/xds.go
index b8c2e8f9204c..e32edc0421c3 100644
--- a/vendor/google.golang.org/grpc/credentials/google/xds.go
+++ b/vendor/google.golang.org/grpc/credentials/google/xds.go
@@ -21,6 +21,7 @@ package google
 import (
 	"context"
 	"net"
+	"net/url"
 	"strings"
 
 	"google.golang.org/grpc/credentials"
@@ -28,12 +29,16 @@ import (
 )
 
 const cfeClusterNamePrefix = "google_cfe_"
+const cfeClusterResourceNamePrefix = "/envoy.config.cluster.v3.Cluster/google_cfe_"
+const cfeClusterAuthorityName = "traffic-director-c2p.xds.googleapis.com"
 
 // clusterTransportCreds is a combo of TLS + ALTS.
 //
 // On the client, ClientHandshake picks TLS or ALTS based on address attributes.
 // - if attributes has cluster name
-//   - if cluster name has prefix "google_cfe_", use TLS
+//   - if cluster name has prefix "google_cfe_", or
+//     "xdstp://traffic-director-c2p.xds.googleapis.com/envoy.config.cluster.v3.Cluster/google_cfe_",
+//     use TLS
 //   - otherwise, use ALTS
 // - else, do TLS
 //
@@ -50,18 +55,49 @@ func newClusterTransportCreds(tls, alts credentials.TransportCredentials) *clust
 	}
 }
 
-func (c *clusterTransportCreds) ClientHandshake(ctx context.Context, authority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+// clusterName returns the xDS cluster name stored in the attributes in the
+// context.
+func clusterName(ctx context.Context) string {
 	chi := credentials.ClientHandshakeInfoFromContext(ctx)
 	if chi.Attributes == nil {
-		return c.tls.ClientHandshake(ctx, authority, rawConn)
+		return ""
+	}
+	cluster, _ := internal.GetXDSHandshakeClusterName(chi.Attributes)
+	return cluster
+}
+
+// isDirectPathCluster returns true if the cluster in the context is a
+// directpath cluster, meaning ALTS should be used.
+func isDirectPathCluster(ctx context.Context) bool {
+	cluster := clusterName(ctx)
+	if cluster == "" {
+		// No cluster; not xDS; use TLS.
+		return false
+	}
+	if strings.HasPrefix(cluster, cfeClusterNamePrefix) {
+		// xDS cluster prefixed by "google_cfe_"; use TLS.
+		return false
 	}
-	cn, ok := internal.GetXDSHandshakeClusterName(chi.Attributes)
-	if !ok || strings.HasPrefix(cn, cfeClusterNamePrefix) {
-		return c.tls.ClientHandshake(ctx, authority, rawConn)
+	if !strings.HasPrefix(cluster, "xdstp:") {
+		// Other xDS cluster name; use ALTS.
+		return true
+	}
+	u, err := url.Parse(cluster)
+	if err != nil {
+		// Shouldn't happen, but assume ALTS.
+		return true
+	}
+	// If authority AND path match our CFE checks, use TLS; otherwise use ALTS.
+	return u.Host != cfeClusterAuthorityName || !strings.HasPrefix(u.Path, cfeClusterResourceNamePrefix)
+}
+
+func (c *clusterTransportCreds) ClientHandshake(ctx context.Context, authority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	if isDirectPathCluster(ctx) {
+		// If attributes have cluster name, and cluster name is not cfe, it's a
+		// backend address, use ALTS.
+		return c.alts.ClientHandshake(ctx, authority, rawConn)
 	}
-	// If attributes have cluster name, and cluster name is not cfe, it's a
-	// backend address, use ALTS.
-	return c.alts.ClientHandshake(ctx, authority, rawConn)
+	return c.tls.ClientHandshake(ctx, authority, rawConn)
 }
 
 func (c *clusterTransportCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
diff --git a/vendor/google.golang.org/grpc/dialoptions.go b/vendor/google.golang.org/grpc/dialoptions.go
index c4bf09f9e940..9372dc322e80 100644
--- a/vendor/google.golang.org/grpc/dialoptions.go
+++ b/vendor/google.golang.org/grpc/dialoptions.go
@@ -20,22 +20,32 @@ package grpc
 
 import (
 	"context"
-	"fmt"
 	"net"
 	"time"
 
 	"google.golang.org/grpc/backoff"
-	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/channelz"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/internal"
 	internalbackoff "google.golang.org/grpc/internal/backoff"
+	"google.golang.org/grpc/internal/binarylog"
 	"google.golang.org/grpc/internal/transport"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/stats"
 )
 
+func init() {
+	internal.AddGlobalDialOptions = func(opt ...DialOption) {
+		extraDialOptions = append(extraDialOptions, opt...)
+	}
+	internal.ClearGlobalDialOptions = func() {
+		extraDialOptions = nil
+	}
+	internal.WithBinaryLogger = withBinaryLogger
+}
+
 // dialOptions configure a Dial call. dialOptions are set by the DialOption
 // values passed to Dial.
 type dialOptions struct {
@@ -45,19 +55,18 @@ type dialOptions struct {
 	chainUnaryInts  []UnaryClientInterceptor
 	chainStreamInts []StreamClientInterceptor
 
-	cp              Compressor
-	dc              Decompressor
-	bs              internalbackoff.Strategy
-	block           bool
-	returnLastError bool
-	timeout         time.Duration
-	scChan          <-chan ServiceConfig
-	authority       string
-	copts           transport.ConnectOptions
-	callOptions     []CallOption
-	// This is used by WithBalancerName dial option.
-	balancerBuilder             balancer.Builder
-	channelzParentID            int64
+	cp                          Compressor
+	dc                          Decompressor
+	bs                          internalbackoff.Strategy
+	block                       bool
+	returnLastError             bool
+	timeout                     time.Duration
+	scChan                      <-chan ServiceConfig
+	authority                   string
+	binaryLogger                binarylog.Logger
+	copts                       transport.ConnectOptions
+	callOptions                 []CallOption
+	channelzParentID            *channelz.Identifier
 	disableServiceConfig        bool
 	disableRetry                bool
 	disableHealthCheck          bool
@@ -73,10 +82,12 @@ type DialOption interface {
 	apply(*dialOptions)
 }
 
+var extraDialOptions []DialOption
+
 // EmptyDialOption does not alter the dial configuration. It can be embedded in
 // another structure to build custom dial options.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This type is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -195,25 +206,6 @@ func WithDecompressor(dc Decompressor) DialOption {
 	})
 }
 
-// WithBalancerName sets the balancer that the ClientConn will be initialized
-// with. Balancer registered with balancerName will be used. This function
-// panics if no balancer was registered by balancerName.
-//
-// The balancer cannot be overridden by balancer option specified by service
-// config.
-//
-// Deprecated: use WithDefaultServiceConfig and WithDisableServiceConfig
-// instead.  Will be removed in a future 1.x release.
-func WithBalancerName(balancerName string) DialOption {
-	builder := balancer.Get(balancerName)
-	if builder == nil {
-		panic(fmt.Sprintf("grpc.WithBalancerName: no balancer is registered for name %v", balancerName))
-	}
-	return newFuncDialOption(func(o *dialOptions) {
-		o.balancerBuilder = builder
-	})
-}
-
 // WithServiceConfig returns a DialOption which has a channel to read the
 // service configuration.
 //
@@ -286,7 +278,7 @@ func WithBlock() DialOption {
 // the context.DeadlineExceeded error.
 // Implies WithBlock()
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -304,8 +296,8 @@ func WithReturnConnectionError() DialOption {
 // WithCredentialsBundle or WithPerRPCCredentials) which require transport
 // security is incompatible and will cause grpc.Dial() to fail.
 //
-// Deprecated: use WithTransportCredentials and insecure.NewCredentials() instead.
-// Will be supported throughout 1.x.
+// Deprecated: use WithTransportCredentials and insecure.NewCredentials()
+// instead. Will be supported throughout 1.x.
 func WithInsecure() DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.copts.TransportCredentials = insecure.NewCredentials()
@@ -315,7 +307,7 @@ func WithInsecure() DialOption {
 // WithNoProxy returns a DialOption which disables the use of proxies for this
 // ClientConn. This is ignored if WithDialer or WithContextDialer are used.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -346,7 +338,7 @@ func WithPerRPCCredentials(creds credentials.PerRPCCredentials) DialOption {
 // the ClientConn.WithCreds. This should not be used together with
 // WithTransportCredentials.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -402,7 +394,21 @@ func WithDialer(f func(string, time.Duration) (net.Conn, error)) DialOption {
 // all the RPCs and underlying network connections in this ClientConn.
 func WithStatsHandler(h stats.Handler) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
-		o.copts.StatsHandler = h
+		if h == nil {
+			logger.Error("ignoring nil parameter in grpc.WithStatsHandler ClientOption")
+			// Do not allow a nil stats handler, which would otherwise cause
+			// panics.
+			return
+		}
+		o.copts.StatsHandlers = append(o.copts.StatsHandlers, h)
+	})
+}
+
+// withBinaryLogger returns a DialOption that specifies the binary logger for
+// this ClientConn.
+func withBinaryLogger(bl binarylog.Logger) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.binaryLogger = bl
 	})
 }
 
@@ -414,7 +420,7 @@ func WithStatsHandler(h stats.Handler) DialOption {
 // FailOnNonTempDialError only affects the initial dial, and does not do
 // anything useful unless you are also using WithBlock().
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -494,11 +500,11 @@ func WithAuthority(a string) DialOption {
 // current ClientConn's parent. This function is used in nested channel creation
 // (e.g. grpclb dial).
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
-func WithChannelzParentID(id int64) DialOption {
+func WithChannelzParentID(id *channelz.Identifier) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.channelzParentID = id
 	})
@@ -539,9 +545,6 @@ func WithDefaultServiceConfig(s string) DialOption {
 // service config enables them.  This does not impact transparent retries, which
 // will happen automatically if no data is written to the wire or if the RPC is
 // unprocessed by the remote server.
-//
-// Retry support is currently enabled by default, but may be disabled by
-// setting the environment variable "GRPC_GO_RETRY" to "off".
 func WithDisableRetry() DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.disableRetry = true
@@ -559,7 +562,7 @@ func WithMaxHeaderListSize(s uint32) DialOption {
 // WithDisableHealthCheck disables the LB channel health checking for all
 // SubConns of this ClientConn.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -606,7 +609,7 @@ func withMinConnectDeadline(f func() time.Duration) DialOption {
 // resolver.Register.  They will be matched against the scheme used for the
 // current Dial only, and will take precedence over the global registry.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
diff --git a/vendor/google.golang.org/grpc/encoding/encoding.go b/vendor/google.golang.org/grpc/encoding/encoding.go
index 6d84f74c7d08..18e530fc9024 100644
--- a/vendor/google.golang.org/grpc/encoding/encoding.go
+++ b/vendor/google.golang.org/grpc/encoding/encoding.go
@@ -108,7 +108,7 @@ var registeredCodecs = make(map[string]Codec)
 // more details.
 //
 // NOTE: this function must only be called during initialization time (i.e. in
-// an init() function), and is not thread-safe.  If multiple Compressors are
+// an init() function), and is not thread-safe.  If multiple Codecs are
 // registered with the same name, the one registered last will take effect.
 func RegisterCodec(codec Codec) {
 	if codec == nil {
diff --git a/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go b/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
index 69f525d1baeb..a332dfd7b54e 100644
--- a/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
+++ b/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
@@ -1,3 +1,20 @@
+// Copyright 2015 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// The canonical version of this proto can be found at
+// https://github.com/grpc/grpc-proto/blob/master/grpc/health/v1/health.proto
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.2.0
diff --git a/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
new file mode 100644
index 000000000000..08666f62a7cb
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
@@ -0,0 +1,384 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package gracefulswitch implements a graceful switch load balancer.
+package gracefulswitch
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/balancer/base"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/resolver"
+)
+
+var errBalancerClosed = errors.New("gracefulSwitchBalancer is closed")
+var _ balancer.Balancer = (*Balancer)(nil)
+
+// NewBalancer returns a graceful switch Balancer.
+func NewBalancer(cc balancer.ClientConn, opts balancer.BuildOptions) *Balancer {
+	return &Balancer{
+		cc:    cc,
+		bOpts: opts,
+	}
+}
+
+// Balancer is a utility to gracefully switch from one balancer to
+// a new balancer. It implements the balancer.Balancer interface.
+type Balancer struct {
+	bOpts balancer.BuildOptions
+	cc    balancer.ClientConn
+
+	// mu protects the following fields and all fields within balancerCurrent
+	// and balancerPending. mu does not need to be held when calling into the
+	// child balancers, as all calls into these children happen only as a direct
+	// result of a call into the gracefulSwitchBalancer, which are also
+	// guaranteed to be synchronous. There is one exception: an UpdateState call
+	// from a child balancer when current and pending are populated can lead to
+	// calling Close() on the current. To prevent that racing with an
+	// UpdateSubConnState from the channel, we hold currentMu during Close and
+	// UpdateSubConnState calls.
+	mu              sync.Mutex
+	balancerCurrent *balancerWrapper
+	balancerPending *balancerWrapper
+	closed          bool // set to true when this balancer is closed
+
+	// currentMu must be locked before mu. This mutex guards against this
+	// sequence of events: UpdateSubConnState() called, finds the
+	// balancerCurrent, gives up lock, updateState comes in, causes Close() on
+	// balancerCurrent before the UpdateSubConnState is called on the
+	// balancerCurrent.
+	currentMu sync.Mutex
+}
+
+// swap swaps out the current lb with the pending lb and updates the ClientConn.
+// The caller must hold gsb.mu.
+func (gsb *Balancer) swap() {
+	gsb.cc.UpdateState(gsb.balancerPending.lastState)
+	cur := gsb.balancerCurrent
+	gsb.balancerCurrent = gsb.balancerPending
+	gsb.balancerPending = nil
+	go func() {
+		gsb.currentMu.Lock()
+		defer gsb.currentMu.Unlock()
+		cur.Close()
+	}()
+}
+
+// Helper function that checks if the balancer passed in is current or pending.
+// The caller must hold gsb.mu.
+func (gsb *Balancer) balancerCurrentOrPending(bw *balancerWrapper) bool {
+	return bw == gsb.balancerCurrent || bw == gsb.balancerPending
+}
+
+// SwitchTo initializes the graceful switch process, which completes based on
+// connectivity state changes on the current/pending balancer. Thus, the switch
+// process is not complete when this method returns. This method must be called
+// synchronously alongside the rest of the balancer.Balancer methods this
+// Graceful Switch Balancer implements.
+func (gsb *Balancer) SwitchTo(builder balancer.Builder) error {
+	gsb.mu.Lock()
+	if gsb.closed {
+		gsb.mu.Unlock()
+		return errBalancerClosed
+	}
+	bw := &balancerWrapper{
+		gsb: gsb,
+		lastState: balancer.State{
+			ConnectivityState: connectivity.Connecting,
+			Picker:            base.NewErrPicker(balancer.ErrNoSubConnAvailable),
+		},
+		subconns: make(map[balancer.SubConn]bool),
+	}
+	balToClose := gsb.balancerPending // nil if there is no pending balancer
+	if gsb.balancerCurrent == nil {
+		gsb.balancerCurrent = bw
+	} else {
+		gsb.balancerPending = bw
+	}
+	gsb.mu.Unlock()
+	balToClose.Close()
+	// This function takes a builder instead of a balancer because builder.Build
+	// can call back inline, and this utility needs to handle the callbacks.
+	newBalancer := builder.Build(bw, gsb.bOpts)
+	if newBalancer == nil {
+		// This is illegal and should never happen; we clear the balancerWrapper
+		// we were constructing if it happens to avoid a potential panic.
+		gsb.mu.Lock()
+		if gsb.balancerPending != nil {
+			gsb.balancerPending = nil
+		} else {
+			gsb.balancerCurrent = nil
+		}
+		gsb.mu.Unlock()
+		return balancer.ErrBadResolverState
+	}
+
+	// This write doesn't need to take gsb.mu because this field never gets read
+	// or written to on any calls from the current or pending. Calls from grpc
+	// to this balancer are guaranteed to be called synchronously, so this
+	// bw.Balancer field will never be forwarded to until this SwitchTo()
+	// function returns.
+	bw.Balancer = newBalancer
+	return nil
+}
+
+// Returns nil if the graceful switch balancer is closed.
+func (gsb *Balancer) latestBalancer() *balancerWrapper {
+	gsb.mu.Lock()
+	defer gsb.mu.Unlock()
+	if gsb.balancerPending != nil {
+		return gsb.balancerPending
+	}
+	return gsb.balancerCurrent
+}
+
+// UpdateClientConnState forwards the update to the latest balancer created.
+func (gsb *Balancer) UpdateClientConnState(state balancer.ClientConnState) error {
+	// The resolver data is only relevant to the most recent LB Policy.
+	balToUpdate := gsb.latestBalancer()
+	if balToUpdate == nil {
+		return errBalancerClosed
+	}
+	// Perform this call without gsb.mu to prevent deadlocks if the child calls
+	// back into the channel. The latest balancer can never be closed during a
+	// call from the channel, even without gsb.mu held.
+	return balToUpdate.UpdateClientConnState(state)
+}
+
+// ResolverError forwards the error to the latest balancer created.
+func (gsb *Balancer) ResolverError(err error) {
+	// The resolver data is only relevant to the most recent LB Policy.
+	balToUpdate := gsb.latestBalancer()
+	if balToUpdate == nil {
+		return
+	}
+	// Perform this call without gsb.mu to prevent deadlocks if the child calls
+	// back into the channel. The latest balancer can never be closed during a
+	// call from the channel, even without gsb.mu held.
+	balToUpdate.ResolverError(err)
+}
+
+// ExitIdle forwards the call to the latest balancer created.
+//
+// If the latest balancer does not support ExitIdle, the subConns are
+// re-connected to manually.
+func (gsb *Balancer) ExitIdle() {
+	balToUpdate := gsb.latestBalancer()
+	if balToUpdate == nil {
+		return
+	}
+	// There is no need to protect this read with a mutex, as the write to the
+	// Balancer field happens in SwitchTo, which completes before this can be
+	// called.
+	if ei, ok := balToUpdate.Balancer.(balancer.ExitIdler); ok {
+		ei.ExitIdle()
+		return
+	}
+	gsb.mu.Lock()
+	defer gsb.mu.Unlock()
+	for sc := range balToUpdate.subconns {
+		sc.Connect()
+	}
+}
+
+// UpdateSubConnState forwards the update to the appropriate child.
+func (gsb *Balancer) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
+	gsb.currentMu.Lock()
+	defer gsb.currentMu.Unlock()
+	gsb.mu.Lock()
+	// Forward update to the appropriate child.  Even if there is a pending
+	// balancer, the current balancer should continue to get SubConn updates to
+	// maintain the proper state while the pending is still connecting.
+	var balToUpdate *balancerWrapper
+	if gsb.balancerCurrent != nil && gsb.balancerCurrent.subconns[sc] {
+		balToUpdate = gsb.balancerCurrent
+	} else if gsb.balancerPending != nil && gsb.balancerPending.subconns[sc] {
+		balToUpdate = gsb.balancerPending
+	}
+	gsb.mu.Unlock()
+	if balToUpdate == nil {
+		// SubConn belonged to a stale lb policy that has not yet fully closed,
+		// or the balancer was already closed.
+		return
+	}
+	balToUpdate.UpdateSubConnState(sc, state)
+}
+
+// Close closes any active child balancers.
+func (gsb *Balancer) Close() {
+	gsb.mu.Lock()
+	gsb.closed = true
+	currentBalancerToClose := gsb.balancerCurrent
+	gsb.balancerCurrent = nil
+	pendingBalancerToClose := gsb.balancerPending
+	gsb.balancerPending = nil
+	gsb.mu.Unlock()
+
+	currentBalancerToClose.Close()
+	pendingBalancerToClose.Close()
+}
+
+// balancerWrapper wraps a balancer.Balancer, and overrides some Balancer
+// methods to help cleanup SubConns created by the wrapped balancer.
+//
+// It implements the balancer.ClientConn interface and is passed down in that
+// capacity to the wrapped balancer. It maintains a set of subConns created by
+// the wrapped balancer and calls from the latter to create/update/remove
+// SubConns update this set before being forwarded to the parent ClientConn.
+// State updates from the wrapped balancer can result in invocation of the
+// graceful switch logic.
+type balancerWrapper struct {
+	balancer.Balancer
+	gsb *Balancer
+
+	lastState balancer.State
+	subconns  map[balancer.SubConn]bool // subconns created by this balancer
+}
+
+func (bw *balancerWrapper) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
+	if state.ConnectivityState == connectivity.Shutdown {
+		bw.gsb.mu.Lock()
+		delete(bw.subconns, sc)
+		bw.gsb.mu.Unlock()
+	}
+	// There is no need to protect this read with a mutex, as the write to the
+	// Balancer field happens in SwitchTo, which completes before this can be
+	// called.
+	bw.Balancer.UpdateSubConnState(sc, state)
+}
+
+// Close closes the underlying LB policy and removes the subconns it created. bw
+// must not be referenced via balancerCurrent or balancerPending in gsb when
+// called. gsb.mu must not be held.  Does not panic with a nil receiver.
+func (bw *balancerWrapper) Close() {
+	// before Close is called.
+	if bw == nil {
+		return
+	}
+	// There is no need to protect this read with a mutex, as Close() is
+	// impossible to be called concurrently with the write in SwitchTo(). The
+	// callsites of Close() for this balancer in Graceful Switch Balancer will
+	// never be called until SwitchTo() returns.
+	bw.Balancer.Close()
+	bw.gsb.mu.Lock()
+	for sc := range bw.subconns {
+		bw.gsb.cc.RemoveSubConn(sc)
+	}
+	bw.gsb.mu.Unlock()
+}
+
+func (bw *balancerWrapper) UpdateState(state balancer.State) {
+	// Hold the mutex for this entire call to ensure it cannot occur
+	// concurrently with other updateState() calls. This causes updates to
+	// lastState and calls to cc.UpdateState to happen atomically.
+	bw.gsb.mu.Lock()
+	defer bw.gsb.mu.Unlock()
+	bw.lastState = state
+
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		return
+	}
+
+	if bw == bw.gsb.balancerCurrent {
+		// In the case that the current balancer exits READY, and there is a pending
+		// balancer, you can forward the pending balancer's cached State up to
+		// ClientConn and swap the pending into the current. This is because there
+		// is no reason to gracefully switch from and keep using the old policy as
+		// the ClientConn is not connected to any backends.
+		if state.ConnectivityState != connectivity.Ready && bw.gsb.balancerPending != nil {
+			bw.gsb.swap()
+			return
+		}
+		// Even if there is a pending balancer waiting to be gracefully switched to,
+		// continue to forward current balancer updates to the Client Conn. Ignoring
+		// state + picker from the current would cause undefined behavior/cause the
+		// system to behave incorrectly from the current LB policies perspective.
+		// Also, the current LB is still being used by grpc to choose SubConns per
+		// RPC, and thus should use the most updated form of the current balancer.
+		bw.gsb.cc.UpdateState(state)
+		return
+	}
+	// This method is now dealing with a state update from the pending balancer.
+	// If the current balancer is currently in a state other than READY, the new
+	// policy can be swapped into place immediately. This is because there is no
+	// reason to gracefully switch from and keep using the old policy as the
+	// ClientConn is not connected to any backends.
+	if state.ConnectivityState != connectivity.Connecting || bw.gsb.balancerCurrent.lastState.ConnectivityState != connectivity.Ready {
+		bw.gsb.swap()
+	}
+}
+
+func (bw *balancerWrapper) NewSubConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (balancer.SubConn, error) {
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		bw.gsb.mu.Unlock()
+		return nil, fmt.Errorf("%T at address %p that called NewSubConn is deleted", bw, bw)
+	}
+	bw.gsb.mu.Unlock()
+
+	sc, err := bw.gsb.cc.NewSubConn(addrs, opts)
+	if err != nil {
+		return nil, err
+	}
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) { // balancer was closed during this call
+		bw.gsb.cc.RemoveSubConn(sc)
+		bw.gsb.mu.Unlock()
+		return nil, fmt.Errorf("%T at address %p that called NewSubConn is deleted", bw, bw)
+	}
+	bw.subconns[sc] = true
+	bw.gsb.mu.Unlock()
+	return sc, nil
+}
+
+func (bw *balancerWrapper) ResolveNow(opts resolver.ResolveNowOptions) {
+	// Ignore ResolveNow requests from anything other than the most recent
+	// balancer, because older balancers were already removed from the config.
+	if bw != bw.gsb.latestBalancer() {
+		return
+	}
+	bw.gsb.cc.ResolveNow(opts)
+}
+
+func (bw *balancerWrapper) RemoveSubConn(sc balancer.SubConn) {
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		bw.gsb.mu.Unlock()
+		return
+	}
+	bw.gsb.mu.Unlock()
+	bw.gsb.cc.RemoveSubConn(sc)
+}
+
+func (bw *balancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resolver.Address) {
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		bw.gsb.mu.Unlock()
+		return
+	}
+	bw.gsb.mu.Unlock()
+	bw.gsb.cc.UpdateAddresses(sc, addrs)
+}
+
+func (bw *balancerWrapper) Target() string {
+	return bw.gsb.cc.Target()
+}
diff --git a/vendor/google.golang.org/grpc/internal/balancergroup/balancergroup.go b/vendor/google.golang.org/grpc/internal/balancergroup/balancergroup.go
index 3142503a0ad5..3daad14473ee 100644
--- a/vendor/google.golang.org/grpc/internal/balancergroup/balancergroup.go
+++ b/vendor/google.golang.org/grpc/internal/balancergroup/balancergroup.go
@@ -25,6 +25,7 @@ import (
 
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/internal/balancer/gracefulswitch"
 	"google.golang.org/grpc/internal/cache"
 	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/resolver"
@@ -67,7 +68,7 @@ type subBalancerWrapper struct {
 	ccState *balancer.ClientConnState
 	// The dynamic part of sub-balancer. Only used when balancer group is
 	// started. Gets cleared when sub-balancer is closed.
-	balancer balancer.Balancer
+	balancer *gracefulswitch.Balancer
 }
 
 // UpdateState overrides balancer.ClientConn, to keep state and picker.
@@ -93,11 +94,13 @@ func (sbc *subBalancerWrapper) updateBalancerStateWithCachedPicker() {
 }
 
 func (sbc *subBalancerWrapper) startBalancer() {
-	b := sbc.builder.Build(sbc, sbc.buildOpts)
-	sbc.group.logger.Infof("Created child policy %p of type %v", b, sbc.builder.Name())
-	sbc.balancer = b
+	if sbc.balancer == nil {
+		sbc.balancer = gracefulswitch.NewBalancer(sbc, sbc.buildOpts)
+	}
+	sbc.group.logger.Infof("Creating child policy of type %v", sbc.builder.Name())
+	sbc.balancer.SwitchTo(sbc.builder)
 	if sbc.ccState != nil {
-		b.UpdateClientConnState(*sbc.ccState)
+		sbc.balancer.UpdateClientConnState(*sbc.ccState)
 	}
 }
 
@@ -108,11 +111,8 @@ func (sbc *subBalancerWrapper) exitIdle() (complete bool) {
 	if b == nil {
 		return true
 	}
-	if ei, ok := b.(balancer.ExitIdler); ok {
-		ei.ExitIdle()
-		return true
-	}
-	return false
+	b.ExitIdle()
+	return true
 }
 
 func (sbc *subBalancerWrapper) updateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
@@ -160,6 +160,20 @@ func (sbc *subBalancerWrapper) resolverError(err error) {
 	b.ResolverError(err)
 }
 
+func (sbc *subBalancerWrapper) gracefulSwitch(builder balancer.Builder) {
+	sbc.builder = builder
+	b := sbc.balancer
+	// Even if you get an add and it persists builder but doesn't start
+	// balancer, this would leave graceful switch being nil, in which we are
+	// correctly overwriting with the recent builder here as well to use later.
+	// The graceful switch balancer's presence is an invariant of whether the
+	// balancer group is closed or not (if closed, nil, if started, present).
+	if sbc.balancer != nil {
+		sbc.group.logger.Infof("Switching child policy %v to type %v", sbc.id, sbc.builder.Name())
+		b.SwitchTo(sbc.builder)
+	}
+}
+
 func (sbc *subBalancerWrapper) stopBalancer() {
 	sbc.balancer.Close()
 	sbc.balancer = nil
@@ -332,6 +346,23 @@ func (bg *BalancerGroup) Add(id string, builder balancer.Builder) {
 	bg.outgoingMu.Unlock()
 }
 
+// UpdateBuilder updates the builder for a current child, starting the Graceful
+// Switch process for that child.
+func (bg *BalancerGroup) UpdateBuilder(id string, builder balancer.Builder) {
+	bg.outgoingMu.Lock()
+	// This does not deal with the balancer cache because this call should come
+	// after an Add call for a given child balancer. If the child is removed,
+	// the caller will call Add if the child balancer comes back which would
+	// then deal with the balancer cache.
+	sbc := bg.idToBalancerConfig[id]
+	if sbc == nil {
+		// simply ignore it if not present, don't error
+		return
+	}
+	sbc.gracefulSwitch(builder)
+	bg.outgoingMu.Unlock()
+}
+
 // Remove removes the balancer with id from the group.
 //
 // But doesn't close the balancer. The balancer is kept in a cache, and will be
@@ -374,7 +405,6 @@ func (bg *BalancerGroup) cleanupSubConns(config *subBalancerWrapper) {
 	// sub-balancers.
 	for sc, b := range bg.scToSubBalancer {
 		if b == config {
-			bg.cc.RemoveSubConn(sc)
 			delete(bg.scToSubBalancer, sc)
 		}
 	}
diff --git a/vendor/google.golang.org/grpc/internal/balancergroup/balancerstateaggregator.go b/vendor/google.golang.org/grpc/internal/balancergroup/balancerstateaggregator.go
index 116394385059..816869555323 100644
--- a/vendor/google.golang.org/grpc/internal/balancergroup/balancerstateaggregator.go
+++ b/vendor/google.golang.org/grpc/internal/balancergroup/balancerstateaggregator.go
@@ -26,7 +26,7 @@ import (
 // state.
 //
 // It takes care of merging sub-picker into one picker. The picking config is
-// passed directly from the the parent to the aggregator implementation (instead
+// passed directly from the parent to the aggregator implementation (instead
 // via balancer group).
 type BalancerStateAggregator interface {
 	// UpdateState updates the state of the id.
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go b/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
index 5cc3aeddb213..809d73ccafb0 100644
--- a/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
+++ b/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
@@ -31,35 +31,42 @@ import (
 // Logger is the global binary logger. It can be used to get binary logger for
 // each method.
 type Logger interface {
-	getMethodLogger(methodName string) *MethodLogger
+	GetMethodLogger(methodName string) MethodLogger
 }
 
 // binLogger is the global binary logger for the binary. One of this should be
 // built at init time from the configuration (environment variable or flags).
 //
-// It is used to get a methodLogger for each individual method.
+// It is used to get a MethodLogger for each individual method.
 var binLogger Logger
 
 var grpclogLogger = grpclog.Component("binarylog")
 
-// SetLogger sets the binarg logger.
+// SetLogger sets the binary logger.
 //
 // Only call this at init time.
 func SetLogger(l Logger) {
 	binLogger = l
 }
 
-// GetMethodLogger returns the methodLogger for the given methodName.
+// GetLogger gets the binary logger.
+//
+// Only call this at init time.
+func GetLogger() Logger {
+	return binLogger
+}
+
+// GetMethodLogger returns the MethodLogger for the given methodName.
 //
 // methodName should be in the format of "/service/method".
 //
-// Each methodLogger returned by this method is a new instance. This is to
+// Each MethodLogger returned by this method is a new instance. This is to
 // generate sequence id within the call.
-func GetMethodLogger(methodName string) *MethodLogger {
+func GetMethodLogger(methodName string) MethodLogger {
 	if binLogger == nil {
 		return nil
 	}
-	return binLogger.getMethodLogger(methodName)
+	return binLogger.GetMethodLogger(methodName)
 }
 
 func init() {
@@ -68,17 +75,29 @@ func init() {
 	binLogger = NewLoggerFromConfigString(configStr)
 }
 
-type methodLoggerConfig struct {
+// MethodLoggerConfig contains the setting for logging behavior of a method
+// logger. Currently, it contains the max length of header and message.
+type MethodLoggerConfig struct {
 	// Max length of header and message.
-	hdr, msg uint64
+	Header, Message uint64
+}
+
+// LoggerConfig contains the config for loggers to create method loggers.
+type LoggerConfig struct {
+	All      *MethodLoggerConfig
+	Services map[string]*MethodLoggerConfig
+	Methods  map[string]*MethodLoggerConfig
+
+	Blacklist map[string]struct{}
 }
 
 type logger struct {
-	all      *methodLoggerConfig
-	services map[string]*methodLoggerConfig
-	methods  map[string]*methodLoggerConfig
+	config LoggerConfig
+}
 
-	blacklist map[string]struct{}
+// NewLoggerFromConfig builds a logger with the given LoggerConfig.
+func NewLoggerFromConfig(config LoggerConfig) Logger {
+	return &logger{config: config}
 }
 
 // newEmptyLogger creates an empty logger. The map fields need to be filled in
@@ -88,83 +107,83 @@ func newEmptyLogger() *logger {
 }
 
 // Set method logger for "*".
-func (l *logger) setDefaultMethodLogger(ml *methodLoggerConfig) error {
-	if l.all != nil {
+func (l *logger) setDefaultMethodLogger(ml *MethodLoggerConfig) error {
+	if l.config.All != nil {
 		return fmt.Errorf("conflicting global rules found")
 	}
-	l.all = ml
+	l.config.All = ml
 	return nil
 }
 
 // Set method logger for "service/*".
 //
-// New methodLogger with same service overrides the old one.
-func (l *logger) setServiceMethodLogger(service string, ml *methodLoggerConfig) error {
-	if _, ok := l.services[service]; ok {
+// New MethodLogger with same service overrides the old one.
+func (l *logger) setServiceMethodLogger(service string, ml *MethodLoggerConfig) error {
+	if _, ok := l.config.Services[service]; ok {
 		return fmt.Errorf("conflicting service rules for service %v found", service)
 	}
-	if l.services == nil {
-		l.services = make(map[string]*methodLoggerConfig)
+	if l.config.Services == nil {
+		l.config.Services = make(map[string]*MethodLoggerConfig)
 	}
-	l.services[service] = ml
+	l.config.Services[service] = ml
 	return nil
 }
 
 // Set method logger for "service/method".
 //
-// New methodLogger with same method overrides the old one.
-func (l *logger) setMethodMethodLogger(method string, ml *methodLoggerConfig) error {
-	if _, ok := l.blacklist[method]; ok {
+// New MethodLogger with same method overrides the old one.
+func (l *logger) setMethodMethodLogger(method string, ml *MethodLoggerConfig) error {
+	if _, ok := l.config.Blacklist[method]; ok {
 		return fmt.Errorf("conflicting blacklist rules for method %v found", method)
 	}
-	if _, ok := l.methods[method]; ok {
+	if _, ok := l.config.Methods[method]; ok {
 		return fmt.Errorf("conflicting method rules for method %v found", method)
 	}
-	if l.methods == nil {
-		l.methods = make(map[string]*methodLoggerConfig)
+	if l.config.Methods == nil {
+		l.config.Methods = make(map[string]*MethodLoggerConfig)
 	}
-	l.methods[method] = ml
+	l.config.Methods[method] = ml
 	return nil
 }
 
 // Set blacklist method for "-service/method".
 func (l *logger) setBlacklist(method string) error {
-	if _, ok := l.blacklist[method]; ok {
+	if _, ok := l.config.Blacklist[method]; ok {
 		return fmt.Errorf("conflicting blacklist rules for method %v found", method)
 	}
-	if _, ok := l.methods[method]; ok {
+	if _, ok := l.config.Methods[method]; ok {
 		return fmt.Errorf("conflicting method rules for method %v found", method)
 	}
-	if l.blacklist == nil {
-		l.blacklist = make(map[string]struct{})
+	if l.config.Blacklist == nil {
+		l.config.Blacklist = make(map[string]struct{})
 	}
-	l.blacklist[method] = struct{}{}
+	l.config.Blacklist[method] = struct{}{}
 	return nil
 }
 
-// getMethodLogger returns the methodLogger for the given methodName.
+// getMethodLogger returns the MethodLogger for the given methodName.
 //
 // methodName should be in the format of "/service/method".
 //
-// Each methodLogger returned by this method is a new instance. This is to
+// Each MethodLogger returned by this method is a new instance. This is to
 // generate sequence id within the call.
-func (l *logger) getMethodLogger(methodName string) *MethodLogger {
+func (l *logger) GetMethodLogger(methodName string) MethodLogger {
 	s, m, err := grpcutil.ParseMethod(methodName)
 	if err != nil {
 		grpclogLogger.Infof("binarylogging: failed to parse %q: %v", methodName, err)
 		return nil
 	}
-	if ml, ok := l.methods[s+"/"+m]; ok {
-		return newMethodLogger(ml.hdr, ml.msg)
+	if ml, ok := l.config.Methods[s+"/"+m]; ok {
+		return NewTruncatingMethodLogger(ml.Header, ml.Message)
 	}
-	if _, ok := l.blacklist[s+"/"+m]; ok {
+	if _, ok := l.config.Blacklist[s+"/"+m]; ok {
 		return nil
 	}
-	if ml, ok := l.services[s]; ok {
-		return newMethodLogger(ml.hdr, ml.msg)
+	if ml, ok := l.config.Services[s]; ok {
+		return NewTruncatingMethodLogger(ml.Header, ml.Message)
 	}
-	if l.all == nil {
+	if l.config.All == nil {
 		return nil
 	}
-	return newMethodLogger(l.all.hdr, l.all.msg)
+	return NewTruncatingMethodLogger(l.config.All.Header, l.config.All.Message)
 }
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/env_config.go b/vendor/google.golang.org/grpc/internal/binarylog/env_config.go
index d8f4e7602fde..c5579e65065f 100644
--- a/vendor/google.golang.org/grpc/internal/binarylog/env_config.go
+++ b/vendor/google.golang.org/grpc/internal/binarylog/env_config.go
@@ -57,7 +57,7 @@ func NewLoggerFromConfigString(s string) Logger {
 	return l
 }
 
-// fillMethodLoggerWithConfigString parses config, creates methodLogger and adds
+// fillMethodLoggerWithConfigString parses config, creates TruncatingMethodLogger and adds
 // it to the right map in the logger.
 func (l *logger) fillMethodLoggerWithConfigString(config string) error {
 	// "" is invalid.
@@ -89,7 +89,7 @@ func (l *logger) fillMethodLoggerWithConfigString(config string) error {
 		if err != nil {
 			return fmt.Errorf("invalid config: %q, %v", config, err)
 		}
-		if err := l.setDefaultMethodLogger(&methodLoggerConfig{hdr: hdr, msg: msg}); err != nil {
+		if err := l.setDefaultMethodLogger(&MethodLoggerConfig{Header: hdr, Message: msg}); err != nil {
 			return fmt.Errorf("invalid config: %v", err)
 		}
 		return nil
@@ -104,11 +104,11 @@ func (l *logger) fillMethodLoggerWithConfigString(config string) error {
 		return fmt.Errorf("invalid header/message length config: %q, %v", suffix, err)
 	}
 	if m == "*" {
-		if err := l.setServiceMethodLogger(s, &methodLoggerConfig{hdr: hdr, msg: msg}); err != nil {
+		if err := l.setServiceMethodLogger(s, &MethodLoggerConfig{Header: hdr, Message: msg}); err != nil {
 			return fmt.Errorf("invalid config: %v", err)
 		}
 	} else {
-		if err := l.setMethodMethodLogger(s+"/"+m, &methodLoggerConfig{hdr: hdr, msg: msg}); err != nil {
+		if err := l.setMethodMethodLogger(s+"/"+m, &MethodLoggerConfig{Header: hdr, Message: msg}); err != nil {
 			return fmt.Errorf("invalid config: %v", err)
 		}
 	}
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go b/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
index 0cdb41831509..179f4a26d135 100644
--- a/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
+++ b/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
@@ -48,7 +48,13 @@ func (g *callIDGenerator) reset() {
 var idGen callIDGenerator
 
 // MethodLogger is the sub-logger for each method.
-type MethodLogger struct {
+type MethodLogger interface {
+	Log(LogEntryConfig)
+}
+
+// TruncatingMethodLogger is a method logger that truncates headers and messages
+// based on configured fields.
+type TruncatingMethodLogger struct {
 	headerMaxLen, messageMaxLen uint64
 
 	callID          uint64
@@ -57,8 +63,9 @@ type MethodLogger struct {
 	sink Sink // TODO(blog): make this plugable.
 }
 
-func newMethodLogger(h, m uint64) *MethodLogger {
-	return &MethodLogger{
+// NewTruncatingMethodLogger returns a new truncating method logger.
+func NewTruncatingMethodLogger(h, m uint64) *TruncatingMethodLogger {
+	return &TruncatingMethodLogger{
 		headerMaxLen:  h,
 		messageMaxLen: m,
 
@@ -69,8 +76,10 @@ func newMethodLogger(h, m uint64) *MethodLogger {
 	}
 }
 
-// Log creates a proto binary log entry, and logs it to the sink.
-func (ml *MethodLogger) Log(c LogEntryConfig) {
+// Build is an internal only method for building the proto message out of the
+// input event. It's made public to enable other library to reuse as much logic
+// in TruncatingMethodLogger as possible.
+func (ml *TruncatingMethodLogger) Build(c LogEntryConfig) *pb.GrpcLogEntry {
 	m := c.toProto()
 	timestamp, _ := ptypes.TimestampProto(time.Now())
 	m.Timestamp = timestamp
@@ -85,11 +94,15 @@ func (ml *MethodLogger) Log(c LogEntryConfig) {
 	case *pb.GrpcLogEntry_Message:
 		m.PayloadTruncated = ml.truncateMessage(pay.Message)
 	}
+	return m
+}
 
-	ml.sink.Write(m)
+// Log creates a proto binary log entry, and logs it to the sink.
+func (ml *TruncatingMethodLogger) Log(c LogEntryConfig) {
+	ml.sink.Write(ml.Build(c))
 }
 
-func (ml *MethodLogger) truncateMetadata(mdPb *pb.Metadata) (truncated bool) {
+func (ml *TruncatingMethodLogger) truncateMetadata(mdPb *pb.Metadata) (truncated bool) {
 	if ml.headerMaxLen == maxUInt {
 		return false
 	}
@@ -119,7 +132,7 @@ func (ml *MethodLogger) truncateMetadata(mdPb *pb.Metadata) (truncated bool) {
 	return truncated
 }
 
-func (ml *MethodLogger) truncateMessage(msgPb *pb.Message) (truncated bool) {
+func (ml *TruncatingMethodLogger) truncateMessage(msgPb *pb.Message) (truncated bool) {
 	if ml.messageMaxLen == maxUInt {
 		return false
 	}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/funcs.go b/vendor/google.golang.org/grpc/internal/channelz/funcs.go
index ea660a147cf9..777cbcd7921d 100644
--- a/vendor/google.golang.org/grpc/internal/channelz/funcs.go
+++ b/vendor/google.golang.org/grpc/internal/channelz/funcs.go
@@ -25,6 +25,7 @@ package channelz
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"sync"
@@ -184,54 +185,77 @@ func GetServer(id int64) *ServerMetric {
 	return db.get().GetServer(id)
 }
 
-// RegisterChannel registers the given channel c in channelz database with ref
-// as its reference name, and add it to the child list of its parent (identified
-// by pid). pid = 0 means no parent. It returns the unique channelz tracking id
-// assigned to this channel.
-func RegisterChannel(c Channel, pid int64, ref string) int64 {
+// RegisterChannel registers the given channel c in the channelz database with
+// ref as its reference name, and adds it to the child list of its parent
+// (identified by pid). pid == nil means no parent.
+//
+// Returns a unique channelz identifier assigned to this channel.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterChannel(c Channel, pid *Identifier, ref string) *Identifier {
 	id := idGen.genID()
+	var parent int64
+	isTopChannel := true
+	if pid != nil {
+		isTopChannel = false
+		parent = pid.Int()
+	}
+
+	if !IsOn() {
+		return newIdentifer(RefChannel, id, pid)
+	}
+
 	cn := &channel{
 		refName:     ref,
 		c:           c,
 		subChans:    make(map[int64]string),
 		nestedChans: make(map[int64]string),
 		id:          id,
-		pid:         pid,
+		pid:         parent,
 		trace:       &channelTrace{createdTime: time.Now(), events: make([]*TraceEvent, 0, getMaxTraceEntry())},
 	}
-	if pid == 0 {
-		db.get().addChannel(id, cn, true, pid)
-	} else {
-		db.get().addChannel(id, cn, false, pid)
-	}
-	return id
+	db.get().addChannel(id, cn, isTopChannel, parent)
+	return newIdentifer(RefChannel, id, pid)
 }
 
-// RegisterSubChannel registers the given channel c in channelz database with ref
-// as its reference name, and add it to the child list of its parent (identified
-// by pid). It returns the unique channelz tracking id assigned to this subchannel.
-func RegisterSubChannel(c Channel, pid int64, ref string) int64 {
-	if pid == 0 {
-		logger.Error("a SubChannel's parent id cannot be 0")
-		return 0
+// RegisterSubChannel registers the given subChannel c in the channelz database
+// with ref as its reference name, and adds it to the child list of its parent
+// (identified by pid).
+//
+// Returns a unique channelz identifier assigned to this subChannel.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterSubChannel(c Channel, pid *Identifier, ref string) (*Identifier, error) {
+	if pid == nil {
+		return nil, errors.New("a SubChannel's parent id cannot be nil")
 	}
 	id := idGen.genID()
+	if !IsOn() {
+		return newIdentifer(RefSubChannel, id, pid), nil
+	}
+
 	sc := &subChannel{
 		refName: ref,
 		c:       c,
 		sockets: make(map[int64]string),
 		id:      id,
-		pid:     pid,
+		pid:     pid.Int(),
 		trace:   &channelTrace{createdTime: time.Now(), events: make([]*TraceEvent, 0, getMaxTraceEntry())},
 	}
-	db.get().addSubChannel(id, sc, pid)
-	return id
+	db.get().addSubChannel(id, sc, pid.Int())
+	return newIdentifer(RefSubChannel, id, pid), nil
 }
 
 // RegisterServer registers the given server s in channelz database. It returns
 // the unique channelz tracking id assigned to this server.
-func RegisterServer(s Server, ref string) int64 {
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterServer(s Server, ref string) *Identifier {
 	id := idGen.genID()
+	if !IsOn() {
+		return newIdentifer(RefServer, id, nil)
+	}
+
 	svr := &server{
 		refName:       ref,
 		s:             s,
@@ -240,71 +264,92 @@ func RegisterServer(s Server, ref string) int64 {
 		id:            id,
 	}
 	db.get().addServer(id, svr)
-	return id
+	return newIdentifer(RefServer, id, nil)
 }
 
 // RegisterListenSocket registers the given listen socket s in channelz database
 // with ref as its reference name, and add it to the child list of its parent
 // (identified by pid). It returns the unique channelz tracking id assigned to
 // this listen socket.
-func RegisterListenSocket(s Socket, pid int64, ref string) int64 {
-	if pid == 0 {
-		logger.Error("a ListenSocket's parent id cannot be 0")
-		return 0
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterListenSocket(s Socket, pid *Identifier, ref string) (*Identifier, error) {
+	if pid == nil {
+		return nil, errors.New("a ListenSocket's parent id cannot be 0")
 	}
 	id := idGen.genID()
-	ls := &listenSocket{refName: ref, s: s, id: id, pid: pid}
-	db.get().addListenSocket(id, ls, pid)
-	return id
+	if !IsOn() {
+		return newIdentifer(RefListenSocket, id, pid), nil
+	}
+
+	ls := &listenSocket{refName: ref, s: s, id: id, pid: pid.Int()}
+	db.get().addListenSocket(id, ls, pid.Int())
+	return newIdentifer(RefListenSocket, id, pid), nil
 }
 
 // RegisterNormalSocket registers the given normal socket s in channelz database
-// with ref as its reference name, and add it to the child list of its parent
+// with ref as its reference name, and adds it to the child list of its parent
 // (identified by pid). It returns the unique channelz tracking id assigned to
 // this normal socket.
-func RegisterNormalSocket(s Socket, pid int64, ref string) int64 {
-	if pid == 0 {
-		logger.Error("a NormalSocket's parent id cannot be 0")
-		return 0
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterNormalSocket(s Socket, pid *Identifier, ref string) (*Identifier, error) {
+	if pid == nil {
+		return nil, errors.New("a NormalSocket's parent id cannot be 0")
 	}
 	id := idGen.genID()
-	ns := &normalSocket{refName: ref, s: s, id: id, pid: pid}
-	db.get().addNormalSocket(id, ns, pid)
-	return id
+	if !IsOn() {
+		return newIdentifer(RefNormalSocket, id, pid), nil
+	}
+
+	ns := &normalSocket{refName: ref, s: s, id: id, pid: pid.Int()}
+	db.get().addNormalSocket(id, ns, pid.Int())
+	return newIdentifer(RefNormalSocket, id, pid), nil
 }
 
 // RemoveEntry removes an entry with unique channelz tracking id to be id from
 // channelz database.
-func RemoveEntry(id int64) {
-	db.get().removeEntry(id)
+//
+// If channelz is not turned ON, this function is a no-op.
+func RemoveEntry(id *Identifier) {
+	if !IsOn() {
+		return
+	}
+	db.get().removeEntry(id.Int())
 }
 
-// TraceEventDesc is what the caller of AddTraceEvent should provide to describe the event to be added
-// to the channel trace.
-// The Parent field is optional. It is used for event that will be recorded in the entity's parent
-// trace also.
+// TraceEventDesc is what the caller of AddTraceEvent should provide to describe
+// the event to be added to the channel trace.
+//
+// The Parent field is optional. It is used for an event that will be recorded
+// in the entity's parent trace.
 type TraceEventDesc struct {
 	Desc     string
 	Severity Severity
 	Parent   *TraceEventDesc
 }
 
-// AddTraceEvent adds trace related to the entity with specified id, using the provided TraceEventDesc.
-func AddTraceEvent(l grpclog.DepthLoggerV2, id int64, depth int, desc *TraceEventDesc) {
-	for d := desc; d != nil; d = d.Parent {
-		switch d.Severity {
-		case CtUnknown, CtInfo:
-			l.InfoDepth(depth+1, d.Desc)
-		case CtWarning:
-			l.WarningDepth(depth+1, d.Desc)
-		case CtError:
-			l.ErrorDepth(depth+1, d.Desc)
-		}
+// AddTraceEvent adds trace related to the entity with specified id, using the
+// provided TraceEventDesc.
+//
+// If channelz is not turned ON, this will simply log the event descriptions.
+func AddTraceEvent(l grpclog.DepthLoggerV2, id *Identifier, depth int, desc *TraceEventDesc) {
+	// Log only the trace description associated with the bottom most entity.
+	switch desc.Severity {
+	case CtUnknown, CtInfo:
+		l.InfoDepth(depth+1, withParens(id)+desc.Desc)
+	case CtWarning:
+		l.WarningDepth(depth+1, withParens(id)+desc.Desc)
+	case CtError:
+		l.ErrorDepth(depth+1, withParens(id)+desc.Desc)
 	}
+
 	if getMaxTraceEntry() == 0 {
 		return
 	}
-	db.get().traceEvent(id, desc)
+	if IsOn() {
+		db.get().traceEvent(id.Int(), desc)
+	}
 }
 
 // channelMap is the storage data structure for channelz.
diff --git a/vendor/google.golang.org/grpc/internal/channelz/id.go b/vendor/google.golang.org/grpc/internal/channelz/id.go
new file mode 100644
index 000000000000..c9a27acd3710
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/id.go
@@ -0,0 +1,75 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import "fmt"
+
+// Identifier is an opaque identifier which uniquely identifies an entity in the
+// channelz database.
+type Identifier struct {
+	typ RefChannelType
+	id  int64
+	str string
+	pid *Identifier
+}
+
+// Type returns the entity type corresponding to id.
+func (id *Identifier) Type() RefChannelType {
+	return id.typ
+}
+
+// Int returns the integer identifier corresponding to id.
+func (id *Identifier) Int() int64 {
+	return id.id
+}
+
+// String returns a string representation of the entity corresponding to id.
+//
+// This includes some information about the parent as well. Examples:
+// Top-level channel: [Channel #channel-number]
+// Nested channel:    [Channel #parent-channel-number Channel #channel-number]
+// Sub channel:       [Channel #parent-channel SubChannel #subchannel-number]
+func (id *Identifier) String() string {
+	return id.str
+}
+
+// Equal returns true if other is the same as id.
+func (id *Identifier) Equal(other *Identifier) bool {
+	if (id != nil) != (other != nil) {
+		return false
+	}
+	if id == nil && other == nil {
+		return true
+	}
+	return id.typ == other.typ && id.id == other.id && id.pid == other.pid
+}
+
+// NewIdentifierForTesting returns a new opaque identifier to be used only for
+// testing purposes.
+func NewIdentifierForTesting(typ RefChannelType, id int64, pid *Identifier) *Identifier {
+	return newIdentifer(typ, id, pid)
+}
+
+func newIdentifer(typ RefChannelType, id int64, pid *Identifier) *Identifier {
+	str := fmt.Sprintf("%s #%d", typ, id)
+	if pid != nil {
+		str = fmt.Sprintf("%s %s", pid, str)
+	}
+	return &Identifier{typ: typ, id: id, str: str, pid: pid}
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/logging.go b/vendor/google.golang.org/grpc/internal/channelz/logging.go
index b0013f9c8865..8e13a3d2ce7b 100644
--- a/vendor/google.golang.org/grpc/internal/channelz/logging.go
+++ b/vendor/google.golang.org/grpc/internal/channelz/logging.go
@@ -26,77 +26,54 @@ import (
 
 var logger = grpclog.Component("channelz")
 
+func withParens(id *Identifier) string {
+	return "[" + id.String() + "] "
+}
+
 // Info logs and adds a trace event if channelz is on.
-func Info(l grpclog.DepthLoggerV2, id int64, args ...interface{}) {
-	if IsOn() {
-		AddTraceEvent(l, id, 1, &TraceEventDesc{
-			Desc:     fmt.Sprint(args...),
-			Severity: CtInfo,
-		})
-	} else {
-		l.InfoDepth(1, args...)
-	}
+func Info(l grpclog.DepthLoggerV2, id *Identifier, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprint(args...),
+		Severity: CtInfo,
+	})
 }
 
 // Infof logs and adds a trace event if channelz is on.
-func Infof(l grpclog.DepthLoggerV2, id int64, format string, args ...interface{}) {
-	msg := fmt.Sprintf(format, args...)
-	if IsOn() {
-		AddTraceEvent(l, id, 1, &TraceEventDesc{
-			Desc:     msg,
-			Severity: CtInfo,
-		})
-	} else {
-		l.InfoDepth(1, msg)
-	}
+func Infof(l grpclog.DepthLoggerV2, id *Identifier, format string, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprintf(format, args...),
+		Severity: CtInfo,
+	})
 }
 
 // Warning logs and adds a trace event if channelz is on.
-func Warning(l grpclog.DepthLoggerV2, id int64, args ...interface{}) {
-	if IsOn() {
-		AddTraceEvent(l, id, 1, &TraceEventDesc{
-			Desc:     fmt.Sprint(args...),
-			Severity: CtWarning,
-		})
-	} else {
-		l.WarningDepth(1, args...)
-	}
+func Warning(l grpclog.DepthLoggerV2, id *Identifier, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprint(args...),
+		Severity: CtWarning,
+	})
 }
 
 // Warningf logs and adds a trace event if channelz is on.
-func Warningf(l grpclog.DepthLoggerV2, id int64, format string, args ...interface{}) {
-	msg := fmt.Sprintf(format, args...)
-	if IsOn() {
-		AddTraceEvent(l, id, 1, &TraceEventDesc{
-			Desc:     msg,
-			Severity: CtWarning,
-		})
-	} else {
-		l.WarningDepth(1, msg)
-	}
+func Warningf(l grpclog.DepthLoggerV2, id *Identifier, format string, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprintf(format, args...),
+		Severity: CtWarning,
+	})
 }
 
 // Error logs and adds a trace event if channelz is on.
-func Error(l grpclog.DepthLoggerV2, id int64, args ...interface{}) {
-	if IsOn() {
-		AddTraceEvent(l, id, 1, &TraceEventDesc{
-			Desc:     fmt.Sprint(args...),
-			Severity: CtError,
-		})
-	} else {
-		l.ErrorDepth(1, args...)
-	}
+func Error(l grpclog.DepthLoggerV2, id *Identifier, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprint(args...),
+		Severity: CtError,
+	})
 }
 
 // Errorf logs and adds a trace event if channelz is on.
-func Errorf(l grpclog.DepthLoggerV2, id int64, format string, args ...interface{}) {
-	msg := fmt.Sprintf(format, args...)
-	if IsOn() {
-		AddTraceEvent(l, id, 1, &TraceEventDesc{
-			Desc:     msg,
-			Severity: CtError,
-		})
-	} else {
-		l.ErrorDepth(1, msg)
-	}
+func Errorf(l grpclog.DepthLoggerV2, id *Identifier, format string, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprintf(format, args...),
+		Severity: CtError,
+	})
 }
diff --git a/vendor/google.golang.org/grpc/internal/channelz/types.go b/vendor/google.golang.org/grpc/internal/channelz/types.go
index 3c595d154bd3..ad0ce4dabf06 100644
--- a/vendor/google.golang.org/grpc/internal/channelz/types.go
+++ b/vendor/google.golang.org/grpc/internal/channelz/types.go
@@ -686,12 +686,33 @@ const (
 type RefChannelType int
 
 const (
+	// RefUnknown indicates an unknown entity type, the zero value for this type.
+	RefUnknown RefChannelType = iota
 	// RefChannel indicates the referenced entity is a Channel.
-	RefChannel RefChannelType = iota
+	RefChannel
 	// RefSubChannel indicates the referenced entity is a SubChannel.
 	RefSubChannel
+	// RefServer indicates the referenced entity is a Server.
+	RefServer
+	// RefListenSocket indicates the referenced entity is a ListenSocket.
+	RefListenSocket
+	// RefNormalSocket indicates the referenced entity is a NormalSocket.
+	RefNormalSocket
 )
 
+var refChannelTypeToString = map[RefChannelType]string{
+	RefUnknown:      "Unknown",
+	RefChannel:      "Channel",
+	RefSubChannel:   "SubChannel",
+	RefServer:       "Server",
+	RefListenSocket: "ListenSocket",
+	RefNormalSocket: "NormalSocket",
+}
+
+func (r RefChannelType) String() string {
+	return refChannelTypeToString[r]
+}
+
 func (c *channelTrace) dumpData() *ChannelTrace {
 	c.mu.Lock()
 	ct := &ChannelTrace{EventNum: c.eventCount, CreationTime: c.createdTime}
diff --git a/vendor/google.golang.org/grpc/internal/envconfig/observability.go b/vendor/google.golang.org/grpc/internal/envconfig/observability.go
new file mode 100644
index 000000000000..821dd0a7c198
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/envconfig/observability.go
@@ -0,0 +1,36 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package envconfig
+
+import "os"
+
+const (
+	envObservabilityConfig     = "GRPC_GCP_OBSERVABILITY_CONFIG"
+	envObservabilityConfigFile = "GRPC_GCP_OBSERVABILITY_CONFIG_FILE"
+)
+
+var (
+	// ObservabilityConfig is the json configuration for the gcp/observability
+	// package specified directly in the envObservabilityConfig env var.
+	ObservabilityConfig = os.Getenv(envObservabilityConfig)
+	// ObservabilityConfigFile is the json configuration for the
+	// gcp/observability specified in a file with the location specified in
+	// envObservabilityConfigFile env var.
+	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)
+)
diff --git a/vendor/google.golang.org/grpc/internal/envconfig/xds.go b/vendor/google.golang.org/grpc/internal/envconfig/xds.go
index 7d996e51b5c1..af09711a3e88 100644
--- a/vendor/google.golang.org/grpc/internal/envconfig/xds.go
+++ b/vendor/google.golang.org/grpc/internal/envconfig/xds.go
@@ -77,16 +77,16 @@ var (
 	// environment variable
 	// "GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER" to
 	// "true".
-	XDSAggregateAndDNS = strings.EqualFold(os.Getenv(aggregateAndDNSSupportEnv), "true")
+	XDSAggregateAndDNS = !strings.EqualFold(os.Getenv(aggregateAndDNSSupportEnv), "false")
 
 	// XDSRBAC indicates whether xDS configured RBAC HTTP Filter is enabled,
 	// which can be disabled by setting the environment variable
 	// "GRPC_XDS_EXPERIMENTAL_RBAC" to "false".
 	XDSRBAC = !strings.EqualFold(os.Getenv(rbacSupportEnv), "false")
 	// XDSOutlierDetection indicates whether outlier detection support is
-	// enabled, which can be enabled by setting the environment variable
-	// "GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION" to "true".
-	XDSOutlierDetection = strings.EqualFold(os.Getenv(outlierDetectionSupportEnv), "true")
+	// enabled, which can be disabled by setting the environment variable
+	// "GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION" to "false".
+	XDSOutlierDetection = !strings.EqualFold(os.Getenv(outlierDetectionSupportEnv), "false")
 	// XDSFederation indicates whether federation support is enabled.
 	XDSFederation = strings.EqualFold(os.Getenv(federationEnv), "true")
 
diff --git a/vendor/google.golang.org/grpc/internal/googlecloud/googlecloud.go b/vendor/google.golang.org/grpc/internal/googlecloud/googlecloud.go
index d6c9e03fc4c8..6717b757f80d 100644
--- a/vendor/google.golang.org/grpc/internal/googlecloud/googlecloud.go
+++ b/vendor/google.golang.org/grpc/internal/googlecloud/googlecloud.go
@@ -20,13 +20,6 @@
 package googlecloud
 
 import (
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"regexp"
 	"runtime"
 	"strings"
 	"sync"
@@ -35,43 +28,9 @@ import (
 	internalgrpclog "google.golang.org/grpc/internal/grpclog"
 )
 
-const (
-	linuxProductNameFile     = "/sys/class/dmi/id/product_name"
-	windowsCheckCommand      = "powershell.exe"
-	windowsCheckCommandArgs  = "Get-WmiObject -Class Win32_BIOS"
-	powershellOutputFilter   = "Manufacturer"
-	windowsManufacturerRegex = ":(.*)"
-
-	logPrefix = "[googlecloud]"
-)
+const logPrefix = "[googlecloud]"
 
 var (
-	// The following two variables will be reassigned in tests.
-	runningOS          = runtime.GOOS
-	manufacturerReader = func() (io.Reader, error) {
-		switch runningOS {
-		case "linux":
-			return os.Open(linuxProductNameFile)
-		case "windows":
-			cmd := exec.Command(windowsCheckCommand, windowsCheckCommandArgs)
-			out, err := cmd.Output()
-			if err != nil {
-				return nil, err
-			}
-			for _, line := range strings.Split(strings.TrimSuffix(string(out), "\n"), "\n") {
-				if strings.HasPrefix(line, powershellOutputFilter) {
-					re := regexp.MustCompile(windowsManufacturerRegex)
-					name := re.FindString(line)
-					name = strings.TrimLeft(name, ":")
-					return strings.NewReader(name), nil
-				}
-			}
-			return nil, errors.New("cannot determine the machine's manufacturer")
-		default:
-			return nil, fmt.Errorf("%s is not supported", runningOS)
-		}
-	}
-
 	vmOnGCEOnce sync.Once
 	vmOnGCE     bool
 
@@ -84,21 +43,21 @@ var (
 // package. We keep this to avoid depending on the cloud library module.
 func OnGCE() bool {
 	vmOnGCEOnce.Do(func() {
-		vmOnGCE = isRunningOnGCE()
+		mf, err := manufacturer()
+		if err != nil {
+			logger.Infof("failed to read manufacturer, setting onGCE=false: %v")
+			return
+		}
+		vmOnGCE = isRunningOnGCE(mf, runtime.GOOS)
 	})
 	return vmOnGCE
 }
 
-// isRunningOnGCE checks whether the local system, without doing a network request is
+// isRunningOnGCE checks whether the local system, without doing a network request, is
 // running on GCP.
-func isRunningOnGCE() bool {
-	manufacturer, err := readManufacturer()
-	if err != nil {
-		logger.Infof("failed to read manufacturer %v, returning OnGCE=false", err)
-		return false
-	}
+func isRunningOnGCE(manufacturer []byte, goos string) bool {
 	name := string(manufacturer)
-	switch runningOS {
+	switch goos {
 	case "linux":
 		name = strings.TrimSpace(name)
 		return name == "Google" || name == "Google Compute Engine"
@@ -111,18 +70,3 @@ func isRunningOnGCE() bool {
 		return false
 	}
 }
-
-func readManufacturer() ([]byte, error) {
-	reader, err := manufacturerReader()
-	if err != nil {
-		return nil, err
-	}
-	if reader == nil {
-		return nil, errors.New("got nil reader")
-	}
-	manufacturer, err := ioutil.ReadAll(reader)
-	if err != nil {
-		return nil, fmt.Errorf("failed reading %v: %v", linuxProductNameFile, err)
-	}
-	return manufacturer, nil
-}
diff --git a/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer.go b/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer.go
new file mode 100644
index 000000000000..ffa0f1ddee5d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer.go
@@ -0,0 +1,26 @@
+//go:build !(linux || windows)
+// +build !linux,!windows
+
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package googlecloud
+
+func manufacturer() ([]byte, error) {
+	return nil, nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer_linux.go b/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer_linux.go
new file mode 100644
index 000000000000..e53b8ffc837f
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer_linux.go
@@ -0,0 +1,27 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package googlecloud
+
+import "io/ioutil"
+
+const linuxProductNameFile = "/sys/class/dmi/id/product_name"
+
+func manufacturer() ([]byte, error) {
+	return ioutil.ReadFile(linuxProductNameFile)
+}
diff --git a/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer_windows.go b/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer_windows.go
new file mode 100644
index 000000000000..2d7aaaaa70fe
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/googlecloud/manufacturer_windows.go
@@ -0,0 +1,50 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package googlecloud
+
+import (
+	"errors"
+	"os/exec"
+	"regexp"
+	"strings"
+)
+
+const (
+	windowsCheckCommand      = "powershell.exe"
+	windowsCheckCommandArgs  = "Get-WmiObject -Class Win32_BIOS"
+	powershellOutputFilter   = "Manufacturer"
+	windowsManufacturerRegex = ":(.*)"
+)
+
+func manufacturer() ([]byte, error) {
+	cmd := exec.Command(windowsCheckCommand, windowsCheckCommandArgs)
+	out, err := cmd.Output()
+	if err != nil {
+		return nil, err
+	}
+	for _, line := range strings.Split(strings.TrimSuffix(string(out), "\n"), "\n") {
+		if strings.HasPrefix(line, powershellOutputFilter) {
+			re := regexp.MustCompile(windowsManufacturerRegex)
+			name := re.FindString(line)
+			name = strings.TrimLeft(name, ":")
+			return []byte(name), nil
+		}
+	}
+	return nil, errors.New("cannot determine the machine's manufacturer")
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go b/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
index 740f83c2b766..517ea70642a1 100644
--- a/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
+++ b/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
@@ -52,6 +52,13 @@ func Intn(n int) int {
 	return r.Intn(n)
 }
 
+// Int31n implements rand.Int31n on the grpcrand global source.
+func Int31n(n int32) int32 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Int31n(n)
+}
+
 // Float64 implements rand.Float64 on the grpcrand global source.
 func Float64() float64 {
 	mu.Lock()
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/method.go b/vendor/google.golang.org/grpc/internal/grpcutil/method.go
index 4e7475060c1c..e9c4af64830c 100644
--- a/vendor/google.golang.org/grpc/internal/grpcutil/method.go
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/method.go
@@ -39,6 +39,11 @@ func ParseMethod(methodName string) (service, method string, _ error) {
 	return methodName[:pos], methodName[pos+1:], nil
 }
 
+// baseContentType is the base content-type for gRPC.  This is a valid
+// content-type on it's own, but can also include a content-subtype such as
+// "proto" as a suffix after "+" or ";".  See
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests
+// for more details.
 const baseContentType = "application/grpc"
 
 // ContentSubtype returns the content-subtype for the given content-type.  The
diff --git a/vendor/google.golang.org/grpc/internal/internal.go b/vendor/google.golang.org/grpc/internal/internal.go
index 20fb880f344f..fd0ee3dcaf1e 100644
--- a/vendor/google.golang.org/grpc/internal/internal.go
+++ b/vendor/google.golang.org/grpc/internal/internal.go
@@ -63,6 +63,70 @@ var (
 	// xDS-enabled server invokes this method on a grpc.Server when a particular
 	// listener moves to "not-serving" mode.
 	DrainServerTransports interface{} // func(*grpc.Server, string)
+	// AddGlobalServerOptions adds an array of ServerOption that will be
+	// effective globally for newly created servers. The priority will be: 1.
+	// user-provided; 2. this method; 3. default values.
+	AddGlobalServerOptions interface{} // func(opt ...ServerOption)
+	// ClearGlobalServerOptions clears the array of extra ServerOption. This
+	// method is useful in testing and benchmarking.
+	ClearGlobalServerOptions func()
+	// AddGlobalDialOptions adds an array of DialOption that will be effective
+	// globally for newly created client channels. The priority will be: 1.
+	// user-provided; 2. this method; 3. default values.
+	AddGlobalDialOptions interface{} // func(opt ...DialOption)
+	// ClearGlobalDialOptions clears the array of extra DialOption. This
+	// method is useful in testing and benchmarking.
+	ClearGlobalDialOptions func()
+	// JoinServerOptions combines the server options passed as arguments into a
+	// single server option.
+	JoinServerOptions interface{} // func(...grpc.ServerOption) grpc.ServerOption
+
+	// WithBinaryLogger returns a DialOption that specifies the binary logger
+	// for a ClientConn.
+	WithBinaryLogger interface{} // func(binarylog.Logger) grpc.DialOption
+	// BinaryLogger returns a ServerOption that can set the binary logger for a
+	// server.
+	BinaryLogger interface{} // func(binarylog.Logger) grpc.ServerOption
+
+	// NewXDSResolverWithConfigForTesting creates a new xds resolver builder using
+	// the provided xds bootstrap config instead of the global configuration from
+	// the supported environment variables.  The resolver.Builder is meant to be
+	// used in conjunction with the grpc.WithResolvers DialOption.
+	//
+	// Testing Only
+	//
+	// This function should ONLY be used for testing and may not work with some
+	// other features, including the CSDS service.
+	NewXDSResolverWithConfigForTesting interface{} // func([]byte) (resolver.Builder, error)
+
+	// RegisterRLSClusterSpecifierPluginForTesting registers the RLS Cluster
+	// Specifier Plugin for testing purposes, regardless of the XDSRLS environment
+	// variable.
+	//
+	// TODO: Remove this function once the RLS env var is removed.
+	RegisterRLSClusterSpecifierPluginForTesting func()
+
+	// UnregisterRLSClusterSpecifierPluginForTesting unregisters the RLS Cluster
+	// Specifier Plugin for testing purposes. This is needed because there is no way
+	// to unregister the RLS Cluster Specifier Plugin after registering it solely
+	// for testing purposes using RegisterRLSClusterSpecifierPluginForTesting().
+	//
+	// TODO: Remove this function once the RLS env var is removed.
+	UnregisterRLSClusterSpecifierPluginForTesting func()
+
+	// RegisterRBACHTTPFilterForTesting registers the RBAC HTTP Filter for testing
+	// purposes, regardless of the RBAC environment variable.
+	//
+	// TODO: Remove this function once the RBAC env var is removed.
+	RegisterRBACHTTPFilterForTesting func()
+
+	// UnregisterRBACHTTPFilterForTesting unregisters the RBAC HTTP Filter for
+	// testing purposes. This is needed because there is no way to unregister the
+	// HTTP Filter after registering it solely for testing purposes using
+	// RegisterRBACHTTPFilterForTesting().
+	//
+	// TODO: Remove this function once the RBAC env var is removed.
+	UnregisterRBACHTTPFilterForTesting func()
 )
 
 // HealthChecker defines the signature of the client-side LB channel health checking function.
@@ -85,3 +149,9 @@ const (
 	// that supports backend returned by grpclb balancer.
 	CredsBundleModeBackendFromBalancer = "backend-from-balancer"
 )
+
+// RLSLoadBalancingPolicyName is the name of the RLS LB policy.
+//
+// It currently has an experimental suffix which would be removed once
+// end-to-end testing of the policy is completed.
+const RLSLoadBalancingPolicyName = "rls_experimental"
diff --git a/vendor/google.golang.org/grpc/internal/metadata/metadata.go b/vendor/google.golang.org/grpc/internal/metadata/metadata.go
index b8733dbf340d..b2980f8ac44a 100644
--- a/vendor/google.golang.org/grpc/internal/metadata/metadata.go
+++ b/vendor/google.golang.org/grpc/internal/metadata/metadata.go
@@ -22,6 +22,9 @@
 package metadata
 
 import (
+	"fmt"
+	"strings"
+
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/resolver"
 )
@@ -72,3 +75,46 @@ func Set(addr resolver.Address, md metadata.MD) resolver.Address {
 	addr.Attributes = addr.Attributes.WithValue(mdKey, mdValue(md))
 	return addr
 }
+
+// Validate returns an error if the input md contains invalid keys or values.
+//
+// If the header is not a pseudo-header, the following items are checked:
+// - header names must contain one or more characters from this set [0-9 a-z _ - .].
+// - if the header-name ends with a "-bin" suffix, no validation of the header value is performed.
+// - otherwise, the header value must contain one or more characters from the set [%x20-%x7E].
+func Validate(md metadata.MD) error {
+	for k, vals := range md {
+		// pseudo-header will be ignored
+		if k[0] == ':' {
+			continue
+		}
+		// check key, for i that saving a conversion if not using for range
+		for i := 0; i < len(k); i++ {
+			r := k[i]
+			if !(r >= 'a' && r <= 'z') && !(r >= '0' && r <= '9') && r != '.' && r != '-' && r != '_' {
+				return fmt.Errorf("header key %q contains illegal characters not in [0-9a-z-_.]", k)
+			}
+		}
+		if strings.HasSuffix(k, "-bin") {
+			continue
+		}
+		// check value
+		for _, val := range vals {
+			if hasNotPrintable(val) {
+				return fmt.Errorf("header key %q contains value with non-printable ASCII characters", k)
+			}
+		}
+	}
+	return nil
+}
+
+// hasNotPrintable return true if msg contains any characters which are not in %x20-%x7E
+func hasNotPrintable(msg string) bool {
+	// for i that saving a conversion if not using for range
+	for i := 0; i < len(msg); i++ {
+		if msg[i] < 0x20 || msg[i] > 0x7E {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls.pb.go b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls.pb.go
new file mode 100644
index 000000000000..437dff2201c9
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls.pb.go
@@ -0,0 +1,362 @@
+// Copyright 2020 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.25.0
+// 	protoc        v3.14.0
+// source: grpc/lookup/v1/rls.proto
+
+package grpc_lookup_v1
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+// Possible reasons for making a request.
+type RouteLookupRequest_Reason int32
+
+const (
+	RouteLookupRequest_REASON_UNKNOWN RouteLookupRequest_Reason = 0 // Unused
+	RouteLookupRequest_REASON_MISS    RouteLookupRequest_Reason = 1 // No data available in local cache
+	RouteLookupRequest_REASON_STALE   RouteLookupRequest_Reason = 2 // Data in local cache is stale
+)
+
+// Enum value maps for RouteLookupRequest_Reason.
+var (
+	RouteLookupRequest_Reason_name = map[int32]string{
+		0: "REASON_UNKNOWN",
+		1: "REASON_MISS",
+		2: "REASON_STALE",
+	}
+	RouteLookupRequest_Reason_value = map[string]int32{
+		"REASON_UNKNOWN": 0,
+		"REASON_MISS":    1,
+		"REASON_STALE":   2,
+	}
+)
+
+func (x RouteLookupRequest_Reason) Enum() *RouteLookupRequest_Reason {
+	p := new(RouteLookupRequest_Reason)
+	*p = x
+	return p
+}
+
+func (x RouteLookupRequest_Reason) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RouteLookupRequest_Reason) Descriptor() protoreflect.EnumDescriptor {
+	return file_grpc_lookup_v1_rls_proto_enumTypes[0].Descriptor()
+}
+
+func (RouteLookupRequest_Reason) Type() protoreflect.EnumType {
+	return &file_grpc_lookup_v1_rls_proto_enumTypes[0]
+}
+
+func (x RouteLookupRequest_Reason) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RouteLookupRequest_Reason.Descriptor instead.
+func (RouteLookupRequest_Reason) EnumDescriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type RouteLookupRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Target type allows the client to specify what kind of target format it
+	// would like from RLS to allow it to find the regional server, e.g. "grpc".
+	TargetType string `protobuf:"bytes,3,opt,name=target_type,json=targetType,proto3" json:"target_type,omitempty"`
+	// Reason for making this request.
+	Reason RouteLookupRequest_Reason `protobuf:"varint,5,opt,name=reason,proto3,enum=grpc.lookup.v1.RouteLookupRequest_Reason" json:"reason,omitempty"`
+	// For REASON_STALE, the header_data from the stale response, if any.
+	StaleHeaderData string `protobuf:"bytes,6,opt,name=stale_header_data,json=staleHeaderData,proto3" json:"stale_header_data,omitempty"`
+	// Map of key values extracted via key builders for the gRPC or HTTP request.
+	KeyMap map[string]string `protobuf:"bytes,4,rep,name=key_map,json=keyMap,proto3" json:"key_map,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *RouteLookupRequest) Reset() {
+	*x = RouteLookupRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RouteLookupRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RouteLookupRequest) ProtoMessage() {}
+
+func (x *RouteLookupRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RouteLookupRequest.ProtoReflect.Descriptor instead.
+func (*RouteLookupRequest) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RouteLookupRequest) GetTargetType() string {
+	if x != nil {
+		return x.TargetType
+	}
+	return ""
+}
+
+func (x *RouteLookupRequest) GetReason() RouteLookupRequest_Reason {
+	if x != nil {
+		return x.Reason
+	}
+	return RouteLookupRequest_REASON_UNKNOWN
+}
+
+func (x *RouteLookupRequest) GetStaleHeaderData() string {
+	if x != nil {
+		return x.StaleHeaderData
+	}
+	return ""
+}
+
+func (x *RouteLookupRequest) GetKeyMap() map[string]string {
+	if x != nil {
+		return x.KeyMap
+	}
+	return nil
+}
+
+type RouteLookupResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Prioritized list (best one first) of addressable entities to use
+	// for routing, using syntax requested by the request target_type.
+	// The targets will be tried in order until a healthy one is found.
+	Targets []string `protobuf:"bytes,3,rep,name=targets,proto3" json:"targets,omitempty"`
+	// Optional header value to pass along to AFE in the X-Google-RLS-Data header.
+	// Cached with "target" and sent with all requests that match the request key.
+	// Allows the RLS to pass its work product to the eventual target.
+	HeaderData string `protobuf:"bytes,2,opt,name=header_data,json=headerData,proto3" json:"header_data,omitempty"`
+}
+
+func (x *RouteLookupResponse) Reset() {
+	*x = RouteLookupResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RouteLookupResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RouteLookupResponse) ProtoMessage() {}
+
+func (x *RouteLookupResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RouteLookupResponse.ProtoReflect.Descriptor instead.
+func (*RouteLookupResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RouteLookupResponse) GetTargets() []string {
+	if x != nil {
+		return x.Targets
+	}
+	return nil
+}
+
+func (x *RouteLookupResponse) GetHeaderData() string {
+	if x != nil {
+		return x.HeaderData
+	}
+	return ""
+}
+
+var File_grpc_lookup_v1_rls_proto protoreflect.FileDescriptor
+
+var file_grpc_lookup_v1_rls_proto_rawDesc = []byte{
+	0x0a, 0x18, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2f, 0x76, 0x31,
+	0x2f, 0x72, 0x6c, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0e, 0x67, 0x72, 0x70, 0x63,
+	0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x22, 0x83, 0x03, 0x0a, 0x12, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x41, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x29, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x52, 0x06, 0x72,
+	0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x74, 0x61, 0x6c, 0x65, 0x5f, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0f, 0x73, 0x74, 0x61, 0x6c, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x44, 0x61, 0x74,
+	0x61, 0x12, 0x47, 0x0a, 0x07, 0x6b, 0x65, 0x79, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x04, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4b, 0x65, 0x79, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x52, 0x06, 0x6b, 0x65, 0x79, 0x4d, 0x61, 0x70, 0x1a, 0x39, 0x0a, 0x0b, 0x4b, 0x65,
+	0x79, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x3f, 0x0a, 0x06, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12,
+	0x12, 0x0a, 0x0e, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57,
+	0x4e, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x4d, 0x49,
+	0x53, 0x53, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x53,
+	0x54, 0x41, 0x4c, 0x45, 0x10, 0x02, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x4a, 0x04, 0x08, 0x02,
+	0x10, 0x03, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x22, 0x5e, 0x0a, 0x13, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x74, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x44, 0x61,
+	0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x32, 0x6e, 0x0a, 0x12, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x58, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c,
+	0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x12, 0x22, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f,
+	0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b,
+	0x75, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x67, 0x72, 0x70, 0x63,
+	0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x42, 0x4d, 0x0a, 0x11, 0x69, 0x6f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b,
+	0x75, 0x70, 0x2e, 0x76, 0x31, 0x42, 0x08, 0x52, 0x6c, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x2c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67,
+	0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
+	0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x5f, 0x76, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_grpc_lookup_v1_rls_proto_rawDescOnce sync.Once
+	file_grpc_lookup_v1_rls_proto_rawDescData = file_grpc_lookup_v1_rls_proto_rawDesc
+)
+
+func file_grpc_lookup_v1_rls_proto_rawDescGZIP() []byte {
+	file_grpc_lookup_v1_rls_proto_rawDescOnce.Do(func() {
+		file_grpc_lookup_v1_rls_proto_rawDescData = protoimpl.X.CompressGZIP(file_grpc_lookup_v1_rls_proto_rawDescData)
+	})
+	return file_grpc_lookup_v1_rls_proto_rawDescData
+}
+
+var file_grpc_lookup_v1_rls_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_grpc_lookup_v1_rls_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_grpc_lookup_v1_rls_proto_goTypes = []interface{}{
+	(RouteLookupRequest_Reason)(0), // 0: grpc.lookup.v1.RouteLookupRequest.Reason
+	(*RouteLookupRequest)(nil),     // 1: grpc.lookup.v1.RouteLookupRequest
+	(*RouteLookupResponse)(nil),    // 2: grpc.lookup.v1.RouteLookupResponse
+	nil,                            // 3: grpc.lookup.v1.RouteLookupRequest.KeyMapEntry
+}
+var file_grpc_lookup_v1_rls_proto_depIdxs = []int32{
+	0, // 0: grpc.lookup.v1.RouteLookupRequest.reason:type_name -> grpc.lookup.v1.RouteLookupRequest.Reason
+	3, // 1: grpc.lookup.v1.RouteLookupRequest.key_map:type_name -> grpc.lookup.v1.RouteLookupRequest.KeyMapEntry
+	1, // 2: grpc.lookup.v1.RouteLookupService.RouteLookup:input_type -> grpc.lookup.v1.RouteLookupRequest
+	2, // 3: grpc.lookup.v1.RouteLookupService.RouteLookup:output_type -> grpc.lookup.v1.RouteLookupResponse
+	3, // [3:4] is the sub-list for method output_type
+	2, // [2:3] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_grpc_lookup_v1_rls_proto_init() }
+func file_grpc_lookup_v1_rls_proto_init() {
+	if File_grpc_lookup_v1_rls_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_grpc_lookup_v1_rls_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RouteLookupRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RouteLookupResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_grpc_lookup_v1_rls_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_grpc_lookup_v1_rls_proto_goTypes,
+		DependencyIndexes: file_grpc_lookup_v1_rls_proto_depIdxs,
+		EnumInfos:         file_grpc_lookup_v1_rls_proto_enumTypes,
+		MessageInfos:      file_grpc_lookup_v1_rls_proto_msgTypes,
+	}.Build()
+	File_grpc_lookup_v1_rls_proto = out.File
+	file_grpc_lookup_v1_rls_proto_rawDesc = nil
+	file_grpc_lookup_v1_rls_proto_goTypes = nil
+	file_grpc_lookup_v1_rls_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_config.pb.go b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_config.pb.go
new file mode 100644
index 000000000000..7e4c932e20ff
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_config.pb.go
@@ -0,0 +1,940 @@
+// Copyright 2020 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.25.0
+// 	protoc        v3.14.0
+// source: grpc/lookup/v1/rls_config.proto
+
+package grpc_lookup_v1
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+// Extract a key based on a given name (e.g. header name or query parameter
+// name).  The name must match one of the names listed in the "name" field.  If
+// the "required_match" field is true, one of the specified names must be
+// present for the keybuilder to match.
+type NameMatcher struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The name that will be used in the RLS key_map to refer to this value.
+	// If required_match is true, you may omit this field or set it to an empty
+	// string, in which case the matcher will require a match, but won't update
+	// the key_map.
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// Ordered list of names (headers or query parameter names) that can supply
+	// this value; the first one with a non-empty value is used.
+	Names []string `protobuf:"bytes,2,rep,name=names,proto3" json:"names,omitempty"`
+	// If true, make this extraction required; the key builder will not match
+	// if no value is found.
+	RequiredMatch bool `protobuf:"varint,3,opt,name=required_match,json=requiredMatch,proto3" json:"required_match,omitempty"`
+}
+
+func (x *NameMatcher) Reset() {
+	*x = NameMatcher{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NameMatcher) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NameMatcher) ProtoMessage() {}
+
+func (x *NameMatcher) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NameMatcher.ProtoReflect.Descriptor instead.
+func (*NameMatcher) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *NameMatcher) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *NameMatcher) GetNames() []string {
+	if x != nil {
+		return x.Names
+	}
+	return nil
+}
+
+func (x *NameMatcher) GetRequiredMatch() bool {
+	if x != nil {
+		return x.RequiredMatch
+	}
+	return false
+}
+
+// A GrpcKeyBuilder applies to a given gRPC service, name, and headers.
+type GrpcKeyBuilder struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Names     []*GrpcKeyBuilder_Name    `protobuf:"bytes,1,rep,name=names,proto3" json:"names,omitempty"`
+	ExtraKeys *GrpcKeyBuilder_ExtraKeys `protobuf:"bytes,3,opt,name=extra_keys,json=extraKeys,proto3" json:"extra_keys,omitempty"`
+	// Extract keys from all listed headers.
+	// For gRPC, it is an error to specify "required_match" on the NameMatcher
+	// protos.
+	Headers []*NameMatcher `protobuf:"bytes,2,rep,name=headers,proto3" json:"headers,omitempty"`
+	// You can optionally set one or more specific key/value pairs to be added to
+	// the key_map.  This can be useful to identify which builder built the key,
+	// for example if you are suppressing the actual method, but need to
+	// separately cache and request all the matched methods.
+	ConstantKeys map[string]string `protobuf:"bytes,4,rep,name=constant_keys,json=constantKeys,proto3" json:"constant_keys,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *GrpcKeyBuilder) Reset() {
+	*x = GrpcKeyBuilder{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GrpcKeyBuilder) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GrpcKeyBuilder) ProtoMessage() {}
+
+func (x *GrpcKeyBuilder) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GrpcKeyBuilder.ProtoReflect.Descriptor instead.
+func (*GrpcKeyBuilder) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GrpcKeyBuilder) GetNames() []*GrpcKeyBuilder_Name {
+	if x != nil {
+		return x.Names
+	}
+	return nil
+}
+
+func (x *GrpcKeyBuilder) GetExtraKeys() *GrpcKeyBuilder_ExtraKeys {
+	if x != nil {
+		return x.ExtraKeys
+	}
+	return nil
+}
+
+func (x *GrpcKeyBuilder) GetHeaders() []*NameMatcher {
+	if x != nil {
+		return x.Headers
+	}
+	return nil
+}
+
+func (x *GrpcKeyBuilder) GetConstantKeys() map[string]string {
+	if x != nil {
+		return x.ConstantKeys
+	}
+	return nil
+}
+
+// An HttpKeyBuilder applies to a given HTTP URL and headers.
+//
+// Path and host patterns use the matching syntax from gRPC transcoding to
+// extract named key/value pairs from the path and host components of the URL:
+// https://github.com/googleapis/googleapis/blob/master/google/api/http.proto
+//
+// It is invalid to specify the same key name in multiple places in a pattern.
+//
+// For a service where the project id can be expressed either as a subdomain or
+// in the path, separate HttpKeyBuilders must be used:
+//     host_pattern: 'example.com' path_pattern: '/{id}/{object}/**'
+//     host_pattern: '{id}.example.com' path_pattern: '/{object}/**'
+// If the host is exactly 'example.com', the first path segment will be used as
+// the id and the second segment as the object. If the host has a subdomain, the
+// subdomain will be used as the id and the first segment as the object. If
+// neither pattern matches, no keys will be extracted.
+type HttpKeyBuilder struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// host_pattern is an ordered list of host template patterns for the desired
+	// value.  If any host_pattern values are specified, then at least one must
+	// match, and the last one wins and sets any specified variables.  A host
+	// consists of labels separated by dots. Each label is matched against the
+	// label in the pattern as follows:
+	//   - "*": Matches any single label.
+	//   - "**": Matches zero or more labels (first or last part of host only).
+	//   - "{<name>=...}": One or more label capture, where "..." can be any
+	//      template that does not include a capture.
+	//   - "{<name>}": A single label capture. Identical to {<name>=*}.
+	//
+	// Examples:
+	//   - "example.com": Only applies to the exact host example.com.
+	//   - "*.example.com": Matches subdomains of example.com.
+	//   - "**.example.com": matches example.com, and all levels of subdomains.
+	//   - "{project}.example.com": Extracts the third level subdomain.
+	//   - "{project=**}.example.com": Extracts the third level+ subdomains.
+	//   - "{project=**}": Extracts the entire host.
+	HostPatterns []string `protobuf:"bytes,1,rep,name=host_patterns,json=hostPatterns,proto3" json:"host_patterns,omitempty"`
+	// path_pattern is an ordered list of path template patterns for the desired
+	// value.  If any path_pattern values are specified, then at least one must
+	// match, and the last one wins and sets any specified variables.  A path
+	// consists of segments separated by slashes. Each segment is matched against
+	// the segment in the pattern as follows:
+	//   - "*": Matches any single segment.
+	//   - "**": Matches zero or more segments (first or last part of path only).
+	//   - "{<name>=...}": One or more segment capture, where "..." can be any
+	//      template that does not include a capture.
+	//   - "{<name>}": A single segment capture. Identical to {<name>=*}.
+	// A custom method may also be specified by appending ":" and the custom
+	// method name or "*" to indicate any custom method (including no custom
+	// method).  For example, "/*/projects/{project_id}/**:*" extracts
+	// `{project_id}` for any version, resource and custom method that includes
+	// it.  By default, any custom method will be matched.
+	//
+	// Examples:
+	//   - "/v1/{name=messages/*}": extracts a name like "messages/12345".
+	//   - "/v1/messages/{message_id}": extracts a message_id like "12345".
+	//   - "/v1/users/{user_id}/messages/{message_id}": extracts two key values.
+	PathPatterns []string `protobuf:"bytes,2,rep,name=path_patterns,json=pathPatterns,proto3" json:"path_patterns,omitempty"`
+	// List of query parameter names to try to match.
+	// For example: ["parent", "name", "resource.name"]
+	// We extract all the specified query_parameters (case-sensitively).  If any
+	// are marked as "required_match" and are not present, this keybuilder fails
+	// to match.  If a given parameter appears multiple times (?foo=a&foo=b) we
+	// will report it as a comma-separated string (foo=a,b).
+	QueryParameters []*NameMatcher `protobuf:"bytes,3,rep,name=query_parameters,json=queryParameters,proto3" json:"query_parameters,omitempty"`
+	// List of headers to try to match.
+	// We extract all the specified header values (case-insensitively).  If any
+	// are marked as "required_match" and are not present, this keybuilder fails
+	// to match.  If a given header appears multiple times in the request we will
+	// report it as a comma-separated string, in standard HTTP fashion.
+	Headers []*NameMatcher `protobuf:"bytes,4,rep,name=headers,proto3" json:"headers,omitempty"`
+	// You can optionally set one or more specific key/value pairs to be added to
+	// the key_map.  This can be useful to identify which builder built the key,
+	// for example if you are suppressing a lot of information from the URL, but
+	// need to separately cache and request URLs with that content.
+	ConstantKeys map[string]string `protobuf:"bytes,5,rep,name=constant_keys,json=constantKeys,proto3" json:"constant_keys,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *HttpKeyBuilder) Reset() {
+	*x = HttpKeyBuilder{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HttpKeyBuilder) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HttpKeyBuilder) ProtoMessage() {}
+
+func (x *HttpKeyBuilder) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HttpKeyBuilder.ProtoReflect.Descriptor instead.
+func (*HttpKeyBuilder) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *HttpKeyBuilder) GetHostPatterns() []string {
+	if x != nil {
+		return x.HostPatterns
+	}
+	return nil
+}
+
+func (x *HttpKeyBuilder) GetPathPatterns() []string {
+	if x != nil {
+		return x.PathPatterns
+	}
+	return nil
+}
+
+func (x *HttpKeyBuilder) GetQueryParameters() []*NameMatcher {
+	if x != nil {
+		return x.QueryParameters
+	}
+	return nil
+}
+
+func (x *HttpKeyBuilder) GetHeaders() []*NameMatcher {
+	if x != nil {
+		return x.Headers
+	}
+	return nil
+}
+
+func (x *HttpKeyBuilder) GetConstantKeys() map[string]string {
+	if x != nil {
+		return x.ConstantKeys
+	}
+	return nil
+}
+
+type RouteLookupConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Ordered specifications for constructing keys for HTTP requests.  Last
+	// match wins.  If no HttpKeyBuilder matches, an empty key_map will be sent to
+	// the lookup service; it should likely reply with a global default route
+	// and raise an alert.
+	HttpKeybuilders []*HttpKeyBuilder `protobuf:"bytes,1,rep,name=http_keybuilders,json=httpKeybuilders,proto3" json:"http_keybuilders,omitempty"`
+	// Unordered specifications for constructing keys for gRPC requests.  All
+	// GrpcKeyBuilders on this list must have unique "name" fields so that the
+	// client is free to prebuild a hash map keyed by name.  If no GrpcKeyBuilder
+	// matches, an empty key_map will be sent to the lookup service; it should
+	// likely reply with a global default route and raise an alert.
+	GrpcKeybuilders []*GrpcKeyBuilder `protobuf:"bytes,2,rep,name=grpc_keybuilders,json=grpcKeybuilders,proto3" json:"grpc_keybuilders,omitempty"`
+	// The name of the lookup service as a gRPC URI.  Typically, this will be
+	// a subdomain of the target, such as "lookup.datastore.googleapis.com".
+	LookupService string `protobuf:"bytes,3,opt,name=lookup_service,json=lookupService,proto3" json:"lookup_service,omitempty"`
+	// Configure a timeout value for lookup service requests.
+	// Defaults to 10 seconds if not specified.
+	LookupServiceTimeout *durationpb.Duration `protobuf:"bytes,4,opt,name=lookup_service_timeout,json=lookupServiceTimeout,proto3" json:"lookup_service_timeout,omitempty"`
+	// How long are responses valid for (like HTTP Cache-Control).
+	// If omitted or zero, the longest valid cache time is used.
+	// This value is clamped to 5 minutes to avoid unflushable bad responses.
+	MaxAge *durationpb.Duration `protobuf:"bytes,5,opt,name=max_age,json=maxAge,proto3" json:"max_age,omitempty"`
+	// After a response has been in the client cache for this amount of time
+	// and is re-requested, start an asynchronous RPC to re-validate it.
+	// This value should be less than max_age by at least the length of a
+	// typical RTT to the Route Lookup Service to fully mask the RTT latency.
+	// If omitted, keys are only re-requested after they have expired.
+	StaleAge *durationpb.Duration `protobuf:"bytes,6,opt,name=stale_age,json=staleAge,proto3" json:"stale_age,omitempty"`
+	// Rough indicator of amount of memory to use for the client cache.  Some of
+	// the data structure overhead is not accounted for, so actual memory consumed
+	// will be somewhat greater than this value.  If this field is omitted or set
+	// to zero, a client default will be used.  The value may be capped to a lower
+	// amount based on client configuration.
+	CacheSizeBytes int64 `protobuf:"varint,7,opt,name=cache_size_bytes,json=cacheSizeBytes,proto3" json:"cache_size_bytes,omitempty"`
+	// This is a list of all the possible targets that can be returned by the
+	// lookup service.  If a target not on this list is returned, it will be
+	// treated the same as an unhealthy target.
+	ValidTargets []string `protobuf:"bytes,8,rep,name=valid_targets,json=validTargets,proto3" json:"valid_targets,omitempty"`
+	// This value provides a default target to use if needed.  If set, it will be
+	// used if RLS returns an error, times out, or returns an invalid response.
+	// Note that requests can be routed only to a subdomain of the original
+	// target, e.g. "us_east_1.cloudbigtable.googleapis.com".
+	DefaultTarget string `protobuf:"bytes,9,opt,name=default_target,json=defaultTarget,proto3" json:"default_target,omitempty"`
+}
+
+func (x *RouteLookupConfig) Reset() {
+	*x = RouteLookupConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RouteLookupConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RouteLookupConfig) ProtoMessage() {}
+
+func (x *RouteLookupConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RouteLookupConfig.ProtoReflect.Descriptor instead.
+func (*RouteLookupConfig) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *RouteLookupConfig) GetHttpKeybuilders() []*HttpKeyBuilder {
+	if x != nil {
+		return x.HttpKeybuilders
+	}
+	return nil
+}
+
+func (x *RouteLookupConfig) GetGrpcKeybuilders() []*GrpcKeyBuilder {
+	if x != nil {
+		return x.GrpcKeybuilders
+	}
+	return nil
+}
+
+func (x *RouteLookupConfig) GetLookupService() string {
+	if x != nil {
+		return x.LookupService
+	}
+	return ""
+}
+
+func (x *RouteLookupConfig) GetLookupServiceTimeout() *durationpb.Duration {
+	if x != nil {
+		return x.LookupServiceTimeout
+	}
+	return nil
+}
+
+func (x *RouteLookupConfig) GetMaxAge() *durationpb.Duration {
+	if x != nil {
+		return x.MaxAge
+	}
+	return nil
+}
+
+func (x *RouteLookupConfig) GetStaleAge() *durationpb.Duration {
+	if x != nil {
+		return x.StaleAge
+	}
+	return nil
+}
+
+func (x *RouteLookupConfig) GetCacheSizeBytes() int64 {
+	if x != nil {
+		return x.CacheSizeBytes
+	}
+	return 0
+}
+
+func (x *RouteLookupConfig) GetValidTargets() []string {
+	if x != nil {
+		return x.ValidTargets
+	}
+	return nil
+}
+
+func (x *RouteLookupConfig) GetDefaultTarget() string {
+	if x != nil {
+		return x.DefaultTarget
+	}
+	return ""
+}
+
+// RouteLookupClusterSpecifier is used in xDS to represent a cluster specifier
+// plugin for RLS.
+type RouteLookupClusterSpecifier struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The RLS config for this cluster specifier plugin instance.
+	RouteLookupConfig *RouteLookupConfig `protobuf:"bytes,1,opt,name=route_lookup_config,json=routeLookupConfig,proto3" json:"route_lookup_config,omitempty"`
+}
+
+func (x *RouteLookupClusterSpecifier) Reset() {
+	*x = RouteLookupClusterSpecifier{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RouteLookupClusterSpecifier) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RouteLookupClusterSpecifier) ProtoMessage() {}
+
+func (x *RouteLookupClusterSpecifier) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RouteLookupClusterSpecifier.ProtoReflect.Descriptor instead.
+func (*RouteLookupClusterSpecifier) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *RouteLookupClusterSpecifier) GetRouteLookupConfig() *RouteLookupConfig {
+	if x != nil {
+		return x.RouteLookupConfig
+	}
+	return nil
+}
+
+// To match, one of the given Name fields must match; the service and method
+// fields are specified as fixed strings.  The service name is required and
+// includes the proto package name.  The method name may be omitted, in
+// which case any method on the given service is matched.
+type GrpcKeyBuilder_Name struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
+	Method  string `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
+}
+
+func (x *GrpcKeyBuilder_Name) Reset() {
+	*x = GrpcKeyBuilder_Name{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GrpcKeyBuilder_Name) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GrpcKeyBuilder_Name) ProtoMessage() {}
+
+func (x *GrpcKeyBuilder_Name) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GrpcKeyBuilder_Name.ProtoReflect.Descriptor instead.
+func (*GrpcKeyBuilder_Name) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *GrpcKeyBuilder_Name) GetService() string {
+	if x != nil {
+		return x.Service
+	}
+	return ""
+}
+
+func (x *GrpcKeyBuilder_Name) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+// If you wish to include the host, service, or method names as keys in the
+// generated RouteLookupRequest, specify key names to use in the extra_keys
+// submessage. If a key name is empty, no key will be set for that value.
+// If this submessage is specified, the normal host/path fields will be left
+// unset in the RouteLookupRequest. We are deprecating host/path in the
+// RouteLookupRequest, so services should migrate to the ExtraKeys approach.
+type GrpcKeyBuilder_ExtraKeys struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Host    string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
+	Method  string `protobuf:"bytes,3,opt,name=method,proto3" json:"method,omitempty"`
+}
+
+func (x *GrpcKeyBuilder_ExtraKeys) Reset() {
+	*x = GrpcKeyBuilder_ExtraKeys{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GrpcKeyBuilder_ExtraKeys) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GrpcKeyBuilder_ExtraKeys) ProtoMessage() {}
+
+func (x *GrpcKeyBuilder_ExtraKeys) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_lookup_v1_rls_config_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GrpcKeyBuilder_ExtraKeys.ProtoReflect.Descriptor instead.
+func (*GrpcKeyBuilder_ExtraKeys) Descriptor() ([]byte, []int) {
+	return file_grpc_lookup_v1_rls_config_proto_rawDescGZIP(), []int{1, 1}
+}
+
+func (x *GrpcKeyBuilder_ExtraKeys) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *GrpcKeyBuilder_ExtraKeys) GetService() string {
+	if x != nil {
+		return x.Service
+	}
+	return ""
+}
+
+func (x *GrpcKeyBuilder_ExtraKeys) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+var File_grpc_lookup_v1_rls_config_proto protoreflect.FileDescriptor
+
+var file_grpc_lookup_v1_rls_config_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2f, 0x76, 0x31,
+	0x2f, 0x72, 0x6c, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x0e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76,
+	0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0x5c, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x72, 0x65, 0x71, 0x75,
+	0x69, 0x72, 0x65, 0x64, 0x5f, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0d, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x22,
+	0xf0, 0x03, 0x0a, 0x0e, 0x47, 0x72, 0x70, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64,
+	0x65, 0x72, 0x12, 0x39, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x23, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x72, 0x70, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65,
+	0x72, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x47, 0x0a,
+	0x0a, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x28, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x72, 0x70, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65,
+	0x72, 0x2e, 0x45, 0x78, 0x74, 0x72, 0x61, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x09, 0x65, 0x78, 0x74,
+	0x72, 0x61, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x35, 0x0a, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c,
+	0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x61, 0x74,
+	0x63, 0x68, 0x65, 0x72, 0x52, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x55, 0x0a,
+	0x0d, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b,
+	0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x72, 0x70, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69,
+	0x6c, 0x64, 0x65, 0x72, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4b, 0x65, 0x79,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74,
+	0x4b, 0x65, 0x79, 0x73, 0x1a, 0x38, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x1a, 0x51,
+	0x0a, 0x09, 0x45, 0x78, 0x74, 0x72, 0x61, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x68,
+	0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12,
+	0x18, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x1a, 0x3f, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4b, 0x65, 0x79,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x22, 0xf1, 0x02, 0x0a, 0x0e, 0x48, 0x74, 0x74, 0x70, 0x4b, 0x65, 0x79, 0x42, 0x75,
+	0x69, 0x6c, 0x64, 0x65, 0x72, 0x12, 0x23, 0x0a, 0x0d, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x70, 0x61,
+	0x74, 0x74, 0x65, 0x72, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68, 0x6f,
+	0x73, 0x74, 0x50, 0x61, 0x74, 0x74, 0x65, 0x72, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x61,
+	0x74, 0x68, 0x5f, 0x70, 0x61, 0x74, 0x74, 0x65, 0x72, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x70, 0x61, 0x74, 0x68, 0x50, 0x61, 0x74, 0x74, 0x65, 0x72, 0x6e, 0x73, 0x12,
+	0x46, 0x0a, 0x10, 0x71, 0x75, 0x65, 0x72, 0x79, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74,
+	0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x72, 0x70, 0x63,
+	0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x52, 0x0f, 0x71, 0x75, 0x65, 0x72, 0x79, 0x50, 0x61, 0x72,
+	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x35, 0x0a, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e,
+	0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x61,
+	0x74, 0x63, 0x68, 0x65, 0x72, 0x52, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x55,
+	0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18,
+	0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f,
+	0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x4b, 0x65, 0x79, 0x42, 0x75,
+	0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4b, 0x65,
+	0x79, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x74, 0x4b, 0x65, 0x79, 0x73, 0x1a, 0x3f, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x74, 0x4b, 0x65, 0x79, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xa6, 0x04, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x49, 0x0a, 0x10,
+	0x68, 0x74, 0x74, 0x70, 0x5f, 0x6b, 0x65, 0x79, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f,
+	0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x4b, 0x65, 0x79, 0x42,
+	0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x52, 0x0f, 0x68, 0x74, 0x74, 0x70, 0x4b, 0x65, 0x79, 0x62,
+	0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x73, 0x12, 0x49, 0x0a, 0x10, 0x67, 0x72, 0x70, 0x63, 0x5f,
+	0x6b, 0x65, 0x79, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1e, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x72, 0x70, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65,
+	0x72, 0x52, 0x0f, 0x67, 0x72, 0x70, 0x63, 0x4b, 0x65, 0x79, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x65,
+	0x72, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x5f, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6c, 0x6f, 0x6f, 0x6b,
+	0x75, 0x70, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x4f, 0x0a, 0x16, 0x6c, 0x6f, 0x6f,
+	0x6b, 0x75, 0x70, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65,
+	0x6f, 0x75, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x14, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61,
+	0x78, 0x5f, 0x61, 0x67, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x6d, 0x61, 0x78, 0x41, 0x67, 0x65, 0x12, 0x36,
+	0x0a, 0x09, 0x73, 0x74, 0x61, 0x6c, 0x65, 0x5f, 0x61, 0x67, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x73, 0x74,
+	0x61, 0x6c, 0x65, 0x41, 0x67, 0x65, 0x12, 0x28, 0x0a, 0x10, 0x63, 0x61, 0x63, 0x68, 0x65, 0x5f,
+	0x73, 0x69, 0x7a, 0x65, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x0e, 0x63, 0x61, 0x63, 0x68, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x42, 0x79, 0x74, 0x65, 0x73,
+	0x12, 0x23, 0x0a, 0x0d, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x54, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x64,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x4a, 0x04, 0x08, 0x0a,
+	0x10, 0x0b, 0x52, 0x1b, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x72, 0x6f, 0x63,
+	0x65, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x22,
+	0x70, 0x0a, 0x1b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x43, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x51,
+	0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x5f, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x67, 0x72,
+	0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x11,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x42, 0x53, 0x0a, 0x11, 0x69, 0x6f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x6c, 0x6f, 0x6f,
+	0x6b, 0x75, 0x70, 0x2e, 0x76, 0x31, 0x42, 0x0e, 0x52, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63,
+	0x2f, 0x6c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x6c, 0x6f, 0x6f,
+	0x6b, 0x75, 0x70, 0x5f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_grpc_lookup_v1_rls_config_proto_rawDescOnce sync.Once
+	file_grpc_lookup_v1_rls_config_proto_rawDescData = file_grpc_lookup_v1_rls_config_proto_rawDesc
+)
+
+func file_grpc_lookup_v1_rls_config_proto_rawDescGZIP() []byte {
+	file_grpc_lookup_v1_rls_config_proto_rawDescOnce.Do(func() {
+		file_grpc_lookup_v1_rls_config_proto_rawDescData = protoimpl.X.CompressGZIP(file_grpc_lookup_v1_rls_config_proto_rawDescData)
+	})
+	return file_grpc_lookup_v1_rls_config_proto_rawDescData
+}
+
+var file_grpc_lookup_v1_rls_config_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_grpc_lookup_v1_rls_config_proto_goTypes = []interface{}{
+	(*NameMatcher)(nil),                 // 0: grpc.lookup.v1.NameMatcher
+	(*GrpcKeyBuilder)(nil),              // 1: grpc.lookup.v1.GrpcKeyBuilder
+	(*HttpKeyBuilder)(nil),              // 2: grpc.lookup.v1.HttpKeyBuilder
+	(*RouteLookupConfig)(nil),           // 3: grpc.lookup.v1.RouteLookupConfig
+	(*RouteLookupClusterSpecifier)(nil), // 4: grpc.lookup.v1.RouteLookupClusterSpecifier
+	(*GrpcKeyBuilder_Name)(nil),         // 5: grpc.lookup.v1.GrpcKeyBuilder.Name
+	(*GrpcKeyBuilder_ExtraKeys)(nil),    // 6: grpc.lookup.v1.GrpcKeyBuilder.ExtraKeys
+	nil,                                 // 7: grpc.lookup.v1.GrpcKeyBuilder.ConstantKeysEntry
+	nil,                                 // 8: grpc.lookup.v1.HttpKeyBuilder.ConstantKeysEntry
+	(*durationpb.Duration)(nil),         // 9: google.protobuf.Duration
+}
+var file_grpc_lookup_v1_rls_config_proto_depIdxs = []int32{
+	5,  // 0: grpc.lookup.v1.GrpcKeyBuilder.names:type_name -> grpc.lookup.v1.GrpcKeyBuilder.Name
+	6,  // 1: grpc.lookup.v1.GrpcKeyBuilder.extra_keys:type_name -> grpc.lookup.v1.GrpcKeyBuilder.ExtraKeys
+	0,  // 2: grpc.lookup.v1.GrpcKeyBuilder.headers:type_name -> grpc.lookup.v1.NameMatcher
+	7,  // 3: grpc.lookup.v1.GrpcKeyBuilder.constant_keys:type_name -> grpc.lookup.v1.GrpcKeyBuilder.ConstantKeysEntry
+	0,  // 4: grpc.lookup.v1.HttpKeyBuilder.query_parameters:type_name -> grpc.lookup.v1.NameMatcher
+	0,  // 5: grpc.lookup.v1.HttpKeyBuilder.headers:type_name -> grpc.lookup.v1.NameMatcher
+	8,  // 6: grpc.lookup.v1.HttpKeyBuilder.constant_keys:type_name -> grpc.lookup.v1.HttpKeyBuilder.ConstantKeysEntry
+	2,  // 7: grpc.lookup.v1.RouteLookupConfig.http_keybuilders:type_name -> grpc.lookup.v1.HttpKeyBuilder
+	1,  // 8: grpc.lookup.v1.RouteLookupConfig.grpc_keybuilders:type_name -> grpc.lookup.v1.GrpcKeyBuilder
+	9,  // 9: grpc.lookup.v1.RouteLookupConfig.lookup_service_timeout:type_name -> google.protobuf.Duration
+	9,  // 10: grpc.lookup.v1.RouteLookupConfig.max_age:type_name -> google.protobuf.Duration
+	9,  // 11: grpc.lookup.v1.RouteLookupConfig.stale_age:type_name -> google.protobuf.Duration
+	3,  // 12: grpc.lookup.v1.RouteLookupClusterSpecifier.route_lookup_config:type_name -> grpc.lookup.v1.RouteLookupConfig
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
+}
+
+func init() { file_grpc_lookup_v1_rls_config_proto_init() }
+func file_grpc_lookup_v1_rls_config_proto_init() {
+	if File_grpc_lookup_v1_rls_config_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NameMatcher); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GrpcKeyBuilder); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HttpKeyBuilder); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RouteLookupConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RouteLookupClusterSpecifier); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GrpcKeyBuilder_Name); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_lookup_v1_rls_config_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GrpcKeyBuilder_ExtraKeys); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_grpc_lookup_v1_rls_config_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_grpc_lookup_v1_rls_config_proto_goTypes,
+		DependencyIndexes: file_grpc_lookup_v1_rls_config_proto_depIdxs,
+		MessageInfos:      file_grpc_lookup_v1_rls_config_proto_msgTypes,
+	}.Build()
+	File_grpc_lookup_v1_rls_config_proto = out.File
+	file_grpc_lookup_v1_rls_config_proto_rawDesc = nil
+	file_grpc_lookup_v1_rls_config_proto_goTypes = nil
+	file_grpc_lookup_v1_rls_config_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go
new file mode 100644
index 000000000000..076b966f3446
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go
@@ -0,0 +1,121 @@
+// Copyright 2020 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.2.0
+// - protoc             v3.14.0
+// source: grpc/lookup/v1/rls.proto
+
+package grpc_lookup_v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+// RouteLookupServiceClient is the client API for RouteLookupService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type RouteLookupServiceClient interface {
+	// Lookup returns a target for a single key.
+	RouteLookup(ctx context.Context, in *RouteLookupRequest, opts ...grpc.CallOption) (*RouteLookupResponse, error)
+}
+
+type routeLookupServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewRouteLookupServiceClient(cc grpc.ClientConnInterface) RouteLookupServiceClient {
+	return &routeLookupServiceClient{cc}
+}
+
+func (c *routeLookupServiceClient) RouteLookup(ctx context.Context, in *RouteLookupRequest, opts ...grpc.CallOption) (*RouteLookupResponse, error) {
+	out := new(RouteLookupResponse)
+	err := c.cc.Invoke(ctx, "/grpc.lookup.v1.RouteLookupService/RouteLookup", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// RouteLookupServiceServer is the server API for RouteLookupService service.
+// All implementations must embed UnimplementedRouteLookupServiceServer
+// for forward compatibility
+type RouteLookupServiceServer interface {
+	// Lookup returns a target for a single key.
+	RouteLookup(context.Context, *RouteLookupRequest) (*RouteLookupResponse, error)
+	mustEmbedUnimplementedRouteLookupServiceServer()
+}
+
+// UnimplementedRouteLookupServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedRouteLookupServiceServer struct {
+}
+
+func (UnimplementedRouteLookupServiceServer) RouteLookup(context.Context, *RouteLookupRequest) (*RouteLookupResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RouteLookup not implemented")
+}
+func (UnimplementedRouteLookupServiceServer) mustEmbedUnimplementedRouteLookupServiceServer() {}
+
+// UnsafeRouteLookupServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RouteLookupServiceServer will
+// result in compilation errors.
+type UnsafeRouteLookupServiceServer interface {
+	mustEmbedUnimplementedRouteLookupServiceServer()
+}
+
+func RegisterRouteLookupServiceServer(s grpc.ServiceRegistrar, srv RouteLookupServiceServer) {
+	s.RegisterService(&RouteLookupService_ServiceDesc, srv)
+}
+
+func _RouteLookupService_RouteLookup_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RouteLookupRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RouteLookupServiceServer).RouteLookup(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/grpc.lookup.v1.RouteLookupService/RouteLookup",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RouteLookupServiceServer).RouteLookup(ctx, req.(*RouteLookupRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// RouteLookupService_ServiceDesc is the grpc.ServiceDesc for RouteLookupService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RouteLookupService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "grpc.lookup.v1.RouteLookupService",
+	HandlerType: (*RouteLookupServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "RouteLookup",
+			Handler:    _RouteLookupService_RouteLookup_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "grpc/lookup/v1/rls.proto",
+}
diff --git a/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go b/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
index 20852e59df29..7f1a702cacbe 100644
--- a/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
+++ b/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
@@ -49,8 +49,9 @@ func (b *builder) Build(target resolver.Target, cc resolver.ClientConn, _ resolv
 	}
 	addr := resolver.Address{Addr: endpoint}
 	if b.scheme == unixAbstractScheme {
-		// prepend "\x00" to address for unix-abstract
-		addr.Addr = "\x00" + addr.Addr
+		// We can not prepend \0 as c++ gRPC does, as in Golang '@' is used to signify we do
+		// not want trailing \0 in address.
+		addr.Addr = "@" + addr.Addr
 	}
 	cc.UpdateState(resolver.State{Addresses: []resolver.Address{networktype.Set(addr, "unix")}})
 	return &nopResolver{}, nil
diff --git a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
index 8394d252df03..409769f48fdc 100644
--- a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
+++ b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
@@ -137,6 +137,7 @@ type earlyAbortStream struct {
 	streamID       uint32
 	contentSubtype string
 	status         *status.Status
+	rst            bool
 }
 
 func (*earlyAbortStream) isTransportResponseFrame() bool { return false }
@@ -786,6 +787,11 @@ func (l *loopyWriter) earlyAbortStreamHandler(eas *earlyAbortStream) error {
 	if err := l.writeHeader(eas.streamID, true, headerFields, nil); err != nil {
 		return err
 	}
+	if eas.rst {
+		if err := l.framer.fr.WriteRSTStream(eas.streamID, http2.ErrCodeNo); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
@@ -880,9 +886,9 @@ func (l *loopyWriter) processData() (bool, error) {
 	dataItem := str.itl.peek().(*dataFrame) // Peek at the first data item this stream.
 	// A data item is represented by a dataFrame, since it later translates into
 	// multiple HTTP2 data frames.
-	// Every dataFrame has two buffers; h that keeps grpc-message header and d that is acutal data.
+	// Every dataFrame has two buffers; h that keeps grpc-message header and d that is actual data.
 	// As an optimization to keep wire traffic low, data from d is copied to h to make as big as the
-	// maximum possilbe HTTP2 frame size.
+	// maximum possible HTTP2 frame size.
 
 	if len(dataItem.h) == 0 && len(dataItem.d) == 0 { // Empty data frame
 		// Client sends out empty data frame with endStream = true
diff --git a/vendor/google.golang.org/grpc/internal/transport/handler_server.go b/vendor/google.golang.org/grpc/internal/transport/handler_server.go
index 1c3459c2b4c5..090120925bb4 100644
--- a/vendor/google.golang.org/grpc/internal/transport/handler_server.go
+++ b/vendor/google.golang.org/grpc/internal/transport/handler_server.go
@@ -49,7 +49,7 @@ import (
 // NewServerHandlerTransport returns a ServerTransport handling gRPC
 // from inside an http.Handler. It requires that the http Server
 // supports HTTP/2.
-func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request, stats stats.Handler) (ServerTransport, error) {
+func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request, stats []stats.Handler) (ServerTransport, error) {
 	if r.ProtoMajor != 2 {
 		return nil, errors.New("gRPC requires HTTP/2")
 	}
@@ -138,7 +138,7 @@ type serverHandlerTransport struct {
 	// TODO make sure this is consistent across handler_server and http2_server
 	contentSubtype string
 
-	stats stats.Handler
+	stats []stats.Handler
 }
 
 func (ht *serverHandlerTransport) Close() {
@@ -228,10 +228,10 @@ func (ht *serverHandlerTransport) WriteStatus(s *Stream, st *status.Status) erro
 	})
 
 	if err == nil { // transport has not been closed
-		if ht.stats != nil {
-			// Note: The trailer fields are compressed with hpack after this call returns.
-			// No WireLength field is set here.
-			ht.stats.HandleRPC(s.Context(), &stats.OutTrailer{
+		// Note: The trailer fields are compressed with hpack after this call returns.
+		// No WireLength field is set here.
+		for _, sh := range ht.stats {
+			sh.HandleRPC(s.Context(), &stats.OutTrailer{
 				Trailer: s.trailer.Copy(),
 			})
 		}
@@ -314,10 +314,10 @@ func (ht *serverHandlerTransport) WriteHeader(s *Stream, md metadata.MD) error {
 	})
 
 	if err == nil {
-		if ht.stats != nil {
+		for _, sh := range ht.stats {
 			// Note: The header fields are compressed with hpack after this call returns.
 			// No WireLength field is set here.
-			ht.stats.HandleRPC(s.Context(), &stats.OutHeader{
+			sh.HandleRPC(s.Context(), &stats.OutHeader{
 				Header:      md.Copy(),
 				Compression: s.sendCompress,
 			})
@@ -369,14 +369,14 @@ func (ht *serverHandlerTransport) HandleStreams(startStream func(*Stream), trace
 	}
 	ctx = metadata.NewIncomingContext(ctx, ht.headerMD)
 	s.ctx = peer.NewContext(ctx, pr)
-	if ht.stats != nil {
-		s.ctx = ht.stats.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
+	for _, sh := range ht.stats {
+		s.ctx = sh.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
 		inHeader := &stats.InHeader{
 			FullMethod:  s.method,
 			RemoteAddr:  ht.RemoteAddr(),
 			Compression: s.recvCompress,
 		}
-		ht.stats.HandleRPC(s.ctx, inHeader)
+		sh.HandleRPC(s.ctx, inHeader)
 	}
 	s.trReader = &transportReader{
 		reader:        &recvBufferReader{ctx: s.ctx, ctxDone: s.ctx.Done(), recv: s.buf, freeBuffer: func(*bytes.Buffer) {}},
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/vendor/google.golang.org/grpc/internal/transport/http2_client.go
index f0c72d337105..5c2f35b24e75 100644
--- a/vendor/google.golang.org/grpc/internal/transport/http2_client.go
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_client.go
@@ -78,6 +78,7 @@ type http2Client struct {
 	framer *framer
 	// controlBuf delivers all the control related tasks (e.g., window
 	// updates, reset streams, and various settings) to the controller.
+	// Do not access controlBuf with mu held.
 	controlBuf *controlBuffer
 	fc         *trInFlow
 	// The scheme used: https if TLS is on, http otherwise.
@@ -90,7 +91,7 @@ type http2Client struct {
 	kp               keepalive.ClientParameters
 	keepaliveEnabled bool
 
-	statsHandler stats.Handler
+	statsHandlers []stats.Handler
 
 	initialWindowSize int32
 
@@ -109,6 +110,7 @@ type http2Client struct {
 	waitingStreams        uint32
 	nextID                uint32
 
+	// Do not access controlBuf with mu held.
 	mu            sync.Mutex // guard the following variables
 	state         transportState
 	activeStreams map[uint32]*Stream
@@ -132,7 +134,7 @@ type http2Client struct {
 	kpDormant bool
 
 	// Fields below are for channelz metric collection.
-	channelzID int64 // channelz unique identification number
+	channelzID *channelz.Identifier
 	czData     *channelzData
 
 	onGoAway func(GoAwayReason)
@@ -311,7 +313,7 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 		isSecure:              isSecure,
 		perRPCCreds:           perRPCCreds,
 		kp:                    kp,
-		statsHandler:          opts.StatsHandler,
+		statsHandlers:         opts.StatsHandlers,
 		initialWindowSize:     initialWindowSize,
 		onPrefaceReceipt:      onPrefaceReceipt,
 		nextID:                1,
@@ -324,6 +326,8 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 		keepaliveEnabled:      keepaliveEnabled,
 		bufferPool:            newBufferPool(),
 	}
+	// Add peer information to the http2client context.
+	t.ctx = peer.NewContext(t.ctx, t.getPeer())
 
 	if md, ok := addr.Metadata.(*metadata.MD); ok {
 		t.md = *md
@@ -341,18 +345,19 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 			updateFlowControl: t.updateFlowControl,
 		}
 	}
-	if t.statsHandler != nil {
-		t.ctx = t.statsHandler.TagConn(t.ctx, &stats.ConnTagInfo{
+	for _, sh := range t.statsHandlers {
+		t.ctx = sh.TagConn(t.ctx, &stats.ConnTagInfo{
 			RemoteAddr: t.remoteAddr,
 			LocalAddr:  t.localAddr,
 		})
 		connBegin := &stats.ConnBegin{
 			Client: true,
 		}
-		t.statsHandler.HandleConn(t.ctx, connBegin)
+		sh.HandleConn(t.ctx, connBegin)
 	}
-	if channelz.IsOn() {
-		t.channelzID = channelz.RegisterNormalSocket(t, opts.ChannelzParentID, fmt.Sprintf("%s -> %s", t.localAddr, t.remoteAddr))
+	t.channelzID, err = channelz.RegisterNormalSocket(t, opts.ChannelzParentID, fmt.Sprintf("%s -> %s", t.localAddr, t.remoteAddr))
+	if err != nil {
+		return nil, err
 	}
 	if t.keepaliveEnabled {
 		t.kpDormancyCond = sync.NewCond(&t.mu)
@@ -466,7 +471,7 @@ func (t *http2Client) newStream(ctx context.Context, callHdr *CallHdr) *Stream {
 func (t *http2Client) getPeer() *peer.Peer {
 	return &peer.Peer{
 		Addr:     t.remoteAddr,
-		AuthInfo: t.authInfo,
+		AuthInfo: t.authInfo, // Can be nil
 	}
 }
 
@@ -630,8 +635,8 @@ func (t *http2Client) getCallAuthData(ctx context.Context, audience string, call
 // the wire.  However, there are two notable exceptions:
 //
 // 1. If the stream headers violate the max header list size allowed by the
-//    server.  In this case there is no reason to retry at all, as it is
-//    assumed the RPC would continue to fail on subsequent attempts.
+//    server.  It's possible this could succeed on another transport, even if
+//    it's unlikely, but do not transparently retry.
 // 2. If the credentials errored when requesting their headers.  In this case,
 //    it's possible a retry can fix the problem, but indefinitely transparently
 //    retrying is not appropriate as it is likely the credentials, if they can
@@ -639,8 +644,7 @@ func (t *http2Client) getCallAuthData(ctx context.Context, audience string, call
 type NewStreamError struct {
 	Err error
 
-	DoNotRetry            bool
-	DoNotTransparentRetry bool
+	AllowTransparentRetry bool
 }
 
 func (e NewStreamError) Error() string {
@@ -649,11 +653,11 @@ func (e NewStreamError) Error() string {
 
 // NewStream creates a stream and registers it into the transport as "active"
 // streams.  All non-nil errors returned will be *NewStreamError.
-func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Stream, err error) {
+func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream, error) {
 	ctx = peer.NewContext(ctx, t.getPeer())
 	headerFields, err := t.createHeaderFields(ctx, callHdr)
 	if err != nil {
-		return nil, &NewStreamError{Err: err, DoNotTransparentRetry: true}
+		return nil, &NewStreamError{Err: err, AllowTransparentRetry: false}
 	}
 	s := t.newStream(ctx, callHdr)
 	cleanup := func(err error) {
@@ -685,7 +689,6 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 				cleanup(err)
 				return err
 			}
-			t.activeStreams[id] = s
 			if channelz.IsOn() {
 				atomic.AddInt64(&t.czData.streamsStarted, 1)
 				atomic.StoreInt64(&t.czData.lastStreamCreatedTime, time.Now().UnixNano())
@@ -719,6 +722,13 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 		t.nextID += 2
 		s.id = h.streamID
 		s.fc = &inFlow{limit: uint32(t.initialWindowSize)}
+		t.mu.Lock()
+		if t.activeStreams == nil { // Can be niled from Close().
+			t.mu.Unlock()
+			return false // Don't create a stream if the transport is already closed.
+		}
+		t.activeStreams[s.id] = s
+		t.mu.Unlock()
 		if t.streamQuota > 0 && t.waitingStreams > 0 {
 			select {
 			case t.streamsQuotaAvailable <- struct{}{}:
@@ -744,22 +754,17 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 	}
 	for {
 		success, err := t.controlBuf.executeAndPut(func(it interface{}) bool {
-			if !checkForStreamQuota(it) {
-				return false
-			}
-			if !checkForHeaderListSize(it) {
-				return false
-			}
-			return true
+			return checkForHeaderListSize(it) && checkForStreamQuota(it)
 		}, hdr)
 		if err != nil {
-			return nil, &NewStreamError{Err: err}
+			// Connection closed.
+			return nil, &NewStreamError{Err: err, AllowTransparentRetry: true}
 		}
 		if success {
 			break
 		}
 		if hdrListSizeErr != nil {
-			return nil, &NewStreamError{Err: hdrListSizeErr, DoNotRetry: true}
+			return nil, &NewStreamError{Err: hdrListSizeErr}
 		}
 		firstTry = false
 		select {
@@ -767,29 +772,32 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 		case <-ctx.Done():
 			return nil, &NewStreamError{Err: ContextErr(ctx.Err())}
 		case <-t.goAway:
-			return nil, &NewStreamError{Err: errStreamDrain}
+			return nil, &NewStreamError{Err: errStreamDrain, AllowTransparentRetry: true}
 		case <-t.ctx.Done():
-			return nil, &NewStreamError{Err: ErrConnClosing}
+			return nil, &NewStreamError{Err: ErrConnClosing, AllowTransparentRetry: true}
 		}
 	}
-	if t.statsHandler != nil {
+	if len(t.statsHandlers) != 0 {
 		header, ok := metadata.FromOutgoingContext(ctx)
 		if ok {
 			header.Set("user-agent", t.userAgent)
 		} else {
 			header = metadata.Pairs("user-agent", t.userAgent)
 		}
-		// Note: The header fields are compressed with hpack after this call returns.
-		// No WireLength field is set here.
-		outHeader := &stats.OutHeader{
-			Client:      true,
-			FullMethod:  callHdr.Method,
-			RemoteAddr:  t.remoteAddr,
-			LocalAddr:   t.localAddr,
-			Compression: callHdr.SendCompress,
-			Header:      header,
+		for _, sh := range t.statsHandlers {
+			// Note: The header fields are compressed with hpack after this call returns.
+			// No WireLength field is set here.
+			// Note: Creating a new stats object to prevent pollution.
+			outHeader := &stats.OutHeader{
+				Client:      true,
+				FullMethod:  callHdr.Method,
+				RemoteAddr:  t.remoteAddr,
+				LocalAddr:   t.localAddr,
+				Compression: callHdr.SendCompress,
+				Header:      header,
+			}
+			sh.HandleRPC(s.ctx, outHeader)
 		}
-		t.statsHandler.HandleRPC(s.ctx, outHeader)
 	}
 	return s, nil
 }
@@ -898,9 +906,7 @@ func (t *http2Client) Close(err error) {
 	t.controlBuf.finish()
 	t.cancel()
 	t.conn.Close()
-	if channelz.IsOn() {
-		channelz.RemoveEntry(t.channelzID)
-	}
+	channelz.RemoveEntry(t.channelzID)
 	// Append info about previous goaways if there were any, since this may be important
 	// for understanding the root cause for this connection to be closed.
 	_, goAwayDebugMessage := t.GetGoAwayReason()
@@ -917,11 +923,11 @@ func (t *http2Client) Close(err error) {
 	for _, s := range streams {
 		t.closeStream(s, err, false, http2.ErrCodeNo, st, nil, false)
 	}
-	if t.statsHandler != nil {
+	for _, sh := range t.statsHandlers {
 		connEnd := &stats.ConnEnd{
 			Client: true,
 		}
-		t.statsHandler.HandleConn(t.ctx, connEnd)
+		sh.HandleConn(t.ctx, connEnd)
 	}
 }
 
@@ -1001,13 +1007,13 @@ func (t *http2Client) updateWindow(s *Stream, n uint32) {
 // for the transport and the stream based on the current bdp
 // estimation.
 func (t *http2Client) updateFlowControl(n uint32) {
-	t.mu.Lock()
-	for _, s := range t.activeStreams {
-		s.fc.newLimit(n)
-	}
-	t.mu.Unlock()
 	updateIWS := func(interface{}) bool {
 		t.initialWindowSize = int32(n)
+		t.mu.Lock()
+		for _, s := range t.activeStreams {
+			s.fc.newLimit(n)
+		}
+		t.mu.Unlock()
 		return true
 	}
 	t.controlBuf.executeAndPut(updateIWS, &outgoingWindowUpdate{streamID: 0, increment: t.fc.newLimit(n)})
@@ -1213,7 +1219,7 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 	default:
 		t.setGoAwayReason(f)
 		close(t.goAway)
-		t.controlBuf.put(&incomingGoAway{})
+		defer t.controlBuf.put(&incomingGoAway{}) // Defer as t.mu is currently held.
 		// Notify the clientconn about the GOAWAY before we set the state to
 		// draining, to allow the client to stop attempting to create streams
 		// before disallowing new streams on this connection.
@@ -1226,18 +1232,29 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 	if upperLimit == 0 { // This is the first GoAway Frame.
 		upperLimit = math.MaxUint32 // Kill all streams after the GoAway ID.
 	}
+
+	t.prevGoAwayID = id
+	if len(t.activeStreams) == 0 {
+		t.mu.Unlock()
+		t.Close(connectionErrorf(true, nil, "received goaway and there are no active streams"))
+		return
+	}
+
+	streamsToClose := make([]*Stream, 0)
 	for streamID, stream := range t.activeStreams {
 		if streamID > id && streamID <= upperLimit {
 			// The stream was unprocessed by the server.
-			atomic.StoreUint32(&stream.unprocessed, 1)
-			t.closeStream(stream, errStreamDrain, false, http2.ErrCodeNo, statusGoAway, nil, false)
+			if streamID > id && streamID <= upperLimit {
+				atomic.StoreUint32(&stream.unprocessed, 1)
+				streamsToClose = append(streamsToClose, stream)
+			}
 		}
 	}
-	t.prevGoAwayID = id
-	active := len(t.activeStreams)
 	t.mu.Unlock()
-	if active == 0 {
-		t.Close(connectionErrorf(true, nil, "received goaway and there are no active streams"))
+	// Called outside t.mu because closeStream can take controlBuf's mu, which
+	// could induce deadlock and is not allowed.
+	for _, stream := range streamsToClose {
+		t.closeStream(stream, errStreamDrain, false, http2.ErrCodeNo, statusGoAway, nil, false)
 	}
 }
 
@@ -1433,7 +1450,7 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) {
 		close(s.headerChan)
 	}
 
-	if t.statsHandler != nil {
+	for _, sh := range t.statsHandlers {
 		if isHeader {
 			inHeader := &stats.InHeader{
 				Client:      true,
@@ -1441,14 +1458,14 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) {
 				Header:      metadata.MD(mdata).Copy(),
 				Compression: s.recvCompress,
 			}
-			t.statsHandler.HandleRPC(s.ctx, inHeader)
+			sh.HandleRPC(s.ctx, inHeader)
 		} else {
 			inTrailer := &stats.InTrailer{
 				Client:     true,
 				WireLength: int(frame.Header().Length),
 				Trailer:    metadata.MD(mdata).Copy(),
 			}
-			t.statsHandler.HandleRPC(s.ctx, inTrailer)
+			sh.HandleRPC(s.ctx, inTrailer)
 		}
 	}
 
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
index 2c6eaf0e59cf..3dd15647bc84 100644
--- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
@@ -21,7 +21,6 @@ package transport
 import (
 	"bytes"
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -36,6 +35,7 @@ import (
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/hpack"
 	"google.golang.org/grpc/internal/grpcutil"
+	"google.golang.org/grpc/internal/syscall"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
@@ -52,10 +52,10 @@ import (
 var (
 	// ErrIllegalHeaderWrite indicates that setting header is illegal because of
 	// the stream's state.
-	ErrIllegalHeaderWrite = errors.New("transport: the stream is done or WriteHeader was already called")
+	ErrIllegalHeaderWrite = status.Error(codes.Internal, "transport: SendHeader called multiple times")
 	// ErrHeaderListSizeLimitViolation indicates that the header list size is larger
 	// than the limit set by peer.
-	ErrHeaderListSizeLimitViolation = errors.New("transport: trying to send header list size larger than the limit set by peer")
+	ErrHeaderListSizeLimitViolation = status.Error(codes.Internal, "transport: trying to send header list size larger than the limit set by peer")
 )
 
 // serverConnectionCounter counts the number of connections a server has seen
@@ -82,7 +82,7 @@ type http2Server struct {
 	// updates, reset streams, and various settings) to the controller.
 	controlBuf *controlBuffer
 	fc         *trInFlow
-	stats      stats.Handler
+	stats      []stats.Handler
 	// Keepalive and max-age parameters for the server.
 	kp keepalive.ServerParameters
 	// Keepalive enforcement policy.
@@ -117,7 +117,7 @@ type http2Server struct {
 	idle time.Time
 
 	// Fields below are for channelz metric collection.
-	channelzID int64 // channelz unique identification number
+	channelzID *channelz.Identifier
 	czData     *channelzData
 	bufferPool *bufferPool
 
@@ -231,6 +231,11 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 	if kp.Timeout == 0 {
 		kp.Timeout = defaultServerKeepaliveTimeout
 	}
+	if kp.Time != infinity {
+		if err = syscall.SetTCPUserTimeout(conn, kp.Timeout); err != nil {
+			return nil, connectionErrorf(false, err, "transport: failed to set TCP_USER_TIMEOUT: %v", err)
+		}
+	}
 	kep := config.KeepalivePolicy
 	if kep.MinTime == 0 {
 		kep.MinTime = defaultKeepalivePolicyMinTime
@@ -252,7 +257,7 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 		fc:                &trInFlow{limit: uint32(icwz)},
 		state:             reachable,
 		activeStreams:     make(map[uint32]*Stream),
-		stats:             config.StatsHandler,
+		stats:             config.StatsHandlers,
 		kp:                kp,
 		idle:              time.Now(),
 		kep:               kep,
@@ -260,6 +265,9 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 		czData:            new(channelzData),
 		bufferPool:        newBufferPool(),
 	}
+	// Add peer information to the http2server context.
+	t.ctx = peer.NewContext(t.ctx, t.getPeer())
+
 	t.controlBuf = newControlBuffer(t.done)
 	if dynamicWindow {
 		t.bdpEst = &bdpEstimator{
@@ -267,20 +275,20 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 			updateFlowControl: t.updateFlowControl,
 		}
 	}
-	if t.stats != nil {
-		t.ctx = t.stats.TagConn(t.ctx, &stats.ConnTagInfo{
+	for _, sh := range t.stats {
+		t.ctx = sh.TagConn(t.ctx, &stats.ConnTagInfo{
 			RemoteAddr: t.remoteAddr,
 			LocalAddr:  t.localAddr,
 		})
 		connBegin := &stats.ConnBegin{}
-		t.stats.HandleConn(t.ctx, connBegin)
+		sh.HandleConn(t.ctx, connBegin)
 	}
-	if channelz.IsOn() {
-		t.channelzID = channelz.RegisterNormalSocket(t, config.ChannelzParentID, fmt.Sprintf("%s -> %s", t.remoteAddr, t.localAddr))
+	t.channelzID, err = channelz.RegisterNormalSocket(t, config.ChannelzParentID, fmt.Sprintf("%s -> %s", t.remoteAddr, t.localAddr))
+	if err != nil {
+		return nil, err
 	}
 
 	t.connectionID = atomic.AddUint64(&serverConnectionCounter, 1)
-
 	t.framer.writer.Flush()
 
 	defer func() {
@@ -443,6 +451,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			streamID:       streamID,
 			contentSubtype: s.contentSubtype,
 			status:         status.New(codes.Internal, errMsg),
+			rst:            !frame.StreamEnded(),
 		})
 		return false
 	}
@@ -479,14 +488,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	} else {
 		s.ctx, s.cancel = context.WithCancel(t.ctx)
 	}
-	pr := &peer.Peer{
-		Addr: t.remoteAddr,
-	}
-	// Attach Auth info if there is any.
-	if t.authInfo != nil {
-		pr.AuthInfo = t.authInfo
-	}
-	s.ctx = peer.NewContext(s.ctx, pr)
+
 	// Attach the received metadata to the context.
 	if len(mdata) > 0 {
 		s.ctx = metadata.NewIncomingContext(s.ctx, mdata)
@@ -516,14 +518,16 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	}
 	if httpMethod != http.MethodPost {
 		t.mu.Unlock()
+		errMsg := fmt.Sprintf("http2Server.operateHeaders parsed a :method field: %v which should be POST", httpMethod)
 		if logger.V(logLevel) {
-			logger.Infof("transport: http2Server.operateHeaders parsed a :method field: %v which should be POST", httpMethod)
+			logger.Infof("transport: %v", errMsg)
 		}
-		t.controlBuf.put(&cleanupStream{
-			streamID: streamID,
-			rst:      true,
-			rstCode:  http2.ErrCodeProtocol,
-			onWrite:  func() {},
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     405,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         status.New(codes.Internal, errMsg),
+			rst:            !frame.StreamEnded(),
 		})
 		s.cancel()
 		return false
@@ -544,6 +548,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 				streamID:       s.id,
 				contentSubtype: s.contentSubtype,
 				status:         stat,
+				rst:            !frame.StreamEnded(),
 			})
 			return false
 		}
@@ -561,8 +566,8 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 		t.adjustWindow(s, uint32(n))
 	}
 	s.ctx = traceCtx(s.ctx, s.method)
-	if t.stats != nil {
-		s.ctx = t.stats.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
+	for _, sh := range t.stats {
+		s.ctx = sh.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
 		inHeader := &stats.InHeader{
 			FullMethod:  s.method,
 			RemoteAddr:  t.remoteAddr,
@@ -571,7 +576,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			WireLength:  int(frame.Header().Length),
 			Header:      metadata.MD(mdata).Copy(),
 		}
-		t.stats.HandleRPC(s.ctx, inHeader)
+		sh.HandleRPC(s.ctx, inHeader)
 	}
 	s.ctxDone = s.ctx.Done()
 	s.wq = newWriteQuota(defaultWriteQuota, s.ctxDone)
@@ -925,12 +930,27 @@ func (t *http2Server) checkForHeaderListSize(it interface{}) bool {
 	return true
 }
 
+func (t *http2Server) streamContextErr(s *Stream) error {
+	select {
+	case <-t.done:
+		return ErrConnClosing
+	default:
+	}
+	return ContextErr(s.ctx.Err())
+}
+
 // WriteHeader sends the header metadata md back to the client.
 func (t *http2Server) WriteHeader(s *Stream, md metadata.MD) error {
-	if s.updateHeaderSent() || s.getState() == streamDone {
+	s.hdrMu.Lock()
+	defer s.hdrMu.Unlock()
+	if s.getState() == streamDone {
+		return t.streamContextErr(s)
+	}
+
+	if s.updateHeaderSent() {
 		return ErrIllegalHeaderWrite
 	}
-	s.hdrMu.Lock()
+
 	if md.Len() > 0 {
 		if s.header.Len() > 0 {
 			s.header = metadata.Join(s.header, md)
@@ -939,10 +959,8 @@ func (t *http2Server) WriteHeader(s *Stream, md metadata.MD) error {
 		}
 	}
 	if err := t.writeHeaderLocked(s); err != nil {
-		s.hdrMu.Unlock()
-		return err
+		return status.Convert(err).Err()
 	}
-	s.hdrMu.Unlock()
 	return nil
 }
 
@@ -973,14 +991,14 @@ func (t *http2Server) writeHeaderLocked(s *Stream) error {
 		t.closeStream(s, true, http2.ErrCodeInternal, false)
 		return ErrHeaderListSizeLimitViolation
 	}
-	if t.stats != nil {
+	for _, sh := range t.stats {
 		// Note: Headers are compressed with hpack after this call returns.
 		// No WireLength field is set here.
 		outHeader := &stats.OutHeader{
 			Header:      s.header.Copy(),
 			Compression: s.sendCompress,
 		}
-		t.stats.HandleRPC(s.Context(), outHeader)
+		sh.HandleRPC(s.Context(), outHeader)
 	}
 	return nil
 }
@@ -990,17 +1008,19 @@ func (t *http2Server) writeHeaderLocked(s *Stream) error {
 // TODO(zhaoq): Now it indicates the end of entire stream. Revisit if early
 // OK is adopted.
 func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
+	s.hdrMu.Lock()
+	defer s.hdrMu.Unlock()
+
 	if s.getState() == streamDone {
 		return nil
 	}
-	s.hdrMu.Lock()
+
 	// TODO(mmukhi): Benchmark if the performance gets better if count the metadata and other header fields
 	// first and create a slice of that exact size.
 	headerFields := make([]hpack.HeaderField, 0, 2) // grpc-status and grpc-message will be there if none else.
 	if !s.updateHeaderSent() {                      // No headers have been sent.
 		if len(s.header) > 0 { // Send a separate header frame.
 			if err := t.writeHeaderLocked(s); err != nil {
-				s.hdrMu.Unlock()
 				return err
 			}
 		} else { // Send a trailer only response.
@@ -1029,7 +1049,7 @@ func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
 		endStream: true,
 		onWrite:   t.setResetPingStrikes,
 	}
-	s.hdrMu.Unlock()
+
 	success, err := t.controlBuf.execute(t.checkForHeaderListSize, trailingHeader)
 	if !success {
 		if err != nil {
@@ -1041,10 +1061,10 @@ func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
 	// Send a RST_STREAM after the trailers if the client has not already half-closed.
 	rst := s.getState() == streamActive
 	t.finishStream(s, rst, http2.ErrCodeNo, trailingHeader, true)
-	if t.stats != nil {
+	for _, sh := range t.stats {
 		// Note: The trailer fields are compressed with hpack after this call returns.
 		// No WireLength field is set here.
-		t.stats.HandleRPC(s.Context(), &stats.OutTrailer{
+		sh.HandleRPC(s.Context(), &stats.OutTrailer{
 			Trailer: s.trailer.Copy(),
 		})
 	}
@@ -1056,23 +1076,12 @@ func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
 func (t *http2Server) Write(s *Stream, hdr []byte, data []byte, opts *Options) error {
 	if !s.isHeaderSent() { // Headers haven't been written yet.
 		if err := t.WriteHeader(s, nil); err != nil {
-			if _, ok := err.(ConnectionError); ok {
-				return err
-			}
-			// TODO(mmukhi, dfawley): Make sure this is the right code to return.
-			return status.Errorf(codes.Internal, "transport: %v", err)
+			return err
 		}
 	} else {
 		// Writing headers checks for this condition.
 		if s.getState() == streamDone {
-			// TODO(mmukhi, dfawley): Should the server write also return io.EOF?
-			s.cancel()
-			select {
-			case <-t.done:
-				return ErrConnClosing
-			default:
-			}
-			return ContextErr(s.ctx.Err())
+			return t.streamContextErr(s)
 		}
 	}
 	df := &dataFrame{
@@ -1082,12 +1091,7 @@ func (t *http2Server) Write(s *Stream, hdr []byte, data []byte, opts *Options) e
 		onEachWrite: t.setResetPingStrikes,
 	}
 	if err := s.wq.get(int32(len(hdr) + len(data))); err != nil {
-		select {
-		case <-t.done:
-			return ErrConnClosing
-		default:
-		}
-		return ContextErr(s.ctx.Err())
+		return t.streamContextErr(s)
 	}
 	return t.controlBuf.put(df)
 }
@@ -1210,25 +1214,19 @@ func (t *http2Server) Close() {
 	if err := t.conn.Close(); err != nil && logger.V(logLevel) {
 		logger.Infof("transport: error closing conn during Close: %v", err)
 	}
-	if channelz.IsOn() {
-		channelz.RemoveEntry(t.channelzID)
-	}
+	channelz.RemoveEntry(t.channelzID)
 	// Cancel all active streams.
 	for _, s := range streams {
 		s.cancel()
 	}
-	if t.stats != nil {
+	for _, sh := range t.stats {
 		connEnd := &stats.ConnEnd{}
-		t.stats.HandleConn(t.ctx, connEnd)
+		sh.HandleConn(t.ctx, connEnd)
 	}
 }
 
 // deleteStream deletes the stream s from transport's active streams.
 func (t *http2Server) deleteStream(s *Stream, eosReceived bool) {
-	// In case stream sending and receiving are invoked in separate
-	// goroutines (e.g., bi-directional streaming), cancel needs to be
-	// called to interrupt the potential blocking on other goroutines.
-	s.cancel()
 
 	t.mu.Lock()
 	if _, ok := t.activeStreams[s.id]; ok {
@@ -1250,6 +1248,11 @@ func (t *http2Server) deleteStream(s *Stream, eosReceived bool) {
 
 // finishStream closes the stream and puts the trailing headerFrame into controlbuf.
 func (t *http2Server) finishStream(s *Stream, rst bool, rstCode http2.ErrCode, hdr *headerFrame, eosReceived bool) {
+	// In case stream sending and receiving are invoked in separate
+	// goroutines (e.g., bi-directional streaming), cancel needs to be
+	// called to interrupt the potential blocking on other goroutines.
+	s.cancel()
+
 	oldState := s.swapState(streamDone)
 	if oldState == streamDone {
 		// If the stream was already done, return.
@@ -1269,6 +1272,11 @@ func (t *http2Server) finishStream(s *Stream, rst bool, rstCode http2.ErrCode, h
 
 // closeStream clears the footprint of a stream when the stream is not needed any more.
 func (t *http2Server) closeStream(s *Stream, rst bool, rstCode http2.ErrCode, eosReceived bool) {
+	// In case stream sending and receiving are invoked in separate
+	// goroutines (e.g., bi-directional streaming), cancel needs to be
+	// called to interrupt the potential blocking on other goroutines.
+	s.cancel()
+
 	s.swapState(streamDone)
 	t.deleteStream(s, eosReceived)
 
@@ -1404,6 +1412,13 @@ func (t *http2Server) getOutFlowWindow() int64 {
 	}
 }
 
+func (t *http2Server) getPeer() *peer.Peer {
+	return &peer.Peer{
+		Addr:     t.remoteAddr,
+		AuthInfo: t.authInfo, // Can be nil
+	}
+}
+
 func getJitter(v time.Duration) time.Duration {
 	if v == infinity {
 		return 0
diff --git a/vendor/google.golang.org/grpc/internal/transport/http_util.go b/vendor/google.golang.org/grpc/internal/transport/http_util.go
index d8247bcdf692..2c601a864d99 100644
--- a/vendor/google.golang.org/grpc/internal/transport/http_util.go
+++ b/vendor/google.golang.org/grpc/internal/transport/http_util.go
@@ -20,7 +20,6 @@ package transport
 
 import (
 	"bufio"
-	"bytes"
 	"encoding/base64"
 	"fmt"
 	"io"
@@ -45,14 +44,8 @@ import (
 const (
 	// http2MaxFrameLen specifies the max length of a HTTP2 frame.
 	http2MaxFrameLen = 16384 // 16KB frame
-	// http://http2.github.io/http2-spec/#SettingValues
+	// https://httpwg.org/specs/rfc7540.html#SettingValues
 	http2InitHeaderTableSize = 4096
-	// baseContentType is the base content-type for gRPC.  This is a valid
-	// content-type on it's own, but can also include a content-subtype such as
-	// "proto" as a suffix after "+" or ";".  See
-	// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests
-	// for more details.
-
 )
 
 var (
@@ -257,13 +250,13 @@ func encodeGrpcMessage(msg string) string {
 }
 
 func encodeGrpcMessageUnchecked(msg string) string {
-	var buf bytes.Buffer
+	var sb strings.Builder
 	for len(msg) > 0 {
 		r, size := utf8.DecodeRuneInString(msg)
 		for _, b := range []byte(string(r)) {
 			if size > 1 {
 				// If size > 1, r is not ascii. Always do percent encoding.
-				buf.WriteString(fmt.Sprintf("%%%02X", b))
+				fmt.Fprintf(&sb, "%%%02X", b)
 				continue
 			}
 
@@ -272,14 +265,14 @@ func encodeGrpcMessageUnchecked(msg string) string {
 			//
 			// fmt.Sprintf("%%%02X", utf8.RuneError) gives "%FFFD".
 			if b >= spaceByte && b <= tildeByte && b != percentByte {
-				buf.WriteByte(b)
+				sb.WriteByte(b)
 			} else {
-				buf.WriteString(fmt.Sprintf("%%%02X", b))
+				fmt.Fprintf(&sb, "%%%02X", b)
 			}
 		}
 		msg = msg[size:]
 	}
-	return buf.String()
+	return sb.String()
 }
 
 // decodeGrpcMessage decodes the msg encoded by encodeGrpcMessage.
@@ -297,23 +290,23 @@ func decodeGrpcMessage(msg string) string {
 }
 
 func decodeGrpcMessageUnchecked(msg string) string {
-	var buf bytes.Buffer
+	var sb strings.Builder
 	lenMsg := len(msg)
 	for i := 0; i < lenMsg; i++ {
 		c := msg[i]
 		if c == percentByte && i+2 < lenMsg {
 			parsed, err := strconv.ParseUint(msg[i+1:i+3], 16, 8)
 			if err != nil {
-				buf.WriteByte(c)
+				sb.WriteByte(c)
 			} else {
-				buf.WriteByte(byte(parsed))
+				sb.WriteByte(byte(parsed))
 				i += 2
 			}
 		} else {
-			buf.WriteByte(c)
+			sb.WriteByte(c)
 		}
 	}
-	return buf.String()
+	return sb.String()
 }
 
 type bufWriter struct {
@@ -322,8 +315,6 @@ type bufWriter struct {
 	batchSize int
 	conn      net.Conn
 	err       error
-
-	onFlush func()
 }
 
 func newBufWriter(conn net.Conn, batchSize int) *bufWriter {
@@ -360,9 +351,6 @@ func (w *bufWriter) Flush() error {
 	if w.offset == 0 {
 		return nil
 	}
-	if w.onFlush != nil {
-		w.onFlush()
-	}
 	_, w.err = w.conn.Write(w.buf[:w.offset])
 	w.offset = 0
 	return w.err
diff --git a/vendor/google.golang.org/grpc/internal/transport/transport.go b/vendor/google.golang.org/grpc/internal/transport/transport.go
index 0c43efaa6497..6c3ba8515940 100644
--- a/vendor/google.golang.org/grpc/internal/transport/transport.go
+++ b/vendor/google.golang.org/grpc/internal/transport/transport.go
@@ -34,6 +34,7 @@ import (
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/resolver"
@@ -522,14 +523,14 @@ type ServerConfig struct {
 	ConnectionTimeout     time.Duration
 	Credentials           credentials.TransportCredentials
 	InTapHandle           tap.ServerInHandle
-	StatsHandler          stats.Handler
+	StatsHandlers         []stats.Handler
 	KeepaliveParams       keepalive.ServerParameters
 	KeepalivePolicy       keepalive.EnforcementPolicy
 	InitialWindowSize     int32
 	InitialConnWindowSize int32
 	WriteBufferSize       int
 	ReadBufferSize        int
-	ChannelzParentID      int64
+	ChannelzParentID      *channelz.Identifier
 	MaxHeaderListSize     *uint32
 	HeaderTableSize       *uint32
 }
@@ -552,8 +553,8 @@ type ConnectOptions struct {
 	CredsBundle credentials.Bundle
 	// KeepaliveParams stores the keepalive parameters.
 	KeepaliveParams keepalive.ClientParameters
-	// StatsHandler stores the handler for stats.
-	StatsHandler stats.Handler
+	// StatsHandlers stores the handler for stats.
+	StatsHandlers []stats.Handler
 	// InitialWindowSize sets the initial window size for a stream.
 	InitialWindowSize int32
 	// InitialConnWindowSize sets the initial window size for a connection.
@@ -563,7 +564,7 @@ type ConnectOptions struct {
 	// ReadBufferSize sets the size of read buffer, which in turn determines how much data can be read at most for one read syscall.
 	ReadBufferSize int
 	// ChannelzParentID sets the addrConn id which initiate the creation of this client transport.
-	ChannelzParentID int64
+	ChannelzParentID *channelz.Identifier
 	// MaxHeaderListSize sets the max (uncompressed) size of header list that is prepared to be received.
 	MaxHeaderListSize *uint32
 	// UseProxy specifies if a proxy should be used.
diff --git a/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go b/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go
index 6f30c8016e2b..9873da268db6 100644
--- a/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go
+++ b/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go
@@ -122,8 +122,11 @@ func matchersFromPermissions(permissions []*v3rbacpb.Permission) ([]matcher, err
 			}
 			matchers = append(matchers, &notMatcher{matcherToNot: mList[0]})
 		case *v3rbacpb.Permission_Metadata:
-			// Not supported in gRPC RBAC currently - a permission typed as
-			// Metadata in the initial config will be a no-op.
+			// Never matches - so no-op if not inverted, always match if
+			// inverted.
+			if permission.GetMetadata().GetInvert() { // Test metadata being no-op and also metadata with invert always matching
+				matchers = append(matchers, &alwaysMatcher{})
+			}
 		case *v3rbacpb.Permission_RequestedServerName:
 			// Not supported in gRPC RBAC currently - a permission typed as
 			// requested server name in the initial config will be a no-op.
diff --git a/vendor/google.golang.org/grpc/metadata/metadata.go b/vendor/google.golang.org/grpc/metadata/metadata.go
index 3604c7819fdc..98d62e0675f6 100644
--- a/vendor/google.golang.org/grpc/metadata/metadata.go
+++ b/vendor/google.golang.org/grpc/metadata/metadata.go
@@ -50,7 +50,7 @@ type MD map[string][]string
 // Keys beginning with "grpc-" are reserved for grpc-internal use only and may
 // result in errors if set in metadata.
 func New(m map[string]string) MD {
-	md := MD{}
+	md := make(MD, len(m))
 	for k, val := range m {
 		key := strings.ToLower(k)
 		md[key] = append(md[key], val)
@@ -74,7 +74,7 @@ func Pairs(kv ...string) MD {
 	if len(kv)%2 == 1 {
 		panic(fmt.Sprintf("metadata: Pairs got the odd number of input pairs for metadata: %d", len(kv)))
 	}
-	md := MD{}
+	md := make(MD, len(kv)/2)
 	for i := 0; i < len(kv); i += 2 {
 		key := strings.ToLower(kv[i])
 		md[key] = append(md[key], kv[i+1])
@@ -182,17 +182,51 @@ func FromIncomingContext(ctx context.Context) (MD, bool) {
 	if !ok {
 		return nil, false
 	}
-	out := MD{}
+	out := make(MD, len(md))
 	for k, v := range md {
 		// We need to manually convert all keys to lower case, because MD is a
 		// map, and there's no guarantee that the MD attached to the context is
 		// created using our helper functions.
 		key := strings.ToLower(k)
-		out[key] = v
+		out[key] = copyOf(v)
 	}
 	return out, true
 }
 
+// ValueFromIncomingContext returns the metadata value corresponding to the metadata
+// key from the incoming metadata if it exists. Key must be lower-case.
+//
+// Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ValueFromIncomingContext(ctx context.Context, key string) []string {
+	md, ok := ctx.Value(mdIncomingKey{}).(MD)
+	if !ok {
+		return nil
+	}
+
+	if v, ok := md[key]; ok {
+		return copyOf(v)
+	}
+	for k, v := range md {
+		// We need to manually convert all keys to lower case, because MD is a
+		// map, and there's no guarantee that the MD attached to the context is
+		// created using our helper functions.
+		if strings.ToLower(k) == key {
+			return copyOf(v)
+		}
+	}
+	return nil
+}
+
+// the returned slice must not be modified in place
+func copyOf(v []string) []string {
+	vals := make([]string, len(v))
+	copy(vals, v)
+	return vals
+}
+
 // FromOutgoingContextRaw returns the un-merged, intermediary contents of rawMD.
 //
 // Remember to perform strings.ToLower on the keys, for both the returned MD (MD
@@ -220,13 +254,18 @@ func FromOutgoingContext(ctx context.Context) (MD, bool) {
 		return nil, false
 	}
 
-	out := MD{}
+	mdSize := len(raw.md)
+	for i := range raw.added {
+		mdSize += len(raw.added[i]) / 2
+	}
+
+	out := make(MD, mdSize)
 	for k, v := range raw.md {
 		// We need to manually convert all keys to lower case, because MD is a
 		// map, and there's no guarantee that the MD attached to the context is
 		// created using our helper functions.
 		key := strings.ToLower(k)
-		out[key] = v
+		out[key] = copyOf(v)
 	}
 	for _, added := range raw.added {
 		if len(added)%2 == 1 {
diff --git a/vendor/google.golang.org/grpc/picker_wrapper.go b/vendor/google.golang.org/grpc/picker_wrapper.go
index e8367cb8993b..843633c910a1 100644
--- a/vendor/google.golang.org/grpc/picker_wrapper.go
+++ b/vendor/google.golang.org/grpc/picker_wrapper.go
@@ -131,7 +131,7 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 			}
 			if _, ok := status.FromError(err); ok {
 				// Status error: end the RPC unconditionally with this status.
-				return nil, nil, err
+				return nil, nil, dropError{error: err}
 			}
 			// For all other errors, wait for ready RPCs should block and other
 			// RPCs should fail with unavailable.
@@ -175,3 +175,9 @@ func (pw *pickerWrapper) close() {
 	pw.done = true
 	close(pw.blockingCh)
 }
+
+// dropError is a wrapper error that indicates the LB policy wishes to drop the
+// RPC and not retry it.
+type dropError struct {
+	error
+}
diff --git a/vendor/google.golang.org/grpc/pickfirst.go b/vendor/google.golang.org/grpc/pickfirst.go
index 5168b62b078a..fb7a99e0a273 100644
--- a/vendor/google.golang.org/grpc/pickfirst.go
+++ b/vendor/google.golang.org/grpc/pickfirst.go
@@ -44,79 +44,107 @@ func (*pickfirstBuilder) Name() string {
 }
 
 type pickfirstBalancer struct {
-	state connectivity.State
-	cc    balancer.ClientConn
-	sc    balancer.SubConn
+	state   connectivity.State
+	cc      balancer.ClientConn
+	subConn balancer.SubConn
 }
 
 func (b *pickfirstBalancer) ResolverError(err error) {
-	switch b.state {
-	case connectivity.TransientFailure, connectivity.Idle, connectivity.Connecting:
-		// Set a failing picker if we don't have a good picker.
-		b.cc.UpdateState(balancer.State{ConnectivityState: connectivity.TransientFailure,
-			Picker: &picker{err: fmt.Errorf("name resolver error: %v", err)},
-		})
-	}
 	if logger.V(2) {
 		logger.Infof("pickfirstBalancer: ResolverError called with error %v", err)
 	}
+	if b.subConn == nil {
+		b.state = connectivity.TransientFailure
+	}
+
+	if b.state != connectivity.TransientFailure {
+		// The picker will not change since the balancer does not currently
+		// report an error.
+		return
+	}
+	b.cc.UpdateState(balancer.State{
+		ConnectivityState: connectivity.TransientFailure,
+		Picker:            &picker{err: fmt.Errorf("name resolver error: %v", err)},
+	})
 }
 
-func (b *pickfirstBalancer) UpdateClientConnState(cs balancer.ClientConnState) error {
-	if len(cs.ResolverState.Addresses) == 0 {
+func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState) error {
+	if len(state.ResolverState.Addresses) == 0 {
+		// The resolver reported an empty address list. Treat it like an error by
+		// calling b.ResolverError.
+		if b.subConn != nil {
+			// Remove the old subConn. All addresses were removed, so it is no longer
+			// valid.
+			b.cc.RemoveSubConn(b.subConn)
+			b.subConn = nil
+		}
 		b.ResolverError(errors.New("produced zero addresses"))
 		return balancer.ErrBadResolverState
 	}
-	if b.sc == nil {
-		var err error
-		b.sc, err = b.cc.NewSubConn(cs.ResolverState.Addresses, balancer.NewSubConnOptions{})
-		if err != nil {
-			if logger.V(2) {
-				logger.Errorf("pickfirstBalancer: failed to NewSubConn: %v", err)
-			}
-			b.state = connectivity.TransientFailure
-			b.cc.UpdateState(balancer.State{ConnectivityState: connectivity.TransientFailure,
-				Picker: &picker{err: fmt.Errorf("error creating connection: %v", err)},
-			})
-			return balancer.ErrBadResolverState
+
+	if b.subConn != nil {
+		b.cc.UpdateAddresses(b.subConn, state.ResolverState.Addresses)
+		return nil
+	}
+
+	subConn, err := b.cc.NewSubConn(state.ResolverState.Addresses, balancer.NewSubConnOptions{})
+	if err != nil {
+		if logger.V(2) {
+			logger.Errorf("pickfirstBalancer: failed to NewSubConn: %v", err)
 		}
-		b.state = connectivity.Idle
-		b.cc.UpdateState(balancer.State{ConnectivityState: connectivity.Idle, Picker: &picker{result: balancer.PickResult{SubConn: b.sc}}})
-		b.sc.Connect()
-	} else {
-		b.cc.UpdateAddresses(b.sc, cs.ResolverState.Addresses)
-		b.sc.Connect()
+		b.state = connectivity.TransientFailure
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: connectivity.TransientFailure,
+			Picker:            &picker{err: fmt.Errorf("error creating connection: %v", err)},
+		})
+		return balancer.ErrBadResolverState
 	}
+	b.subConn = subConn
+	b.state = connectivity.Idle
+	b.cc.UpdateState(balancer.State{
+		ConnectivityState: connectivity.Idle,
+		Picker:            &picker{result: balancer.PickResult{SubConn: b.subConn}},
+	})
+	b.subConn.Connect()
 	return nil
 }
 
-func (b *pickfirstBalancer) UpdateSubConnState(sc balancer.SubConn, s balancer.SubConnState) {
+func (b *pickfirstBalancer) UpdateSubConnState(subConn balancer.SubConn, state balancer.SubConnState) {
 	if logger.V(2) {
-		logger.Infof("pickfirstBalancer: UpdateSubConnState: %p, %v", sc, s)
+		logger.Infof("pickfirstBalancer: UpdateSubConnState: %p, %v", subConn, state)
 	}
-	if b.sc != sc {
+	if b.subConn != subConn {
 		if logger.V(2) {
-			logger.Infof("pickfirstBalancer: ignored state change because sc is not recognized")
+			logger.Infof("pickfirstBalancer: ignored state change because subConn is not recognized")
 		}
 		return
 	}
-	b.state = s.ConnectivityState
-	if s.ConnectivityState == connectivity.Shutdown {
-		b.sc = nil
+	b.state = state.ConnectivityState
+	if state.ConnectivityState == connectivity.Shutdown {
+		b.subConn = nil
 		return
 	}
 
-	switch s.ConnectivityState {
+	switch state.ConnectivityState {
 	case connectivity.Ready:
-		b.cc.UpdateState(balancer.State{ConnectivityState: s.ConnectivityState, Picker: &picker{result: balancer.PickResult{SubConn: sc}}})
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &picker{result: balancer.PickResult{SubConn: subConn}},
+		})
 	case connectivity.Connecting:
-		b.cc.UpdateState(balancer.State{ConnectivityState: s.ConnectivityState, Picker: &picker{err: balancer.ErrNoSubConnAvailable}})
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &picker{err: balancer.ErrNoSubConnAvailable},
+		})
 	case connectivity.Idle:
-		b.cc.UpdateState(balancer.State{ConnectivityState: s.ConnectivityState, Picker: &idlePicker{sc: sc}})
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &idlePicker{subConn: subConn},
+		})
 	case connectivity.TransientFailure:
 		b.cc.UpdateState(balancer.State{
-			ConnectivityState: s.ConnectivityState,
-			Picker:            &picker{err: s.ConnectionError},
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &picker{err: state.ConnectionError},
 		})
 	}
 }
@@ -125,8 +153,8 @@ func (b *pickfirstBalancer) Close() {
 }
 
 func (b *pickfirstBalancer) ExitIdle() {
-	if b.sc != nil && b.state == connectivity.Idle {
-		b.sc.Connect()
+	if b.subConn != nil && b.state == connectivity.Idle {
+		b.subConn.Connect()
 	}
 }
 
@@ -135,18 +163,18 @@ type picker struct {
 	err    error
 }
 
-func (p *picker) Pick(info balancer.PickInfo) (balancer.PickResult, error) {
+func (p *picker) Pick(balancer.PickInfo) (balancer.PickResult, error) {
 	return p.result, p.err
 }
 
 // idlePicker is used when the SubConn is IDLE and kicks the SubConn into
 // CONNECTING when Pick is called.
 type idlePicker struct {
-	sc balancer.SubConn
+	subConn balancer.SubConn
 }
 
-func (i *idlePicker) Pick(info balancer.PickInfo) (balancer.PickResult, error) {
-	i.sc.Connect()
+func (i *idlePicker) Pick(balancer.PickInfo) (balancer.PickResult, error) {
+	i.subConn.Connect()
 	return balancer.PickResult{}, balancer.ErrNoSubConnAvailable
 }
 
diff --git a/vendor/google.golang.org/grpc/regenerate.sh b/vendor/google.golang.org/grpc/regenerate.sh
index 978b89f37a4a..99db79fafcfb 100644
--- a/vendor/google.golang.org/grpc/regenerate.sh
+++ b/vendor/google.golang.org/grpc/regenerate.sh
@@ -68,7 +68,6 @@ SOURCES=(
   ${WORKDIR}/grpc-proto/grpc/gcp/transport_security_common.proto
   ${WORKDIR}/grpc-proto/grpc/lookup/v1/rls.proto
   ${WORKDIR}/grpc-proto/grpc/lookup/v1/rls_config.proto
-  ${WORKDIR}/grpc-proto/grpc/service_config/service_config.proto
   ${WORKDIR}/grpc-proto/grpc/testing/*.proto
   ${WORKDIR}/grpc-proto/grpc/core/*.proto
 )
@@ -80,8 +79,7 @@ SOURCES=(
 # Note that the protos listed here are all for testing purposes. All protos to
 # be used externally should have a go_package option (and they don't need to be
 # listed here).
-OPTS=Mgrpc/service_config/service_config.proto=/internal/proto/grpc_service_config,\
-Mgrpc/core/stats.proto=google.golang.org/grpc/interop/grpc_testing/core,\
+OPTS=Mgrpc/core/stats.proto=google.golang.org/grpc/interop/grpc_testing/core,\
 Mgrpc/testing/benchmark_service.proto=google.golang.org/grpc/interop/grpc_testing,\
 Mgrpc/testing/stats.proto=google.golang.org/grpc/interop/grpc_testing,\
 Mgrpc/testing/report_qps_scenario_service.proto=google.golang.org/grpc/interop/grpc_testing,\
@@ -121,9 +119,6 @@ mv ${WORKDIR}/out/google.golang.org/grpc/lookup/grpc_lookup_v1/* ${WORKDIR}/out/
 # see grpc_testing_not_regenerate/README.md for details.
 rm ${WORKDIR}/out/google.golang.org/grpc/reflection/grpc_testing_not_regenerate/*.pb.go
 
-# grpc/service_config/service_config.proto does not have a go_package option.
-mv ${WORKDIR}/out/grpc/service_config/service_config.pb.go internal/proto/grpc_service_config
-
 # grpc/testing does not have a go_package option.
 mv ${WORKDIR}/out/grpc/testing/*.pb.go interop/grpc_testing/
 mv ${WORKDIR}/out/grpc/core/*.pb.go interop/grpc_testing/core/
diff --git a/vendor/google.golang.org/grpc/resolver/map.go b/vendor/google.golang.org/grpc/resolver/map.go
index e87ecd0eeb38..efcb7f3efd82 100644
--- a/vendor/google.golang.org/grpc/resolver/map.go
+++ b/vendor/google.golang.org/grpc/resolver/map.go
@@ -28,25 +28,40 @@ type addressMapEntry struct {
 // Multiple accesses may not be performed concurrently.  Must be created via
 // NewAddressMap; do not construct directly.
 type AddressMap struct {
-	m map[string]addressMapEntryList
+	// The underlying map is keyed by an Address with fields that we don't care
+	// about being set to their zero values. The only fields that we care about
+	// are `Addr`, `ServerName` and `Attributes`. Since we need to be able to
+	// distinguish between addresses with same `Addr` and `ServerName`, but
+	// different `Attributes`, we cannot store the `Attributes` in the map key.
+	//
+	// The comparison operation for structs work as follows:
+	//  Struct values are comparable if all their fields are comparable. Two
+	//  struct values are equal if their corresponding non-blank fields are equal.
+	//
+	// The value type of the map contains a slice of addresses which match the key
+	// in their `Addr` and `ServerName` fields and contain the corresponding value
+	// associated with them.
+	m map[Address]addressMapEntryList
+}
+
+func toMapKey(addr *Address) Address {
+	return Address{Addr: addr.Addr, ServerName: addr.ServerName}
 }
 
 type addressMapEntryList []*addressMapEntry
 
 // NewAddressMap creates a new AddressMap.
 func NewAddressMap() *AddressMap {
-	return &AddressMap{m: make(map[string]addressMapEntryList)}
+	return &AddressMap{m: make(map[Address]addressMapEntryList)}
 }
 
 // find returns the index of addr in the addressMapEntry slice, or -1 if not
 // present.
 func (l addressMapEntryList) find(addr Address) int {
-	if len(l) == 0 {
-		return -1
-	}
 	for i, entry := range l {
-		if entry.addr.ServerName == addr.ServerName &&
-			entry.addr.Attributes.Equal(addr.Attributes) {
+		// Attributes are the only thing to match on here, since `Addr` and
+		// `ServerName` are already equal.
+		if entry.addr.Attributes.Equal(addr.Attributes) {
 			return i
 		}
 	}
@@ -55,7 +70,8 @@ func (l addressMapEntryList) find(addr Address) int {
 
 // Get returns the value for the address in the map, if present.
 func (a *AddressMap) Get(addr Address) (value interface{}, ok bool) {
-	entryList := a.m[addr.Addr]
+	addrKey := toMapKey(&addr)
+	entryList := a.m[addrKey]
 	if entry := entryList.find(addr); entry != -1 {
 		return entryList[entry].value, true
 	}
@@ -64,17 +80,19 @@ func (a *AddressMap) Get(addr Address) (value interface{}, ok bool) {
 
 // Set updates or adds the value to the address in the map.
 func (a *AddressMap) Set(addr Address, value interface{}) {
-	entryList := a.m[addr.Addr]
+	addrKey := toMapKey(&addr)
+	entryList := a.m[addrKey]
 	if entry := entryList.find(addr); entry != -1 {
-		a.m[addr.Addr][entry].value = value
+		entryList[entry].value = value
 		return
 	}
-	a.m[addr.Addr] = append(a.m[addr.Addr], &addressMapEntry{addr: addr, value: value})
+	a.m[addrKey] = append(entryList, &addressMapEntry{addr: addr, value: value})
 }
 
 // Delete removes addr from the map.
 func (a *AddressMap) Delete(addr Address) {
-	entryList := a.m[addr.Addr]
+	addrKey := toMapKey(&addr)
+	entryList := a.m[addrKey]
 	entry := entryList.find(addr)
 	if entry == -1 {
 		return
@@ -85,7 +103,7 @@ func (a *AddressMap) Delete(addr Address) {
 		copy(entryList[entry:], entryList[entry+1:])
 		entryList = entryList[:len(entryList)-1]
 	}
-	a.m[addr.Addr] = entryList
+	a.m[addrKey] = entryList
 }
 
 // Len returns the number of entries in the map.
@@ -107,3 +125,14 @@ func (a *AddressMap) Keys() []Address {
 	}
 	return ret
 }
+
+// Values returns a slice of all current map values.
+func (a *AddressMap) Values() []interface{} {
+	ret := make([]interface{}, 0, a.Len())
+	for _, entryList := range a.m {
+		for _, entry := range entryList {
+			ret = append(ret, entry.value)
+		}
+	}
+	return ret
+}
diff --git a/vendor/google.golang.org/grpc/resolver/resolver.go b/vendor/google.golang.org/grpc/resolver/resolver.go
index e28b68026062..ca2e35a3596f 100644
--- a/vendor/google.golang.org/grpc/resolver/resolver.go
+++ b/vendor/google.golang.org/grpc/resolver/resolver.go
@@ -27,6 +27,7 @@ import (
 
 	"google.golang.org/grpc/attributes"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/pretty"
 	"google.golang.org/grpc/serviceconfig"
 )
 
@@ -139,13 +140,18 @@ type Address struct {
 
 // Equal returns whether a and o are identical.  Metadata is compared directly,
 // not with any recursive introspection.
-func (a *Address) Equal(o Address) bool {
+func (a Address) Equal(o Address) bool {
 	return a.Addr == o.Addr && a.ServerName == o.ServerName &&
 		a.Attributes.Equal(o.Attributes) &&
 		a.BalancerAttributes.Equal(o.BalancerAttributes) &&
 		a.Type == o.Type && a.Metadata == o.Metadata
 }
 
+// String returns JSON formatted string representation of the address.
+func (a Address) String() string {
+	return pretty.ToJSON(a)
+}
+
 // BuildOptions includes additional information for the builder to create
 // the resolver.
 type BuildOptions struct {
diff --git a/vendor/google.golang.org/grpc/resolver_conn_wrapper.go b/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
index 2c47cd54f07c..05a9d4e0bac0 100644
--- a/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
+++ b/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
@@ -19,7 +19,6 @@
 package grpc
 
 import (
-	"fmt"
 	"strings"
 	"sync"
 
@@ -27,6 +26,7 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/internal/pretty"
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/serviceconfig"
 )
@@ -97,10 +97,7 @@ func (ccr *ccResolverWrapper) UpdateState(s resolver.State) error {
 	if ccr.done.HasFired() {
 		return nil
 	}
-	channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: sending update to cc: %v", s)
-	if channelz.IsOn() {
-		ccr.addChannelzTraceEvent(s)
-	}
+	ccr.addChannelzTraceEvent(s)
 	ccr.curState = s
 	if err := ccr.cc.updateResolverState(ccr.curState, nil); err == balancer.ErrBadResolverState {
 		return balancer.ErrBadResolverState
@@ -125,10 +122,7 @@ func (ccr *ccResolverWrapper) NewAddress(addrs []resolver.Address) {
 	if ccr.done.HasFired() {
 		return
 	}
-	channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: sending new addresses to cc: %v", addrs)
-	if channelz.IsOn() {
-		ccr.addChannelzTraceEvent(resolver.State{Addresses: addrs, ServiceConfig: ccr.curState.ServiceConfig})
-	}
+	ccr.addChannelzTraceEvent(resolver.State{Addresses: addrs, ServiceConfig: ccr.curState.ServiceConfig})
 	ccr.curState.Addresses = addrs
 	ccr.cc.updateResolverState(ccr.curState, nil)
 }
@@ -141,7 +135,7 @@ func (ccr *ccResolverWrapper) NewServiceConfig(sc string) {
 	if ccr.done.HasFired() {
 		return
 	}
-	channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: got new service config: %v", sc)
+	channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: got new service config: %s", sc)
 	if ccr.cc.dopts.disableServiceConfig {
 		channelz.Info(logger, ccr.cc.channelzID, "Service config lookups disabled; ignoring config")
 		return
@@ -151,9 +145,7 @@ func (ccr *ccResolverWrapper) NewServiceConfig(sc string) {
 		channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: error parsing service config: %v", scpr.Err)
 		return
 	}
-	if channelz.IsOn() {
-		ccr.addChannelzTraceEvent(resolver.State{Addresses: ccr.curState.Addresses, ServiceConfig: scpr})
-	}
+	ccr.addChannelzTraceEvent(resolver.State{Addresses: ccr.curState.Addresses, ServiceConfig: scpr})
 	ccr.curState.ServiceConfig = scpr
 	ccr.cc.updateResolverState(ccr.curState, nil)
 }
@@ -180,8 +172,5 @@ func (ccr *ccResolverWrapper) addChannelzTraceEvent(s resolver.State) {
 	} else if len(ccr.curState.Addresses) == 0 && len(s.Addresses) > 0 {
 		updates = append(updates, "resolver returned new addresses")
 	}
-	channelz.AddTraceEvent(logger, ccr.cc.channelzID, 0, &channelz.TraceEventDesc{
-		Desc:     fmt.Sprintf("Resolver state updated: %+v (%v)", s, strings.Join(updates, "; ")),
-		Severity: channelz.CtInfo,
-	})
+	channelz.Infof(logger, ccr.cc.channelzID, "Resolver state updated: %s (%v)", pretty.ToJSON(s), strings.Join(updates, "; "))
 }
diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go
index b24b6d53958d..f4dde72b41f8 100644
--- a/vendor/google.golang.org/grpc/server.go
+++ b/vendor/google.golang.org/grpc/server.go
@@ -73,6 +73,14 @@ func init() {
 	internal.DrainServerTransports = func(srv *Server, addr string) {
 		srv.drainServerTransports(addr)
 	}
+	internal.AddGlobalServerOptions = func(opt ...ServerOption) {
+		extraServerOptions = append(extraServerOptions, opt...)
+	}
+	internal.ClearGlobalServerOptions = func() {
+		extraServerOptions = nil
+	}
+	internal.BinaryLogger = binaryLogger
+	internal.JoinServerOptions = newJoinServerOption
 }
 
 var statusOK = status.New(codes.OK, "")
@@ -134,7 +142,7 @@ type Server struct {
 	channelzRemoveOnce sync.Once
 	serveWG            sync.WaitGroup // counts active Serve goroutines for GracefulStop
 
-	channelzID int64 // channelz unique identification number
+	channelzID *channelz.Identifier
 	czData     *channelzData
 
 	serverWorkerChannels []chan *serverWorkerData
@@ -149,8 +157,9 @@ type serverOptions struct {
 	streamInt             StreamServerInterceptor
 	chainUnaryInts        []UnaryServerInterceptor
 	chainStreamInts       []StreamServerInterceptor
+	binaryLogger          binarylog.Logger
 	inTapHandle           tap.ServerInHandle
-	statsHandler          stats.Handler
+	statsHandlers         []stats.Handler
 	maxConcurrentStreams  uint32
 	maxReceiveMessageSize int
 	maxSendMessageSize    int
@@ -174,6 +183,7 @@ var defaultServerOptions = serverOptions{
 	writeBufferSize:       defaultWriteBufSize,
 	readBufferSize:        defaultReadBufSize,
 }
+var extraServerOptions []ServerOption
 
 // A ServerOption sets options such as credentials, codec and keepalive parameters, etc.
 type ServerOption interface {
@@ -183,7 +193,7 @@ type ServerOption interface {
 // EmptyServerOption does not alter the server configuration. It can be embedded
 // in another structure to build custom server options.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This type is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -207,6 +217,22 @@ func newFuncServerOption(f func(*serverOptions)) *funcServerOption {
 	}
 }
 
+// joinServerOption provides a way to combine arbitrary number of server
+// options into one.
+type joinServerOption struct {
+	opts []ServerOption
+}
+
+func (mdo *joinServerOption) apply(do *serverOptions) {
+	for _, opt := range mdo.opts {
+		opt.apply(do)
+	}
+}
+
+func newJoinServerOption(opts ...ServerOption) ServerOption {
+	return &joinServerOption{opts: opts}
+}
+
 // WriteBufferSize determines how much data can be batched before doing a write on the wire.
 // The corresponding memory allocation for this buffer will be twice the size to keep syscalls low.
 // The default value for this buffer is 32KB.
@@ -298,7 +324,7 @@ func CustomCodec(codec Codec) ServerOption {
 // https://github.com/grpc/grpc-go/blob/master/Documentation/encoding.md#using-a-codec.
 // Will be supported throughout 1.x.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -419,7 +445,7 @@ func ChainStreamInterceptor(interceptors ...StreamServerInterceptor) ServerOptio
 // InTapHandle returns a ServerOption that sets the tap handle for all the server
 // transport to be created. Only one can be installed.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -435,7 +461,21 @@ func InTapHandle(h tap.ServerInHandle) ServerOption {
 // StatsHandler returns a ServerOption that sets the stats handler for the server.
 func StatsHandler(h stats.Handler) ServerOption {
 	return newFuncServerOption(func(o *serverOptions) {
-		o.statsHandler = h
+		if h == nil {
+			logger.Error("ignoring nil parameter in grpc.StatsHandler ServerOption")
+			// Do not allow a nil stats handler, which would otherwise cause
+			// panics.
+			return
+		}
+		o.statsHandlers = append(o.statsHandlers, h)
+	})
+}
+
+// binaryLogger returns a ServerOption that can set the binary logger for the
+// server.
+func binaryLogger(bl binarylog.Logger) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.binaryLogger = bl
 	})
 }
 
@@ -462,7 +502,7 @@ func UnknownServiceHandler(streamHandler StreamHandler) ServerOption {
 // new connections.  If this is not set, the default is 120 seconds.  A zero or
 // negative value will result in an immediate timeout.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -483,7 +523,7 @@ func MaxHeaderListSize(s uint32) ServerOption {
 // HeaderTableSize returns a ServerOption that sets the size of dynamic
 // header table for stream.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -498,7 +538,7 @@ func HeaderTableSize(s uint32) ServerOption {
 // zero (default) will disable workers and spawn a new goroutine for each
 // stream.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -560,6 +600,9 @@ func (s *Server) stopServerWorkers() {
 // started to accept requests yet.
 func NewServer(opt ...ServerOption) *Server {
 	opts := defaultServerOptions
+	for _, o := range extraServerOptions {
+		o.apply(&opts)
+	}
 	for _, o := range opt {
 		o.apply(&opts)
 	}
@@ -584,9 +627,8 @@ func NewServer(opt ...ServerOption) *Server {
 		s.initServerWorkers()
 	}
 
-	if channelz.IsOn() {
-		s.channelzID = channelz.RegisterServer(&channelzServer{s}, "")
-	}
+	s.channelzID = channelz.RegisterServer(&channelzServer{s}, "")
+	channelz.Info(logger, s.channelzID, "Server created")
 	return s
 }
 
@@ -712,7 +754,7 @@ var ErrServerStopped = errors.New("grpc: the server has been stopped")
 
 type listenSocket struct {
 	net.Listener
-	channelzID int64
+	channelzID *channelz.Identifier
 }
 
 func (l *listenSocket) ChannelzMetric() *channelz.SocketInternalMetric {
@@ -724,9 +766,8 @@ func (l *listenSocket) ChannelzMetric() *channelz.SocketInternalMetric {
 
 func (l *listenSocket) Close() error {
 	err := l.Listener.Close()
-	if channelz.IsOn() {
-		channelz.RemoveEntry(l.channelzID)
-	}
+	channelz.RemoveEntry(l.channelzID)
+	channelz.Info(logger, l.channelzID, "ListenSocket deleted")
 	return err
 }
 
@@ -759,11 +800,6 @@ func (s *Server) Serve(lis net.Listener) error {
 	ls := &listenSocket{Listener: lis}
 	s.lis[ls] = true
 
-	if channelz.IsOn() {
-		ls.channelzID = channelz.RegisterListenSocket(ls, s.channelzID, lis.Addr().String())
-	}
-	s.mu.Unlock()
-
 	defer func() {
 		s.mu.Lock()
 		if s.lis != nil && s.lis[ls] {
@@ -773,8 +809,16 @@ func (s *Server) Serve(lis net.Listener) error {
 		s.mu.Unlock()
 	}()
 
-	var tempDelay time.Duration // how long to sleep on accept failure
+	var err error
+	ls.channelzID, err = channelz.RegisterListenSocket(ls, s.channelzID, lis.Addr().String())
+	if err != nil {
+		s.mu.Unlock()
+		return err
+	}
+	s.mu.Unlock()
+	channelz.Info(logger, ls.channelzID, "ListenSocket created")
 
+	var tempDelay time.Duration // how long to sleep on accept failure
 	for {
 		rawConn, err := lis.Accept()
 		if err != nil {
@@ -866,7 +910,7 @@ func (s *Server) newHTTP2Transport(c net.Conn) transport.ServerTransport {
 		ConnectionTimeout:     s.opts.connectionTimeout,
 		Credentials:           s.opts.creds,
 		InTapHandle:           s.opts.inTapHandle,
-		StatsHandler:          s.opts.statsHandler,
+		StatsHandlers:         s.opts.statsHandlers,
 		KeepaliveParams:       s.opts.keepaliveParams,
 		KeepalivePolicy:       s.opts.keepalivePolicy,
 		InitialWindowSize:     s.opts.initialWindowSize,
@@ -887,7 +931,7 @@ func (s *Server) newHTTP2Transport(c net.Conn) transport.ServerTransport {
 		if err != credentials.ErrConnDispatched {
 			// Don't log on ErrConnDispatched and io.EOF to prevent log spam.
 			if err != io.EOF {
-				channelz.Warning(logger, s.channelzID, "grpc: Server.Serve failed to create ServerTransport: ", err)
+				channelz.Info(logger, s.channelzID, "grpc: Server.Serve failed to create ServerTransport: ", err)
 			}
 			c.Close()
 		}
@@ -945,24 +989,24 @@ var _ http.Handler = (*Server)(nil)
 // To share one port (such as 443 for https) between gRPC and an
 // existing http.Handler, use a root http.Handler such as:
 //
-//   if r.ProtoMajor == 2 && strings.HasPrefix(
-//   	r.Header.Get("Content-Type"), "application/grpc") {
-//   	grpcServer.ServeHTTP(w, r)
-//   } else {
-//   	yourMux.ServeHTTP(w, r)
-//   }
+//	if r.ProtoMajor == 2 && strings.HasPrefix(
+//		r.Header.Get("Content-Type"), "application/grpc") {
+//		grpcServer.ServeHTTP(w, r)
+//	} else {
+//		yourMux.ServeHTTP(w, r)
+//	}
 //
 // Note that ServeHTTP uses Go's HTTP/2 server implementation which is totally
 // separate from grpc-go's HTTP/2 server. Performance and features may vary
 // between the two paths. ServeHTTP does not support some gRPC features
 // available through grpc-go's HTTP/2 server.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	st, err := transport.NewServerHandlerTransport(w, r, s.opts.statsHandler)
+	st, err := transport.NewServerHandlerTransport(w, r, s.opts.statsHandlers)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -1075,8 +1119,10 @@ func (s *Server) sendResponse(t transport.ServerTransport, stream *transport.Str
 		return status.Errorf(codes.ResourceExhausted, "grpc: trying to send message larger than max (%d vs. %d)", len(payload), s.opts.maxSendMessageSize)
 	}
 	err = t.Write(stream, hdr, payload, opts)
-	if err == nil && s.opts.statsHandler != nil {
-		s.opts.statsHandler.HandleRPC(stream.Context(), outPayload(false, msg, data, payload, time.Now()))
+	if err == nil {
+		for _, sh := range s.opts.statsHandlers {
+			sh.HandleRPC(stream.Context(), outPayload(false, msg, data, payload, time.Now()))
+		}
 	}
 	return err
 }
@@ -1123,13 +1169,13 @@ func chainUnaryInterceptors(interceptors []UnaryServerInterceptor) UnaryServerIn
 }
 
 func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.Stream, info *serviceInfo, md *MethodDesc, trInfo *traceInfo) (err error) {
-	sh := s.opts.statsHandler
-	if sh != nil || trInfo != nil || channelz.IsOn() {
+	shs := s.opts.statsHandlers
+	if len(shs) != 0 || trInfo != nil || channelz.IsOn() {
 		if channelz.IsOn() {
 			s.incrCallsStarted()
 		}
 		var statsBegin *stats.Begin
-		if sh != nil {
+		for _, sh := range shs {
 			beginTime := time.Now()
 			statsBegin = &stats.Begin{
 				BeginTime:      beginTime,
@@ -1160,7 +1206,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 				trInfo.tr.Finish()
 			}
 
-			if sh != nil {
+			for _, sh := range shs {
 				end := &stats.End{
 					BeginTime: statsBegin.BeginTime,
 					EndTime:   time.Now(),
@@ -1180,9 +1226,16 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 			}
 		}()
 	}
-
-	binlog := binarylog.GetMethodLogger(stream.Method())
-	if binlog != nil {
+	var binlogs []binarylog.MethodLogger
+	if ml := binarylog.GetMethodLogger(stream.Method()); ml != nil {
+		binlogs = append(binlogs, ml)
+	}
+	if s.opts.binaryLogger != nil {
+		if ml := s.opts.binaryLogger.GetMethodLogger(stream.Method()); ml != nil {
+			binlogs = append(binlogs, ml)
+		}
+	}
+	if len(binlogs) != 0 {
 		ctx := stream.Context()
 		md, _ := metadata.FromIncomingContext(ctx)
 		logEntry := &binarylog.ClientHeader{
@@ -1202,7 +1255,9 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 		if peer, ok := peer.FromContext(ctx); ok {
 			logEntry.PeerAddr = peer.Addr
 		}
-		binlog.Log(logEntry)
+		for _, binlog := range binlogs {
+			binlog.Log(logEntry)
+		}
 	}
 
 	// comp and cp are used for compression.  decomp and dc are used for
@@ -1242,7 +1297,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	}
 
 	var payInfo *payloadInfo
-	if sh != nil || binlog != nil {
+	if len(shs) != 0 || len(binlogs) != 0 {
 		payInfo = &payloadInfo{}
 	}
 	d, err := recvAndDecompress(&parser{r: stream}, stream, dc, s.opts.maxReceiveMessageSize, payInfo, decomp)
@@ -1259,7 +1314,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 		if err := s.getCodec(stream.ContentSubtype()).Unmarshal(d, v); err != nil {
 			return status.Errorf(codes.Internal, "grpc: error unmarshalling request: %v", err)
 		}
-		if sh != nil {
+		for _, sh := range shs {
 			sh.HandleRPC(stream.Context(), &stats.InPayload{
 				RecvTime:   time.Now(),
 				Payload:    v,
@@ -1268,10 +1323,13 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 				Length:     len(d),
 			})
 		}
-		if binlog != nil {
-			binlog.Log(&binarylog.ClientMessage{
+		if len(binlogs) != 0 {
+			cm := &binarylog.ClientMessage{
 				Message: d,
-			})
+			}
+			for _, binlog := range binlogs {
+				binlog.Log(cm)
+			}
 		}
 		if trInfo != nil {
 			trInfo.tr.LazyLog(&payload{sent: false, msg: v}, true)
@@ -1295,18 +1353,24 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 		if e := t.WriteStatus(stream, appStatus); e != nil {
 			channelz.Warningf(logger, s.channelzID, "grpc: Server.processUnaryRPC failed to write status: %v", e)
 		}
-		if binlog != nil {
+		if len(binlogs) != 0 {
 			if h, _ := stream.Header(); h.Len() > 0 {
 				// Only log serverHeader if there was header. Otherwise it can
 				// be trailer only.
-				binlog.Log(&binarylog.ServerHeader{
+				sh := &binarylog.ServerHeader{
 					Header: h,
-				})
+				}
+				for _, binlog := range binlogs {
+					binlog.Log(sh)
+				}
 			}
-			binlog.Log(&binarylog.ServerTrailer{
+			st := &binarylog.ServerTrailer{
 				Trailer: stream.Trailer(),
 				Err:     appErr,
-			})
+			}
+			for _, binlog := range binlogs {
+				binlog.Log(st)
+			}
 		}
 		return appErr
 	}
@@ -1332,26 +1396,34 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 				panic(fmt.Sprintf("grpc: Unexpected error (%T) from sendResponse: %v", st, st))
 			}
 		}
-		if binlog != nil {
+		if len(binlogs) != 0 {
 			h, _ := stream.Header()
-			binlog.Log(&binarylog.ServerHeader{
+			sh := &binarylog.ServerHeader{
 				Header: h,
-			})
-			binlog.Log(&binarylog.ServerTrailer{
+			}
+			st := &binarylog.ServerTrailer{
 				Trailer: stream.Trailer(),
 				Err:     appErr,
-			})
+			}
+			for _, binlog := range binlogs {
+				binlog.Log(sh)
+				binlog.Log(st)
+			}
 		}
 		return err
 	}
-	if binlog != nil {
+	if len(binlogs) != 0 {
 		h, _ := stream.Header()
-		binlog.Log(&binarylog.ServerHeader{
+		sh := &binarylog.ServerHeader{
 			Header: h,
-		})
-		binlog.Log(&binarylog.ServerMessage{
+		}
+		sm := &binarylog.ServerMessage{
 			Message: reply,
-		})
+		}
+		for _, binlog := range binlogs {
+			binlog.Log(sh)
+			binlog.Log(sm)
+		}
 	}
 	if channelz.IsOn() {
 		t.IncrMsgSent()
@@ -1363,11 +1435,14 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	// Should the logging be in WriteStatus?  Should we ignore the WriteStatus
 	// error or allow the stats handler to see it?
 	err = t.WriteStatus(stream, statusOK)
-	if binlog != nil {
-		binlog.Log(&binarylog.ServerTrailer{
+	if len(binlogs) != 0 {
+		st := &binarylog.ServerTrailer{
 			Trailer: stream.Trailer(),
 			Err:     appErr,
-		})
+		}
+		for _, binlog := range binlogs {
+			binlog.Log(st)
+		}
 	}
 	return err
 }
@@ -1417,16 +1492,18 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 	if channelz.IsOn() {
 		s.incrCallsStarted()
 	}
-	sh := s.opts.statsHandler
+	shs := s.opts.statsHandlers
 	var statsBegin *stats.Begin
-	if sh != nil {
+	if len(shs) != 0 {
 		beginTime := time.Now()
 		statsBegin = &stats.Begin{
 			BeginTime:      beginTime,
 			IsClientStream: sd.ClientStreams,
 			IsServerStream: sd.ServerStreams,
 		}
-		sh.HandleRPC(stream.Context(), statsBegin)
+		for _, sh := range shs {
+			sh.HandleRPC(stream.Context(), statsBegin)
+		}
 	}
 	ctx := NewContextWithServerTransportStream(stream.Context(), stream)
 	ss := &serverStream{
@@ -1438,10 +1515,10 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		maxReceiveMessageSize: s.opts.maxReceiveMessageSize,
 		maxSendMessageSize:    s.opts.maxSendMessageSize,
 		trInfo:                trInfo,
-		statsHandler:          sh,
+		statsHandler:          shs,
 	}
 
-	if sh != nil || trInfo != nil || channelz.IsOn() {
+	if len(shs) != 0 || trInfo != nil || channelz.IsOn() {
 		// See comment in processUnaryRPC on defers.
 		defer func() {
 			if trInfo != nil {
@@ -1455,7 +1532,7 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 				ss.mu.Unlock()
 			}
 
-			if sh != nil {
+			if len(shs) != 0 {
 				end := &stats.End{
 					BeginTime: statsBegin.BeginTime,
 					EndTime:   time.Now(),
@@ -1463,7 +1540,9 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 				if err != nil && err != io.EOF {
 					end.Error = toRPCErr(err)
 				}
-				sh.HandleRPC(stream.Context(), end)
+				for _, sh := range shs {
+					sh.HandleRPC(stream.Context(), end)
+				}
 			}
 
 			if channelz.IsOn() {
@@ -1476,8 +1555,15 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		}()
 	}
 
-	ss.binlog = binarylog.GetMethodLogger(stream.Method())
-	if ss.binlog != nil {
+	if ml := binarylog.GetMethodLogger(stream.Method()); ml != nil {
+		ss.binlogs = append(ss.binlogs, ml)
+	}
+	if s.opts.binaryLogger != nil {
+		if ml := s.opts.binaryLogger.GetMethodLogger(stream.Method()); ml != nil {
+			ss.binlogs = append(ss.binlogs, ml)
+		}
+	}
+	if len(ss.binlogs) != 0 {
 		md, _ := metadata.FromIncomingContext(ctx)
 		logEntry := &binarylog.ClientHeader{
 			Header:     md,
@@ -1496,7 +1582,9 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		if peer, ok := peer.FromContext(ss.Context()); ok {
 			logEntry.PeerAddr = peer.Addr
 		}
-		ss.binlog.Log(logEntry)
+		for _, binlog := range ss.binlogs {
+			binlog.Log(logEntry)
+		}
 	}
 
 	// If dc is set and matches the stream's compression, use it.  Otherwise, try
@@ -1562,11 +1650,14 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 			ss.mu.Unlock()
 		}
 		t.WriteStatus(ss.s, appStatus)
-		if ss.binlog != nil {
-			ss.binlog.Log(&binarylog.ServerTrailer{
+		if len(ss.binlogs) != 0 {
+			st := &binarylog.ServerTrailer{
 				Trailer: ss.s.Trailer(),
 				Err:     appErr,
-			})
+			}
+			for _, binlog := range ss.binlogs {
+				binlog.Log(st)
+			}
 		}
 		// TODO: Should we log an error from WriteStatus here and below?
 		return appErr
@@ -1577,11 +1668,14 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		ss.mu.Unlock()
 	}
 	err = t.WriteStatus(ss.s, statusOK)
-	if ss.binlog != nil {
-		ss.binlog.Log(&binarylog.ServerTrailer{
+	if len(ss.binlogs) != 0 {
+		st := &binarylog.ServerTrailer{
 			Trailer: ss.s.Trailer(),
 			Err:     appErr,
-		})
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(st)
+		}
 	}
 	return err
 }
@@ -1657,7 +1751,7 @@ type streamKey struct{}
 // NewContextWithServerTransportStream creates a new context from ctx and
 // attaches stream to it.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -1672,7 +1766,7 @@ func NewContextWithServerTransportStream(ctx context.Context, stream ServerTrans
 //
 // See also NewContextWithServerTransportStream.
 //
-// Experimental
+// # Experimental
 //
 // Notice: This type is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -1687,7 +1781,7 @@ type ServerTransportStream interface {
 // ctx. Returns nil if the given context has no stream associated with it
 // (which implies it is not an RPC invocation context).
 //
-// Experimental
+// # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
@@ -1709,11 +1803,7 @@ func (s *Server) Stop() {
 		s.done.Fire()
 	}()
 
-	s.channelzRemoveOnce.Do(func() {
-		if channelz.IsOn() {
-			channelz.RemoveEntry(s.channelzID)
-		}
-	})
+	s.channelzRemoveOnce.Do(func() { channelz.RemoveEntry(s.channelzID) })
 
 	s.mu.Lock()
 	listeners := s.lis
@@ -1751,11 +1841,7 @@ func (s *Server) GracefulStop() {
 	s.quit.Fire()
 	defer s.done.Fire()
 
-	s.channelzRemoveOnce.Do(func() {
-		if channelz.IsOn() {
-			channelz.RemoveEntry(s.channelzID)
-		}
-	})
+	s.channelzRemoveOnce.Do(func() { channelz.RemoveEntry(s.channelzID) })
 	s.mu.Lock()
 	if s.conns == nil {
 		s.mu.Unlock()
@@ -1808,12 +1894,26 @@ func (s *Server) getCodec(contentSubtype string) baseCodec {
 	return codec
 }
 
-// SetHeader sets the header metadata.
-// When called multiple times, all the provided metadata will be merged.
-// All the metadata will be sent out when one of the following happens:
-//  - grpc.SendHeader() is called;
-//  - The first response is sent out;
-//  - An RPC status is sent out (error or success).
+// SetHeader sets the header metadata to be sent from the server to the client.
+// The context provided must be the context passed to the server's handler.
+//
+// Streaming RPCs should prefer the SetHeader method of the ServerStream.
+//
+// When called multiple times, all the provided metadata will be merged.  All
+// the metadata will be sent out when one of the following happens:
+//
+//   - grpc.SendHeader is called, or for streaming handlers, stream.SendHeader.
+//   - The first response message is sent.  For unary handlers, this occurs when
+//     the handler returns; for streaming handlers, this can happen when stream's
+//     SendMsg method is called.
+//   - An RPC status is sent out (error or success).  This occurs when the handler
+//     returns.
+//
+// SetHeader will fail if called after any of the events above.
+//
+// The error returned is compatible with the status package.  However, the
+// status code will often not match the RPC status as seen by the client
+// application, and therefore, should not be relied upon for this purpose.
 func SetHeader(ctx context.Context, md metadata.MD) error {
 	if md.Len() == 0 {
 		return nil
@@ -1825,8 +1925,14 @@ func SetHeader(ctx context.Context, md metadata.MD) error {
 	return stream.SetHeader(md)
 }
 
-// SendHeader sends header metadata. It may be called at most once.
-// The provided md and headers set by SetHeader() will be sent.
+// SendHeader sends header metadata. It may be called at most once, and may not
+// be called after any event that causes headers to be sent (see SetHeader for
+// a complete list).  The provided md and headers set by SetHeader() will be
+// sent.
+//
+// The error returned is compatible with the status package.  However, the
+// status code will often not match the RPC status as seen by the client
+// application, and therefore, should not be relied upon for this purpose.
 func SendHeader(ctx context.Context, md metadata.MD) error {
 	stream := ServerTransportStreamFromContext(ctx)
 	if stream == nil {
@@ -1840,6 +1946,10 @@ func SendHeader(ctx context.Context, md metadata.MD) error {
 
 // SetTrailer sets the trailer metadata that will be sent when an RPC returns.
 // When called more than once, all the provided metadata will be merged.
+//
+// The error returned is compatible with the status package.  However, the
+// status code will often not match the RPC status as seen by the client
+// application, and therefore, should not be relied upon for this purpose.
 func SetTrailer(ctx context.Context, md metadata.MD) error {
 	if md.Len() == 0 {
 		return nil
diff --git a/vendor/google.golang.org/grpc/service_config.go b/vendor/google.golang.org/grpc/service_config.go
index 6926a06dc523..01bbb2025aed 100644
--- a/vendor/google.golang.org/grpc/service_config.go
+++ b/vendor/google.golang.org/grpc/service_config.go
@@ -57,10 +57,9 @@ type lbConfig struct {
 type ServiceConfig struct {
 	serviceconfig.Config
 
-	// LB is the load balancer the service providers recommends. The balancer
-	// specified via grpc.WithBalancerName will override this.  This is deprecated;
-	// lbConfigs is preferred.  If lbConfig and LB are both present, lbConfig
-	// will be used.
+	// LB is the load balancer the service providers recommends.  This is
+	// deprecated; lbConfigs is preferred.  If lbConfig and LB are both present,
+	// lbConfig will be used.
 	LB *string
 
 	// lbConfig is the service config's load balancing configuration.  If
@@ -381,6 +380,9 @@ func init() {
 //
 // If any of them is NOT *ServiceConfig, return false.
 func equalServiceConfig(a, b serviceconfig.Config) bool {
+	if a == nil && b == nil {
+		return true
+	}
 	aa, ok := a.(*ServiceConfig)
 	if !ok {
 		return false
diff --git a/vendor/google.golang.org/grpc/stream.go b/vendor/google.golang.org/grpc/stream.go
index 8cdd652e037b..0c16cfb2ea80 100644
--- a/vendor/google.golang.org/grpc/stream.go
+++ b/vendor/google.golang.org/grpc/stream.go
@@ -36,6 +36,7 @@ import (
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcrand"
 	"google.golang.org/grpc/internal/grpcutil"
+	imetadata "google.golang.org/grpc/internal/metadata"
 	iresolver "google.golang.org/grpc/internal/resolver"
 	"google.golang.org/grpc/internal/serviceconfig"
 	"google.golang.org/grpc/internal/transport"
@@ -139,13 +140,13 @@ type ClientStream interface {
 // To ensure resources are not leaked due to the stream returned, one of the following
 // actions must be performed:
 //
-//      1. Call Close on the ClientConn.
-//      2. Cancel the context provided.
-//      3. Call RecvMsg until a non-nil error is returned. A protobuf-generated
-//         client-streaming RPC, for instance, might use the helper function
-//         CloseAndRecv (note that CloseSend does not Recv, therefore is not
-//         guaranteed to release all resources).
-//      4. Receive a non-nil, non-io.EOF error from Header or SendMsg.
+//  1. Call Close on the ClientConn.
+//  2. Cancel the context provided.
+//  3. Call RecvMsg until a non-nil error is returned. A protobuf-generated
+//     client-streaming RPC, for instance, might use the helper function
+//     CloseAndRecv (note that CloseSend does not Recv, therefore is not
+//     guaranteed to release all resources).
+//  4. Receive a non-nil, non-io.EOF error from Header or SendMsg.
 //
 // If none of the above happen, a goroutine and a context will be leaked, and grpc
 // will not call the optionally-configured stats handler with a stats.End message.
@@ -166,6 +167,11 @@ func NewClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 }
 
 func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
+	if md, _, ok := metadata.FromOutgoingContextRaw(ctx); ok {
+		if err := imetadata.Validate(md); err != nil {
+			return nil, status.Error(codes.Internal, err.Error())
+		}
+	}
 	if channelz.IsOn() {
 		cc.incrCallsStarted()
 		defer func() {
@@ -295,20 +301,35 @@ func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *Client
 	if !cc.dopts.disableRetry {
 		cs.retryThrottler = cc.retryThrottler.Load().(*retryThrottler)
 	}
-	cs.binlog = binarylog.GetMethodLogger(method)
-
-	if err := cs.newAttemptLocked(false /* isTransparent */); err != nil {
-		cs.finish(err)
-		return nil, err
+	if ml := binarylog.GetMethodLogger(method); ml != nil {
+		cs.binlogs = append(cs.binlogs, ml)
+	}
+	if cc.dopts.binaryLogger != nil {
+		if ml := cc.dopts.binaryLogger.GetMethodLogger(method); ml != nil {
+			cs.binlogs = append(cs.binlogs, ml)
+		}
 	}
 
-	op := func(a *csAttempt) error { return a.newStream() }
+	// Pick the transport to use and create a new stream on the transport.
+	// Assign cs.attempt upon success.
+	op := func(a *csAttempt) error {
+		if err := a.getTransport(); err != nil {
+			return err
+		}
+		if err := a.newStream(); err != nil {
+			return err
+		}
+		// Because this operation is always called either here (while creating
+		// the clientStream) or by the retry code while locked when replaying
+		// the operation, it is safe to access cs.attempt directly.
+		cs.attempt = a
+		return nil
+	}
 	if err := cs.withRetry(op, func() { cs.bufferForRetryLocked(0, op) }); err != nil {
-		cs.finish(err)
 		return nil, err
 	}
 
-	if cs.binlog != nil {
+	if len(cs.binlogs) != 0 {
 		md, _ := metadata.FromOutgoingContext(ctx)
 		logEntry := &binarylog.ClientHeader{
 			OnClientSide: true,
@@ -322,7 +343,9 @@ func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *Client
 				logEntry.Timeout = 0
 			}
 		}
-		cs.binlog.Log(logEntry)
+		for _, binlog := range cs.binlogs {
+			binlog.Log(logEntry)
+		}
 	}
 
 	if desc != unaryStreamDesc {
@@ -343,14 +366,20 @@ func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *Client
 	return cs, nil
 }
 
-// newAttemptLocked creates a new attempt with a transport.
-// If it succeeds, then it replaces clientStream's attempt with this new attempt.
-func (cs *clientStream) newAttemptLocked(isTransparent bool) (retErr error) {
+// newAttemptLocked creates a new csAttempt without a transport or stream.
+func (cs *clientStream) newAttemptLocked(isTransparent bool) (*csAttempt, error) {
+	if err := cs.ctx.Err(); err != nil {
+		return nil, toRPCErr(err)
+	}
+	if err := cs.cc.ctx.Err(); err != nil {
+		return nil, ErrClientConnClosing
+	}
+
 	ctx := newContextWithRPCInfo(cs.ctx, cs.callInfo.failFast, cs.callInfo.codec, cs.cp, cs.comp)
 	method := cs.callHdr.Method
-	sh := cs.cc.dopts.copts.StatsHandler
 	var beginTime time.Time
-	if sh != nil {
+	shs := cs.cc.dopts.copts.StatsHandlers
+	for _, sh := range shs {
 		ctx = sh.TagRPC(ctx, &stats.RPCTagInfo{FullMethodName: method, FailFast: cs.callInfo.failFast})
 		beginTime = time.Now()
 		begin := &stats.Begin{
@@ -379,27 +408,6 @@ func (cs *clientStream) newAttemptLocked(isTransparent bool) (retErr error) {
 		ctx = trace.NewContext(ctx, trInfo.tr)
 	}
 
-	newAttempt := &csAttempt{
-		ctx:          ctx,
-		beginTime:    beginTime,
-		cs:           cs,
-		dc:           cs.cc.dopts.dc,
-		statsHandler: sh,
-		trInfo:       trInfo,
-	}
-	defer func() {
-		if retErr != nil {
-			// This attempt is not set in the clientStream, so it's finish won't
-			// be called. Call it here for stats and trace in case they are not
-			// nil.
-			newAttempt.finish(retErr)
-		}
-	}()
-
-	if err := ctx.Err(); err != nil {
-		return toRPCErr(err)
-	}
-
 	if cs.cc.parsedTarget.Scheme == "xds" {
 		// Add extra metadata (metadata that will be added by transport) to context
 		// so the balancer can see them.
@@ -407,16 +415,32 @@ func (cs *clientStream) newAttemptLocked(isTransparent bool) (retErr error) {
 			"content-type", grpcutil.ContentType(cs.callHdr.ContentSubtype),
 		))
 	}
-	t, done, err := cs.cc.getTransport(ctx, cs.callInfo.failFast, cs.callHdr.Method)
+
+	return &csAttempt{
+		ctx:           ctx,
+		beginTime:     beginTime,
+		cs:            cs,
+		dc:            cs.cc.dopts.dc,
+		statsHandlers: shs,
+		trInfo:        trInfo,
+	}, nil
+}
+
+func (a *csAttempt) getTransport() error {
+	cs := a.cs
+
+	var err error
+	a.t, a.done, err = cs.cc.getTransport(a.ctx, cs.callInfo.failFast, cs.callHdr.Method)
 	if err != nil {
+		if de, ok := err.(dropError); ok {
+			err = de.error
+			a.drop = true
+		}
 		return err
 	}
-	if trInfo != nil {
-		trInfo.firstLine.SetRemoteAddr(t.RemoteAddr())
+	if a.trInfo != nil {
+		a.trInfo.firstLine.SetRemoteAddr(a.t.RemoteAddr())
 	}
-	newAttempt.t = t
-	newAttempt.done = done
-	cs.attempt = newAttempt
 	return nil
 }
 
@@ -425,12 +449,21 @@ func (a *csAttempt) newStream() error {
 	cs.callHdr.PreviousAttempts = cs.numRetries
 	s, err := a.t.NewStream(a.ctx, cs.callHdr)
 	if err != nil {
-		// Return without converting to an RPC error so retry code can
-		// inspect.
-		return err
+		nse, ok := err.(*transport.NewStreamError)
+		if !ok {
+			// Unexpected.
+			return err
+		}
+
+		if nse.AllowTransparentRetry {
+			a.allowTransparentRetry = true
+		}
+
+		// Unwrap and convert error.
+		return toRPCErr(nse.Err)
 	}
-	cs.attempt.s = s
-	cs.attempt.p = &parser{r: s}
+	a.s = s
+	a.p = &parser{r: s}
 	return nil
 }
 
@@ -456,7 +489,7 @@ type clientStream struct {
 
 	retryThrottler *retryThrottler // The throttler active when the RPC began.
 
-	binlog *binarylog.MethodLogger // Binary logger, can be nil.
+	binlogs []binarylog.MethodLogger
 	// serverHeaderBinlogged is a boolean for whether server header has been
 	// logged. Server header will be logged when the first time one of those
 	// happens: stream.Header(), stream.Recv().
@@ -506,8 +539,13 @@ type csAttempt struct {
 	// and cleared when the finish method is called.
 	trInfo *traceInfo
 
-	statsHandler stats.Handler
-	beginTime    time.Time
+	statsHandlers []stats.Handler
+	beginTime     time.Time
+
+	// set for newStream errors that may be transparently retried
+	allowTransparentRetry bool
+	// set for pick errors that are returned as a status
+	drop bool
 }
 
 func (cs *clientStream) commitAttemptLocked() {
@@ -527,41 +565,21 @@ func (cs *clientStream) commitAttempt() {
 // shouldRetry returns nil if the RPC should be retried; otherwise it returns
 // the error that should be returned by the operation.  If the RPC should be
 // retried, the bool indicates whether it is being retried transparently.
-func (cs *clientStream) shouldRetry(err error) (bool, error) {
-	if cs.attempt.s == nil {
-		// Error from NewClientStream.
-		nse, ok := err.(*transport.NewStreamError)
-		if !ok {
-			// Unexpected, but assume no I/O was performed and the RPC is not
-			// fatal, so retry indefinitely.
-			return true, nil
-		}
-
-		// Unwrap and convert error.
-		err = toRPCErr(nse.Err)
-
-		// Never retry DoNotRetry errors, which indicate the RPC should not be
-		// retried due to max header list size violation, etc.
-		if nse.DoNotRetry {
-			return false, err
-		}
+func (a *csAttempt) shouldRetry(err error) (bool, error) {
+	cs := a.cs
 
-		// In the event of a non-IO operation error from NewStream, we never
-		// attempted to write anything to the wire, so we can retry
-		// indefinitely.
-		if !nse.DoNotTransparentRetry {
-			return true, nil
-		}
-	}
-	if cs.finished || cs.committed {
-		// RPC is finished or committed; cannot retry.
+	if cs.finished || cs.committed || a.drop {
+		// RPC is finished or committed or was dropped by the picker; cannot retry.
 		return false, err
 	}
+	if a.s == nil && a.allowTransparentRetry {
+		return true, nil
+	}
 	// Wait for the trailers.
 	unprocessed := false
-	if cs.attempt.s != nil {
-		<-cs.attempt.s.Done()
-		unprocessed = cs.attempt.s.Unprocessed()
+	if a.s != nil {
+		<-a.s.Done()
+		unprocessed = a.s.Unprocessed()
 	}
 	if cs.firstAttempt && unprocessed {
 		// First attempt, stream unprocessed: transparently retry.
@@ -573,14 +591,14 @@ func (cs *clientStream) shouldRetry(err error) (bool, error) {
 
 	pushback := 0
 	hasPushback := false
-	if cs.attempt.s != nil {
-		if !cs.attempt.s.TrailersOnly() {
+	if a.s != nil {
+		if !a.s.TrailersOnly() {
 			return false, err
 		}
 
 		// TODO(retry): Move down if the spec changes to not check server pushback
 		// before considering this a failure for throttling.
-		sps := cs.attempt.s.Trailer()["grpc-retry-pushback-ms"]
+		sps := a.s.Trailer()["grpc-retry-pushback-ms"]
 		if len(sps) == 1 {
 			var e error
 			if pushback, e = strconv.Atoi(sps[0]); e != nil || pushback < 0 {
@@ -597,10 +615,10 @@ func (cs *clientStream) shouldRetry(err error) (bool, error) {
 	}
 
 	var code codes.Code
-	if cs.attempt.s != nil {
-		code = cs.attempt.s.Status().Code()
+	if a.s != nil {
+		code = a.s.Status().Code()
 	} else {
-		code = status.Convert(err).Code()
+		code = status.Code(err)
 	}
 
 	rp := cs.methodConfig.RetryPolicy
@@ -645,19 +663,24 @@ func (cs *clientStream) shouldRetry(err error) (bool, error) {
 }
 
 // Returns nil if a retry was performed and succeeded; error otherwise.
-func (cs *clientStream) retryLocked(lastErr error) error {
+func (cs *clientStream) retryLocked(attempt *csAttempt, lastErr error) error {
 	for {
-		cs.attempt.finish(toRPCErr(lastErr))
-		isTransparent, err := cs.shouldRetry(lastErr)
+		attempt.finish(toRPCErr(lastErr))
+		isTransparent, err := attempt.shouldRetry(lastErr)
 		if err != nil {
 			cs.commitAttemptLocked()
 			return err
 		}
 		cs.firstAttempt = false
-		if err := cs.newAttemptLocked(isTransparent); err != nil {
+		attempt, err = cs.newAttemptLocked(isTransparent)
+		if err != nil {
+			// Only returns error if the clientconn is closed or the context of
+			// the stream is canceled.
 			return err
 		}
-		if lastErr = cs.replayBufferLocked(); lastErr == nil {
+		// Note that the first op in the replay buffer always sets cs.attempt
+		// if it is able to pick a transport and create a stream.
+		if lastErr = cs.replayBufferLocked(attempt); lastErr == nil {
 			return nil
 		}
 	}
@@ -667,7 +690,10 @@ func (cs *clientStream) Context() context.Context {
 	cs.commitAttempt()
 	// No need to lock before using attempt, since we know it is committed and
 	// cannot change.
-	return cs.attempt.s.Context()
+	if cs.attempt.s != nil {
+		return cs.attempt.s.Context()
+	}
+	return cs.ctx
 }
 
 func (cs *clientStream) withRetry(op func(a *csAttempt) error, onSuccess func()) error {
@@ -681,6 +707,18 @@ func (cs *clientStream) withRetry(op func(a *csAttempt) error, onSuccess func())
 			// already be status errors.
 			return toRPCErr(op(cs.attempt))
 		}
+		if len(cs.buffer) == 0 {
+			// For the first op, which controls creation of the stream and
+			// assigns cs.attempt, we need to create a new attempt inline
+			// before executing the first op.  On subsequent ops, the attempt
+			// is created immediately before replaying the ops.
+			var err error
+			if cs.attempt, err = cs.newAttemptLocked(false /* isTransparent */); err != nil {
+				cs.mu.Unlock()
+				cs.finish(err)
+				return err
+			}
+		}
 		a := cs.attempt
 		cs.mu.Unlock()
 		err := op(a)
@@ -697,7 +735,7 @@ func (cs *clientStream) withRetry(op func(a *csAttempt) error, onSuccess func())
 			cs.mu.Unlock()
 			return err
 		}
-		if err := cs.retryLocked(err); err != nil {
+		if err := cs.retryLocked(a, err); err != nil {
 			cs.mu.Unlock()
 			return err
 		}
@@ -715,7 +753,7 @@ func (cs *clientStream) Header() (metadata.MD, error) {
 		cs.finish(err)
 		return nil, err
 	}
-	if cs.binlog != nil && !cs.serverHeaderBinlogged {
+	if len(cs.binlogs) != 0 && !cs.serverHeaderBinlogged {
 		// Only log if binary log is on and header has not been logged.
 		logEntry := &binarylog.ServerHeader{
 			OnClientSide: true,
@@ -725,10 +763,12 @@ func (cs *clientStream) Header() (metadata.MD, error) {
 		if peer, ok := peer.FromContext(cs.Context()); ok {
 			logEntry.PeerAddr = peer.Addr
 		}
-		cs.binlog.Log(logEntry)
 		cs.serverHeaderBinlogged = true
+		for _, binlog := range cs.binlogs {
+			binlog.Log(logEntry)
+		}
 	}
-	return m, err
+	return m, nil
 }
 
 func (cs *clientStream) Trailer() metadata.MD {
@@ -746,10 +786,9 @@ func (cs *clientStream) Trailer() metadata.MD {
 	return cs.attempt.s.Trailer()
 }
 
-func (cs *clientStream) replayBufferLocked() error {
-	a := cs.attempt
+func (cs *clientStream) replayBufferLocked(attempt *csAttempt) error {
 	for _, f := range cs.buffer {
-		if err := f(a); err != nil {
+		if err := f(attempt); err != nil {
 			return err
 		}
 	}
@@ -797,47 +836,48 @@ func (cs *clientStream) SendMsg(m interface{}) (err error) {
 	if len(payload) > *cs.callInfo.maxSendMessageSize {
 		return status.Errorf(codes.ResourceExhausted, "trying to send message larger than max (%d vs. %d)", len(payload), *cs.callInfo.maxSendMessageSize)
 	}
-	msgBytes := data // Store the pointer before setting to nil. For binary logging.
 	op := func(a *csAttempt) error {
-		err := a.sendMsg(m, hdr, payload, data)
-		// nil out the message and uncomp when replaying; they are only needed for
-		// stats which is disabled for subsequent attempts.
-		m, data = nil, nil
-		return err
+		return a.sendMsg(m, hdr, payload, data)
 	}
 	err = cs.withRetry(op, func() { cs.bufferForRetryLocked(len(hdr)+len(payload), op) })
-	if cs.binlog != nil && err == nil {
-		cs.binlog.Log(&binarylog.ClientMessage{
+	if len(cs.binlogs) != 0 && err == nil {
+		cm := &binarylog.ClientMessage{
 			OnClientSide: true,
-			Message:      msgBytes,
-		})
+			Message:      data,
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cm)
+		}
 	}
-	return
+	return err
 }
 
 func (cs *clientStream) RecvMsg(m interface{}) error {
-	if cs.binlog != nil && !cs.serverHeaderBinlogged {
+	if len(cs.binlogs) != 0 && !cs.serverHeaderBinlogged {
 		// Call Header() to binary log header if it's not already logged.
 		cs.Header()
 	}
 	var recvInfo *payloadInfo
-	if cs.binlog != nil {
+	if len(cs.binlogs) != 0 {
 		recvInfo = &payloadInfo{}
 	}
 	err := cs.withRetry(func(a *csAttempt) error {
 		return a.recvMsg(m, recvInfo)
 	}, cs.commitAttemptLocked)
-	if cs.binlog != nil && err == nil {
-		cs.binlog.Log(&binarylog.ServerMessage{
+	if len(cs.binlogs) != 0 && err == nil {
+		sm := &binarylog.ServerMessage{
 			OnClientSide: true,
 			Message:      recvInfo.uncompressedBytes,
-		})
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(sm)
+		}
 	}
 	if err != nil || !cs.desc.ServerStreams {
 		// err != nil or non-server-streaming indicates end of stream.
 		cs.finish(err)
 
-		if cs.binlog != nil {
+		if len(cs.binlogs) != 0 {
 			// finish will not log Trailer. Log Trailer here.
 			logEntry := &binarylog.ServerTrailer{
 				OnClientSide: true,
@@ -850,7 +890,9 @@ func (cs *clientStream) RecvMsg(m interface{}) error {
 			if peer, ok := peer.FromContext(cs.Context()); ok {
 				logEntry.PeerAddr = peer.Addr
 			}
-			cs.binlog.Log(logEntry)
+			for _, binlog := range cs.binlogs {
+				binlog.Log(logEntry)
+			}
 		}
 	}
 	return err
@@ -871,10 +913,13 @@ func (cs *clientStream) CloseSend() error {
 		return nil
 	}
 	cs.withRetry(op, func() { cs.bufferForRetryLocked(0, op) })
-	if cs.binlog != nil {
-		cs.binlog.Log(&binarylog.ClientHalfClose{
+	if len(cs.binlogs) != 0 {
+		chc := &binarylog.ClientHalfClose{
 			OnClientSide: true,
-		})
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(chc)
+		}
 	}
 	// We never returned an error here for reasons.
 	return nil
@@ -907,10 +952,13 @@ func (cs *clientStream) finish(err error) {
 	//
 	// Only one of cancel or trailer needs to be logged. In the cases where
 	// users don't call RecvMsg, users must have already canceled the RPC.
-	if cs.binlog != nil && status.Code(err) == codes.Canceled {
-		cs.binlog.Log(&binarylog.Cancel{
+	if len(cs.binlogs) != 0 && status.Code(err) == codes.Canceled {
+		c := &binarylog.Cancel{
 			OnClientSide: true,
-		})
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(c)
+		}
 	}
 	if err == nil {
 		cs.retryThrottler.successfulRPC()
@@ -943,8 +991,8 @@ func (a *csAttempt) sendMsg(m interface{}, hdr, payld, data []byte) error {
 		}
 		return io.EOF
 	}
-	if a.statsHandler != nil {
-		a.statsHandler.HandleRPC(a.ctx, outPayload(true, m, data, payld, time.Now()))
+	for _, sh := range a.statsHandlers {
+		sh.HandleRPC(a.ctx, outPayload(true, m, data, payld, time.Now()))
 	}
 	if channelz.IsOn() {
 		a.t.IncrMsgSent()
@@ -954,7 +1002,7 @@ func (a *csAttempt) sendMsg(m interface{}, hdr, payld, data []byte) error {
 
 func (a *csAttempt) recvMsg(m interface{}, payInfo *payloadInfo) (err error) {
 	cs := a.cs
-	if a.statsHandler != nil && payInfo == nil {
+	if len(a.statsHandlers) != 0 && payInfo == nil {
 		payInfo = &payloadInfo{}
 	}
 
@@ -982,6 +1030,7 @@ func (a *csAttempt) recvMsg(m interface{}, payInfo *payloadInfo) (err error) {
 			}
 			return io.EOF // indicates successful end of stream.
 		}
+
 		return toRPCErr(err)
 	}
 	if a.trInfo != nil {
@@ -991,8 +1040,8 @@ func (a *csAttempt) recvMsg(m interface{}, payInfo *payloadInfo) (err error) {
 		}
 		a.mu.Unlock()
 	}
-	if a.statsHandler != nil {
-		a.statsHandler.HandleRPC(a.ctx, &stats.InPayload{
+	for _, sh := range a.statsHandlers {
+		sh.HandleRPC(a.ctx, &stats.InPayload{
 			Client:   true,
 			RecvTime: time.Now(),
 			Payload:  m,
@@ -1051,7 +1100,7 @@ func (a *csAttempt) finish(err error) {
 			ServerLoad:    balancerload.Parse(tr),
 		})
 	}
-	if a.statsHandler != nil {
+	for _, sh := range a.statsHandlers {
 		end := &stats.End{
 			Client:    true,
 			BeginTime: a.beginTime,
@@ -1059,7 +1108,7 @@ func (a *csAttempt) finish(err error) {
 			Trailer:   tr,
 			Error:     err,
 		}
-		a.statsHandler.HandleRPC(a.ctx, end)
+		sh.HandleRPC(a.ctx, end)
 	}
 	if a.trInfo != nil && a.trInfo.tr != nil {
 		if err == nil {
@@ -1364,8 +1413,10 @@ func (as *addrConnStream) finish(err error) {
 
 // ServerStream defines the server-side behavior of a streaming RPC.
 //
-// All errors returned from ServerStream methods are compatible with the
-// status package.
+// Errors returned from ServerStream methods are compatible with the status
+// package.  However, the status code will often not match the RPC status as
+// seen by the client application, and therefore, should not be relied upon for
+// this purpose.
 type ServerStream interface {
 	// SetHeader sets the header metadata. It may be called multiple times.
 	// When call multiple times, all the provided metadata will be merged.
@@ -1426,9 +1477,9 @@ type serverStream struct {
 	maxSendMessageSize    int
 	trInfo                *traceInfo
 
-	statsHandler stats.Handler
+	statsHandler []stats.Handler
 
-	binlog *binarylog.MethodLogger
+	binlogs []binarylog.MethodLogger
 	// serverHeaderBinlogged indicates whether server header has been logged. It
 	// will happen when one of the following two happens: stream.SendHeader(),
 	// stream.Send().
@@ -1448,17 +1499,29 @@ func (ss *serverStream) SetHeader(md metadata.MD) error {
 	if md.Len() == 0 {
 		return nil
 	}
+	err := imetadata.Validate(md)
+	if err != nil {
+		return status.Error(codes.Internal, err.Error())
+	}
 	return ss.s.SetHeader(md)
 }
 
 func (ss *serverStream) SendHeader(md metadata.MD) error {
-	err := ss.t.WriteHeader(ss.s, md)
-	if ss.binlog != nil && !ss.serverHeaderBinlogged {
+	err := imetadata.Validate(md)
+	if err != nil {
+		return status.Error(codes.Internal, err.Error())
+	}
+
+	err = ss.t.WriteHeader(ss.s, md)
+	if len(ss.binlogs) != 0 && !ss.serverHeaderBinlogged {
 		h, _ := ss.s.Header()
-		ss.binlog.Log(&binarylog.ServerHeader{
+		sh := &binarylog.ServerHeader{
 			Header: h,
-		})
+		}
 		ss.serverHeaderBinlogged = true
+		for _, binlog := range ss.binlogs {
+			binlog.Log(sh)
+		}
 	}
 	return err
 }
@@ -1467,6 +1530,9 @@ func (ss *serverStream) SetTrailer(md metadata.MD) {
 	if md.Len() == 0 {
 		return
 	}
+	if err := imetadata.Validate(md); err != nil {
+		logger.Errorf("stream: failed to validate md when setting trailer, err: %v", err)
+	}
 	ss.s.SetTrailer(md)
 }
 
@@ -1512,20 +1578,28 @@ func (ss *serverStream) SendMsg(m interface{}) (err error) {
 	if err := ss.t.Write(ss.s, hdr, payload, &transport.Options{Last: false}); err != nil {
 		return toRPCErr(err)
 	}
-	if ss.binlog != nil {
+	if len(ss.binlogs) != 0 {
 		if !ss.serverHeaderBinlogged {
 			h, _ := ss.s.Header()
-			ss.binlog.Log(&binarylog.ServerHeader{
+			sh := &binarylog.ServerHeader{
 				Header: h,
-			})
+			}
 			ss.serverHeaderBinlogged = true
+			for _, binlog := range ss.binlogs {
+				binlog.Log(sh)
+			}
 		}
-		ss.binlog.Log(&binarylog.ServerMessage{
+		sm := &binarylog.ServerMessage{
 			Message: data,
-		})
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(sm)
+		}
 	}
-	if ss.statsHandler != nil {
-		ss.statsHandler.HandleRPC(ss.s.Context(), outPayload(false, m, data, payload, time.Now()))
+	if len(ss.statsHandler) != 0 {
+		for _, sh := range ss.statsHandler {
+			sh.HandleRPC(ss.s.Context(), outPayload(false, m, data, payload, time.Now()))
+		}
 	}
 	return nil
 }
@@ -1559,13 +1633,16 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 		}
 	}()
 	var payInfo *payloadInfo
-	if ss.statsHandler != nil || ss.binlog != nil {
+	if len(ss.statsHandler) != 0 || len(ss.binlogs) != 0 {
 		payInfo = &payloadInfo{}
 	}
 	if err := recv(ss.p, ss.codec, ss.s, ss.dc, m, ss.maxReceiveMessageSize, payInfo, ss.decomp); err != nil {
 		if err == io.EOF {
-			if ss.binlog != nil {
-				ss.binlog.Log(&binarylog.ClientHalfClose{})
+			if len(ss.binlogs) != 0 {
+				chc := &binarylog.ClientHalfClose{}
+				for _, binlog := range ss.binlogs {
+					binlog.Log(chc)
+				}
 			}
 			return err
 		}
@@ -1574,20 +1651,25 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 		}
 		return toRPCErr(err)
 	}
-	if ss.statsHandler != nil {
-		ss.statsHandler.HandleRPC(ss.s.Context(), &stats.InPayload{
-			RecvTime: time.Now(),
-			Payload:  m,
-			// TODO truncate large payload.
-			Data:       payInfo.uncompressedBytes,
-			WireLength: payInfo.wireLength + headerLen,
-			Length:     len(payInfo.uncompressedBytes),
-		})
+	if len(ss.statsHandler) != 0 {
+		for _, sh := range ss.statsHandler {
+			sh.HandleRPC(ss.s.Context(), &stats.InPayload{
+				RecvTime: time.Now(),
+				Payload:  m,
+				// TODO truncate large payload.
+				Data:       payInfo.uncompressedBytes,
+				WireLength: payInfo.wireLength + headerLen,
+				Length:     len(payInfo.uncompressedBytes),
+			})
+		}
 	}
-	if ss.binlog != nil {
-		ss.binlog.Log(&binarylog.ClientMessage{
+	if len(ss.binlogs) != 0 {
+		cm := &binarylog.ClientMessage{
 			Message: payInfo.uncompressedBytes,
-		})
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(cm)
+		}
 	}
 	return nil
 }
diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go
index 5bd4f534c1d3..d472ca64307b 100644
--- a/vendor/google.golang.org/grpc/version.go
+++ b/vendor/google.golang.org/grpc/version.go
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.45.0"
+const Version = "1.50.1"
diff --git a/vendor/google.golang.org/grpc/vet.sh b/vendor/google.golang.org/grpc/vet.sh
index ceb436c6ce47..c3fc8253b13a 100644
--- a/vendor/google.golang.org/grpc/vet.sh
+++ b/vendor/google.golang.org/grpc/vet.sh
@@ -147,7 +147,6 @@ grpc.NewGZIPDecompressor
 grpc.RPCCompressor
 grpc.RPCDecompressor
 grpc.ServiceConfig
-grpc.WithBalancerName
 grpc.WithCompressor
 grpc.WithDecompressor
 grpc.WithDialer
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/balancer.go b/vendor/google.golang.org/grpc/xds/internal/balancer/balancer.go
index 8d81aced2dd5..68ed789f2a4d 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/balancer.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/balancer.go
@@ -20,10 +20,11 @@
 package balancer
 
 import (
-	_ "google.golang.org/grpc/balancer/weightedtarget"               // Register the weighted_target balancer
-	_ "google.golang.org/grpc/xds/internal/balancer/cdsbalancer"     // Register the CDS balancer
-	_ "google.golang.org/grpc/xds/internal/balancer/clusterimpl"     // Register the xds_cluster_impl balancer
-	_ "google.golang.org/grpc/xds/internal/balancer/clustermanager"  // Register the xds_cluster_manager balancer
-	_ "google.golang.org/grpc/xds/internal/balancer/clusterresolver" // Register the xds_cluster_resolver balancer
-	_ "google.golang.org/grpc/xds/internal/balancer/priority"        // Register the priority balancer
+	_ "google.golang.org/grpc/balancer/weightedtarget"                // Register the weighted_target balancer
+	_ "google.golang.org/grpc/xds/internal/balancer/cdsbalancer"      // Register the CDS balancer
+	_ "google.golang.org/grpc/xds/internal/balancer/clusterimpl"      // Register the xds_cluster_impl balancer
+	_ "google.golang.org/grpc/xds/internal/balancer/clustermanager"   // Register the xds_cluster_manager balancer
+	_ "google.golang.org/grpc/xds/internal/balancer/clusterresolver"  // Register the xds_cluster_resolver balancer
+	_ "google.golang.org/grpc/xds/internal/balancer/outlierdetection" // Register the outlier_detection balancer
+	_ "google.golang.org/grpc/xds/internal/balancer/priority"         // Register the priority balancer
 )
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cdsbalancer.go b/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cdsbalancer.go
index 0be796c47bad..14c1c2e769aa 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cdsbalancer.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cdsbalancer.go
@@ -29,6 +29,7 @@ import (
 	"google.golang.org/grpc/credentials/tls/certprovider"
 	"google.golang.org/grpc/internal/buffer"
 	xdsinternal "google.golang.org/grpc/internal/credentials/xds"
+	"google.golang.org/grpc/internal/envconfig"
 	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/internal/pretty"
@@ -36,6 +37,7 @@ import (
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/serviceconfig"
 	"google.golang.org/grpc/xds/internal/balancer/clusterresolver"
+	"google.golang.org/grpc/xds/internal/balancer/outlierdetection"
 	"google.golang.org/grpc/xds/internal/balancer/ringhash"
 	"google.golang.org/grpc/xds/internal/xdsclient"
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
@@ -270,6 +272,52 @@ func buildProviderFunc(configs map[string]*certprovider.BuildableConfig, instanc
 	return provider, nil
 }
 
+func outlierDetectionToConfig(od *xdsresource.OutlierDetection) outlierdetection.LBConfig { // Already validated - no need to return error
+	if od == nil {
+		// "If the outlier_detection field is not set in the Cluster message, a
+		// "no-op" outlier_detection config will be generated, with interval set
+		// to the maximum possible value and all other fields unset." - A50
+		return outlierdetection.LBConfig{
+			Interval: 1<<63 - 1,
+		}
+	}
+
+	// "if the enforcing_success_rate field is set to 0, the config
+	// success_rate_ejection field will be null and all success_rate_* fields
+	// will be ignored." - A50
+	var sre *outlierdetection.SuccessRateEjection
+	if od.EnforcingSuccessRate != 0 {
+		sre = &outlierdetection.SuccessRateEjection{
+			StdevFactor:           od.SuccessRateStdevFactor,
+			EnforcementPercentage: od.EnforcingSuccessRate,
+			MinimumHosts:          od.SuccessRateMinimumHosts,
+			RequestVolume:         od.SuccessRateRequestVolume,
+		}
+	}
+
+	// "If the enforcing_failure_percent field is set to 0 or null, the config
+	// failure_percent_ejection field will be null and all failure_percent_*
+	// fields will be ignored." - A50
+	var fpe *outlierdetection.FailurePercentageEjection
+	if od.EnforcingFailurePercentage != 0 {
+		fpe = &outlierdetection.FailurePercentageEjection{
+			Threshold:             od.FailurePercentageThreshold,
+			EnforcementPercentage: od.EnforcingFailurePercentage,
+			MinimumHosts:          od.FailurePercentageMinimumHosts,
+			RequestVolume:         od.FailurePercentageRequestVolume,
+		}
+	}
+
+	return outlierdetection.LBConfig{
+		Interval:                  od.Interval,
+		BaseEjectionTime:          od.BaseEjectionTime,
+		MaxEjectionTime:           od.MaxEjectionTime,
+		MaxEjectionPercent:        od.MaxEjectionPercent,
+		SuccessRateEjection:       sre,
+		FailurePercentageEjection: fpe,
+	}
+}
+
 // handleWatchUpdate handles a watch update from the xDS Client. Good updates
 // lead to clientConn updates being invoked on the underlying cluster_resolver balancer.
 func (b *cdsBalancer) handleWatchUpdate(update clusterHandlerUpdate) {
@@ -342,6 +390,9 @@ func (b *cdsBalancer) handleWatchUpdate(update clusterHandlerUpdate) {
 		default:
 			b.logger.Infof("unexpected cluster type %v when handling update from cluster handler", cu.ClusterType)
 		}
+		if envconfig.XDSOutlierDetection {
+			dms[i].OutlierDetection = outlierDetectionToConfig(cu.OutlierDetection)
+		}
 	}
 	lbCfg := &clusterresolver.LBConfig{
 		DiscoveryMechanisms: dms,
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cluster_handler.go b/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cluster_handler.go
index a10d8d772f2b..234511a45dcf 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cluster_handler.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/cdsbalancer/cluster_handler.go
@@ -24,7 +24,12 @@ import (
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
 )
 
-var errNotReceivedUpdate = errors.New("tried to construct a cluster update on a cluster that has not received an update")
+const maxDepth = 16
+
+var (
+	errNotReceivedUpdate = errors.New("tried to construct a cluster update on a cluster that has not received an update")
+	errExceedsMaxDepth   = errors.New("aggregate cluster graph exceeds max depth")
+)
 
 // clusterHandlerUpdate wraps the information received from the registered CDS
 // watcher. A non-nil error is propagated to the underlying cluster_resolver
@@ -54,9 +59,10 @@ type clusterHandler struct {
 
 	// A mutex to protect entire tree of clusters.
 	clusterMutex    sync.Mutex
-	root            *clusterNode
 	rootClusterName string
 
+	createdClusters map[string]*clusterNode
+
 	// A way to ping CDS Balancer about any updates or errors to a Node in the
 	// tree. This will either get called from this handler constructing an
 	// update or from a child with an error. Capacity of one as the only update
@@ -66,39 +72,48 @@ type clusterHandler struct {
 
 func newClusterHandler(parent *cdsBalancer) *clusterHandler {
 	return &clusterHandler{
-		parent:        parent,
-		updateChannel: make(chan clusterHandlerUpdate, 1),
+		parent:          parent,
+		updateChannel:   make(chan clusterHandlerUpdate, 1),
+		createdClusters: make(map[string]*clusterNode),
 	}
 }
 
 func (ch *clusterHandler) updateRootCluster(rootClusterName string) {
 	ch.clusterMutex.Lock()
 	defer ch.clusterMutex.Unlock()
-	if ch.root == nil {
+	if ch.createdClusters[ch.rootClusterName] == nil {
 		// Construct a root node on first update.
-		ch.root = createClusterNode(rootClusterName, ch.parent.xdsClient, ch)
+		createClusterNode(rootClusterName, ch.parent.xdsClient, ch, 0)
 		ch.rootClusterName = rootClusterName
 		return
 	}
 	// Check if root cluster was changed. If it was, delete old one and start
 	// new one, if not do nothing.
 	if rootClusterName != ch.rootClusterName {
-		ch.root.delete()
-		ch.root = createClusterNode(rootClusterName, ch.parent.xdsClient, ch)
+		ch.createdClusters[ch.rootClusterName].delete()
+		createClusterNode(rootClusterName, ch.parent.xdsClient, ch, 0)
 		ch.rootClusterName = rootClusterName
 	}
 }
 
 // This function tries to construct a cluster update to send to CDS.
 func (ch *clusterHandler) constructClusterUpdate() {
-	if ch.root == nil {
+	if ch.createdClusters[ch.rootClusterName] == nil {
 		// If root is nil, this handler is closed, ignore the update.
 		return
 	}
-	clusterUpdate, err := ch.root.constructClusterUpdate()
+	clusterUpdate, err := ch.createdClusters[ch.rootClusterName].constructClusterUpdate(make(map[string]bool))
 	if err != nil {
-		// If there was an error received no op, as this simply means one of the
-		// children hasn't received an update yet.
+		// If there was an error received no op, as this can mean one of the
+		// children hasn't received an update yet, or the graph continued to
+		// stay in an error state. If the graph continues to stay in an error
+		// state, no new error needs to be written to the update buffer as that
+		// would be redundant information.
+		return
+	}
+	if clusterUpdate == nil {
+		// This means that there was an aggregated cluster with no EDS or DNS as
+		// leaf nodes. No update to be written.
 		return
 	}
 	// For a ClusterUpdate, the only update CDS cares about is the most
@@ -109,8 +124,8 @@ func (ch *clusterHandler) constructClusterUpdate() {
 	default:
 	}
 	ch.updateChannel <- clusterHandlerUpdate{
-		securityCfg: ch.root.clusterUpdate.SecurityCfg,
-		lbPolicy:    ch.root.clusterUpdate.LBPolicy,
+		securityCfg: ch.createdClusters[ch.rootClusterName].clusterUpdate.SecurityCfg,
+		lbPolicy:    ch.createdClusters[ch.rootClusterName].clusterUpdate.LBPolicy,
 		updates:     clusterUpdate,
 	}
 }
@@ -120,11 +135,10 @@ func (ch *clusterHandler) constructClusterUpdate() {
 func (ch *clusterHandler) close() {
 	ch.clusterMutex.Lock()
 	defer ch.clusterMutex.Unlock()
-	if ch.root == nil {
+	if ch.createdClusters[ch.rootClusterName] == nil {
 		return
 	}
-	ch.root.delete()
-	ch.root = nil
+	ch.createdClusters[ch.rootClusterName].delete()
 	ch.rootClusterName = ""
 }
 
@@ -136,7 +150,7 @@ type clusterNode struct {
 	cancelFunc func()
 
 	// A list of children, as the Node can be an aggregate Cluster.
-	children []*clusterNode
+	children []string
 
 	// A ClusterUpdate in order to build a list of cluster updates for CDS to
 	// send down to child XdsClusterResolverLoadBalancingPolicy.
@@ -149,13 +163,30 @@ type clusterNode struct {
 	receivedUpdate bool
 
 	clusterHandler *clusterHandler
+
+	depth    int32
+	refCount int32
+
+	// maxDepthErr is set if this cluster node is an aggregate cluster and has a
+	// child that causes the graph to exceed the maximum depth allowed. This is
+	// used to show a cluster graph as being in an error state when it constructs
+	// a cluster update.
+	maxDepthErr error
 }
 
 // CreateClusterNode creates a cluster node from a given clusterName. This will
 // also start the watch for that cluster.
-func createClusterNode(clusterName string, xdsClient xdsclient.XDSClient, topLevelHandler *clusterHandler) *clusterNode {
+func createClusterNode(clusterName string, xdsClient xdsclient.XDSClient, topLevelHandler *clusterHandler, depth int32) {
+	// If the cluster has already been created, simply return, which ignores
+	// duplicates.
+	if topLevelHandler.createdClusters[clusterName] != nil {
+		topLevelHandler.createdClusters[clusterName].refCount++
+		return
+	}
 	c := &clusterNode{
 		clusterHandler: topLevelHandler,
+		depth:          depth,
+		refCount:       1,
 	}
 	// Communicate with the xds client here.
 	topLevelHandler.parent.logger.Infof("CDS watch started on %v", clusterName)
@@ -164,25 +195,43 @@ func createClusterNode(clusterName string, xdsClient xdsclient.XDSClient, topLev
 		topLevelHandler.parent.logger.Infof("CDS watch canceled on %v", clusterName)
 		cancel()
 	}
-	return c
+	topLevelHandler.createdClusters[clusterName] = c
 }
 
 // This function cancels the cluster watch on the cluster and all of it's
 // children.
 func (c *clusterNode) delete() {
-	c.cancelFunc()
-	for _, child := range c.children {
-		child.delete()
+	c.refCount--
+	if c.refCount == 0 {
+		c.cancelFunc()
+		delete(c.clusterHandler.createdClusters, c.clusterUpdate.ClusterName)
+		for _, child := range c.children {
+			if c.clusterHandler.createdClusters[child] != nil {
+				c.clusterHandler.createdClusters[child].delete()
+			}
+		}
 	}
 }
 
 // Construct cluster update (potentially a list of ClusterUpdates) for a node.
-func (c *clusterNode) constructClusterUpdate() ([]xdsresource.ClusterUpdate, error) {
+func (c *clusterNode) constructClusterUpdate(clustersSeen map[string]bool) ([]xdsresource.ClusterUpdate, error) {
 	// If the cluster has not yet received an update, the cluster update is not
 	// yet ready.
 	if !c.receivedUpdate {
 		return nil, errNotReceivedUpdate
 	}
+	if c.maxDepthErr != nil {
+		return nil, c.maxDepthErr
+	}
+	// Ignore duplicates. It's ok to ignore duplicates because the second
+	// occurrence of a cluster will never be used. I.e. in [C, D, C], the second
+	// C will never be used (the only way to fall back to lower priority D is if
+	// C is down, which means second C will never be chosen). Thus, [C, D, C] is
+	// logically equivalent to [C, D].
+	if clustersSeen[c.clusterUpdate.ClusterName] {
+		return []xdsresource.ClusterUpdate{}, nil
+	}
+	clustersSeen[c.clusterUpdate.ClusterName] = true
 
 	// Base case - LogicalDNS or EDS. Both of these cluster types will be tied
 	// to a single ClusterUpdate.
@@ -194,7 +243,7 @@ func (c *clusterNode) constructClusterUpdate() ([]xdsresource.ClusterUpdate, err
 	// it's children.
 	var childrenUpdates []xdsresource.ClusterUpdate
 	for _, child := range c.children {
-		childUpdateList, err := child.constructClusterUpdate()
+		childUpdateList, err := c.clusterHandler.createdClusters[child].constructClusterUpdate(clustersSeen)
 		if err != nil {
 			return nil, err
 		}
@@ -219,6 +268,8 @@ func (c *clusterNode) handleResp(clusterUpdate xdsresource.ClusterUpdate, err er
 		default:
 		}
 		c.clusterHandler.updateChannel <- clusterHandlerUpdate{err: err}
+		c.receivedUpdate = false
+		c.maxDepthErr = nil
 		return
 	}
 
@@ -233,9 +284,10 @@ func (c *clusterNode) handleResp(clusterUpdate xdsresource.ClusterUpdate, err er
 	// cluster.
 	if clusterUpdate.ClusterType != xdsresource.ClusterTypeAggregate {
 		for _, child := range c.children {
-			child.delete()
+			c.clusterHandler.createdClusters[child].delete()
 		}
 		c.children = nil
+		c.maxDepthErr = nil
 		// This is an update in the one leaf node, should try to send an update
 		// to the parent CDS balancer.
 		//
@@ -248,6 +300,22 @@ func (c *clusterNode) handleResp(clusterUpdate xdsresource.ClusterUpdate, err er
 	}
 
 	// Aggregate cluster handling.
+	if len(clusterUpdate.PrioritizedClusterNames) >= 1 {
+		if c.depth == maxDepth-1 {
+			// For a ClusterUpdate, the only update CDS cares about is the most
+			// recent one, so opportunistically drain the update channel before
+			// sending the new update.
+			select {
+			case <-c.clusterHandler.updateChannel:
+			default:
+			}
+			c.clusterHandler.updateChannel <- clusterHandlerUpdate{err: errExceedsMaxDepth}
+			c.children = []string{}
+			c.maxDepthErr = errExceedsMaxDepth
+			return
+		}
+	}
+
 	newChildren := make(map[string]bool)
 	for _, childName := range clusterUpdate.PrioritizedClusterNames {
 		newChildren[childName] = true
@@ -261,59 +329,42 @@ func (c *clusterNode) handleResp(clusterUpdate xdsresource.ClusterUpdate, err er
 	// the update to build (ex. if a child is created and a watch is started,
 	// that child hasn't received an update yet due to the mutex lock on this
 	// callback).
-	var createdChild, deletedChild bool
+	var createdChild bool
 
 	// This map will represent the current children of the cluster. It will be
 	// first added to in order to represent the new children. It will then have
-	// any children deleted that are no longer present. Then, from the cluster
-	// update received, will be used to construct the new child list.
-	mapCurrentChildren := make(map[string]*clusterNode)
+	// any children deleted that are no longer present.
+	mapCurrentChildren := make(map[string]bool)
 	for _, child := range c.children {
-		mapCurrentChildren[child.clusterUpdate.ClusterName] = child
+		mapCurrentChildren[child] = true
 	}
 
 	// Add and construct any new child nodes.
 	for child := range newChildren {
 		if _, inChildrenAlready := mapCurrentChildren[child]; !inChildrenAlready {
-			createdChild = true
-			mapCurrentChildren[child] = createClusterNode(child, c.clusterHandler.parent.xdsClient, c.clusterHandler)
+			createClusterNode(child, c.clusterHandler.parent.xdsClient, c.clusterHandler, c.depth+1)
 		}
 	}
 
 	// Delete any child nodes no longer in the aggregate cluster's children.
 	for child := range mapCurrentChildren {
 		if _, stillAChild := newChildren[child]; !stillAChild {
-			deletedChild = true
-			mapCurrentChildren[child].delete()
+			c.clusterHandler.createdClusters[child].delete()
 			delete(mapCurrentChildren, child)
 		}
 	}
 
-	// The order of the children list matters, so use the clusterUpdate from
-	// xdsclient as the ordering, and use that logical ordering for the new
-	// children list. This will be a mixture of child nodes which are all
-	// already constructed in the mapCurrentChildrenMap.
-	var children = make([]*clusterNode, 0, len(clusterUpdate.PrioritizedClusterNames))
-
-	for _, orderedChild := range clusterUpdate.PrioritizedClusterNames {
-		// The cluster's already have watches started for them in xds client, so
-		// you can use these pointers to construct the new children list, you
-		// just have to put them in the correct order using the original cluster
-		// update.
-		currentChild := mapCurrentChildren[orderedChild]
-		children = append(children, currentChild)
-	}
-
-	c.children = children
+	c.children = clusterUpdate.PrioritizedClusterNames
 
+	c.maxDepthErr = nil
 	// If the cluster is an aggregate cluster, if this callback created any new
 	// child cluster nodes, then there's no possibility for a full cluster
 	// update to successfully build, as those created children will not have
-	// received an update yet. However, if there was simply a child deleted,
-	// then there is a possibility that it will have a full cluster update to
-	// build and also will have a changed overall cluster update from the
-	// deleted child.
-	if deletedChild && !createdChild {
+	// received an update yet. Even if this update did not delete a child, there
+	// is still a possibility for the cluster update to build, as the aggregate
+	// cluster can ignore duplicated children and thus the update can fill out
+	// the full cluster update tree.
+	if !createdChild {
 		c.clusterHandler.constructClusterUpdate()
 	}
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterimpl/picker.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterimpl/picker.go
index 8cce07553082..360fc44c9e4d 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterimpl/picker.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterimpl/picker.go
@@ -19,7 +19,6 @@
 package clusterimpl
 
 import (
-	orcapb "github.com/cncf/xds/go/xds/data/orca/v3"
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/connectivity"
@@ -27,6 +26,8 @@ import (
 	"google.golang.org/grpc/status"
 	"google.golang.org/grpc/xds/internal/xdsclient"
 	"google.golang.org/grpc/xds/internal/xdsclient/load"
+
+	v3orcapb "github.com/cncf/xds/go/xds/data/orca/v3"
 )
 
 // NewRandomWRR is used when calculating drops. It's exported so that tests can
@@ -158,7 +159,7 @@ func (d *picker) Pick(info balancer.PickInfo) (balancer.PickResult, error) {
 			}
 			d.loadStore.CallFinished(lIDStr, info.Err)
 
-			load, ok := info.ServerLoad.(*orcapb.OrcaLoadReport)
+			load, ok := info.ServerLoad.(*v3orcapb.OrcaLoadReport)
 			if !ok {
 				return
 			}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/balancerstateaggregator.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/balancerstateaggregator.go
index 6e0e03299f95..4b971a3e241b 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/balancerstateaggregator.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/balancerstateaggregator.go
@@ -57,6 +57,11 @@ type balancerStateAggregator struct {
 	//
 	// If an ID is not in map, it's either removed or never added.
 	idToPickerState map[string]*subBalancerState
+	// Set when UpdateState call propagation is paused.
+	pauseUpdateState bool
+	// Set when UpdateState call propagation is paused and an UpdateState call
+	// is suppressed.
+	needUpdateStateOnResume bool
 }
 
 func newBalancerStateAggregator(cc balancer.ClientConn, logger *grpclog.PrefixLogger) *balancerStateAggregator {
@@ -118,6 +123,27 @@ func (bsa *balancerStateAggregator) remove(id string) {
 	delete(bsa.idToPickerState, id)
 }
 
+// pauseStateUpdates causes UpdateState calls to not propagate to the parent
+// ClientConn.  The last state will be remembered and propagated when
+// ResumeStateUpdates is called.
+func (bsa *balancerStateAggregator) pauseStateUpdates() {
+	bsa.mu.Lock()
+	defer bsa.mu.Unlock()
+	bsa.pauseUpdateState = true
+	bsa.needUpdateStateOnResume = false
+}
+
+// resumeStateUpdates will resume propagating UpdateState calls to the parent,
+// and call UpdateState on the parent if any UpdateState call was suppressed.
+func (bsa *balancerStateAggregator) resumeStateUpdates() {
+	bsa.mu.Lock()
+	defer bsa.mu.Unlock()
+	bsa.pauseUpdateState = false
+	if bsa.needUpdateStateOnResume {
+		bsa.cc.UpdateState(bsa.build())
+	}
+}
+
 // UpdateState is called to report a balancer state change from sub-balancer.
 // It's usually called by the balancer group.
 //
@@ -143,6 +169,12 @@ func (bsa *balancerStateAggregator) UpdateState(id string, state balancer.State)
 	if !bsa.started {
 		return
 	}
+	if bsa.pauseUpdateState {
+		// If updates are paused, do not call UpdateState, but remember that we
+		// need to call it when they are resumed.
+		bsa.needUpdateStateOnResume = true
+		return
+	}
 	bsa.cc.UpdateState(bsa.build())
 }
 
@@ -168,6 +200,12 @@ func (bsa *balancerStateAggregator) buildAndUpdate() {
 	if !bsa.started {
 		return
 	}
+	if bsa.pauseUpdateState {
+		// If updates are paused, do not call UpdateState, but remember that we
+		// need to call it when they are resumed.
+		bsa.needUpdateStateOnResume = true
+		return
+	}
 	bsa.cc.UpdateState(bsa.build())
 }
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/clustermanager.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/clustermanager.go
index 8d71200d8c61..6ac7a39b2b4c 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/clustermanager.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clustermanager/clustermanager.go
@@ -93,6 +93,11 @@ func (b *bal) updateChildren(s balancer.ClientConnState, newConfig *lbConfig) {
 			b.stateAggregator.add(name)
 			// Then add to the balancer group.
 			b.bg.Add(name, balancer.Get(newT.ChildPolicy.Name))
+		} else {
+			// Already present, check for type change and if so send down a new builder.
+			if newT.ChildPolicy.Name != b.children[name].ChildPolicy.Name {
+				b.bg.UpdateBuilder(name, balancer.Get(newT.ChildPolicy.Name))
+			}
 		}
 		// TODO: handle error? How to aggregate errors and return?
 		_ = b.bg.UpdateClientConnState(name, balancer.ClientConnState{
@@ -118,6 +123,8 @@ func (b *bal) UpdateClientConnState(s balancer.ClientConnState) error {
 	}
 	b.logger.Infof("update with config %+v, resolver state %+v", pretty.ToJSON(s.BalancerConfig), s.ResolverState)
 
+	b.stateAggregator.pauseStateUpdates()
+	defer b.stateAggregator.resumeStateUpdates()
 	b.updateChildren(s, newConfig)
 	return nil
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/clusterresolver.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/clusterresolver.go
index d49014cfa433..9b373fb36970 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/clusterresolver.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/clusterresolver.go
@@ -23,10 +23,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 
 	"google.golang.org/grpc/attributes"
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/balancer/base"
+	"google.golang.org/grpc/balancer/roundrobin"
 	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/internal/buffer"
 	"google.golang.org/grpc/internal/grpclog"
@@ -35,6 +37,7 @@ import (
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/serviceconfig"
 	"google.golang.org/grpc/xds/internal/balancer/priority"
+	"google.golang.org/grpc/xds/internal/balancer/ringhash"
 	"google.golang.org/grpc/xds/internal/xdsclient"
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
 )
@@ -99,6 +102,9 @@ func (bb) ParseConfig(c json.RawMessage) (serviceconfig.LoadBalancingConfig, err
 	if err := json.Unmarshal(c, &cfg); err != nil {
 		return nil, fmt.Errorf("unable to unmarshal balancer config %s into cluster-resolver config, error: %v", string(c), err)
 	}
+	if lbp := cfg.XDSLBPolicy; lbp != nil && !strings.EqualFold(lbp.Name, roundrobin.Name) && !strings.EqualFold(lbp.Name, ringhash.Name) {
+		return nil, fmt.Errorf("unsupported child policy with name %q, not one of {%q,%q}", lbp.Name, roundrobin.Name, ringhash.Name)
+	}
 	return &cfg, nil
 }
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/config.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/config.go
index 363afd03ab2c..2458b106772f 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/config.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/config.go
@@ -21,12 +21,10 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"strings"
 
-	"google.golang.org/grpc/balancer/roundrobin"
 	internalserviceconfig "google.golang.org/grpc/internal/serviceconfig"
 	"google.golang.org/grpc/serviceconfig"
-	"google.golang.org/grpc/xds/internal/balancer/ringhash"
+	"google.golang.org/grpc/xds/internal/balancer/outlierdetection"
 	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
 )
 
@@ -102,6 +100,9 @@ type DiscoveryMechanism struct {
 	// DNSHostname is the DNS name to resolve in "host:port" form. For type
 	// LOGICAL_DNS only.
 	DNSHostname string `json:"dnsHostname,omitempty"`
+	// OutlierDetection is the Outlier Detection LB configuration for this
+	// priority.
+	OutlierDetection outlierdetection.LBConfig `json:"outlierDetection,omitempty"`
 }
 
 // Equal returns whether the DiscoveryMechanism is the same with the parameter.
@@ -117,6 +118,8 @@ func (dm DiscoveryMechanism) Equal(b DiscoveryMechanism) bool {
 		return false
 	case dm.DNSHostname != b.DNSHostname:
 		return false
+	case !dm.OutlierDetection.EqualIgnoringChildPolicy(&b.OutlierDetection):
+		return false
 	}
 
 	if dm.LoadReportingServer == nil && b.LoadReportingServer == nil {
@@ -161,19 +164,3 @@ type LBConfig struct {
 	// is responsible for both locality picking and endpoint picking.
 	XDSLBPolicy *internalserviceconfig.BalancerConfig `json:"xdsLbPolicy,omitempty"`
 }
-
-const (
-	rrName = roundrobin.Name
-	rhName = ringhash.Name
-)
-
-func parseConfig(c json.RawMessage) (*LBConfig, error) {
-	var cfg LBConfig
-	if err := json.Unmarshal(c, &cfg); err != nil {
-		return nil, err
-	}
-	if lbp := cfg.XDSLBPolicy; lbp != nil && !strings.EqualFold(lbp.Name, rrName) && !strings.EqualFold(lbp.Name, rhName) {
-		return nil, fmt.Errorf("unsupported child policy with name %q, not one of {%q,%q}", lbp.Name, rrName, rhName)
-	}
-	return &cfg, nil
-}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder.go
index 4cce16ff9a3d..a29658ec3141 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder.go
@@ -26,11 +26,13 @@ import (
 	"google.golang.org/grpc/balancer/roundrobin"
 	"google.golang.org/grpc/balancer/weightedroundrobin"
 	"google.golang.org/grpc/balancer/weightedtarget"
+	"google.golang.org/grpc/internal/envconfig"
 	"google.golang.org/grpc/internal/hierarchy"
 	internalserviceconfig "google.golang.org/grpc/internal/serviceconfig"
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/xds/internal"
 	"google.golang.org/grpc/xds/internal/balancer/clusterimpl"
+	"google.golang.org/grpc/xds/internal/balancer/outlierdetection"
 	"google.golang.org/grpc/xds/internal/balancer/priority"
 	"google.golang.org/grpc/xds/internal/balancer/ringhash"
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
@@ -51,6 +53,9 @@ type priorityConfig struct {
 	edsResp xdsresource.EndpointsUpdate
 	// addresses is set only if type is DNS.
 	addresses []string
+	// Each discovery mechanism has a name generator so that the child policies
+	// can reuse names between updates (EDS updates for example).
+	childNameGen *nameGenerator
 }
 
 // buildPriorityConfigJSON builds balancer config for the passed in
@@ -118,42 +123,80 @@ func buildPriorityConfig(priorities []priorityConfig, xdsLBPolicy *internalservi
 		retConfig = &priority.LBConfig{Children: make(map[string]*priority.Child)}
 		retAddrs  []resolver.Address
 	)
-	for i, p := range priorities {
+	for _, p := range priorities {
 		switch p.mechanism.Type {
 		case DiscoveryMechanismTypeEDS:
-			names, configs, addrs, err := buildClusterImplConfigForEDS(i, p.edsResp, p.mechanism, xdsLBPolicy)
+			names, configs, addrs, err := buildClusterImplConfigForEDS(p.childNameGen, p.edsResp, p.mechanism, xdsLBPolicy)
 			if err != nil {
 				return nil, nil, err
 			}
 			retConfig.Priorities = append(retConfig.Priorities, names...)
+			retAddrs = append(retAddrs, addrs...)
+			var odCfgs map[string]*outlierdetection.LBConfig
+			if envconfig.XDSOutlierDetection {
+				odCfgs = convertClusterImplMapToOutlierDetection(configs, p.mechanism.OutlierDetection)
+				for n, c := range odCfgs {
+					retConfig.Children[n] = &priority.Child{
+						Config: &internalserviceconfig.BalancerConfig{Name: outlierdetection.Name, Config: c},
+						// Ignore all re-resolution from EDS children.
+						IgnoreReresolutionRequests: true,
+					}
+				}
+				continue
+			}
 			for n, c := range configs {
 				retConfig.Children[n] = &priority.Child{
 					Config: &internalserviceconfig.BalancerConfig{Name: clusterimpl.Name, Config: c},
 					// Ignore all re-resolution from EDS children.
 					IgnoreReresolutionRequests: true,
 				}
+
 			}
-			retAddrs = append(retAddrs, addrs...)
 		case DiscoveryMechanismTypeLogicalDNS:
-			name, config, addrs := buildClusterImplConfigForDNS(i, p.addresses, p.mechanism)
+			name, config, addrs := buildClusterImplConfigForDNS(p.childNameGen, p.addresses, p.mechanism)
 			retConfig.Priorities = append(retConfig.Priorities, name)
+			retAddrs = append(retAddrs, addrs...)
+			var odCfg *outlierdetection.LBConfig
+			if envconfig.XDSOutlierDetection {
+				odCfg = makeClusterImplOutlierDetectionChild(config, p.mechanism.OutlierDetection)
+				retConfig.Children[name] = &priority.Child{
+					Config: &internalserviceconfig.BalancerConfig{Name: outlierdetection.Name, Config: odCfg},
+					// Not ignore re-resolution from DNS children, they will trigger
+					// DNS to re-resolve.
+					IgnoreReresolutionRequests: false,
+				}
+				continue
+			}
 			retConfig.Children[name] = &priority.Child{
 				Config: &internalserviceconfig.BalancerConfig{Name: clusterimpl.Name, Config: config},
 				// Not ignore re-resolution from DNS children, they will trigger
 				// DNS to re-resolve.
 				IgnoreReresolutionRequests: false,
 			}
-			retAddrs = append(retAddrs, addrs...)
 		}
 	}
 	return retConfig, retAddrs, nil
 }
 
-func buildClusterImplConfigForDNS(parentPriority int, addrStrs []string, mechanism DiscoveryMechanism) (string, *clusterimpl.LBConfig, []resolver.Address) {
+func convertClusterImplMapToOutlierDetection(ciCfgs map[string]*clusterimpl.LBConfig, odCfg outlierdetection.LBConfig) map[string]*outlierdetection.LBConfig {
+	odCfgs := make(map[string]*outlierdetection.LBConfig, len(ciCfgs))
+	for n, c := range ciCfgs {
+		odCfgs[n] = makeClusterImplOutlierDetectionChild(c, odCfg)
+	}
+	return odCfgs
+}
+
+func makeClusterImplOutlierDetectionChild(ciCfg *clusterimpl.LBConfig, odCfg outlierdetection.LBConfig) *outlierdetection.LBConfig {
+	odCfgRet := odCfg
+	odCfgRet.ChildPolicy = &internalserviceconfig.BalancerConfig{Name: clusterimpl.Name, Config: ciCfg}
+	return &odCfgRet
+}
+
+func buildClusterImplConfigForDNS(g *nameGenerator, addrStrs []string, mechanism DiscoveryMechanism) (string, *clusterimpl.LBConfig, []resolver.Address) {
 	// Endpoint picking policy for DNS is hardcoded to pick_first.
 	const childPolicy = "pick_first"
 	retAddrs := make([]resolver.Address, 0, len(addrStrs))
-	pName := fmt.Sprintf("priority-%v", parentPriority)
+	pName := fmt.Sprintf("priority-%v", g.prefix)
 	for _, addrStr := range addrStrs {
 		retAddrs = append(retAddrs, hierarchy.Set(resolver.Address{Addr: addrStr}, []string{pName}))
 	}
@@ -172,7 +215,7 @@ func buildClusterImplConfigForDNS(parentPriority int, addrStrs []string, mechani
 // - map{"p0":p0_config, "p1":p1_config}
 // - [p0_address_0, p0_address_1, p1_address_0, p1_address_1]
 //   - p0 addresses' hierarchy attributes are set to p0
-func buildClusterImplConfigForEDS(parentPriority int, edsResp xdsresource.EndpointsUpdate, mechanism DiscoveryMechanism, xdsLBPolicy *internalserviceconfig.BalancerConfig) ([]string, map[string]*clusterimpl.LBConfig, []resolver.Address, error) {
+func buildClusterImplConfigForEDS(g *nameGenerator, edsResp xdsresource.EndpointsUpdate, mechanism DiscoveryMechanism, xdsLBPolicy *internalserviceconfig.BalancerConfig) ([]string, map[string]*clusterimpl.LBConfig, []resolver.Address, error) {
 	drops := make([]clusterimpl.DropConfig, 0, len(edsResp.Drops))
 	for _, d := range edsResp.Drops {
 		drops = append(drops, clusterimpl.DropConfig{
@@ -181,15 +224,12 @@ func buildClusterImplConfigForEDS(parentPriority int, edsResp xdsresource.Endpoi
 		})
 	}
 
-	priorityChildNames, priorities := groupLocalitiesByPriority(edsResp.Localities)
-	retNames := make([]string, 0, len(priorityChildNames))
-	retAddrs := make([]resolver.Address, 0, len(priorityChildNames))
-	retConfigs := make(map[string]*clusterimpl.LBConfig, len(priorityChildNames))
-	for _, priorityName := range priorityChildNames {
-		priorityLocalities := priorities[priorityName]
-		// Prepend parent priority to the priority names, to avoid duplicates.
-		pName := fmt.Sprintf("priority-%v-%v", parentPriority, priorityName)
-		retNames = append(retNames, pName)
+	priorities := groupLocalitiesByPriority(edsResp.Localities)
+	retNames := g.generate(priorities)
+	retConfigs := make(map[string]*clusterimpl.LBConfig, len(retNames))
+	var retAddrs []resolver.Address
+	for i, pName := range retNames {
+		priorityLocalities := priorities[i]
 		cfg, addrs, err := priorityLocalitiesToClusterImpl(priorityLocalities, pName, mechanism, drops, xdsLBPolicy)
 		if err != nil {
 			return nil, nil, nil, err
@@ -202,33 +242,29 @@ func buildClusterImplConfigForEDS(parentPriority int, edsResp xdsresource.Endpoi
 
 // groupLocalitiesByPriority returns the localities grouped by priority.
 //
-// It also returns a list of strings where each string represents a priority,
-// and the list is sorted from higher priority to lower priority.
+// The returned list is sorted from higher priority to lower. Each item in the
+// list is a group of localities.
 //
 // For example, for L0-p0, L1-p0, L2-p1, results will be
-// - ["p0", "p1"]
-// - map{"p0":[L0, L1], "p1":[L2]}
-func groupLocalitiesByPriority(localities []xdsresource.Locality) ([]string, map[string][]xdsresource.Locality) {
+// - [[L0, L1], [L2]]
+func groupLocalitiesByPriority(localities []xdsresource.Locality) [][]xdsresource.Locality {
 	var priorityIntSlice []int
-	priorities := make(map[string][]xdsresource.Locality)
+	priorities := make(map[int][]xdsresource.Locality)
 	for _, locality := range localities {
-		if locality.Weight == 0 {
-			continue
-		}
-		priorityName := fmt.Sprintf("%v", locality.Priority)
-		priorities[priorityName] = append(priorities[priorityName], locality)
-		priorityIntSlice = append(priorityIntSlice, int(locality.Priority))
+		priority := int(locality.Priority)
+		priorities[priority] = append(priorities[priority], locality)
+		priorityIntSlice = append(priorityIntSlice, priority)
 	}
 	// Sort the priorities based on the int value, deduplicate, and then turn
 	// the sorted list into a string list. This will be child names, in priority
 	// order.
 	sort.Ints(priorityIntSlice)
 	priorityIntSliceDeduped := dedupSortedIntSlice(priorityIntSlice)
-	priorityNameSlice := make([]string, 0, len(priorityIntSliceDeduped))
+	ret := make([][]xdsresource.Locality, 0, len(priorityIntSliceDeduped))
 	for _, p := range priorityIntSliceDeduped {
-		priorityNameSlice = append(priorityNameSlice, fmt.Sprintf("%v", p))
+		ret = append(ret, priorities[p])
 	}
-	return priorityNameSlice, priorities
+	return ret
 }
 
 func dedupSortedIntSlice(a []int) []int {
@@ -265,22 +301,22 @@ func priorityLocalitiesToClusterImpl(localities []xdsresource.Locality, priority
 		// ChildPolicy is not set. Will be set based on xdsLBPolicy
 	}
 
-	if xdsLBPolicy == nil || xdsLBPolicy.Name == rrName {
+	if xdsLBPolicy == nil || xdsLBPolicy.Name == roundrobin.Name {
 		// If lb policy is ROUND_ROBIN:
 		// - locality-picking policy is weighted_target
 		// - endpoint-picking policy is round_robin
-		logger.Infof("xds lb policy is %q, building config with weighted_target + round_robin", rrName)
+		logger.Infof("xds lb policy is %q, building config with weighted_target + round_robin", roundrobin.Name)
 		// Child of weighted_target is hardcoded to round_robin.
 		wtConfig, addrs := localitiesToWeightedTarget(localities, priorityName, rrBalancerConfig)
 		clusterImplCfg.ChildPolicy = &internalserviceconfig.BalancerConfig{Name: weightedtarget.Name, Config: wtConfig}
 		return clusterImplCfg, addrs, nil
 	}
 
-	if xdsLBPolicy.Name == rhName {
+	if xdsLBPolicy.Name == ringhash.Name {
 		// If lb policy is RIHG_HASH, will build one ring_hash policy as child.
 		// The endpoints from all localities will be flattened to one addresses
 		// list, and the ring_hash policy will pick endpoints from it.
-		logger.Infof("xds lb policy is %q, building config with ring_hash", rhName)
+		logger.Infof("xds lb policy is %q, building config with ring_hash", ringhash.Name)
 		addrs := localitiesToRingHash(localities, priorityName)
 		// Set child to ring_hash, note that the ring_hash config is from
 		// xdsLBPolicy.
@@ -288,7 +324,7 @@ func priorityLocalitiesToClusterImpl(localities []xdsresource.Locality, priority
 		return clusterImplCfg, addrs, nil
 	}
 
-	return nil, nil, fmt.Errorf("unsupported xds LB policy %q, not one of {%q,%q}", xdsLBPolicy.Name, rrName, rhName)
+	return nil, nil, fmt.Errorf("unsupported xds LB policy %q, not one of {%q,%q}", xdsLBPolicy.Name, roundrobin.Name, ringhash.Name)
 }
 
 // localitiesToRingHash takes a list of localities (with the same priority), and
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder_childname.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder_childname.go
new file mode 100644
index 000000000000..119f4c474752
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/configbuilder_childname.go
@@ -0,0 +1,88 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package clusterresolver
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/xds/internal"
+	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
+)
+
+// nameGenerator generates a child name for a list of priorities (each priority
+// is a list of localities).
+//
+// The purpose of this generator is to reuse names between updates. So the
+// struct keeps state between generate() calls, and a later generate() might
+// return names returned by the previous call.
+type nameGenerator struct {
+	existingNames map[internal.LocalityID]string
+	prefix        uint64
+	nextID        uint64
+}
+
+func newNameGenerator(prefix uint64) *nameGenerator {
+	return &nameGenerator{prefix: prefix}
+}
+
+// generate returns a list of names for the given list of priorities.
+//
+// Each priority is a list of localities. The name for the priority is picked as
+// - for each locality in this priority, if it exists in the existing names,
+// this priority will reuse the name
+// - if no reusable name is found for this priority, a new name is generated
+//
+// For example:
+// - update 1: [[L1], [L2], [L3]] --> ["0", "1", "2"]
+// - update 2: [[L1], [L2], [L3]] --> ["0", "1", "2"]
+// - update 3: [[L1, L2], [L3]] --> ["0", "2"]   (Two priorities were merged)
+// - update 4: [[L1], [L4]] --> ["0", "3",]      (A priority was split, and a new priority was added)
+func (ng *nameGenerator) generate(priorities [][]xdsresource.Locality) []string {
+	var ret []string
+	usedNames := make(map[string]bool)
+	newNames := make(map[internal.LocalityID]string)
+	for _, priority := range priorities {
+		var nameFound string
+		for _, locality := range priority {
+			if name, ok := ng.existingNames[locality.ID]; ok {
+				if !usedNames[name] {
+					nameFound = name
+					// Found a name to use. No need to process the remaining
+					// localities.
+					break
+				}
+			}
+		}
+
+		if nameFound == "" {
+			// No appropriate used name is found. Make a new name.
+			nameFound = fmt.Sprintf("priority-%d-%d", ng.prefix, ng.nextID)
+			ng.nextID++
+		}
+
+		ret = append(ret, nameFound)
+		// All localities in this priority share the same name. Add them all to
+		// the new map.
+		for _, l := range priority {
+			newNames[l.ID] = nameFound
+		}
+		usedNames[nameFound] = true
+	}
+	ng.existingNames = newNames
+	return ret
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/resource_resolver.go b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/resource_resolver.go
index 9d7db26ad14a..9c2fc6e7c797 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/resource_resolver.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/clusterresolver/resource_resolver.go
@@ -55,6 +55,8 @@ type resolverMechanismTuple struct {
 	dm    DiscoveryMechanism
 	dmKey discoveryMechanismKey
 	r     discoveryMechanism
+
+	childNameGen *nameGenerator
 }
 
 type resourceResolver struct {
@@ -62,17 +64,28 @@ type resourceResolver struct {
 	updateChannel chan *resourceUpdate
 
 	// mu protects the slice and map, and content of the resolvers in the slice.
-	mu          sync.Mutex
-	mechanisms  []DiscoveryMechanism
-	children    []resolverMechanismTuple
-	childrenMap map[discoveryMechanismKey]discoveryMechanism
+	mu         sync.Mutex
+	mechanisms []DiscoveryMechanism
+	children   []resolverMechanismTuple
+	// childrenMap's value only needs the resolver implementation (type
+	// discoveryMechanism) and the childNameGen. The other two fields are not
+	// used.
+	//
+	// TODO(cleanup): maybe we can make a new type with just the necessary
+	// fields, and use it here instead.
+	childrenMap map[discoveryMechanismKey]resolverMechanismTuple
+	// Each new discovery mechanism needs a child name generator to reuse child
+	// policy names. But to make sure the names across discover mechanism
+	// doesn't conflict, we need a seq ID. This ID is incremented for each new
+	// discover mechanism.
+	childNameGeneratorSeqID uint64
 }
 
 func newResourceResolver(parent *clusterResolverBalancer) *resourceResolver {
 	return &resourceResolver{
 		parent:        parent,
 		updateChannel: make(chan *resourceUpdate, 1),
-		childrenMap:   make(map[discoveryMechanismKey]discoveryMechanism),
+		childrenMap:   make(map[discoveryMechanismKey]resolverMechanismTuple),
 	}
 }
 
@@ -112,31 +125,54 @@ func (rr *resourceResolver) updateMechanisms(mechanisms []DiscoveryMechanism) {
 			dmKey := discoveryMechanismKey{typ: dm.Type, name: nameToWatch}
 			newDMs[dmKey] = true
 
-			r := rr.childrenMap[dmKey]
-			if r == nil {
-				r = newEDSResolver(nameToWatch, rr.parent.xdsClient, rr)
+			r, ok := rr.childrenMap[dmKey]
+			if !ok {
+				r = resolverMechanismTuple{
+					dm:           dm,
+					dmKey:        dmKey,
+					r:            newEDSResolver(nameToWatch, rr.parent.xdsClient, rr),
+					childNameGen: newNameGenerator(rr.childNameGeneratorSeqID),
+				}
 				rr.childrenMap[dmKey] = r
+				rr.childNameGeneratorSeqID++
+			} else {
+				// If this is not new, keep the fields (especially
+				// childNameGen), and only update the DiscoveryMechanism.
+				//
+				// Note that the same dmKey doesn't mean the same
+				// DiscoveryMechanism. There are fields (e.g.
+				// MaxConcurrentRequests) in DiscoveryMechanism that are not
+				// copied to dmKey, we need to keep those updated.
+				r.dm = dm
 			}
-			rr.children[i] = resolverMechanismTuple{dm: dm, dmKey: dmKey, r: r}
+			rr.children[i] = r
 		case DiscoveryMechanismTypeLogicalDNS:
 			// Name to resolve in DNS is the hostname, not the ClientConn
 			// target.
 			dmKey := discoveryMechanismKey{typ: dm.Type, name: dm.DNSHostname}
 			newDMs[dmKey] = true
 
-			r := rr.childrenMap[dmKey]
-			if r == nil {
-				r = newDNSResolver(dm.DNSHostname, rr)
+			r, ok := rr.childrenMap[dmKey]
+			if !ok {
+				r = resolverMechanismTuple{
+					dm:           dm,
+					dmKey:        dmKey,
+					r:            newDNSResolver(dm.DNSHostname, rr),
+					childNameGen: newNameGenerator(rr.childNameGeneratorSeqID),
+				}
 				rr.childrenMap[dmKey] = r
+				rr.childNameGeneratorSeqID++
+			} else {
+				r.dm = dm
 			}
-			rr.children[i] = resolverMechanismTuple{dm: dm, dmKey: dmKey, r: r}
+			rr.children[i] = r
 		}
 	}
 	// Stop the resources that were removed.
 	for dm, r := range rr.childrenMap {
 		if !newDMs[dm] {
 			delete(rr.childrenMap, dm)
-			r.stop()
+			r.r.stop()
 		}
 	}
 	// Regenerate even if there's no change in discovery mechanism, in case
@@ -150,19 +186,27 @@ func (rr *resourceResolver) resolveNow() {
 	rr.mu.Lock()
 	defer rr.mu.Unlock()
 	for _, r := range rr.childrenMap {
-		r.resolveNow()
+		r.r.resolveNow()
 	}
 }
 
 func (rr *resourceResolver) stop() {
 	rr.mu.Lock()
-	defer rr.mu.Unlock()
-	for dm, r := range rr.childrenMap {
-		delete(rr.childrenMap, dm)
-		r.stop()
-	}
+	// Save the previous childrenMap to stop the children outside the mutex,
+	// and reinitialize the map.  We only need to reinitialize to allow for the
+	// policy to be reused if the resource comes back.  In practice, this does
+	// not happen as the parent LB policy will also be closed, causing this to
+	// be removed entirely, but a future use case might want to reuse the
+	// policy instead.
+	cm := rr.childrenMap
+	rr.childrenMap = make(map[discoveryMechanismKey]resolverMechanismTuple)
 	rr.mechanisms = nil
 	rr.children = nil
+	rr.mu.Unlock()
+
+	for _, r := range cm {
+		r.r.stop()
+	}
 }
 
 // generate collects all the updates from all the resolvers, and push the
@@ -174,13 +218,7 @@ func (rr *resourceResolver) stop() {
 func (rr *resourceResolver) generate() {
 	var ret []priorityConfig
 	for _, rDM := range rr.children {
-		r, ok := rr.childrenMap[rDM.dmKey]
-		if !ok {
-			rr.parent.logger.Infof("resolver for %+v not found, should never happen", rDM.dmKey)
-			continue
-		}
-
-		u, ok := r.lastUpdate()
+		u, ok := rDM.r.lastUpdate()
 		if !ok {
 			// Don't send updates to parent until all resolvers have update to
 			// send.
@@ -188,9 +226,9 @@ func (rr *resourceResolver) generate() {
 		}
 		switch uu := u.(type) {
 		case xdsresource.EndpointsUpdate:
-			ret = append(ret, priorityConfig{mechanism: rDM.dm, edsResp: uu})
+			ret = append(ret, priorityConfig{mechanism: rDM.dm, edsResp: uu, childNameGen: rDM.childNameGen})
 		case []string:
-			ret = append(ret, priorityConfig{mechanism: rDM.dm, addresses: uu})
+			ret = append(ret, priorityConfig{mechanism: rDM.dm, addresses: uu, childNameGen: rDM.childNameGen})
 		}
 	}
 	select {
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/balancer.go b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/balancer.go
new file mode 100644
index 000000000000..062a8e5e48d2
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/balancer.go
@@ -0,0 +1,894 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package outlierdetection provides an implementation of the outlier detection
+// LB policy, as defined in
+// https://github.com/grpc/proposal/blob/master/A50-xds-outlier-detection.md.
+package outlierdetection
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"sync"
+	"sync/atomic"
+	"time"
+	"unsafe"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/internal/balancer/gracefulswitch"
+	"google.golang.org/grpc/internal/buffer"
+	"google.golang.org/grpc/internal/envconfig"
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcrand"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+// Globals to stub out in tests.
+var (
+	afterFunc = time.AfterFunc
+	now       = time.Now
+)
+
+// Name is the name of the outlier detection balancer.
+const Name = "outlier_detection_experimental"
+
+func init() {
+	if envconfig.XDSOutlierDetection {
+		balancer.Register(bb{})
+	}
+}
+
+type bb struct{}
+
+func (bb) Build(cc balancer.ClientConn, bOpts balancer.BuildOptions) balancer.Balancer {
+	b := &outlierDetectionBalancer{
+		cc:             cc,
+		closed:         grpcsync.NewEvent(),
+		done:           grpcsync.NewEvent(),
+		addrs:          make(map[string]*addressInfo),
+		scWrappers:     make(map[balancer.SubConn]*subConnWrapper),
+		scUpdateCh:     buffer.NewUnbounded(),
+		pickerUpdateCh: buffer.NewUnbounded(),
+	}
+	b.logger = prefixLogger(b)
+	b.logger.Infof("Created")
+	b.child = gracefulswitch.NewBalancer(b, bOpts)
+	go b.run()
+	return b
+}
+
+func (bb) ParseConfig(s json.RawMessage) (serviceconfig.LoadBalancingConfig, error) {
+	var lbCfg *LBConfig
+	if err := json.Unmarshal(s, &lbCfg); err != nil { // Validates child config if present as well.
+		return nil, fmt.Errorf("xds: unable to unmarshal LBconfig: %s, error: %v", string(s), err)
+	}
+
+	// Note: in the xds flow, these validations will never fail. The xdsclient
+	// performs the same validations as here on the xds Outlier Detection
+	// resource before parsing into the internal struct which gets marshaled
+	// into JSON before calling this function. A50 defines two separate places
+	// for these validations to take place, the xdsclient and this ParseConfig
+	// method. "When parsing a config from JSON, if any of these requirements is
+	// violated, that should be treated as a parsing error." - A50
+
+	switch {
+	// "The google.protobuf.Duration fields interval, base_ejection_time, and
+	// max_ejection_time must obey the restrictions in the
+	// google.protobuf.Duration documentation and they must have non-negative
+	// values." - A50
+	// Approximately 290 years is the maximum time that time.Duration (int64)
+	// can represent. The restrictions on the protobuf.Duration field are to be
+	// within +-10000 years. Thus, just check for negative values.
+	case lbCfg.Interval < 0:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.interval = %s; must be >= 0", lbCfg.Interval)
+	case lbCfg.BaseEjectionTime < 0:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.base_ejection_time = %s; must be >= 0", lbCfg.BaseEjectionTime)
+	case lbCfg.MaxEjectionTime < 0:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.max_ejection_time = %s; must be >= 0", lbCfg.MaxEjectionTime)
+
+	// "The fields max_ejection_percent,
+	// success_rate_ejection.enforcement_percentage,
+	// failure_percentage_ejection.threshold, and
+	// failure_percentage.enforcement_percentage must have values less than or
+	// equal to 100." - A50
+	case lbCfg.MaxEjectionPercent > 100:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.max_ejection_percent = %v; must be <= 100", lbCfg.MaxEjectionPercent)
+	case lbCfg.SuccessRateEjection != nil && lbCfg.SuccessRateEjection.EnforcementPercentage > 100:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.SuccessRateEjection.enforcement_percentage = %v; must be <= 100", lbCfg.SuccessRateEjection.EnforcementPercentage)
+	case lbCfg.FailurePercentageEjection != nil && lbCfg.FailurePercentageEjection.Threshold > 100:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.FailurePercentageEjection.threshold = %v; must be <= 100", lbCfg.FailurePercentageEjection.Threshold)
+	case lbCfg.FailurePercentageEjection != nil && lbCfg.FailurePercentageEjection.EnforcementPercentage > 100:
+		return nil, fmt.Errorf("OutlierDetectionLoadBalancingConfig.FailurePercentageEjection.enforcement_percentage = %v; must be <= 100", lbCfg.FailurePercentageEjection.EnforcementPercentage)
+	case lbCfg.ChildPolicy == nil:
+		return nil, errors.New("OutlierDetectionLoadBalancingConfig.child_policy must be present")
+	}
+
+	return lbCfg, nil
+}
+
+func (bb) Name() string {
+	return Name
+}
+
+// scUpdate wraps a subConn update to be sent to the child balancer.
+type scUpdate struct {
+	scw   *subConnWrapper
+	state balancer.SubConnState
+}
+
+type ejectionUpdate struct {
+	scw       *subConnWrapper
+	isEjected bool // true for ejected, false for unejected
+}
+
+type lbCfgUpdate struct {
+	lbCfg *LBConfig
+	// to make sure picker is updated synchronously.
+	done chan struct{}
+}
+
+type outlierDetectionBalancer struct {
+	// These fields are safe to be accessed without holding any mutex because
+	// they are synchronized in run(), which makes these field accesses happen
+	// serially.
+	//
+	// childState is the latest balancer state received from the child.
+	childState balancer.State
+	// recentPickerNoop represents whether the most recent picker sent upward to
+	// the balancer.ClientConn is a noop picker, which doesn't count RPC's. Used
+	// to suppress redundant picker updates.
+	recentPickerNoop bool
+
+	closed *grpcsync.Event
+	done   *grpcsync.Event
+	cc     balancer.ClientConn
+	logger *grpclog.PrefixLogger
+
+	// childMu guards calls into child (to uphold the balancer.Balancer API
+	// guarantee of synchronous calls).
+	childMu sync.Mutex
+	child   *gracefulswitch.Balancer
+
+	// mu guards access to the following fields. It also helps to synchronize
+	// behaviors of the following events: config updates, firing of the interval
+	// timer, SubConn State updates, SubConn address updates, and child state
+	// updates.
+	//
+	// For example, when we receive a config update in the middle of the
+	// interval timer algorithm, which uses knobs present in the config, the
+	// balancer will wait for the interval timer algorithm to finish before
+	// persisting the new configuration.
+	//
+	// Another example would be the updating of the addrs map, such as from a
+	// SubConn address update in the middle of the interval timer algorithm
+	// which uses addrs. This balancer waits for the interval timer algorithm to
+	// finish before making the update to the addrs map.
+	//
+	// This mutex is never held at the same time as childMu (within the context
+	// of a single goroutine).
+	mu                    sync.Mutex
+	addrs                 map[string]*addressInfo
+	cfg                   *LBConfig
+	scWrappers            map[balancer.SubConn]*subConnWrapper
+	timerStartTime        time.Time
+	intervalTimer         *time.Timer
+	inhibitPickerUpdates  bool
+	updateUnconditionally bool
+	numAddrsEjected       int // For fast calculations of percentage of addrs ejected
+
+	scUpdateCh     *buffer.Unbounded
+	pickerUpdateCh *buffer.Unbounded
+}
+
+// noopConfig returns whether this balancer is configured with a logical no-op
+// configuration or not.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) noopConfig() bool {
+	return b.cfg.SuccessRateEjection == nil && b.cfg.FailurePercentageEjection == nil
+}
+
+// onIntervalConfig handles logic required specifically on the receipt of a
+// configuration which specifies to count RPC's and periodically perform passive
+// health checking based on heuristics defined in configuration every configured
+// interval.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) onIntervalConfig() {
+	var interval time.Duration
+	if b.timerStartTime.IsZero() {
+		b.timerStartTime = time.Now()
+		for _, addrInfo := range b.addrs {
+			addrInfo.callCounter.clear()
+		}
+		interval = b.cfg.Interval
+	} else {
+		interval = b.cfg.Interval - now().Sub(b.timerStartTime)
+		if interval < 0 {
+			interval = 0
+		}
+	}
+	b.intervalTimer = afterFunc(interval, b.intervalTimerAlgorithm)
+}
+
+// onNoopConfig handles logic required specifically on the receipt of a
+// configuration which specifies the balancer to be a noop.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) onNoopConfig() {
+	// "If a config is provided with both the `success_rate_ejection` and
+	// `failure_percentage_ejection` fields unset, skip starting the timer and
+	// do the following:"
+	// "Unset the timer start timestamp."
+	b.timerStartTime = time.Time{}
+	for _, addrInfo := range b.addrs {
+		// "Uneject all currently ejected addresses."
+		if !addrInfo.latestEjectionTimestamp.IsZero() {
+			b.unejectAddress(addrInfo)
+		}
+		// "Reset each address's ejection time multiplier to 0."
+		addrInfo.ejectionTimeMultiplier = 0
+	}
+}
+
+func (b *outlierDetectionBalancer) UpdateClientConnState(s balancer.ClientConnState) error {
+	lbCfg, ok := s.BalancerConfig.(*LBConfig)
+	if !ok {
+		b.logger.Errorf("received config with unexpected type %T: %v", s.BalancerConfig, s.BalancerConfig)
+		return balancer.ErrBadResolverState
+	}
+
+	// Reject whole config if child policy doesn't exist, don't persist it for
+	// later.
+	bb := balancer.Get(lbCfg.ChildPolicy.Name)
+	if bb == nil {
+		return fmt.Errorf("outlier detection: child balancer %q not registered", lbCfg.ChildPolicy.Name)
+	}
+
+	// It is safe to read b.cfg here without holding the mutex, as the only
+	// write to b.cfg happens later in this function. This function is part of
+	// the balancer.Balancer API, so it is guaranteed to be called in a
+	// synchronous manner, so it cannot race with this read.
+	if b.cfg == nil || b.cfg.ChildPolicy.Name != lbCfg.ChildPolicy.Name {
+		b.childMu.Lock()
+		err := b.child.SwitchTo(bb)
+		if err != nil {
+			b.childMu.Unlock()
+			return fmt.Errorf("outlier detection: error switching to child of type %q: %v", lbCfg.ChildPolicy.Name, err)
+		}
+		b.childMu.Unlock()
+	}
+
+	b.mu.Lock()
+	// Inhibit child picker updates until this UpdateClientConnState() call
+	// completes. If needed, a picker update containing the no-op config bit
+	// determined from this config and most recent state from the child will be
+	// sent synchronously upward at the end of this UpdateClientConnState()
+	// call.
+	b.inhibitPickerUpdates = true
+	b.updateUnconditionally = false
+	b.cfg = lbCfg
+
+	addrs := make(map[string]bool, len(s.ResolverState.Addresses))
+	for _, addr := range s.ResolverState.Addresses {
+		addrs[addr.Addr] = true
+		if _, ok := b.addrs[addr.Addr]; !ok {
+			b.addrs[addr.Addr] = newAddressInfo()
+		}
+	}
+	for addr := range b.addrs {
+		if !addrs[addr] {
+			delete(b.addrs, addr)
+		}
+	}
+
+	if b.intervalTimer != nil {
+		b.intervalTimer.Stop()
+	}
+
+	if b.noopConfig() {
+		b.onNoopConfig()
+	} else {
+		b.onIntervalConfig()
+	}
+	b.mu.Unlock()
+
+	b.childMu.Lock()
+	err := b.child.UpdateClientConnState(balancer.ClientConnState{
+		ResolverState:  s.ResolverState,
+		BalancerConfig: b.cfg.ChildPolicy.Config,
+	})
+	b.childMu.Unlock()
+
+	done := make(chan struct{})
+	b.pickerUpdateCh.Put(lbCfgUpdate{
+		lbCfg: lbCfg,
+		done:  done,
+	})
+	<-done
+
+	return err
+}
+
+func (b *outlierDetectionBalancer) ResolverError(err error) {
+	b.childMu.Lock()
+	defer b.childMu.Unlock()
+	b.child.ResolverError(err)
+}
+
+func (b *outlierDetectionBalancer) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	scw, ok := b.scWrappers[sc]
+	if !ok {
+		// Shouldn't happen if passed down a SubConnWrapper to child on SubConn
+		// creation.
+		b.logger.Errorf("UpdateSubConnState called with SubConn that has no corresponding SubConnWrapper")
+		return
+	}
+	if state.ConnectivityState == connectivity.Shutdown {
+		delete(b.scWrappers, scw.SubConn)
+	}
+	b.scUpdateCh.Put(&scUpdate{
+		scw:   scw,
+		state: state,
+	})
+}
+
+func (b *outlierDetectionBalancer) Close() {
+	b.closed.Fire()
+	<-b.done.Done()
+	b.childMu.Lock()
+	b.child.Close()
+	b.childMu.Unlock()
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.intervalTimer != nil {
+		b.intervalTimer.Stop()
+	}
+}
+
+func (b *outlierDetectionBalancer) ExitIdle() {
+	b.childMu.Lock()
+	defer b.childMu.Unlock()
+	b.child.ExitIdle()
+}
+
+// wrappedPicker delegates to the child policy's picker, and when the request
+// finishes, it increments the corresponding counter in the map entry referenced
+// by the subConnWrapper that was picked. If both the `success_rate_ejection`
+// and `failure_percentage_ejection` fields are unset in the configuration, this
+// picker will not count.
+type wrappedPicker struct {
+	childPicker balancer.Picker
+	noopPicker  bool
+}
+
+func (wp *wrappedPicker) Pick(info balancer.PickInfo) (balancer.PickResult, error) {
+	pr, err := wp.childPicker.Pick(info)
+	if err != nil {
+		return balancer.PickResult{}, err
+	}
+
+	done := func(di balancer.DoneInfo) {
+		if !wp.noopPicker {
+			incrementCounter(pr.SubConn, di)
+		}
+		if pr.Done != nil {
+			pr.Done(di)
+		}
+	}
+	scw, ok := pr.SubConn.(*subConnWrapper)
+	if !ok {
+		// This can never happen, but check is present for defensive
+		// programming.
+		logger.Errorf("Picked SubConn from child picker is not a SubConnWrapper")
+		return balancer.PickResult{
+			SubConn: pr.SubConn,
+			Done:    done,
+		}, nil
+	}
+	return balancer.PickResult{
+		SubConn: scw.SubConn,
+		Done:    done,
+	}, nil
+}
+
+func incrementCounter(sc balancer.SubConn, info balancer.DoneInfo) {
+	scw, ok := sc.(*subConnWrapper)
+	if !ok {
+		// Shouldn't happen, as comes from child
+		return
+	}
+
+	// scw.addressInfo and callCounter.activeBucket can be written to
+	// concurrently (the pointers themselves). Thus, protect the reads here with
+	// atomics to prevent data corruption. There exists a race in which you read
+	// the addressInfo or active bucket pointer and then that pointer points to
+	// deprecated memory. If this goroutine yields the processor, in between
+	// reading the addressInfo pointer and writing to the active bucket,
+	// UpdateAddresses can switch the addressInfo the scw points to. Writing to
+	// an outdated addresses is a very small race and tolerable. After reading
+	// callCounter.activeBucket in this picker a swap call can concurrently
+	// change what activeBucket points to. A50 says to swap the pointer, which
+	// will cause this race to write to deprecated memory the interval timer
+	// algorithm will never read, which makes this race alright.
+	addrInfo := (*addressInfo)(atomic.LoadPointer(&scw.addressInfo))
+	if addrInfo == nil {
+		return
+	}
+	ab := (*bucket)(atomic.LoadPointer(&addrInfo.callCounter.activeBucket))
+
+	if info.Err == nil {
+		atomic.AddUint32(&ab.numSuccesses, 1)
+	} else {
+		atomic.AddUint32(&ab.numFailures, 1)
+	}
+}
+
+func (b *outlierDetectionBalancer) UpdateState(s balancer.State) {
+	b.pickerUpdateCh.Put(s)
+}
+
+func (b *outlierDetectionBalancer) NewSubConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (balancer.SubConn, error) {
+	sc, err := b.cc.NewSubConn(addrs, opts)
+	if err != nil {
+		return nil, err
+	}
+	scw := &subConnWrapper{
+		SubConn:    sc,
+		addresses:  addrs,
+		scUpdateCh: b.scUpdateCh,
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.scWrappers[sc] = scw
+	if len(addrs) != 1 {
+		return scw, nil
+	}
+	addrInfo, ok := b.addrs[addrs[0].Addr]
+	if !ok {
+		return scw, nil
+	}
+	addrInfo.sws = append(addrInfo.sws, scw)
+	atomic.StorePointer(&scw.addressInfo, unsafe.Pointer(addrInfo))
+	if !addrInfo.latestEjectionTimestamp.IsZero() {
+		scw.eject()
+	}
+	return scw, nil
+}
+
+func (b *outlierDetectionBalancer) RemoveSubConn(sc balancer.SubConn) {
+	scw, ok := sc.(*subConnWrapper)
+	if !ok { // Shouldn't happen
+		return
+	}
+	// Remove the wrapped SubConn from the parent Client Conn. We don't remove
+	// from map entry until we get a Shutdown state for the SubConn, as we need
+	// that data to forward that state down.
+	b.cc.RemoveSubConn(scw.SubConn)
+}
+
+// appendIfPresent appends the scw to the address, if the address is present in
+// the Outlier Detection balancers address map. Returns nil if not present, and
+// the map entry if present.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) appendIfPresent(addr string, scw *subConnWrapper) *addressInfo {
+	addrInfo, ok := b.addrs[addr]
+	if !ok {
+		return nil
+	}
+
+	addrInfo.sws = append(addrInfo.sws, scw)
+	atomic.StorePointer(&scw.addressInfo, unsafe.Pointer(addrInfo))
+	return addrInfo
+}
+
+// removeSubConnFromAddressesMapEntry removes the scw from its map entry if
+// present.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) removeSubConnFromAddressesMapEntry(scw *subConnWrapper) {
+	addrInfo := (*addressInfo)(atomic.LoadPointer(&scw.addressInfo))
+	if addrInfo == nil {
+		return
+	}
+	for i, sw := range addrInfo.sws {
+		if scw == sw {
+			addrInfo.sws = append(addrInfo.sws[:i], addrInfo.sws[i+1:]...)
+			return
+		}
+	}
+}
+
+func (b *outlierDetectionBalancer) UpdateAddresses(sc balancer.SubConn, addrs []resolver.Address) {
+	scw, ok := sc.(*subConnWrapper)
+	if !ok {
+		// Return, shouldn't happen if passed up scw
+		return
+	}
+
+	b.cc.UpdateAddresses(scw.SubConn, addrs)
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	// Note that 0 addresses is a valid update/state for a SubConn to be in.
+	// This is correctly handled by this algorithm (handled as part of a non singular
+	// old address/new address).
+	switch {
+	case len(scw.addresses) == 1 && len(addrs) == 1: // single address to single address
+		// If the updated address is the same, then there is nothing to do
+		// past this point.
+		if scw.addresses[0].Addr == addrs[0].Addr {
+			return
+		}
+		b.removeSubConnFromAddressesMapEntry(scw)
+		addrInfo := b.appendIfPresent(addrs[0].Addr, scw)
+		if addrInfo == nil { // uneject unconditionally because could have come from an ejected address
+			scw.uneject()
+			break
+		}
+		if addrInfo.latestEjectionTimestamp.IsZero() { // relay new updated subconn state
+			scw.uneject()
+		} else {
+			scw.eject()
+		}
+	case len(scw.addresses) == 1: // single address to multiple/no addresses
+		b.removeSubConnFromAddressesMapEntry(scw)
+		addrInfo := (*addressInfo)(atomic.LoadPointer(&scw.addressInfo))
+		if addrInfo != nil {
+			addrInfo.callCounter.clear()
+		}
+		scw.uneject()
+	case len(addrs) == 1: // multiple/no addresses to single address
+		addrInfo := b.appendIfPresent(addrs[0].Addr, scw)
+		if addrInfo != nil && !addrInfo.latestEjectionTimestamp.IsZero() {
+			scw.eject()
+		}
+	} // otherwise multiple/no addresses to multiple/no addresses; ignore
+
+	scw.addresses = addrs
+}
+
+func (b *outlierDetectionBalancer) ResolveNow(opts resolver.ResolveNowOptions) {
+	b.cc.ResolveNow(opts)
+}
+
+func (b *outlierDetectionBalancer) Target() string {
+	return b.cc.Target()
+}
+
+func max(x, y int64) int64 {
+	if x < y {
+		return y
+	}
+	return x
+}
+
+func min(x, y int64) int64 {
+	if x < y {
+		return x
+	}
+	return y
+}
+
+// handleSubConnUpdate stores the recent state and forward the update
+// if the SubConn is not ejected.
+func (b *outlierDetectionBalancer) handleSubConnUpdate(u *scUpdate) {
+	scw := u.scw
+	scw.latestState = u.state
+	if !scw.ejected {
+		b.childMu.Lock()
+		b.child.UpdateSubConnState(scw, u.state)
+		b.childMu.Unlock()
+	}
+}
+
+// handleEjectedUpdate handles any SubConns that get ejected/unejected, and
+// forwards the appropriate corresponding subConnState to the child policy.
+func (b *outlierDetectionBalancer) handleEjectedUpdate(u *ejectionUpdate) {
+	scw := u.scw
+	scw.ejected = u.isEjected
+	// If scw.latestState has never been written to will default to connectivity
+	// IDLE, which is fine.
+	stateToUpdate := scw.latestState
+	if u.isEjected {
+		stateToUpdate = balancer.SubConnState{
+			ConnectivityState: connectivity.TransientFailure,
+		}
+	}
+	b.childMu.Lock()
+	b.child.UpdateSubConnState(scw, stateToUpdate)
+	b.childMu.Unlock()
+}
+
+// handleChildStateUpdate forwards the picker update wrapped in a wrapped picker
+// with the noop picker bit present.
+func (b *outlierDetectionBalancer) handleChildStateUpdate(u balancer.State) {
+	b.childState = u
+	b.mu.Lock()
+	if b.inhibitPickerUpdates {
+		// If a child's state is updated during the suppression of child
+		// updates, the synchronous handleLBConfigUpdate function with respect
+		// to UpdateClientConnState should return a picker unconditionally.
+		b.updateUnconditionally = true
+		b.mu.Unlock()
+		return
+	}
+	noopCfg := b.noopConfig()
+	b.mu.Unlock()
+	b.recentPickerNoop = noopCfg
+	b.cc.UpdateState(balancer.State{
+		ConnectivityState: b.childState.ConnectivityState,
+		Picker: &wrappedPicker{
+			childPicker: b.childState.Picker,
+			noopPicker:  noopCfg,
+		},
+	})
+}
+
+// handleLBConfigUpdate compares whether the new config is a noop config or not,
+// to the noop bit in the picker if present. It updates the picker if this bit
+// changed compared to the picker currently in use.
+func (b *outlierDetectionBalancer) handleLBConfigUpdate(u lbCfgUpdate) {
+	lbCfg := u.lbCfg
+	noopCfg := lbCfg.SuccessRateEjection == nil && lbCfg.FailurePercentageEjection == nil
+	// If the child has sent it's first update and this config flips the noop
+	// bit compared to the most recent picker update sent upward, then a new
+	// picker with this updated bit needs to be forwarded upward. If a child
+	// update was received during the suppression of child updates within
+	// UpdateClientConnState(), then a new picker needs to be forwarded with
+	// this updated state, irregardless of whether this new configuration flips
+	// the bit.
+	if b.childState.Picker != nil && noopCfg != b.recentPickerNoop || b.updateUnconditionally {
+		b.recentPickerNoop = noopCfg
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: b.childState.ConnectivityState,
+			Picker: &wrappedPicker{
+				childPicker: b.childState.Picker,
+				noopPicker:  noopCfg,
+			},
+		})
+	}
+	b.inhibitPickerUpdates = false
+	b.updateUnconditionally = false
+	close(u.done)
+}
+
+func (b *outlierDetectionBalancer) run() {
+	defer b.done.Fire()
+	for {
+		select {
+		case update := <-b.scUpdateCh.Get():
+			b.scUpdateCh.Load()
+			if b.closed.HasFired() { // don't send SubConn updates to child after the balancer has been closed
+				return
+			}
+			switch u := update.(type) {
+			case *scUpdate:
+				b.handleSubConnUpdate(u)
+			case *ejectionUpdate:
+				b.handleEjectedUpdate(u)
+			}
+		case update := <-b.pickerUpdateCh.Get():
+			b.pickerUpdateCh.Load()
+			if b.closed.HasFired() { // don't send picker updates to grpc after the balancer has been closed
+				return
+			}
+			switch u := update.(type) {
+			case balancer.State:
+				b.handleChildStateUpdate(u)
+			case lbCfgUpdate:
+				b.handleLBConfigUpdate(u)
+			}
+		case <-b.closed.Done():
+			return
+		}
+	}
+}
+
+// intervalTimerAlgorithm ejects and unejects addresses based on the Outlier
+// Detection configuration and data about each address from the previous
+// interval.
+func (b *outlierDetectionBalancer) intervalTimerAlgorithm() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.timerStartTime = time.Now()
+
+	for _, addrInfo := range b.addrs {
+		addrInfo.callCounter.swap()
+	}
+
+	if b.cfg.SuccessRateEjection != nil {
+		b.successRateAlgorithm()
+	}
+
+	if b.cfg.FailurePercentageEjection != nil {
+		b.failurePercentageAlgorithm()
+	}
+
+	for _, addrInfo := range b.addrs {
+		if addrInfo.latestEjectionTimestamp.IsZero() && addrInfo.ejectionTimeMultiplier > 0 {
+			addrInfo.ejectionTimeMultiplier--
+			continue
+		}
+		if addrInfo.latestEjectionTimestamp.IsZero() {
+			// Address is already not ejected, so no need to check for whether
+			// to uneject the address below.
+			continue
+		}
+		et := b.cfg.BaseEjectionTime.Nanoseconds() * addrInfo.ejectionTimeMultiplier
+		met := max(b.cfg.BaseEjectionTime.Nanoseconds(), b.cfg.MaxEjectionTime.Nanoseconds())
+		curTimeAfterEt := now().After(addrInfo.latestEjectionTimestamp.Add(time.Duration(min(et, met))))
+		if curTimeAfterEt {
+			b.unejectAddress(addrInfo)
+		}
+	}
+
+	// This conditional only for testing (since the interval timer algorithm is
+	// called manually), will never hit in production.
+	if b.intervalTimer != nil {
+		b.intervalTimer.Stop()
+	}
+	b.intervalTimer = afterFunc(b.cfg.Interval, b.intervalTimerAlgorithm)
+}
+
+// addrsWithAtLeastRequestVolume returns a slice of address information of all
+// addresses with at least request volume passed in.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) addrsWithAtLeastRequestVolume(requestVolume uint32) []*addressInfo {
+	var addrs []*addressInfo
+	for _, addrInfo := range b.addrs {
+		bucket := addrInfo.callCounter.inactiveBucket
+		rv := bucket.numSuccesses + bucket.numFailures
+		if rv >= requestVolume {
+			addrs = append(addrs, addrInfo)
+		}
+	}
+	return addrs
+}
+
+// meanAndStdDev returns the mean and std dev of the fractions of successful
+// requests of the addresses passed in.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) meanAndStdDev(addrs []*addressInfo) (float64, float64) {
+	var totalFractionOfSuccessfulRequests float64
+	var mean float64
+	for _, addrInfo := range addrs {
+		bucket := addrInfo.callCounter.inactiveBucket
+		rv := bucket.numSuccesses + bucket.numFailures
+		totalFractionOfSuccessfulRequests += float64(bucket.numSuccesses) / float64(rv)
+	}
+	mean = totalFractionOfSuccessfulRequests / float64(len(addrs))
+	var sumOfSquares float64
+	for _, addrInfo := range addrs {
+		bucket := addrInfo.callCounter.inactiveBucket
+		rv := bucket.numSuccesses + bucket.numFailures
+		devFromMean := (float64(bucket.numSuccesses) / float64(rv)) - mean
+		sumOfSquares += devFromMean * devFromMean
+	}
+	variance := sumOfSquares / float64(len(addrs))
+	return mean, math.Sqrt(variance)
+}
+
+// successRateAlgorithm ejects any addresses where the success rate falls below
+// the other addresses according to mean and standard deviation, and if overall
+// applicable from other set heuristics.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) successRateAlgorithm() {
+	addrsToConsider := b.addrsWithAtLeastRequestVolume(b.cfg.SuccessRateEjection.RequestVolume)
+	if len(addrsToConsider) < int(b.cfg.SuccessRateEjection.MinimumHosts) {
+		return
+	}
+	mean, stddev := b.meanAndStdDev(addrsToConsider)
+	for _, addrInfo := range addrsToConsider {
+		bucket := addrInfo.callCounter.inactiveBucket
+		ejectionCfg := b.cfg.SuccessRateEjection
+		if float64(b.numAddrsEjected)/float64(len(b.addrs))*100 >= float64(b.cfg.MaxEjectionPercent) {
+			return
+		}
+		successRate := float64(bucket.numSuccesses) / float64(bucket.numSuccesses+bucket.numFailures)
+		if successRate < (mean - stddev*(float64(ejectionCfg.StdevFactor)/1000)) {
+			if uint32(grpcrand.Int31n(100)) < ejectionCfg.EnforcementPercentage {
+				b.ejectAddress(addrInfo)
+			}
+		}
+	}
+}
+
+// failurePercentageAlgorithm ejects any addresses where the failure percentage
+// rate exceeds a set enforcement percentage, if overall applicable from other
+// set heuristics.
+//
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) failurePercentageAlgorithm() {
+	addrsToConsider := b.addrsWithAtLeastRequestVolume(b.cfg.FailurePercentageEjection.RequestVolume)
+	if len(addrsToConsider) < int(b.cfg.FailurePercentageEjection.MinimumHosts) {
+		return
+	}
+
+	for _, addrInfo := range addrsToConsider {
+		bucket := addrInfo.callCounter.inactiveBucket
+		ejectionCfg := b.cfg.FailurePercentageEjection
+		if float64(b.numAddrsEjected)/float64(len(b.addrs))*100 >= float64(b.cfg.MaxEjectionPercent) {
+			return
+		}
+		failurePercentage := (float64(bucket.numFailures) / float64(bucket.numSuccesses+bucket.numFailures)) * 100
+		if failurePercentage > float64(b.cfg.FailurePercentageEjection.Threshold) {
+			if uint32(grpcrand.Int31n(100)) < ejectionCfg.EnforcementPercentage {
+				b.ejectAddress(addrInfo)
+			}
+		}
+	}
+}
+
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) ejectAddress(addrInfo *addressInfo) {
+	b.numAddrsEjected++
+	addrInfo.latestEjectionTimestamp = b.timerStartTime
+	addrInfo.ejectionTimeMultiplier++
+	for _, sbw := range addrInfo.sws {
+		sbw.eject()
+	}
+}
+
+// Caller must hold b.mu.
+func (b *outlierDetectionBalancer) unejectAddress(addrInfo *addressInfo) {
+	b.numAddrsEjected--
+	addrInfo.latestEjectionTimestamp = time.Time{}
+	for _, sbw := range addrInfo.sws {
+		sbw.uneject()
+	}
+}
+
+// addressInfo contains the runtime information about an address that pertains
+// to Outlier Detection. This struct and all of its fields is protected by
+// outlierDetectionBalancer.mu in the case where it is accessed through the
+// address map. In the case of Picker callbacks, the writes to the activeBucket
+// of callCounter are protected by atomically loading and storing
+// unsafe.Pointers (see further explanation in incrementCounter()).
+type addressInfo struct {
+	// The call result counter object.
+	callCounter *callCounter
+
+	// The latest ejection timestamp, or zero if the address is currently not
+	// ejected.
+	latestEjectionTimestamp time.Time
+
+	// The current ejection time multiplier, starting at 0.
+	ejectionTimeMultiplier int64
+
+	// A list of subchannel wrapper objects that correspond to this address.
+	sws []*subConnWrapper
+}
+
+func newAddressInfo() *addressInfo {
+	return &addressInfo{
+		callCounter: newCallCounter(),
+	}
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/callcounter.go b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/callcounter.go
new file mode 100644
index 000000000000..4597f727b6e0
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/callcounter.go
@@ -0,0 +1,66 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package outlierdetection
+
+import (
+	"sync/atomic"
+	"unsafe"
+)
+
+type bucket struct {
+	numSuccesses uint32
+	numFailures  uint32
+}
+
+func newCallCounter() *callCounter {
+	return &callCounter{
+		activeBucket:   unsafe.Pointer(&bucket{}),
+		inactiveBucket: &bucket{},
+	}
+}
+
+// callCounter has two buckets, which each count successful and failing RPC's.
+// The activeBucket is used to actively count any finished RPC's, and the
+// inactiveBucket is populated with this activeBucket's data every interval for
+// use by the Outlier Detection algorithm.
+type callCounter struct {
+	// activeBucket updates every time a call finishes (from picker passed to
+	// Client Conn), so protect pointer read with atomic load of unsafe.Pointer
+	// so picker does not have to grab a mutex per RPC, the critical path.
+	activeBucket   unsafe.Pointer // bucket
+	inactiveBucket *bucket
+}
+
+func (cc *callCounter) clear() {
+	atomic.StorePointer(&cc.activeBucket, unsafe.Pointer(&bucket{}))
+	cc.inactiveBucket = &bucket{}
+}
+
+// "When the timer triggers, the inactive bucket is zeroed and swapped with the
+// active bucket. Then the inactive bucket contains the number of successes and
+// failures since the last time the timer triggered. Those numbers are used to
+// evaluate the ejection criteria." - A50.
+func (cc *callCounter) swap() {
+	ib := cc.inactiveBucket
+	*ib = bucket{}
+	ab := (*bucket)(atomic.SwapPointer(&cc.activeBucket, unsafe.Pointer(ib)))
+	cc.inactiveBucket = &bucket{
+		numSuccesses: atomic.LoadUint32(&ab.numSuccesses),
+		numFailures:  atomic.LoadUint32(&ab.numFailures),
+	}
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/config.go b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/config.go
new file mode 100644
index 000000000000..c931674ae409
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/config.go
@@ -0,0 +1,180 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package outlierdetection
+
+import (
+	"time"
+
+	internalserviceconfig "google.golang.org/grpc/internal/serviceconfig"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+// SuccessRateEjection is parameters for the success rate ejection algorithm.
+// This algorithm monitors the request success rate for all endpoints and ejects
+// individual endpoints whose success rates are statistical outliers.
+type SuccessRateEjection struct {
+	// StddevFactor is used to determine the ejection threshold for
+	// success rate outlier ejection. The ejection threshold is the difference
+	// between the mean success rate, and the product of this factor and the
+	// standard deviation of the mean success rate: mean - (stdev *
+	// success_rate_stdev_factor). This factor is divided by a thousand to get a
+	// double. That is, if the desired factor is 1.9, the runtime value should
+	// be 1900. Defaults to 1900.
+	StdevFactor uint32 `json:"stdevFactor,omitempty"`
+	// EnforcementPercentage is the % chance that a host will be actually ejected
+	// when an outlier status is detected through success rate statistics. This
+	// setting can be used to disable ejection or to ramp it up slowly. Defaults
+	// to 100.
+	EnforcementPercentage uint32 `json:"enforcementPercentage,omitempty"`
+	// MinimumHosts is the number of hosts in a cluster that must have enough
+	// request volume to detect success rate outliers. If the number of hosts is
+	// less than this setting, outlier detection via success rate statistics is
+	// not performed for any host in the cluster. Defaults to 5.
+	MinimumHosts uint32 `json:"minimumHosts,omitempty"`
+	// RequestVolume is the minimum number of total requests that must be
+	// collected in one interval (as defined by the interval duration above) to
+	// include this host in success rate based outlier detection. If the volume
+	// is lower than this setting, outlier detection via success rate statistics
+	// is not performed for that host. Defaults to 100.
+	RequestVolume uint32 `json:"requestVolume,omitempty"`
+}
+
+// Equal returns whether the SuccessRateEjection is the same with the parameter.
+func (sre *SuccessRateEjection) Equal(sre2 *SuccessRateEjection) bool {
+	if sre == nil && sre2 == nil {
+		return true
+	}
+	if (sre != nil) != (sre2 != nil) {
+		return false
+	}
+	if sre.StdevFactor != sre2.StdevFactor {
+		return false
+	}
+	if sre.EnforcementPercentage != sre2.EnforcementPercentage {
+		return false
+	}
+	if sre.MinimumHosts != sre2.MinimumHosts {
+		return false
+	}
+	return sre.RequestVolume == sre2.RequestVolume
+}
+
+// FailurePercentageEjection is parameters for the failure percentage algorithm.
+// This algorithm ejects individual endpoints whose failure rate is greater than
+// some threshold, independently of any other endpoint.
+type FailurePercentageEjection struct {
+	// Threshold is the failure percentage to use when determining failure
+	// percentage-based outlier detection. If the failure percentage of a given
+	// host is greater than or equal to this value, it will be ejected. Defaults
+	// to 85.
+	Threshold uint32 `json:"threshold,omitempty"`
+	// EnforcementPercentage is the % chance that a host will be actually
+	// ejected when an outlier status is detected through failure percentage
+	// statistics. This setting can be used to disable ejection or to ramp it up
+	// slowly. Defaults to 0.
+	EnforcementPercentage uint32 `json:"enforcementPercentage,omitempty"`
+	// MinimumHosts is the minimum number of hosts in a cluster in order to
+	// perform failure percentage-based ejection. If the total number of hosts
+	// in the cluster is less than this value, failure percentage-based ejection
+	// will not be performed. Defaults to 5.
+	MinimumHosts uint32 `json:"minimumHosts,omitempty"`
+	// RequestVolume is the minimum number of total requests that must be
+	// collected in one interval (as defined by the interval duration above) to
+	// perform failure percentage-based ejection for this host. If the volume is
+	// lower than this setting, failure percentage-based ejection will not be
+	// performed for this host. Defaults to 50.
+	RequestVolume uint32 `json:"requestVolume,omitempty"`
+}
+
+// Equal returns whether the FailurePercentageEjection is the same with the
+// parameter.
+func (fpe *FailurePercentageEjection) Equal(fpe2 *FailurePercentageEjection) bool {
+	if fpe == nil && fpe2 == nil {
+		return true
+	}
+	if (fpe != nil) != (fpe2 != nil) {
+		return false
+	}
+	if fpe.Threshold != fpe2.Threshold {
+		return false
+	}
+	if fpe.EnforcementPercentage != fpe2.EnforcementPercentage {
+		return false
+	}
+	if fpe.MinimumHosts != fpe2.MinimumHosts {
+		return false
+	}
+	return fpe.RequestVolume == fpe2.RequestVolume
+}
+
+// LBConfig is the config for the outlier detection balancer.
+type LBConfig struct {
+	serviceconfig.LoadBalancingConfig `json:"-"`
+	// Interval is the time interval between ejection analysis sweeps. This can
+	// result in both new ejections as well as addresses being returned to
+	// service. Defaults to 10s.
+	Interval time.Duration `json:"interval,omitempty"`
+	// BaseEjectionTime is the base time that a host is ejected for. The real
+	// time is equal to the base time multiplied by the number of times the host
+	// has been ejected and is capped by MaxEjectionTime. Defaults to 30s.
+	BaseEjectionTime time.Duration `json:"baseEjectionTime,omitempty"`
+	// MaxEjectionTime is the maximum time that an address is ejected for. If
+	// not specified, the default value (300s) or the BaseEjectionTime value is
+	// applied, whichever is larger.
+	MaxEjectionTime time.Duration `json:"maxEjectionTime,omitempty"`
+	// MaxEjectionPercent is the maximum % of an upstream cluster that can be
+	// ejected due to outlier detection. Defaults to 10% but will eject at least
+	// one host regardless of the value.
+	MaxEjectionPercent uint32 `json:"maxEjectionPercent,omitempty"`
+	// SuccessRateEjection is the parameters for the success rate ejection
+	// algorithm. If set, success rate ejections will be performed.
+	SuccessRateEjection *SuccessRateEjection `json:"successRateEjection,omitempty"`
+	// FailurePercentageEjection is the parameters for the failure percentage
+	// algorithm. If set, failure rate ejections will be performed.
+	FailurePercentageEjection *FailurePercentageEjection `json:"failurePercentageEjection,omitempty"`
+	// ChildPolicy is the config for the child policy.
+	ChildPolicy *internalserviceconfig.BalancerConfig `json:"childPolicy,omitempty"`
+}
+
+// EqualIgnoringChildPolicy returns whether the LBConfig is same with the
+// parameter outside of the child policy, only comparing the Outlier Detection
+// specific configuration.
+func (lbc *LBConfig) EqualIgnoringChildPolicy(lbc2 *LBConfig) bool {
+	if lbc == nil && lbc2 == nil {
+		return true
+	}
+	if (lbc != nil) != (lbc2 != nil) {
+		return false
+	}
+	if lbc.Interval != lbc2.Interval {
+		return false
+	}
+	if lbc.BaseEjectionTime != lbc2.BaseEjectionTime {
+		return false
+	}
+	if lbc.MaxEjectionTime != lbc2.MaxEjectionTime {
+		return false
+	}
+	if lbc.MaxEjectionPercent != lbc2.MaxEjectionPercent {
+		return false
+	}
+	if !lbc.SuccessRateEjection.Equal(lbc2.SuccessRateEjection) {
+		return false
+	}
+	return lbc.FailurePercentageEjection.Equal(lbc2.FailurePercentageEjection)
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/logging.go b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/logging.go
new file mode 100644
index 000000000000..705b0cb6918d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/logging.go
@@ -0,0 +1,34 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package outlierdetection
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/grpclog"
+	internalgrpclog "google.golang.org/grpc/internal/grpclog"
+)
+
+const prefix = "[outlier-detection-lb %p] "
+
+var logger = grpclog.Component("xds")
+
+func prefixLogger(p *outlierDetectionBalancer) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf(prefix, p))
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/subconn_wrapper.go b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/subconn_wrapper.go
new file mode 100644
index 000000000000..8e25eb788b1d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/outlierdetection/subconn_wrapper.go
@@ -0,0 +1,68 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package outlierdetection
+
+import (
+	"unsafe"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/internal/buffer"
+	"google.golang.org/grpc/resolver"
+)
+
+// subConnWrapper wraps every created SubConn in the Outlier Detection Balancer,
+// to help track the latest state update from the underlying SubConn, and also
+// whether or not this SubConn is ejected.
+type subConnWrapper struct {
+	balancer.SubConn
+
+	// addressInfo is a pointer to the subConnWrapper's corresponding address
+	// map entry, if the map entry exists.
+	addressInfo unsafe.Pointer // *addressInfo
+	// These two pieces of state will reach eventual consistency due to sync in
+	// run(), and child will always have the correctly updated SubConnState.
+	// latestState is the latest state update from the underlying SubConn. This
+	// is used whenever a SubConn gets unejected.
+	latestState balancer.SubConnState
+	ejected     bool
+
+	scUpdateCh *buffer.Unbounded
+
+	// addresses is the list of address(es) this SubConn was created with to
+	// help support any change in address(es)
+	addresses []resolver.Address
+}
+
+// eject causes the wrapper to report a state update with the TRANSIENT_FAILURE
+// state, and to stop passing along updates from the underlying subchannel.
+func (scw *subConnWrapper) eject() {
+	scw.scUpdateCh.Put(&ejectionUpdate{
+		scw:       scw,
+		isEjected: true,
+	})
+}
+
+// uneject causes the wrapper to report a state update with the latest update
+// from the underlying subchannel, and resume passing along updates from the
+// underlying subchannel.
+func (scw *subConnWrapper) uneject() {
+	scw.scUpdateCh.Put(&ejectionUpdate{
+		scw:       scw,
+		isEjected: false,
+	})
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer.go b/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer.go
index 98fd0672af42..b5cace684960 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer.go
@@ -30,6 +30,8 @@ import (
 	"time"
 
 	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/balancer/base"
+	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/internal/balancergroup"
 	"google.golang.org/grpc/internal/buffer"
 	"google.golang.org/grpc/internal/grpclog"
@@ -53,7 +55,6 @@ func (bb) Build(cc balancer.ClientConn, bOpts balancer.BuildOptions) balancer.Ba
 	b := &priorityBalancer{
 		cc:                       cc,
 		done:                     grpcsync.NewEvent(),
-		childToPriority:          make(map[string]int),
 		children:                 make(map[string]*childBalancer),
 		childBalancerStateUpdate: buffer.NewUnbounded(),
 	}
@@ -90,22 +91,17 @@ type priorityBalancer struct {
 
 	mu         sync.Mutex
 	childInUse string
-	// priority of the child that's current in use. Int starting from 0, and 0
-	// is the higher priority.
-	priorityInUse int
 	// priorities is a list of child names from higher to lower priority.
 	priorities []string
-	// childToPriority is a map from the child name to it's priority. Priority
-	// is an int start from 0, and 0 is the higher priority.
-	childToPriority map[string]int
 	// children is a map from child name to sub-balancers.
 	children map[string]*childBalancer
-	// The timer to give a priority some time to connect. And if the priority
-	// doesn't go into Ready/Failure, the next priority will be started.
-	//
-	// One timer is enough because there can be at most one priority in init
-	// state.
-	priorityInitTimer *timerWrapper
+
+	// Set during UpdateClientConnState when calling into sub-balancers.
+	// Prevents child updates from recomputing the active priority or sending
+	// an update of the aggregated picker to the parent.  Cleared after all
+	// sub-balancers have finished UpdateClientConnState, after which
+	// syncPriority is called manually.
+	inhibitPickerUpdates bool
 }
 
 func (b *priorityBalancer) UpdateClientConnState(s balancer.ClientConnState) error {
@@ -117,7 +113,6 @@ func (b *priorityBalancer) UpdateClientConnState(s balancer.ClientConnState) err
 	addressesSplit := hierarchy.Group(s.ResolverState.Addresses)
 
 	b.mu.Lock()
-	defer b.mu.Unlock()
 	// Create and remove children, since we know all children from the config
 	// are used by some priority.
 	for name, newSubConfig := range newConfig.Children {
@@ -152,15 +147,14 @@ func (b *priorityBalancer) UpdateClientConnState(s balancer.ClientConnState) err
 		}
 
 		// Update config and address, but note that this doesn't send the
-		// updates to child balancer (the child balancer might not be built, if
-		// it's a low priority).
+		// updates to non-started child balancers (the child balancer might not
+		// be built, if it's a low priority).
 		currentChild.updateConfig(newSubConfig, resolver.State{
 			Addresses:     addressesSplit[name],
 			ServiceConfig: s.ResolverState.ServiceConfig,
 			Attributes:    s.ResolverState.Attributes,
 		})
 	}
-
 	// Remove child from children if it's not in new config.
 	for name, oldChild := range b.children {
 		if _, ok := newConfig.Children[name]; !ok {
@@ -170,13 +164,32 @@ func (b *priorityBalancer) UpdateClientConnState(s balancer.ClientConnState) err
 
 	// Update priorities and handle priority changes.
 	b.priorities = newConfig.Priorities
-	b.childToPriority = make(map[string]int, len(newConfig.Priorities))
-	for pi, pName := range newConfig.Priorities {
-		b.childToPriority[pName] = pi
+
+	// Everything was removed by the update.
+	if len(b.priorities) == 0 {
+		b.childInUse = ""
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: connectivity.TransientFailure,
+			Picker:            base.NewErrPicker(ErrAllPrioritiesRemoved),
+		})
+		b.mu.Unlock()
+		return nil
 	}
-	// Sync the states of all children to the new updated priorities. This
-	// include starting/stopping child balancers when necessary.
-	b.syncPriority()
+
+	// This will sync the states of all children to the new updated
+	// priorities. Includes starting/stopping child balancers when necessary.
+	// Block picker updates until all children have had a chance to call
+	// UpdateState to prevent races where, e.g., the active priority reports
+	// transient failure but a higher priority may have reported something that
+	// made it active, and if the transient failure update is handled first,
+	// RPCs could fail.
+	b.inhibitPickerUpdates = true
+	// Add an item to queue to notify us when the current items in the queue
+	// are done and syncPriority has been called.
+	done := make(chan struct{})
+	b.childBalancerStateUpdate.Put(resumePickerUpdates{done: done})
+	b.mu.Unlock()
+	<-done
 
 	return nil
 }
@@ -198,31 +211,21 @@ func (b *priorityBalancer) Close() {
 	// Clear states of the current child in use, so if there's a race in picker
 	// update, it will be dropped.
 	b.childInUse = ""
-	b.stopPriorityInitTimer()
+	// Stop the child policies, this is necessary to stop the init timers in the
+	// children.
+	for _, child := range b.children {
+		child.stop()
+	}
 }
 
 func (b *priorityBalancer) ExitIdle() {
 	b.bg.ExitIdle()
 }
 
-// stopPriorityInitTimer stops the priorityInitTimer if it's not nil, and set it
-// to nil.
-//
-// Caller must hold b.mu.
-func (b *priorityBalancer) stopPriorityInitTimer() {
-	timerW := b.priorityInitTimer
-	if timerW == nil {
-		return
-	}
-	b.priorityInitTimer = nil
-	timerW.stopped = true
-	timerW.timer.Stop()
-}
-
 // UpdateState implements balancergroup.BalancerStateAggregator interface. The
 // balancer group sends new connectivity state and picker here.
 func (b *priorityBalancer) UpdateState(childName string, state balancer.State) {
-	b.childBalancerStateUpdate.Put(&childBalancerState{
+	b.childBalancerStateUpdate.Put(childBalancerState{
 		name: childName,
 		s:    state,
 	})
@@ -233,6 +236,10 @@ type childBalancerState struct {
 	s    balancer.State
 }
 
+type resumePickerUpdates struct {
+	done chan struct{}
+}
+
 // run handles child update in a separate goroutine, so if the child sends
 // updates inline (when called by parent), it won't cause deadlocks (by trying
 // to hold the same mutex).
@@ -241,11 +248,22 @@ func (b *priorityBalancer) run() {
 		select {
 		case u := <-b.childBalancerStateUpdate.Get():
 			b.childBalancerStateUpdate.Load()
-			s := u.(*childBalancerState)
 			// Needs to handle state update in a goroutine, because each state
 			// update needs to start/close child policy, could result in
 			// deadlock.
-			b.handleChildStateUpdate(s.name, s.s)
+			b.mu.Lock()
+			if b.done.HasFired() {
+				return
+			}
+			switch s := u.(type) {
+			case childBalancerState:
+				b.handleChildStateUpdate(s.name, s.s)
+			case resumePickerUpdates:
+				b.inhibitPickerUpdates = false
+				b.syncPriority(b.childInUse)
+				close(s.done)
+			}
+			b.mu.Unlock()
 		case <-b.done.Done():
 			return
 		}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_child.go b/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_child.go
index 600705da01af..34bab34c915c 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_child.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_child.go
@@ -19,6 +19,8 @@
 package priority
 
 import (
+	"time"
+
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/balancer/base"
 	"google.golang.org/grpc/connectivity"
@@ -36,7 +38,17 @@ type childBalancer struct {
 	rState                     resolver.State
 
 	started bool
-	state   balancer.State
+	// This is set when the child reports TransientFailure, and unset when it
+	// reports Ready or Idle. It is used to decide whether the failover timer
+	// should start when the child is transitioning into Connecting. The timer
+	// will be restarted if the child has not reported TF more recently than it
+	// reported Ready or Idle.
+	reportedTF bool
+	// The latest state the child balancer provided.
+	state balancer.State
+	// The timer to give a priority some time to connect. And if the priority
+	// doesn't go into Ready/Failure, the next priority will be started.
+	initTimer *timerWrapper
 }
 
 // newChildBalancer creates a child balancer place holder, but doesn't
@@ -63,11 +75,14 @@ func (cb *childBalancer) updateBuilder(bb balancer.Builder) {
 }
 
 // updateConfig sets childBalancer's config and state, but doesn't send update to
-// the child balancer.
+// the child balancer unless it is started.
 func (cb *childBalancer) updateConfig(child *Child, rState resolver.State) {
 	cb.ignoreReresolutionRequests = child.IgnoreReresolutionRequests
 	cb.config = child.Config.Config
 	cb.rState = rState
+	if cb.started {
+		cb.sendUpdate()
+	}
 }
 
 // start builds the child balancer if it's not already started.
@@ -79,6 +94,8 @@ func (cb *childBalancer) start() {
 	}
 	cb.started = true
 	cb.parent.bg.Add(cb.name, cb.bb)
+	cb.startInitTimer()
+	cb.sendUpdate()
 }
 
 // sendUpdate sends the addresses and config to the child balancer.
@@ -103,10 +120,46 @@ func (cb *childBalancer) stop() {
 	if !cb.started {
 		return
 	}
+	cb.stopInitTimer()
 	cb.parent.bg.Remove(cb.name)
 	cb.started = false
 	cb.state = balancer.State{
 		ConnectivityState: connectivity.Connecting,
 		Picker:            base.NewErrPicker(balancer.ErrNoSubConnAvailable),
 	}
+	// Clear child.reportedTF, so that if this child is started later, it will
+	// be given time to connect.
+	cb.reportedTF = false
+}
+
+func (cb *childBalancer) startInitTimer() {
+	if cb.initTimer != nil {
+		return
+	}
+	// Need this local variable to capture timerW in the AfterFunc closure
+	// to check the stopped boolean.
+	timerW := &timerWrapper{}
+	cb.initTimer = timerW
+	timerW.timer = time.AfterFunc(DefaultPriorityInitTimeout, func() {
+		cb.parent.mu.Lock()
+		defer cb.parent.mu.Unlock()
+		if timerW.stopped {
+			return
+		}
+		cb.initTimer = nil
+		// Re-sync the priority. This will switch to the next priority if
+		// there's any. Note that it's important sync() is called after setting
+		// initTimer to nil.
+		cb.parent.syncPriority("")
+	})
+}
+
+func (cb *childBalancer) stopInitTimer() {
+	timerW := cb.initTimer
+	if timerW == nil {
+		return
+	}
+	cb.initTimer = nil
+	timerW.stopped = true
+	timerW.timer.Stop()
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_priority.go b/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_priority.go
index 3a18f6e10d83..c12dfe47ffea 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_priority.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/priority/balancer_priority.go
@@ -23,7 +23,6 @@ import (
 	"time"
 
 	"google.golang.org/grpc/balancer"
-	"google.golang.org/grpc/balancer/base"
 	"google.golang.org/grpc/connectivity"
 )
 
@@ -36,9 +35,10 @@ var (
 	DefaultPriorityInitTimeout = 10 * time.Second
 )
 
-// syncPriority handles priority after a config update. It makes sure the
-// balancer state (started or not) is in sync with the priorities (even in
-// tricky cases where a child is moved from a priority to another).
+// syncPriority handles priority after a config update or a child balancer
+// connectivity state update. It makes sure the balancer state (started or not)
+// is in sync with the priorities (even in tricky cases where a child is moved
+// from a priority to another).
 //
 // It's guaranteed that after this function returns:
 // - If some child is READY, it is childInUse, and all lower priorities are
@@ -53,10 +53,13 @@ var (
 // set parent ClientConn to TransientFailure
 // - Otherwise, Scan all children from p0, and check balancer stats:
 //   - For any of the following cases:
-// 	   - If balancer is not started (not built), this is either a new child
-//       with high priority, or a new builder for an existing child.
-// 	   - If balancer is READY
-// 	   - If this is the lowest priority
+//     - If balancer is not started (not built), this is either a new child with
+//       high priority, or a new builder for an existing child.
+//     - If balancer is Connecting and has non-nil initTimer (meaning it
+//       transitioned from Ready or Idle to connecting, not from TF, so we
+//       should give it init-time to connect).
+//     - If balancer is READY or IDLE
+//     - If this is the lowest priority
 //   - do the following:
 //     - if this is not the old childInUse, override picker so old picker is no
 //       longer used.
@@ -64,21 +67,11 @@ var (
 //     - forward the new addresses and config
 //
 // Caller must hold b.mu.
-func (b *priorityBalancer) syncPriority() {
-	// Everything was removed by the update.
-	if len(b.priorities) == 0 {
-		b.childInUse = ""
-		b.priorityInUse = 0
-		// Stop the init timer. This can happen if the only priority is removed
-		// shortly after it's added.
-		b.stopPriorityInitTimer()
-		b.cc.UpdateState(balancer.State{
-			ConnectivityState: connectivity.TransientFailure,
-			Picker:            base.NewErrPicker(ErrAllPrioritiesRemoved),
-		})
+func (b *priorityBalancer) syncPriority(childUpdating string) {
+	if b.inhibitPickerUpdates {
+		b.logger.Infof("Skipping update from child with name %q", childUpdating)
 		return
 	}
-
 	for p, name := range b.priorities {
 		child, ok := b.children[name]
 		if !ok {
@@ -89,16 +82,16 @@ func (b *priorityBalancer) syncPriority() {
 		if !child.started ||
 			child.state.ConnectivityState == connectivity.Ready ||
 			child.state.ConnectivityState == connectivity.Idle ||
+			(child.state.ConnectivityState == connectivity.Connecting && child.initTimer != nil) ||
 			p == len(b.priorities)-1 {
-			if b.childInUse != "" && b.childInUse != child.name {
-				// childInUse was set and is different from this child, will
-				// change childInUse later. We need to update picker here
-				// immediately so parent stops using the old picker.
+			if b.childInUse != child.name || child.name == childUpdating {
+				b.logger.Warningf("childInUse, childUpdating: %q, %q", b.childInUse, child.name)
+				// If we switch children or the child in use just updated its
+				// picker, push the child's picker to the parent.
 				b.cc.UpdateState(child.state)
 			}
 			b.logger.Infof("switching to (%q, %v) in syncPriority", child.name, p)
 			b.switchToChild(child, p)
-			child.sendUpdate()
 			break
 		}
 	}
@@ -123,8 +116,7 @@ func (b *priorityBalancer) stopSubBalancersLowerThanPriority(p int) {
 // - stop all child with lower priorities
 // - if childInUse is not this child
 //   - set childInUse to this child
-//   - stops init timer
-//   - if this child is not started, start it, and start a init timer
+//   - if this child is not started, start it
 //
 // Note that it does NOT send the current child state (picker) to the parent
 // ClientConn. The caller needs to send it if necessary.
@@ -154,209 +146,41 @@ func (b *priorityBalancer) switchToChild(child *childBalancer, priority int) {
 		return
 	}
 	b.childInUse = child.name
-	b.priorityInUse = priority
-
-	// Init timer is always for childInUse. Since we are switching to a
-	// different child, we will stop the init timer no matter what. If this
-	// child is not started, we will start the init timer later.
-	b.stopPriorityInitTimer()
 
 	if !child.started {
 		child.start()
-		// Need this local variable to capture timerW in the AfterFunc closure
-		// to check the stopped boolean.
-		timerW := &timerWrapper{}
-		b.priorityInitTimer = timerW
-		timerW.timer = time.AfterFunc(DefaultPriorityInitTimeout, func() {
-			b.mu.Lock()
-			defer b.mu.Unlock()
-			if timerW.stopped {
-				return
-			}
-			b.priorityInitTimer = nil
-			// Switch to the next priority if there's any.
-			if pNext := priority + 1; pNext < len(b.priorities) {
-				nameNext := b.priorities[pNext]
-				if childNext, ok := b.children[nameNext]; ok {
-					b.switchToChild(childNext, pNext)
-					childNext.sendUpdate()
-				}
-			}
-		})
 	}
 }
 
 // handleChildStateUpdate start/close priorities based on the connectivity
 // state.
 func (b *priorityBalancer) handleChildStateUpdate(childName string, s balancer.State) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.done.HasFired() {
-		return
-	}
-
-	priority, ok := b.childToPriority[childName]
-	if !ok {
-		b.logger.Warningf("priority: received picker update with unknown child %v", childName)
-		return
-	}
-
-	if b.childInUse == "" {
-		b.logger.Warningf("priority: no child is in use when picker update is received")
-		return
-	}
-
-	// priorityInUse is higher than this priority.
-	if b.priorityInUse < priority {
-		// Lower priorities should all be closed, this is an unexpected update.
-		// Can happen if the child policy sends an update after we tell it to
-		// close.
-		b.logger.Warningf("priority: received picker update from priority %v,  lower than priority in use %v", priority, b.priorityInUse)
-		return
-	}
-
 	// Update state in child. The updated picker will be sent to parent later if
 	// necessary.
 	child, ok := b.children[childName]
 	if !ok {
-		b.logger.Warningf("priority: child balancer not found for child %v, priority %v", childName, priority)
+		b.logger.Warningf("priority: child balancer not found for child %v", childName)
 		return
 	}
-	oldState := child.state.ConnectivityState
 	child.state = s
 
+	// We start/stop the init timer of this child based on the new connectivity
+	// state. syncPriority() later will need the init timer (to check if it's
+	// nil or not) to decide which child to switch to.
 	switch s.ConnectivityState {
 	case connectivity.Ready, connectivity.Idle:
-		// Note that idle is also handled as if it's Ready. It will close the
-		// lower priorities (which will be kept in a cache, not deleted), and
-		// new picks will use the Idle picker.
-		b.handlePriorityWithNewStateReady(child, priority)
+		child.reportedTF = false
+		child.stopInitTimer()
 	case connectivity.TransientFailure:
-		b.handlePriorityWithNewStateTransientFailure(child, priority)
+		child.reportedTF = true
+		child.stopInitTimer()
 	case connectivity.Connecting:
-		b.handlePriorityWithNewStateConnecting(child, priority, oldState)
+		if !child.reportedTF {
+			child.startInitTimer()
+		}
 	default:
 		// New state is Shutdown, should never happen. Don't forward.
 	}
-}
-
-// handlePriorityWithNewStateReady handles state Ready from a higher or equal
-// priority.
-//
-// An update with state Ready:
-// - If it's from higher priority:
-//   - Switch to this priority
-//   - Forward the update
-// - If it's from priorityInUse:
-//   - Forward only
-//
-// Caller must make sure priorityInUse is not higher than priority.
-//
-// Caller must hold mu.
-func (b *priorityBalancer) handlePriorityWithNewStateReady(child *childBalancer, priority int) {
-	// If one priority higher or equal to priorityInUse goes Ready, stop the
-	// init timer. If update is from higher than priorityInUse, priorityInUse
-	// will be closed, and the init timer will become useless.
-	b.stopPriorityInitTimer()
-
-	// priorityInUse is lower than this priority, switch to this.
-	if b.priorityInUse > priority {
-		b.logger.Infof("Switching priority from %v to %v, because latter became Ready", b.priorityInUse, priority)
-		b.switchToChild(child, priority)
-	}
-	// Forward the update since it's READY.
-	b.cc.UpdateState(child.state)
-}
-
-// handlePriorityWithNewStateTransientFailure handles state TransientFailure
-// from a higher or equal priority.
-//
-// An update with state TransientFailure:
-// - If it's from a higher priority:
-//   - Do not forward, and do nothing
-// - If it's from priorityInUse:
-//   - If there's no lower:
-//     - Forward and do nothing else
-//   - If there's a lower priority:
-//     - Switch to the lower
-//     - Forward the lower child's state
-//     - Do NOT forward this update
-//
-// Caller must make sure priorityInUse is not higher than priority.
-//
-// Caller must hold mu.
-func (b *priorityBalancer) handlePriorityWithNewStateTransientFailure(child *childBalancer, priority int) {
-	// priorityInUse is lower than this priority, do nothing.
-	if b.priorityInUse > priority {
-		return
-	}
-	// priorityInUse sends a failure. Stop its init timer.
-	b.stopPriorityInitTimer()
-	priorityNext := priority + 1
-	if priorityNext >= len(b.priorities) {
-		// Forward this update.
-		b.cc.UpdateState(child.state)
-		return
-	}
-	b.logger.Infof("Switching priority from %v to %v, because former became TransientFailure", priority, priorityNext)
-	nameNext := b.priorities[priorityNext]
-	childNext := b.children[nameNext]
-	b.switchToChild(childNext, priorityNext)
-	b.cc.UpdateState(childNext.state)
-	childNext.sendUpdate()
-}
 
-// handlePriorityWithNewStateConnecting handles state Connecting from a higher
-// than or equal priority.
-//
-// An update with state Connecting:
-// - If it's from a higher priority
-//   - Do nothing
-// - If it's from priorityInUse, the behavior depends on previous state.
-//
-// When new state is Connecting, the behavior depends on previous state. If the
-// previous state was Ready, this is a transition out from Ready to Connecting.
-// Assuming there are multiple backends in the same priority, this mean we are
-// in a bad situation and we should failover to the next priority (Side note:
-// the current connectivity state aggregating algorithm (e.g. round-robin) is
-// not handling this right, because if many backends all go from Ready to
-// Connecting, the overall situation is more like TransientFailure, not
-// Connecting).
-//
-// If the previous state was Idle, we don't do anything special with failure,
-// and simply forward the update. The init timer should be in process, will
-// handle failover if it timeouts. If the previous state was TransientFailure,
-// we do not forward, because the lower priority is in use.
-//
-// Caller must make sure priorityInUse is not higher than priority.
-//
-// Caller must hold mu.
-func (b *priorityBalancer) handlePriorityWithNewStateConnecting(child *childBalancer, priority int, oldState connectivity.State) {
-	// priorityInUse is lower than this priority, do nothing.
-	if b.priorityInUse > priority {
-		return
-	}
-
-	switch oldState {
-	case connectivity.Ready:
-		// Handling transition from Ready to Connecting, is same as handling
-		// TransientFailure. There's no need to stop the init timer, because it
-		// should have been stopped when state turned Ready.
-		priorityNext := priority + 1
-		if priorityNext >= len(b.priorities) {
-			// Forward this update.
-			b.cc.UpdateState(child.state)
-			return
-		}
-		b.logger.Infof("Switching priority from %v to %v, because former became TransientFailure", priority, priorityNext)
-		nameNext := b.priorities[priorityNext]
-		childNext := b.children[nameNext]
-		b.switchToChild(childNext, priorityNext)
-		b.cc.UpdateState(childNext.state)
-		childNext.sendUpdate()
-	case connectivity.Idle:
-		b.cc.UpdateState(child.state)
-	default:
-		// Old state is Connecting, TransientFailure or Shutdown. Don't forward.
-	}
+	child.parent.syncPriority(childName)
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/logging.go b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/logging.go
index 64a1d467f554..3e0f0adf58eb 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/logging.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/logging.go
@@ -32,3 +32,7 @@ var logger = grpclog.Component("xds")
 func prefixLogger(p *ringhashBalancer) *internalgrpclog.PrefixLogger {
 	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf(prefix, p))
 }
+
+func subConnPrefixLogger(p *ringhashBalancer, sc *subConn) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf(prefix, p)+fmt.Sprintf("[subConn %p] ", sc))
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/picker.go b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/picker.go
index dcea6d46e517..ec3b5605690d 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/picker.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/picker.go
@@ -143,6 +143,8 @@ func (p *picker) handleTransientFailure(e *ringEntry) (balancer.PickResult, erro
 	return balancer.PickResult{}, fmt.Errorf("no connection is Ready")
 }
 
+// nextSkippingDuplicates finds the next entry in the ring, with a different
+// subconn from the given entry.
 func nextSkippingDuplicates(ring *ring, entry *ringEntry) *ringEntry {
 	for next := ring.next(entry); next != entry; next = ring.next(next) {
 		if next.sc != entry.sc {
@@ -152,3 +154,28 @@ func nextSkippingDuplicates(ring *ring, entry *ringEntry) *ringEntry {
 	// There's no qualifying next entry.
 	return nil
 }
+
+// nextSkippingDuplicatesSubConn finds the next subconn in the ring, that's
+// different from the given subconn.
+func nextSkippingDuplicatesSubConn(ring *ring, sc *subConn) *subConn {
+	var entry *ringEntry
+	for _, it := range ring.items {
+		if it.sc == sc {
+			entry = it
+			break
+		}
+	}
+	if entry == nil {
+		// If the given subconn is not in the ring (e.g. it was deleted), return
+		// the first one.
+		if len(ring.items) > 0 {
+			return ring.items[0].sc
+		}
+		return nil
+	}
+	ee := nextSkippingDuplicates(ring, entry)
+	if ee == nil {
+		return nil
+	}
+	return ee.sc
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ring.go b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ring.go
index 68e844cfb487..71d31eaeb8b0 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ring.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ring.go
@@ -19,7 +19,6 @@
 package ringhash
 
 import (
-	"fmt"
 	"math"
 	"sort"
 	"strconv"
@@ -43,8 +42,8 @@ type ringEntry struct {
 	sc   *subConn
 }
 
-// newRing creates a ring from the subConns. The ring size is limited by the
-// passed in max/min.
+// newRing creates a ring from the subConns stored in the AddressMap. The ring
+// size is limited by the passed in max/min.
 //
 // ring entries will be created for each subConn, and subConn with high weight
 // (specified by the address) may have multiple entries.
@@ -64,12 +63,12 @@ type ringEntry struct {
 //
 // To pick from a ring, a binary search will be done for the given target hash,
 // and first item with hash >= given hash will be returned.
-func newRing(subConns map[resolver.Address]*subConn, minRingSize, maxRingSize uint64) (*ring, error) {
+//
+// Must be called with a non-empty subConns map.
+func newRing(subConns *resolver.AddressMap, minRingSize, maxRingSize uint64) *ring {
 	// https://github.com/envoyproxy/envoy/blob/765c970f06a4c962961a0e03a467e165b276d50f/source/common/upstream/ring_hash_lb.cc#L114
-	normalizedWeights, minWeight, err := normalizeWeights(subConns)
-	if err != nil {
-		return nil, err
-	}
+	normalizedWeights, minWeight := normalizeWeights(subConns)
+
 	// Normalized weights for {3,3,4} is {0.3,0.3,0.4}.
 
 	// Scale up the size of the ring such that the least-weighted host gets a
@@ -95,7 +94,7 @@ func newRing(subConns map[resolver.Address]*subConn, minRingSize, maxRingSize ui
 	for _, scw := range normalizedWeights {
 		targetIdx += scale * scw.weight
 		for float64(idx) < targetIdx {
-			h := xxhash.Sum64String(scw.sc.addr + strconv.Itoa(len(items)))
+			h := xxhash.Sum64String(scw.sc.addr + strconv.Itoa(idx))
 			items = append(items, &ringEntry{idx: idx, hash: h, sc: scw.sc})
 			idx++
 		}
@@ -106,31 +105,30 @@ func newRing(subConns map[resolver.Address]*subConn, minRingSize, maxRingSize ui
 	for i, ii := range items {
 		ii.idx = i
 	}
-	return &ring{items: items}, nil
+	return &ring{items: items}
 }
 
 // normalizeWeights divides all the weights by the sum, so that the total weight
 // is 1.
-func normalizeWeights(subConns map[resolver.Address]*subConn) (_ []subConnWithWeight, min float64, _ error) {
-	if len(subConns) == 0 {
-		return nil, 0, fmt.Errorf("number of subconns is 0")
-	}
+//
+// Must be called with a non-empty subConns map.
+func normalizeWeights(subConns *resolver.AddressMap) ([]subConnWithWeight, float64) {
 	var weightSum uint32
-	for a := range subConns {
-		// The address weight was moved from attributes to the Metadata field.
-		// This is necessary (all the attributes need to be stripped) for the
-		// balancer to detect identical {address+weight} combination.
-		weightSum += a.Metadata.(uint32)
-	}
-	if weightSum == 0 {
-		return nil, 0, fmt.Errorf("total weight of all subconns is 0")
+	keys := subConns.Keys()
+	for _, a := range keys {
+		weightSum += getWeightAttribute(a)
 	}
-	weightSumF := float64(weightSum)
-	ret := make([]subConnWithWeight, 0, len(subConns))
-	min = math.MaxFloat64
-	for a, sc := range subConns {
-		nw := float64(a.Metadata.(uint32)) / weightSumF
-		ret = append(ret, subConnWithWeight{sc: sc, weight: nw})
+	ret := make([]subConnWithWeight, 0, len(keys))
+	min := float64(1.0)
+	for _, a := range keys {
+		v, _ := subConns.Get(a)
+		scInfo := v.(*subConn)
+		// getWeightAttribute() returns 1 if the weight attribute is not found
+		// on the address. And since this function is guaranteed to be called
+		// with a non-empty subConns map, weightSum is guaranteed to be
+		// non-zero. So, we need not worry about divide a by zero error here.
+		nw := float64(getWeightAttribute(a)) / float64(weightSum)
+		ret = append(ret, subConnWithWeight{sc: scInfo, weight: nw})
 		if nw < min {
 			min = nw
 		}
@@ -142,7 +140,7 @@ func normalizeWeights(subConns map[resolver.Address]*subConn) (_ []subConnWithWe
 	// where an address is added and then removed, the RPCs will still pick the
 	// same old SubConn.
 	sort.Slice(ret, func(i, j int) bool { return ret[i].sc.addr < ret[j].sc.addr })
-	return ret, min, nil
+	return ret, min
 }
 
 // pick does a binary search. It returns the item with smallest index i that
diff --git a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ringhash.go b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ringhash.go
index f8a47f165bdf..59ccd0127a2a 100644
--- a/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ringhash.go
+++ b/vendor/google.golang.org/grpc/xds/internal/balancer/ringhash/ringhash.go
@@ -47,7 +47,7 @@ type bb struct{}
 func (bb) Build(cc balancer.ClientConn, bOpts balancer.BuildOptions) balancer.Balancer {
 	b := &ringhashBalancer{
 		cc:       cc,
-		subConns: make(map[resolver.Address]*subConn),
+		subConns: resolver.NewAddressMap(),
 		scStates: make(map[balancer.SubConn]*subConn),
 		csEvltr:  &connectivityStateEvaluator{},
 	}
@@ -65,8 +65,10 @@ func (bb) ParseConfig(c json.RawMessage) (serviceconfig.LoadBalancingConfig, err
 }
 
 type subConn struct {
-	addr string
-	sc   balancer.SubConn
+	addr   string
+	weight uint32
+	sc     balancer.SubConn
+	logger *grpclog.PrefixLogger
 
 	mu sync.RWMutex
 	// This is the actual state of this SubConn (as updated by the ClientConn).
@@ -98,6 +100,10 @@ type subConn struct {
 	// When connectivity state is updated to Idle for this SubConn, if
 	// connectQueued is true, Connect() will be called on the SubConn.
 	connectQueued bool
+	// attemptingToConnect indicates if this subconn is attempting to connect.
+	// It's set when queueConnect is called. It's unset when the state is
+	// changed to Ready/Shutdown, or Idle (and if connectQueued is false).
+	attemptingToConnect bool
 }
 
 // setState updates the state of this SubConn.
@@ -112,7 +118,10 @@ func (sc *subConn) setState(s connectivity.State) {
 		// Trigger Connect() if new state is Idle, and there is a queued connect.
 		if sc.connectQueued {
 			sc.connectQueued = false
+			sc.logger.Infof("Executing a queued connect for subConn moving to state: %v", sc.state)
 			sc.sc.Connect()
+		} else {
+			sc.attemptingToConnect = false
 		}
 	case connectivity.Connecting:
 		// Clear connectQueued if the SubConn isn't failing. This state
@@ -122,11 +131,14 @@ func (sc *subConn) setState(s connectivity.State) {
 		// Clear connectQueued if the SubConn isn't failing. This state
 		// transition is unlikely to happen, but handle this just in case.
 		sc.connectQueued = false
+		sc.attemptingToConnect = false
 		// Set to a non-failing state.
 		sc.failing = false
 	case connectivity.TransientFailure:
 		// Set to a failing state.
 		sc.failing = true
+	case connectivity.Shutdown:
+		sc.attemptingToConnect = false
 	}
 	sc.state = s
 }
@@ -149,22 +161,30 @@ func (sc *subConn) effectiveState() connectivity.State {
 func (sc *subConn) queueConnect() {
 	sc.mu.Lock()
 	defer sc.mu.Unlock()
+	sc.attemptingToConnect = true
 	if sc.state == connectivity.Idle {
+		sc.logger.Infof("Executing a queued connect for subConn in state: %v", sc.state)
 		sc.sc.Connect()
 		return
 	}
 	// Queue this connect, and when this SubConn switches back to Idle (happens
 	// after backoff in TransientFailure), it will Connect().
+	sc.logger.Infof("Queueing a connect for subConn in state: %v", sc.state)
 	sc.connectQueued = true
 }
 
+func (sc *subConn) isAttemptingToConnect() bool {
+	sc.mu.Lock()
+	defer sc.mu.Unlock()
+	return sc.attemptingToConnect
+}
+
 type ringhashBalancer struct {
 	cc     balancer.ClientConn
 	logger *grpclog.PrefixLogger
 
-	config *LBConfig
-
-	subConns map[resolver.Address]*subConn // `attributes` is stripped from the keys of this map (the addresses)
+	config   *LBConfig
+	subConns *resolver.AddressMap // Map from resolver.Address to `*subConn`.
 	scStates map[balancer.SubConn]*subConn
 
 	// ring is always in sync with subConns. When subConns change, a new ring is
@@ -192,55 +212,48 @@ type ringhashBalancer struct {
 // SubConn states are Idle.
 func (b *ringhashBalancer) updateAddresses(addrs []resolver.Address) bool {
 	var addrsUpdated bool
-	// addrsSet is the set converted from addrs, it's used for quick lookup of
-	// an address.
-	//
-	// Addresses in this map all have attributes stripped, but metadata set to
-	// the weight. So that weight change can be detected.
-	//
-	// TODO: this won't be necessary if there are ways to compare address
-	// attributes.
-	addrsSet := make(map[resolver.Address]struct{})
-	for _, a := range addrs {
-		aNoAttrs := a
-		// Strip attributes but set Metadata to the weight.
-		aNoAttrs.Attributes = nil
-		w := weightedroundrobin.GetAddrInfo(a).Weight
-		if w == 0 {
-			// If weight is not set, use 1.
-			w = 1
-		}
-		aNoAttrs.Metadata = w
-		addrsSet[aNoAttrs] = struct{}{}
-		if scInfo, ok := b.subConns[aNoAttrs]; !ok {
-			// When creating SubConn, the original address with attributes is
-			// passed through. So that connection configurations in attributes
-			// (like creds) will be used.
-			sc, err := b.cc.NewSubConn([]resolver.Address{a}, balancer.NewSubConnOptions{HealthCheckEnabled: true})
+	// addrsSet is the set converted from addrs, used for quick lookup.
+	addrsSet := resolver.NewAddressMap()
+	for _, addr := range addrs {
+		addrsSet.Set(addr, true)
+		newWeight := getWeightAttribute(addr)
+		if val, ok := b.subConns.Get(addr); !ok {
+			sc, err := b.cc.NewSubConn([]resolver.Address{addr}, balancer.NewSubConnOptions{HealthCheckEnabled: true})
 			if err != nil {
-				logger.Warningf("base.baseBalancer: failed to create new SubConn: %v", err)
+				b.logger.Warningf("Failed to create new SubConn: %v", err)
 				continue
 			}
-			scs := &subConn{addr: a.Addr, sc: sc}
+			scs := &subConn{addr: addr.Addr, weight: newWeight, sc: sc}
+			scs.logger = subConnPrefixLogger(b, scs)
 			scs.setState(connectivity.Idle)
 			b.state = b.csEvltr.recordTransition(connectivity.Shutdown, connectivity.Idle)
-			b.subConns[aNoAttrs] = scs
+			b.subConns.Set(addr, scs)
 			b.scStates[sc] = scs
 			addrsUpdated = true
 		} else {
-			// Always update the subconn's address in case the attributes
-			// changed. The SubConn does a reflect.DeepEqual of the new and old
-			// addresses. So this is a noop if the current address is the same
-			// as the old one (including attributes).
-			b.subConns[aNoAttrs] = scInfo
-			b.cc.UpdateAddresses(scInfo.sc, []resolver.Address{a})
+			// We have seen this address before and created a subConn for it. If the
+			// weight associated with the address has changed, update the subConns map
+			// with the new weight. This will be used when a new ring is created.
+			//
+			// There is no need to call UpdateAddresses on the subConn at this point
+			// since *only* the weight attribute has changed, and that does not affect
+			// subConn uniqueness.
+			scInfo := val.(*subConn)
+			if oldWeight := scInfo.weight; oldWeight != newWeight {
+				scInfo.weight = newWeight
+				b.subConns.Set(addr, scInfo)
+				// Return true to force recreation of the ring.
+				addrsUpdated = true
+			}
 		}
 	}
-	for a, scInfo := range b.subConns {
-		// a was removed by resolver.
-		if _, ok := addrsSet[a]; !ok {
+	for _, addr := range b.subConns.Keys() {
+		// addr was removed by resolver.
+		if _, ok := addrsSet.Get(addr); !ok {
+			v, _ := b.subConns.Get(addr)
+			scInfo := v.(*subConn)
 			b.cc.RemoveSubConn(scInfo.sc)
-			delete(b.subConns, a)
+			b.subConns.Delete(addr)
 			addrsUpdated = true
 			// Keep the state of this sc in b.scStates until sc's state becomes Shutdown.
 			// The entry will be deleted in UpdateSubConnState.
@@ -251,28 +264,22 @@ func (b *ringhashBalancer) updateAddresses(addrs []resolver.Address) bool {
 
 func (b *ringhashBalancer) UpdateClientConnState(s balancer.ClientConnState) error {
 	b.logger.Infof("Received update from resolver, balancer config: %+v", pretty.ToJSON(s.BalancerConfig))
-	if b.config == nil {
-		newConfig, ok := s.BalancerConfig.(*LBConfig)
-		if !ok {
-			return fmt.Errorf("unexpected balancer config with type: %T", s.BalancerConfig)
-		}
-		b.config = newConfig
+	newConfig, ok := s.BalancerConfig.(*LBConfig)
+	if !ok {
+		return fmt.Errorf("unexpected balancer config with type: %T", s.BalancerConfig)
 	}
 
-	// Successful resolution; clear resolver error and ensure we return nil.
-	b.resolverErr = nil
-	if b.updateAddresses(s.ResolverState.Addresses) {
-		// If addresses were updated, no matter whether it resulted in SubConn
-		// creation/deletion, or just weight update, we will need to regenerate
-		// the ring.
-		var err error
-		b.ring, err = newRing(b.subConns, b.config.MinRingSize, b.config.MaxRingSize)
-		if err != nil {
-			panic(err)
-		}
-		b.regeneratePicker()
-		b.cc.UpdateState(balancer.State{ConnectivityState: b.state, Picker: b.picker})
+	// If addresses were updated, whether it resulted in SubConn
+	// creation/deletion, or just weight update, we need to regenerate the ring
+	// and send a new picker.
+	regenerateRing := b.updateAddresses(s.ResolverState.Addresses)
+
+	// If the ring configuration has changed, we need to regenerate the ring and
+	// send a new picker.
+	if b.config == nil || b.config.MinRingSize != newConfig.MinRingSize || b.config.MaxRingSize != newConfig.MaxRingSize {
+		regenerateRing = true
 	}
+	b.config = newConfig
 
 	// If resolver state contains no addresses, return an error so ClientConn
 	// will trigger re-resolve. Also records this as an resolver error, so when
@@ -282,12 +289,23 @@ func (b *ringhashBalancer) UpdateClientConnState(s balancer.ClientConnState) err
 		b.ResolverError(errors.New("produced zero addresses"))
 		return balancer.ErrBadResolverState
 	}
+
+	if regenerateRing {
+		// Ring creation is guaranteed to not fail because we call newRing()
+		// with a non-empty subConns map.
+		b.ring = newRing(b.subConns, b.config.MinRingSize, b.config.MaxRingSize)
+		b.regeneratePicker()
+		b.cc.UpdateState(balancer.State{ConnectivityState: b.state, Picker: b.picker})
+	}
+
+	// Successful resolution; clear resolver error and return nil.
+	b.resolverErr = nil
 	return nil
 }
 
 func (b *ringhashBalancer) ResolverError(err error) {
 	b.resolverErr = err
-	if len(b.subConns) == 0 {
+	if b.subConns.Len() == 0 {
 		b.state = connectivity.TransientFailure
 	}
 
@@ -315,15 +333,18 @@ func (b *ringhashBalancer) ResolverError(err error) {
 //   for some RPCs.
 func (b *ringhashBalancer) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
 	s := state.ConnectivityState
-	b.logger.Infof("handle SubConn state change: %p, %v", sc, s)
+	if logger.V(2) {
+		b.logger.Infof("Handle SubConn state change: %p, %v", sc, s)
+	}
 	scs, ok := b.scStates[sc]
 	if !ok {
-		b.logger.Infof("got state changes for an unknown SubConn: %p, %v", sc, s)
+		b.logger.Infof("Received state change for an unknown SubConn: %p, %v", sc, s)
 		return
 	}
 	oldSCState := scs.effectiveState()
 	scs.setState(s)
 	newSCState := scs.effectiveState()
+	b.logger.Infof("SubConn's effective old state was: %v, new state is %v", oldSCState, newSCState)
 
 	var sendUpdate bool
 	oldBalancerState := b.state
@@ -334,27 +355,21 @@ func (b *ringhashBalancer) UpdateSubConnState(sc balancer.SubConn, state balance
 
 	switch s {
 	case connectivity.Idle:
-		// When the overall state is TransientFailure, this will never get picks
-		// if there's a lower priority. Need to keep the SubConns connecting so
-		// there's a chance it will recover.
-		if b.state == connectivity.TransientFailure {
-			scs.queueConnect()
-		}
 		// No need to send an update. No queued RPC can be unblocked. If the
 		// overall state changed because of this, sendUpdate is already true.
 	case connectivity.Connecting:
 		// No need to send an update. No queued RPC can be unblocked. If the
 		// overall state changed because of this, sendUpdate is already true.
 	case connectivity.Ready:
-		// Resend the picker, there's no need to regenerate the picker because
-		// the ring didn't change.
+		// We need to regenerate the picker even if the ring has not changed
+		// because we could be moving from TRANSIENT_FAILURE to READY, in which
+		// case, we need to update the error picker returned earlier.
+		b.regeneratePicker()
 		sendUpdate = true
 	case connectivity.TransientFailure:
 		// Save error to be reported via picker.
 		b.connErr = state.ConnectionError
-		// Regenerate picker to update error message.
 		b.regeneratePicker()
-		sendUpdate = true
 	case connectivity.Shutdown:
 		// When an address was removed by resolver, b called RemoveSubConn but
 		// kept the sc's state in scStates. Remove state for this sc here.
@@ -362,8 +377,46 @@ func (b *ringhashBalancer) UpdateSubConnState(sc balancer.SubConn, state balance
 	}
 
 	if sendUpdate {
+		b.logger.Infof("Pushing new state %v and picker %p", b.state, b.picker)
 		b.cc.UpdateState(balancer.State{ConnectivityState: b.state, Picker: b.picker})
 	}
+
+	switch b.state {
+	case connectivity.Connecting, connectivity.TransientFailure:
+		// When overall state is TransientFailure, we need to make sure at least
+		// one SubConn is attempting to connect, otherwise this balancer may
+		// never get picks if the parent is priority.
+		//
+		// Because we report Connecting as the overall state when only one
+		// SubConn is in TransientFailure, we do the same check for Connecting
+		// here.
+		//
+		// Note that this check also covers deleting SubConns due to address
+		// change. E.g. if the SubConn attempting to connect is deleted, and the
+		// overall state is TF. Since there must be at least one SubConn
+		// attempting to connect, we need to trigger one. But since the deleted
+		// SubConn will eventually send a shutdown update, this code will run
+		// and trigger the next SubConn to connect.
+		for _, v := range b.subConns.Values() {
+			sc := v.(*subConn)
+			if sc.isAttemptingToConnect() {
+				return
+			}
+		}
+		// Trigger a SubConn (this updated SubConn's next SubConn in the ring)
+		// to connect if nobody is attempting to connect.
+		sc := nextSkippingDuplicatesSubConn(b.ring, scs)
+		if sc != nil {
+			sc.queueConnect()
+			return
+		}
+		// This handles the edge case where we have a single subConn in the
+		// ring. nextSkippingDuplicatesSubCon() would have returned nil. We
+		// still need to ensure that some subConn is attempting to connect, in
+		// order to give the LB policy a chance to move out of
+		// TRANSIENT_FAILURE. Hence, we try connecting on the current subConn.
+		scs.queueConnect()
+	}
 }
 
 // mergeErrors builds an error from the last connection error and the last
@@ -390,11 +443,17 @@ func (b *ringhashBalancer) regeneratePicker() {
 
 func (b *ringhashBalancer) Close() {}
 
+func (b *ringhashBalancer) ExitIdle() {
+	// ExitIdle implementation is a no-op because connections are either
+	// triggers from picks or from subConn state changes.
+}
+
 // connectivityStateEvaluator takes the connectivity states of multiple SubConns
 // and returns one aggregated connectivity state.
 //
 // It's not thread safe.
 type connectivityStateEvaluator struct {
+	sum  uint64
 	nums [5]uint64
 }
 
@@ -404,6 +463,7 @@ type connectivityStateEvaluator struct {
 // - If there is at least one subchannel in READY state, report READY.
 // - If there are 2 or more subchannels in TRANSIENT_FAILURE state, report TRANSIENT_FAILURE.
 // - If there is at least one subchannel in CONNECTING state, report CONNECTING.
+// - If there is one subchannel in TRANSIENT_FAILURE and there is more than one subchannel, report state CONNECTING.
 // - If there is at least one subchannel in Idle state, report Idle.
 // - Otherwise, report TRANSIENT_FAILURE.
 //
@@ -417,6 +477,14 @@ func (cse *connectivityStateEvaluator) recordTransition(oldState, newState conne
 		updateVal := 2*uint64(idx) - 1 // -1 for oldState and +1 for new.
 		cse.nums[state] += updateVal
 	}
+	if oldState == connectivity.Shutdown {
+		// There's technically no transition from Shutdown. But we record a
+		// Shutdown->Idle transition when a new SubConn is created.
+		cse.sum++
+	}
+	if newState == connectivity.Shutdown {
+		cse.sum--
+	}
 
 	if cse.nums[connectivity.Ready] > 0 {
 		return connectivity.Ready
@@ -427,8 +495,26 @@ func (cse *connectivityStateEvaluator) recordTransition(oldState, newState conne
 	if cse.nums[connectivity.Connecting] > 0 {
 		return connectivity.Connecting
 	}
+	if cse.nums[connectivity.TransientFailure] > 0 && cse.sum > 1 {
+		return connectivity.Connecting
+	}
 	if cse.nums[connectivity.Idle] > 0 {
 		return connectivity.Idle
 	}
 	return connectivity.TransientFailure
 }
+
+// getWeightAttribute is a convenience function which returns the value of the
+// weight attribute stored in the BalancerAttributes field of addr, using the
+// weightedroundrobin package.
+//
+// When used in the xDS context, the weight attribute is guaranteed to be
+// non-zero. But, when used in a non-xDS context, the weight attribute could be
+// unset. A Default of 1 is used in the latter case.
+func getWeightAttribute(addr resolver.Address) uint32 {
+	w := weightedroundrobin.GetAddrInfo(addr).Weight
+	if w == 0 {
+		return 1
+	}
+	return w
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/cluster_specifier.go b/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/cluster_specifier.go
index 54776f20cf0b..b95a101116ed 100644
--- a/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/cluster_specifier.go
+++ b/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/cluster_specifier.go
@@ -37,7 +37,7 @@ type ClusterSpecifier interface {
 	// ParseClusterSpecifierConfig parses the provided configuration
 	// proto.Message from the top level RDS configuration. The resulting
 	// BalancerConfig will be used as configuration for a child LB Policy of the
-	// Cluster Manager LB Policy.
+	// Cluster Manager LB Policy. A nil BalancerConfig is invalid.
 	ParseClusterSpecifierConfig(proto.Message) (BalancerConfig, error)
 }
 
@@ -65,3 +65,8 @@ func Register(cs ClusterSpecifier) {
 func Get(typeURL string) ClusterSpecifier {
 	return m[typeURL]
 }
+
+// UnregisterForTesting unregisters the ClusterSpecifier for testing purposes.
+func UnregisterForTesting(typeURL string) {
+	delete(m, typeURL)
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/rls/rls.go b/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/rls/rls.go
new file mode 100644
index 000000000000..a167cc5fa2c9
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/clusterspecifier/rls/rls.go
@@ -0,0 +1,109 @@
+/*
+ *
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package rls implements the RLS cluster specifier plugin.
+package rls
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/golang/protobuf/ptypes"
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/internal"
+	"google.golang.org/grpc/internal/envconfig"
+	rlspb "google.golang.org/grpc/internal/proto/grpc_lookup_v1"
+	"google.golang.org/grpc/xds/internal/clusterspecifier"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func init() {
+	if envconfig.XDSRLS {
+		clusterspecifier.Register(rls{})
+	}
+
+	// TODO: Remove these once the RLS env var is removed.
+	internal.RegisterRLSClusterSpecifierPluginForTesting = func() {
+		clusterspecifier.Register(rls{})
+	}
+	internal.UnregisterRLSClusterSpecifierPluginForTesting = func() {
+		for _, typeURL := range rls.TypeURLs(rls{}) {
+			clusterspecifier.UnregisterForTesting(typeURL)
+		}
+	}
+}
+
+type rls struct{}
+
+func (rls) TypeURLs() []string {
+	return []string{"type.googleapis.com/grpc.lookup.v1.RouteLookupClusterSpecifier"}
+}
+
+// lbConfigJSON is the RLS LB Policies configuration in JSON format.
+// RouteLookupConfig will be a raw JSON string from the passed in proto
+// configuration, and the other fields will be hardcoded.
+type lbConfigJSON struct {
+	RouteLookupConfig                json.RawMessage              `json:"routeLookupConfig"`
+	ChildPolicy                      []map[string]json.RawMessage `json:"childPolicy"`
+	ChildPolicyConfigTargetFieldName string                       `json:"childPolicyConfigTargetFieldName"`
+}
+
+func (rls) ParseClusterSpecifierConfig(cfg proto.Message) (clusterspecifier.BalancerConfig, error) {
+	if cfg == nil {
+		return nil, fmt.Errorf("rls_csp: nil configuration message provided")
+	}
+	any, ok := cfg.(*anypb.Any)
+	if !ok {
+		return nil, fmt.Errorf("rls_csp: error parsing config %v: unknown type %T", cfg, cfg)
+	}
+	rlcs := new(rlspb.RouteLookupClusterSpecifier)
+
+	if err := ptypes.UnmarshalAny(any, rlcs); err != nil {
+		return nil, fmt.Errorf("rls_csp: error parsing config %v: %v", cfg, err)
+	}
+	rlcJSON, err := protojson.Marshal(rlcs.GetRouteLookupConfig())
+	if err != nil {
+		return nil, fmt.Errorf("rls_csp: error marshaling route lookup config: %v: %v", rlcs.GetRouteLookupConfig(), err)
+	}
+	lbCfgJSON := &lbConfigJSON{
+		RouteLookupConfig: rlcJSON, // "JSON form of RouteLookupClusterSpecifier.config" - RLS in xDS Design Doc
+		ChildPolicy: []map[string]json.RawMessage{
+			{
+				"cds_experimental": json.RawMessage("{}"),
+			},
+		},
+		ChildPolicyConfigTargetFieldName: "cluster",
+	}
+
+	rawJSON, err := json.Marshal(lbCfgJSON)
+	if err != nil {
+		return nil, fmt.Errorf("rls_csp: error marshaling load balancing config %v: %v", lbCfgJSON, err)
+	}
+
+	rlsBB := balancer.Get(internal.RLSLoadBalancingPolicyName)
+	if rlsBB == nil {
+		return nil, fmt.Errorf("RLS LB policy not registered")
+	}
+	if _, err = rlsBB.(balancer.ConfigParser).ParseConfig(rawJSON); err != nil {
+		return nil, fmt.Errorf("rls_csp: validation error from rls lb policy parsing %v", err)
+	}
+
+	return clusterspecifier.BalancerConfig{{internal.RLSLoadBalancingPolicyName: lbCfgJSON}}, nil
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/httpfilter/rbac/rbac.go b/vendor/google.golang.org/grpc/xds/internal/httpfilter/rbac/rbac.go
index bb85dc80d460..209283c3bf59 100644
--- a/vendor/google.golang.org/grpc/xds/internal/httpfilter/rbac/rbac.go
+++ b/vendor/google.golang.org/grpc/xds/internal/httpfilter/rbac/rbac.go
@@ -27,6 +27,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/golang/protobuf/ptypes"
+	"google.golang.org/grpc/internal"
 	"google.golang.org/grpc/internal/envconfig"
 	"google.golang.org/grpc/internal/resolver"
 	"google.golang.org/grpc/internal/xds/rbac"
@@ -41,21 +42,15 @@ func init() {
 	if envconfig.XDSRBAC {
 		httpfilter.Register(builder{})
 	}
-}
-
-// RegisterForTesting registers the RBAC HTTP Filter for testing purposes, regardless
-// of the RBAC environment variable. This is needed because there is no way to set the RBAC
-// environment variable to true in a test before init() in this package is run.
-func RegisterForTesting() {
-	httpfilter.Register(builder{})
-}
 
-// UnregisterForTesting unregisters the RBAC HTTP Filter for testing purposes. This is needed because
-// there is no way to unregister the HTTP Filter after registering it solely for testing purposes using
-// rbac.RegisterForTesting()
-func UnregisterForTesting() {
-	for _, typeURL := range builder.TypeURLs(builder{}) {
-		httpfilter.UnregisterForTesting(typeURL)
+	// TODO: Remove these once the RBAC env var is removed.
+	internal.RegisterRBACHTTPFilterForTesting = func() {
+		httpfilter.Register(builder{})
+	}
+	internal.UnregisterRBACHTTPFilterForTesting = func() {
+		for _, typeURL := range builder.TypeURLs(builder{}) {
+			httpfilter.UnregisterForTesting(typeURL)
+		}
 	}
 }
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/resolver/serviceconfig.go b/vendor/google.golang.org/grpc/xds/internal/resolver/serviceconfig.go
index fd75af210457..d1dd79354ae0 100644
--- a/vendor/google.golang.org/grpc/xds/internal/resolver/serviceconfig.go
+++ b/vendor/google.golang.org/grpc/xds/internal/resolver/serviceconfig.go
@@ -245,9 +245,8 @@ func (cs *configSelector) generateHash(rpcInfo iresolver.RPCInfo, hashPolicies [
 			generatedHash = true
 			generatedPolicyHash = true
 		case xdsresource.HashPolicyTypeChannelID:
-			// Hash the ClientConn pointer which logically uniquely
-			// identifies the client.
-			policyHash = xxhash.Sum64String(fmt.Sprintf("%p", &cs.r.cc))
+			// Use the static channel ID as the hash for this policy.
+			policyHash = cs.r.channelID
 			generatedHash = true
 			generatedPolicyHash = true
 		}
diff --git a/vendor/google.golang.org/grpc/xds/internal/resolver/watch_service.go b/vendor/google.golang.org/grpc/xds/internal/resolver/watch_service.go
index 3db9be1cac07..4f8609ce9df5 100644
--- a/vendor/google.golang.org/grpc/xds/internal/resolver/watch_service.go
+++ b/vendor/google.golang.org/grpc/xds/internal/resolver/watch_service.go
@@ -58,6 +58,10 @@ type ldsConfig struct {
 // Note that during race (e.g. an xDS response is received while the user is
 // calling cancel()), there's a small window where the callback can be called
 // after the watcher is canceled. The caller needs to handle this case.
+//
+// TODO(easwars): Make this function a method on the xdsResolver type.
+// Currently, there is a single call site for this function, and all arguments
+// passed to it are fields of the xdsResolver type.
 func watchService(c xdsclient.XDSClient, serviceName string, cb func(serviceUpdate, error), logger *grpclog.PrefixLogger) (cancel func()) {
 	w := &serviceUpdateWatcher{
 		logger:      logger,
@@ -139,7 +143,7 @@ func (w *serviceUpdateWatcher) handleLDSResp(update xdsresource.ListenerUpdate,
 		// update before reporting this LDS config.
 		if w.lastUpdate.virtualHost != nil {
 			// We want to send an update with the new fields from the new LDS
-			// (e.g. max stream duration), and old fields from the the previous
+			// (e.g. max stream duration), and old fields from the previous
 			// RDS.
 			//
 			// But note that this should only happen when virtual host is set,
diff --git a/vendor/google.golang.org/grpc/xds/internal/resolver/xds_resolver.go b/vendor/google.golang.org/grpc/xds/internal/resolver/xds_resolver.go
index c4b147d21efb..f473fcbaa733 100644
--- a/vendor/google.golang.org/grpc/xds/internal/resolver/xds_resolver.go
+++ b/vendor/google.golang.org/grpc/xds/internal/resolver/xds_resolver.go
@@ -25,7 +25,9 @@ import (
 	"strings"
 
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal"
 	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcrand"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/internal/pretty"
 	iresolver "google.golang.org/grpc/internal/resolver"
@@ -37,10 +39,10 @@ import (
 
 const xdsScheme = "xds"
 
-// NewBuilderForTesting creates a new xds resolver builder using a specific xds
+// newBuilderForTesting creates a new xds resolver builder using a specific xds
 // bootstrap config, so tests can use multiple xds clients in different
 // ClientConns at the same time.
-func NewBuilderForTesting(config []byte) (resolver.Builder, error) {
+func newBuilderForTesting(config []byte) (resolver.Builder, error) {
 	return &xdsResolverBuilder{
 		newXDSClient: func() (xdsclient.XDSClient, error) {
 			return xdsclient.NewWithBootstrapContentsForTesting(config)
@@ -53,6 +55,7 @@ var newXDSClient = func() (xdsclient.XDSClient, error) { return xdsclient.New()
 
 func init() {
 	resolver.Register(&xdsResolverBuilder{})
+	internal.NewXDSResolverWithConfigForTesting = newBuilderForTesting
 }
 
 type xdsResolverBuilder struct {
@@ -63,13 +66,13 @@ type xdsResolverBuilder struct {
 //
 // The xds bootstrap process is performed (and a new xds client is built) every
 // time an xds resolver is built.
-func (b *xdsResolverBuilder) Build(t resolver.Target, cc resolver.ClientConn, opts resolver.BuildOptions) (_ resolver.Resolver, retErr error) {
+func (b *xdsResolverBuilder) Build(target resolver.Target, cc resolver.ClientConn, opts resolver.BuildOptions) (_ resolver.Resolver, retErr error) {
 	r := &xdsResolver{
-		target:         t,
 		cc:             cc,
 		closed:         grpcsync.NewEvent(),
 		updateCh:       make(chan suWithError, 1),
 		activeClusters: make(map[string]*clusterInfo),
+		channelID:      grpcrand.Uint64(),
 	}
 	defer func() {
 		if retErr != nil {
@@ -77,7 +80,7 @@ func (b *xdsResolverBuilder) Build(t resolver.Target, cc resolver.ClientConn, op
 		}
 	}()
 	r.logger = prefixLogger(r)
-	r.logger.Infof("Creating resolver for target: %+v", t)
+	r.logger.Infof("Creating resolver for target: %+v", target)
 
 	newXDSClient := newXDSClient
 	if b.newXDSClient != nil {
@@ -115,7 +118,7 @@ func (b *xdsResolverBuilder) Build(t resolver.Target, cc resolver.ClientConn, op
 	// - If authority is not set in the target, use the top level template
 	// - If authority is set, use the template from the authority map.
 	template := bootstrapConfig.ClientDefaultListenerResourceNameTemplate
-	if authority := r.target.URL.Host; authority != "" {
+	if authority := target.URL.Host; authority != "" {
 		a := bootstrapConfig.Authorities[authority]
 		if a == nil {
 			return nil, fmt.Errorf("xds: authority %q is not found in the bootstrap file", authority)
@@ -127,19 +130,19 @@ func (b *xdsResolverBuilder) Build(t resolver.Target, cc resolver.ClientConn, op
 			template = a.ClientListenerResourceNameTemplate
 		}
 	}
-	endpoint := r.target.URL.Path
+	endpoint := target.URL.Path
 	if endpoint == "" {
-		endpoint = r.target.URL.Opaque
+		endpoint = target.URL.Opaque
 	}
 	endpoint = strings.TrimPrefix(endpoint, "/")
-	resourceName := bootstrap.PopulateResourceTemplate(template, endpoint)
+	r.ldsResourceName = bootstrap.PopulateResourceTemplate(template, endpoint)
 
-	// Register a watch on the xdsClient for the user's dial target.
-	cancelWatch := watchService(r.client, resourceName, r.handleServiceUpdate, r.logger)
-	r.logger.Infof("Watch started on resource name %v with xds-client %p", r.target.Endpoint, r.client)
+	// Register a watch on the xdsClient for the resource name determined above.
+	cancelWatch := watchService(r.client, r.ldsResourceName, r.handleServiceUpdate, r.logger)
+	r.logger.Infof("Watch started on resource name %v with xds-client %p", r.ldsResourceName, r.client)
 	r.cancelWatch = func() {
 		cancelWatch()
-		r.logger.Infof("Watch cancel on resource name %v with xds-client %p", r.target.Endpoint, r.client)
+		r.logger.Infof("Watch cancel on resource name %v with xds-client %p", r.ldsResourceName, r.client)
 	}
 
 	go r.run()
@@ -165,11 +168,10 @@ type suWithError struct {
 // (which performs LDS/RDS queries for the same), and passes the received
 // updates to the ClientConn.
 type xdsResolver struct {
-	target resolver.Target
-	cc     resolver.ClientConn
-	closed *grpcsync.Event
-
-	logger *grpclog.PrefixLogger
+	cc              resolver.ClientConn
+	closed          *grpcsync.Event
+	logger          *grpclog.PrefixLogger
+	ldsResourceName string
 
 	// The underlying xdsClient which performs all xDS requests and responses.
 	client xdsclient.XDSClient
@@ -184,6 +186,10 @@ type xdsResolver struct {
 	activeClusters map[string]*clusterInfo
 
 	curConfigSelector *configSelector
+
+	// A random number which uniquely identifies the channel which owns this
+	// resolver.
+	channelID uint64
 }
 
 // sendNewServiceConfig prunes active clusters, generates a new service config
@@ -212,7 +218,7 @@ func (r *xdsResolver) sendNewServiceConfig(cs *configSelector) bool {
 		r.cc.ReportError(err)
 		return false
 	}
-	r.logger.Infof("Received update on resource %v from xds-client %p, generated service config: %v", r.target.Endpoint, r.client, pretty.FormatJSON(sc))
+	r.logger.Infof("Received update on resource %v from xds-client %p, generated service config: %v", r.ldsResourceName, r.client, pretty.FormatJSON(sc))
 
 	// Send the update to the ClientConn.
 	state := iresolver.SetConfigSelector(resolver.State{
@@ -231,7 +237,7 @@ func (r *xdsResolver) run() {
 			return
 		case update := <-r.updateCh:
 			if update.err != nil {
-				r.logger.Warningf("Watch error on resource %v from xds-client %p, %v", r.target.Endpoint, r.client, update.err)
+				r.logger.Warningf("Watch error on resource %v from xds-client %p, %v", r.ldsResourceName, r.client, update.err)
 				if xdsresource.ErrType(update.err) == xdsresource.ErrorTypeResourceNotFound {
 					// If error is resource-not-found, it means the LDS
 					// resource was removed. Ultimately send an empty service
@@ -259,7 +265,7 @@ func (r *xdsResolver) run() {
 			// Create the config selector for this update.
 			cs, err := r.newConfigSelector(update.su)
 			if err != nil {
-				r.logger.Warningf("Error parsing update on resource %v from xds-client %p: %v", r.target.Endpoint, r.client, err)
+				r.logger.Warningf("Error parsing update on resource %v from xds-client %p: %v", r.ldsResourceName, r.client, err)
 				r.cc.ReportError(err)
 				continue
 			}
diff --git a/vendor/google.golang.org/grpc/xds/internal/server/listener_wrapper.go b/vendor/google.golang.org/grpc/xds/internal/server/listener_wrapper.go
index c90f9672ea32..c6ab885fcf90 100644
--- a/vendor/google.golang.org/grpc/xds/internal/server/listener_wrapper.go
+++ b/vendor/google.golang.org/grpc/xds/internal/server/listener_wrapper.go
@@ -111,6 +111,7 @@ func NewListenerWrapper(params ListenerWrapperParams) (net.Listener, <-chan stru
 		drainCallback:     params.DrainCallback,
 		isUnspecifiedAddr: params.Listener.Addr().(*net.TCPAddr).IP.IsUnspecified(),
 
+		mode:        connectivity.ServingModeStarting,
 		closed:      grpcsync.NewEvent(),
 		goodUpdate:  grpcsync.NewEvent(),
 		ldsUpdateCh: make(chan ldsUpdateWithError, 1),
@@ -429,14 +430,24 @@ func (l *listenerWrapper) handleLDSUpdate(update ldsUpdateWithError) {
 	}
 }
 
+// switchMode updates the value of serving mode and filter chains stored in the
+// listenerWrapper. And if the serving mode has changed, it invokes the
+// registered mode change callback.
 func (l *listenerWrapper) switchMode(fcs *xdsresource.FilterChainManager, newMode connectivity.ServingMode, err error) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
 	l.filterChains = fcs
+	if l.mode == newMode && l.mode == connectivity.ServingModeServing {
+		// Redundant updates are suppressed only when we are SERVING and the new
+		// mode is also SERVING. In the other case (where we are NOT_SERVING and the
+		// new mode is also NOT_SERVING), the update is not suppressed as:
+		//   1. the error may have change
+		//   2. it provides a timestamp of the last backoff attempt
+		return
+	}
 	l.mode = newMode
 	if l.modeCallback != nil {
 		l.modeCallback(l.Listener.Addr(), newMode, err)
 	}
-	l.logger.Warningf("Listener %q entering mode: %q due to error: %v", l.Addr(), newMode, err)
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/attributes.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/attributes.go
index 514181627361..9076a76fd0dc 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/attributes.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/attributes.go
@@ -17,36 +17,12 @@
 
 package xdsclient
 
-import (
-	"google.golang.org/grpc/resolver"
-	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
-	"google.golang.org/grpc/xds/internal/xdsclient/load"
-	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
-)
+import "google.golang.org/grpc/resolver"
 
 type clientKeyType string
 
 const clientKey = clientKeyType("grpc.xds.internal.client.Client")
 
-// XDSClient is a full fledged gRPC client which queries a set of discovery APIs
-// (collectively termed as xDS) on a remote management server, to discover
-// various dynamic resources.
-type XDSClient interface {
-	WatchListener(string, func(xdsresource.ListenerUpdate, error)) func()
-	WatchRouteConfig(string, func(xdsresource.RouteConfigUpdate, error)) func()
-	WatchCluster(string, func(xdsresource.ClusterUpdate, error)) func()
-	WatchEndpoints(clusterName string, edsCb func(xdsresource.EndpointsUpdate, error)) (cancel func())
-	ReportLoad(server *bootstrap.ServerConfig) (*load.Store, func())
-
-	DumpLDS() map[string]xdsresource.UpdateWithMD
-	DumpRDS() map[string]xdsresource.UpdateWithMD
-	DumpCDS() map[string]xdsresource.UpdateWithMD
-	DumpEDS() map[string]xdsresource.UpdateWithMD
-
-	BootstrapConfig() *bootstrap.Config
-	Close()
-}
-
 // FromResolverState returns the Client from state, or nil if not present.
 func FromResolverState(state resolver.State) XDSClient {
 	cs, _ := state.Attributes.Value(clientKey).(XDSClient)
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/authority.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/authority.go
index 1a236849c377..817cb7338f5a 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/authority.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/authority.go
@@ -18,126 +18,12 @@
 package xdsclient
 
 import (
-	"errors"
-	"fmt"
-
 	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
 	"google.golang.org/grpc/xds/internal/xdsclient/load"
 	"google.golang.org/grpc/xds/internal/xdsclient/pubsub"
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
 )
 
-// findAuthority returns the authority for this name. If it doesn't already
-// exist, one will be created.
-//
-// Note that this doesn't always create new authority. authorities with the same
-// config but different names are shared.
-//
-// The returned unref function must be called when the caller is done using this
-// authority, without holding c.authorityMu.
-//
-// Caller must not hold c.authorityMu.
-func (c *clientImpl) findAuthority(n *xdsresource.Name) (_ *authority, unref func(), _ error) {
-	scheme, authority := n.Scheme, n.Authority
-
-	c.authorityMu.Lock()
-	defer c.authorityMu.Unlock()
-	if c.done.HasFired() {
-		return nil, nil, errors.New("the xds-client is closed")
-	}
-
-	config := c.config.XDSServer
-	if scheme == xdsresource.FederationScheme {
-		cfg, ok := c.config.Authorities[authority]
-		if !ok {
-			return nil, nil, fmt.Errorf("xds: failed to find authority %q", authority)
-		}
-		config = cfg.XDSServer
-	}
-
-	a, err := c.newAuthority(config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("xds: failed to connect to the control plane for authority %q: %v", authority, err)
-	}
-	// All returned authority from this function will be used by a watch,
-	// holding the ref here.
-	//
-	// Note that this must be done while c.authorityMu is held, to avoid the
-	// race that an authority is returned, but before the watch starts, the
-	// old last watch is canceled (in another goroutine), causing this
-	// authority to be removed, and then a watch will start on a removed
-	// authority.
-	//
-	// unref() will be done when the watch is canceled.
-	a.ref()
-	return a, func() { c.unrefAuthority(a) }, nil
-}
-
-// newAuthority creates a new authority for the config. But before that, it
-// checks the cache to see if an authority for this config already exists.
-//
-// The caller must take a reference of the returned authority before using, and
-// unref afterwards.
-//
-// caller must hold c.authorityMu
-func (c *clientImpl) newAuthority(config *bootstrap.ServerConfig) (_ *authority, retErr error) {
-	// First check if there's already an authority for this config. If found, it
-	// means this authority is used by other watches (could be the same
-	// authority name, or a different authority name but the same server
-	// config). Return it.
-	configStr := config.String()
-	if a, ok := c.authorities[configStr]; ok {
-		return a, nil
-	}
-	// Second check if there's an authority in the idle cache. If found, it
-	// means this authority was created, but moved to the idle cache because the
-	// watch was canceled. Move it from idle cache to the authority cache, and
-	// return.
-	if old, ok := c.idleAuthorities.Remove(configStr); ok {
-		oldA, _ := old.(*authority)
-		if oldA != nil {
-			c.authorities[configStr] = oldA
-			return oldA, nil
-		}
-	}
-
-	// Make a new authority since there's no existing authority for this config.
-	ret := &authority{config: config, pubsub: pubsub.New(c.watchExpiryTimeout, c.logger)}
-	defer func() {
-		if retErr != nil {
-			ret.close()
-		}
-	}()
-	ctr, err := newController(config, ret.pubsub, c.updateValidator, c.logger)
-	if err != nil {
-		return nil, err
-	}
-	ret.controller = ctr
-	// Add it to the cache, so it will be reused.
-	c.authorities[configStr] = ret
-	return ret, nil
-}
-
-// unrefAuthority unrefs the authority. It also moves the authority to idle
-// cache if it's ref count is 0.
-//
-// This function doesn't need to called explicitly. It's called by the returned
-// unref from findAuthority().
-//
-// Caller must not hold c.authorityMu.
-func (c *clientImpl) unrefAuthority(a *authority) {
-	c.authorityMu.Lock()
-	defer c.authorityMu.Unlock()
-	if a.unref() > 0 {
-		return
-	}
-	configStr := a.config.String()
-	delete(c.authorities, configStr)
-	c.idleAuthorities.Add(configStr, a, func() {
-		a.close()
-	})
-}
-
 // authority is a combination of pubsub and the controller for this authority.
 //
 // Note that it might make sense to use one pubsub for all the resources (for
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/bootstrap/bootstrap.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/bootstrap/bootstrap.go
index 4523a6131fd4..97fe4a8b0792 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/bootstrap/bootstrap.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/bootstrap/bootstrap.go
@@ -53,6 +53,7 @@ const (
 
 	gRPCUserAgentName               = "gRPC Go"
 	clientFeatureNoOverprovisioning = "envoy.lb.does_not_support_overprovisioning"
+	clientFeatureResourceWrapper    = "xds.config.resource-in-sotw"
 )
 
 func init() {
@@ -499,7 +500,7 @@ func (c *Config) updateNodeProto(node *v3corepb.Node) error {
 	}
 	v3.UserAgentName = gRPCUserAgentName
 	v3.UserAgentVersionType = &v3corepb.Node_UserAgentVersion{UserAgentVersion: grpc.Version}
-	v3.ClientFeatures = append(v3.ClientFeatures, clientFeatureNoOverprovisioning)
+	v3.ClientFeatures = append(v3.ClientFeatures, clientFeatureNoOverprovisioning, clientFeatureResourceWrapper)
 
 	v3bytes, err := proto.Marshal(v3)
 	if err != nil {
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/client.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/client.go
index 817a4507eb34..8ae7301fb7e3 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/client.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/client.go
@@ -21,135 +21,26 @@
 package xdsclient
 
 import (
-	"fmt"
-	"sync"
-	"time"
-
-	"google.golang.org/grpc/internal/cache"
-	"google.golang.org/grpc/internal/grpclog"
-	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
+	"google.golang.org/grpc/xds/internal/xdsclient/load"
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
 )
 
-// clientImpl is the real implementation of the xds client. The exported Client
-// is a wrapper of this struct with a ref count.
-//
-// Implements UpdateHandler interface.
-// TODO(easwars): Make a wrapper struct which implements this interface in the
-// style of ccBalancerWrapper so that the Client type does not implement these
-// exported methods.
-type clientImpl struct {
-	done   *grpcsync.Event
-	config *bootstrap.Config
-
-	// authorityMu protects the authority fields. It's necessary because an
-	// authority is created when it's used.
-	authorityMu sync.Mutex
-	// authorities is a map from ServerConfig to authority. So that
-	// different authorities sharing the same ServerConfig can share the
-	// authority.
-	//
-	// The key is **ServerConfig.String()**, not the authority name.
-	//
-	// An authority is either in authorities, or idleAuthorities,
-	// never both.
-	authorities map[string]*authority
-	// idleAuthorities keeps the authorities that are not used (the last
-	// watch on it was canceled). They are kept in the cache and will be deleted
-	// after a timeout. The key is ServerConfig.String().
-	//
-	// An authority is either in authorities, or idleAuthorities,
-	// never both.
-	idleAuthorities *cache.TimeoutCache
-
-	logger             *grpclog.PrefixLogger
-	watchExpiryTimeout time.Duration
-}
-
-// newWithConfig returns a new xdsClient with the given config.
-func newWithConfig(config *bootstrap.Config, watchExpiryTimeout time.Duration, idleAuthorityDeleteTimeout time.Duration) (*clientImpl, error) {
-	c := &clientImpl{
-		done:               grpcsync.NewEvent(),
-		config:             config,
-		watchExpiryTimeout: watchExpiryTimeout,
-		authorities:        make(map[string]*authority),
-		idleAuthorities:    cache.NewTimeoutCache(idleAuthorityDeleteTimeout),
-	}
-
-	c.logger = prefixLogger(c)
-	c.logger.Infof("Created ClientConn to xDS management server: %s", config.XDSServer)
-	c.logger.Infof("Created")
-	return c, nil
-}
-
-// BootstrapConfig returns the configuration read from the bootstrap file.
-// Callers must treat the return value as read-only.
-func (c *clientRefCounted) BootstrapConfig() *bootstrap.Config {
-	return c.config
-}
-
-// Close closes the gRPC connection to the management server.
-func (c *clientImpl) Close() {
-	if c.done.HasFired() {
-		return
-	}
-	c.done.Fire()
-	// TODO: Should we invoke the registered callbacks here with an error that
-	// the client is closed?
-
-	// Note that Close needs to check for nils even if some of them are always
-	// set in the constructor. This is because the constructor defers Close() in
-	// error cases, and the fields might not be set when the error happens.
-
-	c.authorityMu.Lock()
-	for _, a := range c.authorities {
-		a.close()
-	}
-	c.idleAuthorities.Clear(true)
-	c.authorityMu.Unlock()
-
-	c.logger.Infof("Shutdown")
-}
-
-func (c *clientImpl) filterChainUpdateValidator(fc *xdsresource.FilterChain) error {
-	if fc == nil {
-		return nil
-	}
-	return c.securityConfigUpdateValidator(fc.SecurityCfg)
-}
-
-func (c *clientImpl) securityConfigUpdateValidator(sc *xdsresource.SecurityConfig) error {
-	if sc == nil {
-		return nil
-	}
-	if sc.IdentityInstanceName != "" {
-		if _, ok := c.config.CertProviderConfigs[sc.IdentityInstanceName]; !ok {
-			return fmt.Errorf("identitiy certificate provider instance name %q missing in bootstrap configuration", sc.IdentityInstanceName)
-		}
-	}
-	if sc.RootInstanceName != "" {
-		if _, ok := c.config.CertProviderConfigs[sc.RootInstanceName]; !ok {
-			return fmt.Errorf("root certificate provider instance name %q missing in bootstrap configuration", sc.RootInstanceName)
-		}
-	}
-	return nil
-}
-
-func (c *clientImpl) updateValidator(u interface{}) error {
-	switch update := u.(type) {
-	case xdsresource.ListenerUpdate:
-		if update.InboundListenerCfg == nil || update.InboundListenerCfg.FilterChains == nil {
-			return nil
-		}
-		return update.InboundListenerCfg.FilterChains.Validate(c.filterChainUpdateValidator)
-	case xdsresource.ClusterUpdate:
-		return c.securityConfigUpdateValidator(update.SecurityCfg)
-	default:
-		// We currently invoke this update validation function only for LDS and
-		// CDS updates. In the future, if we wish to invoke it for other xDS
-		// updates, corresponding plumbing needs to be added to those unmarshal
-		// functions.
-	}
-	return nil
+// XDSClient is a full fledged gRPC client which queries a set of discovery APIs
+// (collectively termed as xDS) on a remote management server, to discover
+// various dynamic resources.
+type XDSClient interface {
+	WatchListener(string, func(xdsresource.ListenerUpdate, error)) func()
+	WatchRouteConfig(string, func(xdsresource.RouteConfigUpdate, error)) func()
+	WatchCluster(string, func(xdsresource.ClusterUpdate, error)) func()
+	WatchEndpoints(string, func(xdsresource.EndpointsUpdate, error)) func()
+	ReportLoad(*bootstrap.ServerConfig) (*load.Store, func())
+
+	DumpLDS() map[string]xdsresource.UpdateWithMD
+	DumpRDS() map[string]xdsresource.UpdateWithMD
+	DumpCDS() map[string]xdsresource.UpdateWithMD
+	DumpEDS() map[string]xdsresource.UpdateWithMD
+
+	BootstrapConfig() *bootstrap.Config
+	Close()
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/client_new.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/client_new.go
new file mode 100644
index 000000000000..0631d3b0fadb
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/client_new.go
@@ -0,0 +1,134 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package xdsclient
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc/internal/cache"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
+)
+
+// New returns a new xDS client configured by the bootstrap file specified in env
+// variable GRPC_XDS_BOOTSTRAP or GRPC_XDS_BOOTSTRAP_CONFIG.
+//
+// The returned client is a reference counted singleton instance. This function
+// creates a new client only when one doesn't already exist.
+//
+// Note that the first invocation of New() or NewWithConfig() sets the client
+// singleton. The following calls will return the singleton client without
+// checking or using the config.
+func New() (XDSClient, error) {
+	return newRefCountedWithConfig(nil)
+}
+
+// NewWithConfig returns a new xDS client configured by the given config.
+//
+// Internal/Testing Only
+//
+// This function should ONLY be used for internal (c2p resolver) and/or testing
+// purposese. DO NOT use this elsewhere. Use New() instead.
+func NewWithConfig(config *bootstrap.Config) (XDSClient, error) {
+	return newRefCountedWithConfig(config)
+}
+
+// newWithConfig returns a new xdsClient with the given config.
+func newWithConfig(config *bootstrap.Config, watchExpiryTimeout time.Duration, idleAuthorityDeleteTimeout time.Duration) (*clientImpl, error) {
+	c := &clientImpl{
+		done:               grpcsync.NewEvent(),
+		config:             config,
+		watchExpiryTimeout: watchExpiryTimeout,
+		authorities:        make(map[string]*authority),
+		idleAuthorities:    cache.NewTimeoutCache(idleAuthorityDeleteTimeout),
+	}
+
+	c.logger = prefixLogger(c)
+	c.logger.Infof("Created ClientConn to xDS management server: %s", config.XDSServer)
+	c.logger.Infof("Created")
+	return c, nil
+}
+
+// NewWithConfigForTesting returns an xDS client for the specified bootstrap
+// config, separate from the global singleton.
+//
+// Testing Only
+//
+// This function should ONLY be used for testing purposes.
+func NewWithConfigForTesting(config *bootstrap.Config, watchExpiryTimeout time.Duration) (XDSClient, error) {
+	cl, err := newWithConfig(config, watchExpiryTimeout, defaultIdleAuthorityDeleteTimeout)
+	if err != nil {
+		return nil, err
+	}
+	return &clientRefCounted{clientImpl: cl, refCount: 1}, nil
+}
+
+// NewWithBootstrapContentsForTesting returns an xDS client for this config,
+// separate from the global singleton.
+//
+//
+// Testing Only
+//
+// This function should ONLY be used for testing purposes.
+func NewWithBootstrapContentsForTesting(contents []byte) (XDSClient, error) {
+	// Normalize the contents
+	buf := bytes.Buffer{}
+	err := json.Indent(&buf, contents, "", "")
+	if err != nil {
+		return nil, fmt.Errorf("xds: error normalizing JSON: %v", err)
+	}
+	contents = bytes.TrimSpace(buf.Bytes())
+
+	clientsMu.Lock()
+	defer clientsMu.Unlock()
+	if c := clients[string(contents)]; c != nil {
+		c.mu.Lock()
+		// Since we don't remove the *Client from the map when it is closed, we
+		// need to recreate the impl if the ref count dropped to zero.
+		if c.refCount > 0 {
+			c.refCount++
+			c.mu.Unlock()
+			return c, nil
+		}
+		c.mu.Unlock()
+	}
+
+	bcfg, err := bootstrap.NewConfigFromContentsForTesting(contents)
+	if err != nil {
+		return nil, fmt.Errorf("xds: error with bootstrap config: %v", err)
+	}
+
+	cImpl, err := newWithConfig(bcfg, defaultWatchExpiryTimeout, defaultIdleAuthorityDeleteTimeout)
+	if err != nil {
+		return nil, err
+	}
+
+	c := &clientRefCounted{clientImpl: cImpl, refCount: 1}
+	clients[string(contents)] = c
+	return c, nil
+}
+
+var (
+	clients   = map[string]*clientRefCounted{}
+	clientsMu sync.Mutex
+)
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl.go
new file mode 100644
index 000000000000..800ae91fa311
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl.go
@@ -0,0 +1,95 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package xdsclient
+
+import (
+	"sync"
+	"time"
+
+	"google.golang.org/grpc/internal/cache"
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
+)
+
+var _ XDSClient = &clientImpl{}
+
+// clientImpl is the real implementation of the xds client. The exported Client
+// is a wrapper of this struct with a ref count.
+//
+// Implements UpdateHandler interface.
+// TODO(easwars): Make a wrapper struct which implements this interface in the
+// style of ccBalancerWrapper so that the Client type does not implement these
+// exported methods.
+type clientImpl struct {
+	done   *grpcsync.Event
+	config *bootstrap.Config
+
+	// authorityMu protects the authority fields. It's necessary because an
+	// authority is created when it's used.
+	authorityMu sync.Mutex
+	// authorities is a map from ServerConfig to authority. So that
+	// different authorities sharing the same ServerConfig can share the
+	// authority.
+	//
+	// The key is **ServerConfig.String()**, not the authority name.
+	//
+	// An authority is either in authorities, or idleAuthorities,
+	// never both.
+	authorities map[string]*authority
+	// idleAuthorities keeps the authorities that are not used (the last
+	// watch on it was canceled). They are kept in the cache and will be deleted
+	// after a timeout. The key is ServerConfig.String().
+	//
+	// An authority is either in authorities, or idleAuthorities,
+	// never both.
+	idleAuthorities *cache.TimeoutCache
+
+	logger             *grpclog.PrefixLogger
+	watchExpiryTimeout time.Duration
+}
+
+// BootstrapConfig returns the configuration read from the bootstrap file.
+// Callers must treat the return value as read-only.
+func (c *clientImpl) BootstrapConfig() *bootstrap.Config {
+	return c.config
+}
+
+// Close closes the gRPC connection to the management server.
+func (c *clientImpl) Close() {
+	if c.done.HasFired() {
+		return
+	}
+	c.done.Fire()
+	// TODO: Should we invoke the registered callbacks here with an error that
+	// the client is closed?
+
+	// Note that Close needs to check for nils even if some of them are always
+	// set in the constructor. This is because the constructor defers Close() in
+	// error cases, and the fields might not be set when the error happens.
+
+	c.authorityMu.Lock()
+	for _, a := range c.authorities {
+		a.close()
+	}
+	c.idleAuthorities.Clear(true)
+	c.authorityMu.Unlock()
+
+	c.logger.Infof("Shutdown")
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_authority.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_authority.go
new file mode 100644
index 000000000000..623420ccc78f
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_authority.go
@@ -0,0 +1,164 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package xdsclient
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
+	"google.golang.org/grpc/xds/internal/xdsclient/controller"
+	"google.golang.org/grpc/xds/internal/xdsclient/load"
+	"google.golang.org/grpc/xds/internal/xdsclient/pubsub"
+	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
+
+	v2corepb "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
+	v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+)
+
+type controllerInterface interface {
+	AddWatch(resourceType xdsresource.ResourceType, resourceName string)
+	RemoveWatch(resourceType xdsresource.ResourceType, resourceName string)
+	ReportLoad(server string) (*load.Store, func())
+	Close()
+}
+
+var newController = func(config *bootstrap.ServerConfig, pubsub *pubsub.Pubsub, validator xdsresource.UpdateValidatorFunc, logger *grpclog.PrefixLogger, boff func(int) time.Duration) (controllerInterface, error) {
+	return controller.New(config, pubsub, validator, logger, boff)
+}
+
+// findAuthority returns the authority for this name. If it doesn't already
+// exist, one will be created.
+//
+// Note that this doesn't always create new authority. authorities with the same
+// config but different names are shared.
+//
+// The returned unref function must be called when the caller is done using this
+// authority, without holding c.authorityMu.
+//
+// Caller must not hold c.authorityMu.
+func (c *clientImpl) findAuthority(n *xdsresource.Name) (_ *authority, unref func(), _ error) {
+	scheme, authority := n.Scheme, n.Authority
+
+	c.authorityMu.Lock()
+	defer c.authorityMu.Unlock()
+	if c.done.HasFired() {
+		return nil, nil, errors.New("the xds-client is closed")
+	}
+
+	config := c.config.XDSServer
+	if scheme == xdsresource.FederationScheme {
+		cfg, ok := c.config.Authorities[authority]
+		if !ok {
+			return nil, nil, fmt.Errorf("xds: failed to find authority %q", authority)
+		}
+		if cfg.XDSServer != nil {
+			config = cfg.XDSServer
+		}
+	}
+
+	a, err := c.newAuthorityLocked(config)
+	if err != nil {
+		return nil, nil, fmt.Errorf("xds: failed to connect to the control plane for authority %q: %v", authority, err)
+	}
+	// All returned authority from this function will be used by a watch,
+	// holding the ref here.
+	//
+	// Note that this must be done while c.authorityMu is held, to avoid the
+	// race that an authority is returned, but before the watch starts, the
+	// old last watch is canceled (in another goroutine), causing this
+	// authority to be removed, and then a watch will start on a removed
+	// authority.
+	//
+	// unref() will be done when the watch is canceled.
+	a.ref()
+	return a, func() { c.unrefAuthority(a) }, nil
+}
+
+// newAuthorityLocked creates a new authority for the config. But before that, it
+// checks the cache to see if an authority for this config already exists.
+//
+// The caller must take a reference of the returned authority before using, and
+// unref afterwards.
+//
+// caller must hold c.authorityMu
+func (c *clientImpl) newAuthorityLocked(config *bootstrap.ServerConfig) (_ *authority, retErr error) {
+	// First check if there's already an authority for this config. If found, it
+	// means this authority is used by other watches (could be the same
+	// authority name, or a different authority name but the same server
+	// config). Return it.
+	configStr := config.String()
+	if a, ok := c.authorities[configStr]; ok {
+		return a, nil
+	}
+	// Second check if there's an authority in the idle cache. If found, it
+	// means this authority was created, but moved to the idle cache because the
+	// watch was canceled. Move it from idle cache to the authority cache, and
+	// return.
+	if old, ok := c.idleAuthorities.Remove(configStr); ok {
+		oldA, _ := old.(*authority)
+		if oldA != nil {
+			c.authorities[configStr] = oldA
+			return oldA, nil
+		}
+	}
+
+	// Make a new authority since there's no existing authority for this config.
+	nodeID := ""
+	if v3, ok := c.config.XDSServer.NodeProto.(*v3corepb.Node); ok {
+		nodeID = v3.GetId()
+	} else if v2, ok := c.config.XDSServer.NodeProto.(*v2corepb.Node); ok {
+		nodeID = v2.GetId()
+	}
+	ret := &authority{config: config, pubsub: pubsub.New(c.watchExpiryTimeout, nodeID, c.logger)}
+	defer func() {
+		if retErr != nil {
+			ret.close()
+		}
+	}()
+	ctr, err := newController(config, ret.pubsub, c.updateValidator, c.logger, nil)
+	if err != nil {
+		return nil, err
+	}
+	ret.controller = ctr
+	// Add it to the cache, so it will be reused.
+	c.authorities[configStr] = ret
+	return ret, nil
+}
+
+// unrefAuthority unrefs the authority. It also moves the authority to idle
+// cache if it's ref count is 0.
+//
+// This function doesn't need to called explicitly. It's called by the returned
+// unref from findAuthority().
+//
+// Caller must not hold c.authorityMu.
+func (c *clientImpl) unrefAuthority(a *authority) {
+	c.authorityMu.Lock()
+	defer c.authorityMu.Unlock()
+	if a.unref() > 0 {
+		return
+	}
+	configStr := a.config.String()
+	delete(c.authorities, configStr)
+	c.idleAuthorities.Add(configStr, a, func() {
+		a.close()
+	})
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/dump.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_dump.go
similarity index 100%
rename from vendor/google.golang.org/grpc/xds/internal/xdsclient/dump.go
rename to vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_dump.go
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/loadreport.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_loadreport.go
similarity index 94%
rename from vendor/google.golang.org/grpc/xds/internal/xdsclient/loadreport.go
rename to vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_loadreport.go
index 32c7e9c9d791..cba5afd454a7 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/loadreport.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_loadreport.go
@@ -28,7 +28,9 @@ import (
 // It returns a Store for the user to report loads, a function to cancel the
 // load reporting stream.
 func (c *clientImpl) ReportLoad(server *bootstrap.ServerConfig) (*load.Store, func()) {
-	a, err := c.newAuthority(server)
+	c.authorityMu.Lock()
+	a, err := c.newAuthorityLocked(server)
+	c.authorityMu.Unlock()
 	if err != nil {
 		c.logger.Infof("xds: failed to connect to the control plane to do load reporting for authority %q: %v", server, err)
 		return nil, func() {}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_validator.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_validator.go
new file mode 100644
index 000000000000..50bdbe4e23f4
--- /dev/null
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_validator.go
@@ -0,0 +1,67 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package xdsclient
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
+)
+
+func (c *clientImpl) filterChainUpdateValidator(fc *xdsresource.FilterChain) error {
+	if fc == nil {
+		return nil
+	}
+	return c.securityConfigUpdateValidator(fc.SecurityCfg)
+}
+
+func (c *clientImpl) securityConfigUpdateValidator(sc *xdsresource.SecurityConfig) error {
+	if sc == nil {
+		return nil
+	}
+	if sc.IdentityInstanceName != "" {
+		if _, ok := c.config.CertProviderConfigs[sc.IdentityInstanceName]; !ok {
+			return fmt.Errorf("identitiy certificate provider instance name %q missing in bootstrap configuration", sc.IdentityInstanceName)
+		}
+	}
+	if sc.RootInstanceName != "" {
+		if _, ok := c.config.CertProviderConfigs[sc.RootInstanceName]; !ok {
+			return fmt.Errorf("root certificate provider instance name %q missing in bootstrap configuration", sc.RootInstanceName)
+		}
+	}
+	return nil
+}
+
+func (c *clientImpl) updateValidator(u interface{}) error {
+	switch update := u.(type) {
+	case xdsresource.ListenerUpdate:
+		if update.InboundListenerCfg == nil || update.InboundListenerCfg.FilterChains == nil {
+			return nil
+		}
+		return update.InboundListenerCfg.FilterChains.Validate(c.filterChainUpdateValidator)
+	case xdsresource.ClusterUpdate:
+		return c.securityConfigUpdateValidator(update.SecurityCfg)
+	default:
+		// We currently invoke this update validation function only for LDS and
+		// CDS updates. In the future, if we wish to invoke it for other xDS
+		// updates, corresponding plumbing needs to be added to those unmarshal
+		// functions.
+	}
+	return nil
+}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/watchers.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_watchers.go
similarity index 100%
rename from vendor/google.golang.org/grpc/xds/internal/xdsclient/watchers.go
rename to vendor/google.golang.org/grpc/xds/internal/xdsclient/clientimpl_watchers.go
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller.go
deleted file mode 100644
index 431a14498e1f..000000000000
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller.go
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- *
- * Copyright 2021 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package xdsclient
-
-import (
-	"google.golang.org/grpc/internal/grpclog"
-	"google.golang.org/grpc/xds/internal/xdsclient/bootstrap"
-	"google.golang.org/grpc/xds/internal/xdsclient/controller"
-	"google.golang.org/grpc/xds/internal/xdsclient/load"
-	"google.golang.org/grpc/xds/internal/xdsclient/pubsub"
-	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource"
-)
-
-type controllerInterface interface {
-	AddWatch(resourceType xdsresource.ResourceType, resourceName string)
-	RemoveWatch(resourceType xdsresource.ResourceType, resourceName string)
-	ReportLoad(server string) (*load.Store, func())
-	Close()
-}
-
-var newController = func(config *bootstrap.ServerConfig, pubsub *pubsub.Pubsub, validator xdsresource.UpdateValidatorFunc, logger *grpclog.PrefixLogger) (controllerInterface, error) {
-	return controller.New(config, pubsub, validator, logger)
-}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/controller.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/controller.go
index 3f7371ae63c7..4b07dc8d6ac5 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/controller.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/controller.go
@@ -72,7 +72,7 @@ type Controller struct {
 	watchMap map[xdsresource.ResourceType]map[string]bool
 	// versionMap contains the version that was acked (the version in the ack
 	// request that was sent on wire). The key is rType, the value is the
-	// version string, becaues the versions for different resource types should
+	// version string, because the versions for different resource types should
 	// be independent.
 	versionMap map[xdsresource.ResourceType]string
 	// nonceMap contains the nonce from the most recent received response.
@@ -100,7 +100,7 @@ func SetGRPCDial(dialer func(target string, opts ...grpc.DialOption) (*grpc.Clie
 }
 
 // New creates a new controller.
-func New(config *bootstrap.ServerConfig, updateHandler pubsub.UpdateHandler, validator xdsresource.UpdateValidatorFunc, logger *grpclog.PrefixLogger) (_ *Controller, retErr error) {
+func New(config *bootstrap.ServerConfig, updateHandler pubsub.UpdateHandler, validator xdsresource.UpdateValidatorFunc, logger *grpclog.PrefixLogger, boff func(int) time.Duration) (_ *Controller, retErr error) {
 	switch {
 	case config == nil:
 		return nil, errors.New("xds: no xds_server provided")
@@ -120,12 +120,15 @@ func New(config *bootstrap.ServerConfig, updateHandler pubsub.UpdateHandler, val
 		}),
 	}
 
+	if boff == nil {
+		boff = backoff.DefaultExponential.Backoff
+	}
 	ret := &Controller{
 		config:          config,
 		updateValidator: validator,
 		updateHandler:   updateHandler,
 
-		backoff:    backoff.DefaultExponential.Backoff, // TODO: should this be configurable?
+		backoff:    boff,
 		streamCh:   make(chan grpc.ClientStream, 1),
 		sendCh:     buffer.NewUnbounded(),
 		watchMap:   make(map[xdsresource.ResourceType]map[string]bool),
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/transport.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/transport.go
index 0b982b0d7057..28641dc874a4 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/transport.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/transport.go
@@ -59,26 +59,21 @@ func (t *Controller) run(ctx context.Context) {
 	// report error (and log) when stats is transient failure.
 
 	retries := 0
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		default:
-		}
-
-		if retries != 0 {
-			timer := time.NewTimer(t.backoff(retries))
+	lastStreamStartTime := time.Time{}
+	for ctx.Err() == nil {
+		dur := time.Until(lastStreamStartTime.Add(t.backoff(retries)))
+		if dur > 0 {
+			timer := time.NewTimer(dur)
 			select {
 			case <-timer.C:
 			case <-ctx.Done():
-				if !timer.Stop() {
-					<-timer.C
-				}
+				timer.Stop()
 				return
 			}
 		}
 
 		retries++
+		lastStreamStartTime = time.Now()
 		stream, err := t.vClient.NewStream(ctx, t.cc)
 		if err != nil {
 			t.updateHandler.NewConnectionError(err)
@@ -104,10 +99,10 @@ func (t *Controller) run(ctx context.Context) {
 // new requests to send on the stream.
 //
 // For each new request (watchAction), it's
-//  - processed and added to the watch map
-//    - so resend will pick them up when there are new streams
-//  - sent on the current stream if there's one
-//    - the current stream is cleared when any send on it fails
+//   - processed and added to the watch map
+//     so, resend will pick them up when there are new streams
+//   - sent on the current stream if there's one
+//     the current stream is cleared when any send on it fails
 //
 // For each new stream, all the existing requests will be resent.
 //
@@ -171,12 +166,20 @@ func (t *Controller) sendExisting(stream grpc.ClientStream) bool {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
-	// Reset the ack versions when the stream restarts.
-	t.versionMap = make(map[xdsresource.ResourceType]string)
+	// Reset only the nonce when the stream restarts.
+	//
+	// xDS spec says the following. See section:
+	// https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol#ack-nack-and-resource-type-instance-version
+	//
+	// Note that the version for a resource type is not a property of an
+	// individual xDS stream but rather a property of the resources themselves. If
+	// the stream becomes broken and the client creates a new stream, the client’s
+	// initial request on the new stream should indicate the most recent version
+	// seen by the client on the previous stream
 	t.nonceMap = make(map[xdsresource.ResourceType]string)
 
 	for rType, s := range t.watchMap {
-		if err := t.vClient.SendRequest(stream, mapToSlice(s), rType, "", "", ""); err != nil {
+		if err := t.vClient.SendRequest(stream, mapToSlice(s), rType, t.versionMap[rType], "", ""); err != nil {
 			t.logger.Warningf("ADS request failed: %v", err)
 			return false
 		}
@@ -188,17 +191,17 @@ func (t *Controller) sendExisting(stream grpc.ClientStream) bool {
 // recv receives xDS responses on the provided ADS stream and branches out to
 // message specific handlers.
 func (t *Controller) recv(stream grpc.ClientStream) bool {
-	success := false
+	msgReceived := false
 	for {
 		resp, err := t.vClient.RecvResponse(stream)
 		if err != nil {
 			t.updateHandler.NewConnectionError(err)
 			t.logger.Warningf("ADS stream is closed with error: %v", err)
-			return success
+			return msgReceived
 		}
+		msgReceived = true
 
 		rType, version, nonce, err := t.handleResponse(resp)
-
 		if e, ok := err.(xdsresourceversion.ErrResourceTypeUnsupported); ok {
 			t.logger.Warningf("%s", e.ErrStr)
 			continue
@@ -221,7 +224,6 @@ func (t *Controller) recv(stream grpc.ClientStream) bool {
 			stream:  stream,
 		})
 		t.logger.Infof("Sending ACK for response type: %v, version: %v, nonce: %v", rType, version, nonce)
-		success = true
 	}
 }
 
@@ -302,8 +304,8 @@ func (t *Controller) processWatchInfo(w *watchAction) (target []string, rType xd
 	rType = w.rType
 	target = mapToSlice(current)
 	// We don't reset version or nonce when a new watch is started. The version
-	// and nonce from previous response are carried by the request unless the
-	// stream is recreated.
+	// and nonce from previous response are carried by the request. Only the nonce
+	// is reset when the stream is recreated.
 	ver = t.versionMap[rType]
 	nonce = t.nonceMap[rType]
 	return target, rType, ver, nonce
@@ -371,44 +373,48 @@ func (t *Controller) processAckInfo(ack *ackAction, stream grpc.ClientStream) (t
 // It blocks until the context is cancelled.
 func (t *Controller) reportLoad(ctx context.Context, cc *grpc.ClientConn, opts controllerversion.LoadReportingOptions) {
 	retries := 0
-	for {
-		if ctx.Err() != nil {
-			return
-		}
-
-		if retries != 0 {
-			timer := time.NewTimer(t.backoff(retries))
+	lastStreamStartTime := time.Time{}
+	for ctx.Err() == nil {
+		dur := time.Until(lastStreamStartTime.Add(t.backoff(retries)))
+		if dur > 0 {
+			timer := time.NewTimer(dur)
 			select {
 			case <-timer.C:
 			case <-ctx.Done():
-				if !timer.Stop() {
-					<-timer.C
-				}
+				timer.Stop()
 				return
 			}
 		}
 
 		retries++
-		stream, err := t.vClient.NewLoadStatsStream(ctx, cc)
-		if err != nil {
-			t.logger.Warningf("lrs: failed to create stream: %v", err)
-			continue
-		}
-		t.logger.Infof("lrs: created LRS stream")
+		lastStreamStartTime = time.Now()
+		func() {
+			// streamCtx is created and canceled in case we terminate the stream
+			// early for any reason, to avoid gRPC-Go leaking the RPC's monitoring
+			// goroutine.
+			streamCtx, cancel := context.WithCancel(ctx)
+			defer cancel()
+			stream, err := t.vClient.NewLoadStatsStream(streamCtx, cc)
+			if err != nil {
+				t.logger.Warningf("lrs: failed to create stream: %v", err)
+				return
+			}
+			t.logger.Infof("lrs: created LRS stream")
 
-		if err := t.vClient.SendFirstLoadStatsRequest(stream); err != nil {
-			t.logger.Warningf("lrs: failed to send first request: %v", err)
-			continue
-		}
+			if err := t.vClient.SendFirstLoadStatsRequest(stream); err != nil {
+				t.logger.Warningf("lrs: failed to send first request: %v", err)
+				return
+			}
 
-		clusters, interval, err := t.vClient.HandleLoadStatsResponse(stream)
-		if err != nil {
-			t.logger.Warningf("%v", err)
-			continue
-		}
+			clusters, interval, err := t.vClient.HandleLoadStatsResponse(stream)
+			if err != nil {
+				t.logger.Warningf("lrs: error from stream: %v", err)
+				return
+			}
 
-		retries = 0
-		t.sendLoads(ctx, stream, opts.LoadStore, clusters, interval)
+			retries = 0
+			t.sendLoads(streamCtx, stream, opts.LoadStore, clusters, interval)
+		}()
 	}
 }
 
@@ -422,7 +428,7 @@ func (t *Controller) sendLoads(ctx context.Context, stream grpc.ClientStream, st
 			return
 		}
 		if err := t.vClient.SendLoadStatsRequest(stream, store.Stats(clusterNames)); err != nil {
-			t.logger.Warningf("%v", err)
+			t.logger.Warningf("lrs: error from stream: %v", err)
 			return
 		}
 	}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v2/loadreport.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v2/loadreport.go
index f0034e21c353..da5128ac456e 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v2/loadreport.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v2/loadreport.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"time"
 
 	"github.com/golang/protobuf/proto"
@@ -59,7 +60,11 @@ func (v2c *client) SendFirstLoadStatsRequest(s grpc.ClientStream) error {
 
 	req := &lrspb.LoadStatsRequest{Node: node}
 	v2c.logger.Infof("lrs: sending init LoadStatsRequest: %v", pretty.ToJSON(req))
-	return stream.Send(req)
+	err := stream.Send(req)
+	if err == io.EOF {
+		return getStreamError(stream)
+	}
+	return err
 }
 
 func (v2c *client) HandleLoadStatsResponse(s grpc.ClientStream) ([]string, time.Duration, error) {
@@ -149,5 +154,17 @@ func (v2c *client) SendLoadStatsRequest(s grpc.ClientStream, loads []*load.Data)
 
 	req := &lrspb.LoadStatsRequest{ClusterStats: clusterStats}
 	v2c.logger.Infof("lrs: sending LRS loads: %+v", pretty.ToJSON(req))
-	return stream.Send(req)
+	err := stream.Send(req)
+	if err == io.EOF {
+		return getStreamError(stream)
+	}
+	return err
+}
+
+func getStreamError(stream lrsStream) error {
+	for {
+		if _, err := stream.Recv(); err != nil {
+			return err
+		}
+	}
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v3/loadreport.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v3/loadreport.go
index 8cdb5476fbbd..f8d866bb1a59 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v3/loadreport.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/controller/version/v3/loadreport.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"time"
 
 	"github.com/golang/protobuf/proto"
@@ -59,7 +60,11 @@ func (v3c *client) SendFirstLoadStatsRequest(s grpc.ClientStream) error {
 
 	req := &lrspb.LoadStatsRequest{Node: node}
 	v3c.logger.Infof("lrs: sending init LoadStatsRequest: %v", pretty.ToJSON(req))
-	return stream.Send(req)
+	err := stream.Send(req)
+	if err == io.EOF {
+		return getStreamError(stream)
+	}
+	return err
 }
 
 func (v3c *client) HandleLoadStatsResponse(s grpc.ClientStream) ([]string, time.Duration, error) {
@@ -148,5 +153,17 @@ func (v3c *client) SendLoadStatsRequest(s grpc.ClientStream, loads []*load.Data)
 
 	req := &lrspb.LoadStatsRequest{ClusterStats: clusterStats}
 	v3c.logger.Infof("lrs: sending LRS loads: %+v", pretty.ToJSON(req))
-	return stream.Send(req)
+	err := stream.Send(req)
+	if err == io.EOF {
+		return getStreamError(stream)
+	}
+	return err
+}
+
+func getStreamError(stream lrsStream) error {
+	for {
+		if _, err := stream.Recv(); err != nil {
+			return err
+		}
+	}
 }
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/pubsub.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/pubsub.go
index a843fd5f191f..95e8ac77300e 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/pubsub.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/pubsub.go
@@ -41,6 +41,7 @@ type Pubsub struct {
 	done               *grpcsync.Event
 	logger             *grpclog.PrefixLogger
 	watchExpiryTimeout time.Duration
+	nodeID             string
 
 	updateCh *buffer.Unbounded // chan *watcherInfoWithUpdate
 	// All the following maps are to keep the updates/metadata in a cache.
@@ -60,11 +61,14 @@ type Pubsub struct {
 }
 
 // New creates a new Pubsub.
-func New(watchExpiryTimeout time.Duration, logger *grpclog.PrefixLogger) *Pubsub {
+//
+// The passed in nodeID will be attached to all errors sent to the watchers.
+func New(watchExpiryTimeout time.Duration, nodeID string, logger *grpclog.PrefixLogger) *Pubsub {
 	pb := &Pubsub{
 		done:               grpcsync.NewEvent(),
 		logger:             logger,
 		watchExpiryTimeout: watchExpiryTimeout,
+		nodeID:             nodeID,
 
 		updateCh:    buffer.NewUnbounded(),
 		ldsWatchers: make(map[string]map[*watchInfo]bool),
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/update.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/update.go
index 371405b67972..9ae6ae976712 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/update.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/update.go
@@ -232,7 +232,7 @@ func (pb *Pubsub) NewClusters(updates map[string]xdsresource.ClusterUpdateErrTup
 			// from cache, and also send an resource not found error to indicate
 			// resource removed.
 			delete(pb.cdsCache, name)
-			pb.ldsMD[name] = xdsresource.UpdateMetadata{Status: xdsresource.ServiceStatusNotExist}
+			pb.cdsMD[name] = xdsresource.UpdateMetadata{Status: xdsresource.ServiceStatusNotExist}
 			for wi := range pb.cdsWatchers[name] {
 				wi.resourceNotFound()
 			}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/watch.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/watch.go
index 0baa683175dd..bef179936a89 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/watch.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/pubsub/watch.go
@@ -100,9 +100,7 @@ func (wi *watchInfo) timeout() {
 
 // Caller must hold wi.mu.
 func (wi *watchInfo) sendErrorLocked(err error) {
-	var (
-		u interface{}
-	)
+	var u interface{}
 	switch wi.rType {
 	case xdsresource.ListenerResource:
 		u = xdsresource.ListenerUpdate{}
@@ -113,6 +111,15 @@ func (wi *watchInfo) sendErrorLocked(err error) {
 	case xdsresource.EndpointsResource:
 		u = xdsresource.EndpointsUpdate{}
 	}
+
+	errMsg := err.Error()
+	errTyp := xdsresource.ErrType(err)
+	if errTyp == xdsresource.ErrorTypeUnknown {
+		err = fmt.Errorf("%v, xDS client nodeID: %s", errMsg, wi.c.nodeID)
+	} else {
+		err = xdsresource.NewErrorf(errTyp, "%v, xDS client nodeID: %s", errMsg, wi.c.nodeID)
+	}
+
 	wi.c.scheduleCallback(wi, u, err)
 }
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/singleton.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/singleton.go
index f4951ba8f488..c07dd4323f76 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/singleton.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/singleton.go
@@ -19,8 +19,6 @@
 package xdsclient
 
 import (
-	"bytes"
-	"encoding/json"
 	"fmt"
 	"sync"
 	"time"
@@ -34,7 +32,7 @@ const (
 )
 
 var (
-	// This is the Client returned by New(). It contains one client implementation,
+	// This is the client returned by New(). It contains one client implementation,
 	// and maintains the refcount.
 	singletonClient = &clientRefCounted{}
 
@@ -63,55 +61,6 @@ func (o *onceClosingClient) Close() {
 	o.once.Do(o.XDSClient.Close)
 }
 
-// clientRefCounted is ref-counted, and to be shared by the xds resolver and
-// balancer implementations, across multiple ClientConns and Servers.
-type clientRefCounted struct {
-	*clientImpl
-
-	// This mu protects all the fields, including the embedded clientImpl above.
-	mu       sync.Mutex
-	refCount int
-}
-
-// New returns a new xdsClient configured by the bootstrap file specified in env
-// variable GRPC_XDS_BOOTSTRAP or GRPC_XDS_BOOTSTRAP_CONFIG.
-//
-// The returned xdsClient is a singleton. This function creates the xds client
-// if it doesn't already exist.
-//
-// Note that the first invocation of New() or NewWithConfig() sets the client
-// singleton. The following calls will return the singleton xds client without
-// checking or using the config.
-func New() (XDSClient, error) {
-	// This cannot just return newRefCounted(), because in error cases, the
-	// returned nil is a typed nil (*clientRefCounted), which may cause nil
-	// checks fail.
-	c, err := newRefCounted()
-	if err != nil {
-		return nil, err
-	}
-	return c, nil
-}
-
-func newRefCounted() (XDSClient, error) {
-	return newRefCountedWithConfig(nil)
-}
-
-// NewWithConfig returns a new xdsClient configured by the given config.
-//
-// The returned xdsClient is a singleton. This function creates the xds client
-// if it doesn't already exist.
-//
-// Note that the first invocation of New() or NewWithConfig() sets the client
-// singleton. The following calls will return the singleton xds client without
-// checking or using the config.
-//
-// This function is internal only, for c2p resolver and testing to use. DO NOT
-// use this elsewhere. Use New() instead.
-func NewWithConfig(config *bootstrap.Config) (XDSClient, error) {
-	return newRefCountedWithConfig(config)
-}
-
 func newRefCountedWithConfig(config *bootstrap.Config) (XDSClient, error) {
 	singletonClient.mu.Lock()
 	defer singletonClient.mu.Unlock()
@@ -144,6 +93,16 @@ func newRefCountedWithConfig(config *bootstrap.Config) (XDSClient, error) {
 	return &onceClosingClient{XDSClient: singletonClient}, nil
 }
 
+// clientRefCounted is ref-counted, and to be shared by the xds resolver and
+// balancer implementations, across multiple ClientConns and Servers.
+type clientRefCounted struct {
+	*clientImpl
+
+	// This mu protects all the fields, including the embedded clientImpl above.
+	mu       sync.Mutex
+	refCount int
+}
+
 // Close closes the client. It does ref count of the xds client implementation,
 // and closes the gRPC connection to the management server when ref count
 // reaches 0.
@@ -159,62 +118,3 @@ func (c *clientRefCounted) Close() {
 		singletonClientImplCloseHook()
 	}
 }
-
-// NewWithConfigForTesting returns an xdsClient for the specified bootstrap
-// config, separate from the global singleton.
-//
-// This should be used for testing purposes only.
-func NewWithConfigForTesting(config *bootstrap.Config, watchExpiryTimeout time.Duration) (XDSClient, error) {
-	cl, err := newWithConfig(config, watchExpiryTimeout, defaultIdleAuthorityDeleteTimeout)
-	if err != nil {
-		return nil, err
-	}
-	return &clientRefCounted{clientImpl: cl, refCount: 1}, nil
-}
-
-// NewWithBootstrapContentsForTesting returns an xdsClient for this config,
-// separate from the global singleton.
-//
-// This should be used for testing purposes only.
-func NewWithBootstrapContentsForTesting(contents []byte) (XDSClient, error) {
-	// Normalize the contents
-	buf := bytes.Buffer{}
-	err := json.Indent(&buf, contents, "", "")
-	if err != nil {
-		return nil, fmt.Errorf("xds: error normalizing JSON: %v", err)
-	}
-	contents = bytes.TrimSpace(buf.Bytes())
-
-	clientsMu.Lock()
-	defer clientsMu.Unlock()
-	if c := clients[string(contents)]; c != nil {
-		c.mu.Lock()
-		// Since we don't remove the *Client from the map when it is closed, we
-		// need to recreate the impl if the ref count dropped to zero.
-		if c.refCount > 0 {
-			c.refCount++
-			c.mu.Unlock()
-			return c, nil
-		}
-		c.mu.Unlock()
-	}
-
-	bcfg, err := bootstrap.NewConfigFromContentsForTesting(contents)
-	if err != nil {
-		return nil, fmt.Errorf("xds: error with bootstrap config: %v", err)
-	}
-
-	cImpl, err := newWithConfig(bcfg, defaultWatchExpiryTimeout, defaultIdleAuthorityDeleteTimeout)
-	if err != nil {
-		return nil, err
-	}
-
-	c := &clientRefCounted{clientImpl: cImpl, refCount: 1}
-	clients[string(contents)] = c
-	return c, nil
-}
-
-var (
-	clients   = map[string]*clientRefCounted{}
-	clientsMu sync.Mutex
-)
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/name.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/name.go
index eb1ee323cee9..80c0efd37b39 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/name.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/name.go
@@ -119,7 +119,7 @@ func (n *Name) String() string {
 
 	path := n.Type
 	if n.ID != "" {
-		path = path + "/" + n.ID
+		path = "/" + path + "/" + n.ID
 	}
 
 	tempURL := &url.URL{
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type.go
index c64f7c609c62..faf34f98e3c7 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type.go
@@ -20,6 +20,8 @@ package xdsresource
 import (
 	"time"
 
+	v3discoverypb "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	"github.com/golang/protobuf/proto"
 	"google.golang.org/grpc/xds/internal/xdsclient/xdsresource/version"
 	"google.golang.org/protobuf/types/known/anypb"
 )
@@ -76,6 +78,21 @@ func IsEndpointsResource(url string) bool {
 	return url == version.V2EndpointsURL || url == version.V3EndpointsURL
 }
 
+// unwrapResource unwraps and returns the inner resource if it's in a resource
+// wrapper. The original resource is returned if it's not wrapped.
+func unwrapResource(r *anypb.Any) (*anypb.Any, error) {
+	url := r.GetTypeUrl()
+	if url != version.V2ResourceWrapperURL && url != version.V3ResourceWrapperURL {
+		// Not wrapped.
+		return r, nil
+	}
+	inner := &v3discoverypb.Resource{}
+	if err := proto.Unmarshal(r.GetValue(), inner); err != nil {
+		return nil, err
+	}
+	return inner.Resource, nil
+}
+
 // ServiceStatus is the status of the update.
 type ServiceStatus int
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_cds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_cds.go
index b61a80b429c4..d459717acd23 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_cds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_cds.go
@@ -76,7 +76,7 @@ type OutlierDetection struct {
 	// ejected due to outlier detection. Defaults to 10% but will eject at least
 	// one host regardless of the value.
 	MaxEjectionPercent uint32
-	// SuccessRateStddevFactor is used to determine the ejection threshold for
+	// SuccessRateStdevFactor is used to determine the ejection threshold for
 	// success rate outlier ejection. The ejection threshold is the difference
 	// between the mean success rate, and the product of this factor and the
 	// standard deviation of the mean success rate: mean - (stdev *
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_eds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_eds.go
index ad590160f6af..ec70f32ca436 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_eds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_eds.go
@@ -64,7 +64,10 @@ type Locality struct {
 
 // EndpointsUpdate contains an EDS update.
 type EndpointsUpdate struct {
-	Drops      []OverloadDropConfig
+	Drops []OverloadDropConfig
+	// Localities in the EDS response with `load_balancing_weight` field not set
+	// or explicitly set to 0 are ignored while parsing the resource, and
+	// therefore do not show up here.
 	Localities []Locality
 
 	// Raw is the resource from the xds response.
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_rds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_rds.go
index decffd4ae767..0504346c399f 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_rds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/type_rds.go
@@ -80,7 +80,7 @@ const (
 	// HashPolicyTypeHeader specifies to hash a Header in the incoming request.
 	HashPolicyTypeHeader HashPolicyType = iota
 	// HashPolicyTypeChannelID specifies to hash a unique Identifier of the
-	// Channel. In grpc-go, this will be done using the ClientConn pointer.
+	// Channel. This is a 64-bit random int computed at initialization time.
 	HashPolicyTypeChannelID
 )
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_cds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_cds.go
index eba78716eebd..3621d61209a0 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_cds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_cds.go
@@ -51,6 +51,11 @@ func UnmarshalCluster(opts *UnmarshalOptions) (map[string]ClusterUpdateErrTuple,
 }
 
 func unmarshalClusterResource(r *anypb.Any, f UpdateValidatorFunc, logger *grpclog.PrefixLogger) (string, ClusterUpdate, error) {
+	r, err := unwrapResource(r)
+	if err != nil {
+		return "", ClusterUpdate{}, fmt.Errorf("failed to unwrap resource: %v", err)
+	}
+
 	if !IsClusterResource(r.GetTypeUrl()) {
 		return "", ClusterUpdate{}, fmt.Errorf("unexpected resource type: %q ", r.GetTypeUrl())
 	}
@@ -150,7 +155,14 @@ func validateClusterAndConstructClusterUpdate(cluster *v3clusterpb.Cluster) (Clu
 	// xdsclient bootstrap information now (can be added if necessary). The
 	// ServerConfig will be read and populated by the CDS balancer when
 	// processing this field.
-	if cluster.GetLrsServer().GetSelf() != nil {
+	// According to A27:
+	// If the `lrs_server` field is set, it must have its `self` field set, in
+	// which case the client should use LRS for load reporting. Otherwise
+	// (the `lrs_server` field is not set), LRS load reporting will be disabled.
+	if lrs := cluster.GetLrsServer(); lrs != nil {
+		if lrs.GetSelf() == nil {
+			return ClusterUpdate{}, fmt.Errorf("unsupported config_source_specifier %T in lrs_server field", lrs.ConfigSourceSpecifier)
+		}
 		ret.LRSServerConfig = ClusterLRSServerSelf
 	}
 
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_eds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_eds.go
index f1774dedae43..7d4b89dc9dc1 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_eds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_eds.go
@@ -42,6 +42,11 @@ func UnmarshalEndpoints(opts *UnmarshalOptions) (map[string]EndpointsUpdateErrTu
 }
 
 func unmarshalEndpointsResource(r *anypb.Any, logger *grpclog.PrefixLogger) (string, EndpointsUpdate, error) {
+	r, err := unwrapResource(r)
+	if err != nil {
+		return "", EndpointsUpdate{}, fmt.Errorf("failed to unwrap resource: %v", err)
+	}
+
 	if !IsEndpointsResource(r.GetTypeUrl()) {
 		return "", EndpointsUpdate{}, fmt.Errorf("unexpected resource type: %q ", r.GetTypeUrl())
 	}
@@ -52,7 +57,7 @@ func unmarshalEndpointsResource(r *anypb.Any, logger *grpclog.PrefixLogger) (str
 	}
 	logger.Infof("Resource with name: %v, type: %T, contains: %v", cla.GetClusterName(), cla, pretty.ToJSON(cla))
 
-	u, err := parseEDSRespProto(cla)
+	u, err := parseEDSRespProto(cla, logger)
 	if err != nil {
 		return cla.GetClusterName(), EndpointsUpdate{}, err
 	}
@@ -85,39 +90,67 @@ func parseDropPolicy(dropPolicy *v3endpointpb.ClusterLoadAssignment_Policy_DropO
 	}
 }
 
-func parseEndpoints(lbEndpoints []*v3endpointpb.LbEndpoint) []Endpoint {
+func parseEndpoints(lbEndpoints []*v3endpointpb.LbEndpoint) ([]Endpoint, error) {
 	endpoints := make([]Endpoint, 0, len(lbEndpoints))
 	for _, lbEndpoint := range lbEndpoints {
+		// If the load_balancing_weight field is specified, it must be set to a
+		// value of at least 1.  If unspecified, each host is presumed to have
+		// equal weight in a locality.
+		weight := uint32(1)
+		if w := lbEndpoint.GetLoadBalancingWeight(); w != nil {
+			if w.GetValue() == 0 {
+				return nil, fmt.Errorf("EDS response contains an endpoint with zero weight: %+v", lbEndpoint)
+			}
+			weight = w.GetValue()
+		}
 		endpoints = append(endpoints, Endpoint{
 			HealthStatus: EndpointHealthStatus(lbEndpoint.GetHealthStatus()),
 			Address:      parseAddress(lbEndpoint.GetEndpoint().GetAddress().GetSocketAddress()),
-			Weight:       lbEndpoint.GetLoadBalancingWeight().GetValue(),
+			Weight:       weight,
 		})
 	}
-	return endpoints
+	return endpoints, nil
 }
 
-func parseEDSRespProto(m *v3endpointpb.ClusterLoadAssignment) (EndpointsUpdate, error) {
+func parseEDSRespProto(m *v3endpointpb.ClusterLoadAssignment, logger *grpclog.PrefixLogger) (EndpointsUpdate, error) {
 	ret := EndpointsUpdate{}
 	for _, dropPolicy := range m.GetPolicy().GetDropOverloads() {
 		ret.Drops = append(ret.Drops, parseDropPolicy(dropPolicy))
 	}
-	priorities := make(map[uint32]struct{})
+	priorities := make(map[uint32]map[string]bool)
 	for _, locality := range m.Endpoints {
 		l := locality.GetLocality()
 		if l == nil {
 			return EndpointsUpdate{}, fmt.Errorf("EDS response contains a locality without ID, locality: %+v", locality)
 		}
+		weight := locality.GetLoadBalancingWeight().GetValue()
+		if weight == 0 {
+			logger.Warningf("Ignoring locality %s with weight 0", pretty.ToJSON(l))
+			continue
+		}
 		lid := internal.LocalityID{
 			Region:  l.Region,
 			Zone:    l.Zone,
 			SubZone: l.SubZone,
 		}
 		priority := locality.GetPriority()
-		priorities[priority] = struct{}{}
+		localitiesWithPriority := priorities[priority]
+		if localitiesWithPriority == nil {
+			localitiesWithPriority = make(map[string]bool)
+			priorities[priority] = localitiesWithPriority
+		}
+		lidStr, _ := lid.ToString()
+		if localitiesWithPriority[lidStr] {
+			return EndpointsUpdate{}, fmt.Errorf("duplicate locality %s with the same priority %v", lidStr, priority)
+		}
+		localitiesWithPriority[lidStr] = true
+		endpoints, err := parseEndpoints(locality.GetLbEndpoints())
+		if err != nil {
+			return EndpointsUpdate{}, err
+		}
 		ret.Localities = append(ret.Localities, Locality{
 			ID:        lid,
-			Endpoints: parseEndpoints(locality.GetLbEndpoints()),
+			Endpoints: endpoints,
 			Weight:    locality.GetLoadBalancingWeight().GetValue(),
 			Priority:  priority,
 		})
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_lds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_lds.go
index b259c7b87e4c..2e59c0605c9b 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_lds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_lds.go
@@ -46,6 +46,11 @@ func UnmarshalListener(opts *UnmarshalOptions) (map[string]ListenerUpdateErrTupl
 }
 
 func unmarshalListenerResource(r *anypb.Any, f UpdateValidatorFunc, logger *grpclog.PrefixLogger) (string, ListenerUpdate, error) {
+	r, err := unwrapResource(r)
+	if err != nil {
+		return "", ListenerUpdate{}, fmt.Errorf("failed to unwrap resource: %v", err)
+	}
+
 	if !IsListenerResource(r.GetTypeUrl()) {
 		return "", ListenerUpdate{}, fmt.Errorf("unexpected resource type: %q ", r.GetTypeUrl())
 	}
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_rds.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_rds.go
index f43b18292f0c..32c48d46b691 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_rds.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/unmarshal_rds.go
@@ -46,6 +46,11 @@ func UnmarshalRouteConfig(opts *UnmarshalOptions) (map[string]RouteConfigUpdateE
 }
 
 func unmarshalRouteConfigResource(r *anypb.Any, logger *grpclog.PrefixLogger) (string, RouteConfigUpdate, error) {
+	r, err := unwrapResource(r)
+	if err != nil {
+		return "", RouteConfigUpdate{}, fmt.Errorf("failed to unwrap resource: %v", err)
+	}
+
 	if !IsRouteConfigResource(r.GetTypeUrl()) {
 		return "", RouteConfigUpdate{}, fmt.Errorf("unexpected resource type: %q ", r.GetTypeUrl())
 	}
@@ -142,6 +147,12 @@ func processClusterSpecifierPlugins(csps []*v3routepb.ClusterSpecifierPlugin) (m
 	for _, csp := range csps {
 		cs := clusterspecifier.Get(csp.GetExtension().GetTypedConfig().GetTypeUrl())
 		if cs == nil {
+			if csp.GetIsOptional() {
+				// "If a plugin is not supported but has is_optional set, then
+				// we will ignore any routes that point to that plugin"
+				cspCfgs[csp.GetExtension().GetName()] = nil
+				continue
+			}
 			// "If no plugin is registered for it, the resource will be NACKed."
 			// - RLS in xDS design
 			return nil, fmt.Errorf("cluster specifier %q of type %q was not found", csp.GetExtension().GetName(), csp.GetExtension().GetTypedConfig().GetTypeUrl())
@@ -349,11 +360,23 @@ func routesProtoToSlice(routes []*v3routepb.Route, csps map[string]clusterspecif
 				if totalWeight == 0 {
 					return nil, nil, fmt.Errorf("route %+v, action %+v, has no valid cluster in WeightedCluster action", r, a)
 				}
-			case *v3routepb.RouteAction_ClusterHeader:
-				continue
 			case *v3routepb.RouteAction_ClusterSpecifierPlugin:
+				// gRFC A28 was updated to say the following:
+				//
+				// The route’s action field must be route, and its
+				// cluster_specifier:
+				// - Can be Cluster
+				// - Can be Weighted_clusters
+				//   - The sum of weights must add up to the total_weight.
+				// - Can be unset or an unsupported field. The route containing
+				//   this action will be ignored.
+				//
+				// This means that if this env var is not set, we should treat
+				// it as if it we didn't know about the cluster_specifier_plugin
+				// at all.
 				if !envconfig.XDSRLS {
-					return nil, nil, fmt.Errorf("route %+v, has an unknown ClusterSpecifier: %+v", r, a)
+					logger.Infof("route %+v contains route_action with unsupported field: cluster_specifier_plugin, the route will be ignored", r)
+					continue
 				}
 				if _, ok := csps[a.ClusterSpecifierPlugin]; !ok {
 					// "When processing RouteActions, if any action includes a
@@ -362,10 +385,15 @@ func routesProtoToSlice(routes []*v3routepb.Route, csps map[string]clusterspecif
 					// resource will be NACKed." - RLS in xDS design
 					return nil, nil, fmt.Errorf("route %+v, action %+v, specifies a cluster specifier plugin %+v that is not in Route Configuration", r, a, a.ClusterSpecifierPlugin)
 				}
+				if csps[a.ClusterSpecifierPlugin] == nil {
+					logger.Infof("route %+v references optional and unsupported cluster specifier plugin %v, the route will be ignored", r, a.ClusterSpecifierPlugin)
+					continue
+				}
 				cspNames[a.ClusterSpecifierPlugin] = true
 				route.ClusterSpecifierPlugin = a.ClusterSpecifierPlugin
 			default:
-				return nil, nil, fmt.Errorf("route %+v, has an unknown ClusterSpecifier: %+v", r, a)
+				logger.Infof("route %+v references unknown ClusterSpecifier %+v, the route will be ignored", r, a)
+				continue
 			}
 
 			msd := action.GetMaxStreamDuration()
diff --git a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/version/version.go b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/version/version.go
index edfa68762f6e..2c4819abddc0 100644
--- a/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/version/version.go
+++ b/vendor/google.golang.org/grpc/xds/internal/xdsclient/xdsresource/version/version.go
@@ -42,6 +42,7 @@ const (
 	V2ClusterType     = "envoy.api.v2.Cluster"
 	V2EndpointsType   = "envoy.api.v2.ClusterLoadAssignment"
 
+	V2ResourceWrapperURL = googleapiPrefix + "envoy.api.v2.Resource"
 	V2ListenerURL        = googleapiPrefix + V2ListenerType
 	V2RouteConfigURL     = googleapiPrefix + V2RouteConfigType
 	V2ClusterURL         = googleapiPrefix + V2ClusterType
@@ -53,6 +54,7 @@ const (
 	V3ClusterType     = "envoy.config.cluster.v3.Cluster"
 	V3EndpointsType   = "envoy.config.endpoint.v3.ClusterLoadAssignment"
 
+	V3ResourceWrapperURL      = googleapiPrefix + "envoy.service.discovery.v3.Resource"
 	V3ListenerURL             = googleapiPrefix + V3ListenerType
 	V3RouteConfigURL          = googleapiPrefix + V3RouteConfigType
 	V3ClusterURL              = googleapiPrefix + V3ClusterType
diff --git a/vendor/google.golang.org/grpc/xds/server.go b/vendor/google.golang.org/grpc/xds/server.go
index 0319ddcaf533..5ab8a5a98008 100644
--- a/vendor/google.golang.org/grpc/xds/server.go
+++ b/vendor/google.golang.org/grpc/xds/server.go
@@ -105,10 +105,10 @@ func NewGRPCServer(opts ...grpc.ServerOption) *GRPCServer {
 	s := &GRPCServer{
 		gs:   newGRPCServer(newOpts...),
 		quit: grpcsync.NewEvent(),
-		opts: handleServerOptions(opts),
 	}
 	s.logger = prefixLogger(s)
 	s.logger.Infof("Created xds.GRPCServer")
+	s.handleServerOptions(opts)
 
 	// We type assert our underlying gRPC server to the real grpc.Server here
 	// before trying to retrieve the configured credentials. This approach
@@ -128,14 +128,35 @@ func NewGRPCServer(opts ...grpc.ServerOption) *GRPCServer {
 
 // handleServerOptions iterates through the list of server options passed in by
 // the user, and handles the xDS server specific options.
-func handleServerOptions(opts []grpc.ServerOption) *serverOptions {
-	so := &serverOptions{}
+func (s *GRPCServer) handleServerOptions(opts []grpc.ServerOption) {
+	so := s.defaultServerOptions()
 	for _, opt := range opts {
 		if o, ok := opt.(*serverOption); ok {
 			o.apply(so)
 		}
 	}
-	return so
+	s.opts = so
+}
+
+func (s *GRPCServer) defaultServerOptions() *serverOptions {
+	return &serverOptions{
+		// A default serving mode change callback which simply logs at the
+		// default-visible log level. This will be used if the application does not
+		// register a mode change callback.
+		//
+		// Note that this means that `s.opts.modeCallback` will never be nil and can
+		// safely be invoked directly from `handleServingModeChanges`.
+		modeCallback: s.loggingServerModeChangeCallback,
+	}
+}
+
+func (s *GRPCServer) loggingServerModeChangeCallback(addr net.Addr, args ServingModeChangeArgs) {
+	switch args.Mode {
+	case connectivity.ServingModeServing:
+		s.logger.Errorf("Listener %q entering mode: %q", addr.String(), args.Mode)
+	case connectivity.ServingModeNotServing:
+		s.logger.Errorf("Listener %q entering mode: %q due to error: %v", addr.String(), args.Mode, args.Err)
+	}
 }
 
 // RegisterService registers a service and its implementation to the underlying
@@ -291,12 +312,16 @@ func (s *GRPCServer) handleServingModeChanges(updateCh *buffer.Unbounded) {
 					drainServerTransports(gs, args.addr.String())
 				}
 			}
-			if s.opts.modeCallback != nil {
-				s.opts.modeCallback(args.addr, ServingModeChangeArgs{
-					Mode: args.mode,
-					Err:  args.err,
-				})
-			}
+
+			// The XdsServer API will allow applications to register a "serving state"
+			// callback to be invoked when the server begins serving and when the
+			// server encounters errors that force it to be "not serving". If "not
+			// serving", the callback must be provided error information, for
+			// debugging use by developers - A36.
+			s.opts.modeCallback(args.addr, ServingModeChangeArgs{
+				Mode: args.mode,
+				Err:  args.err,
+			})
 		}
 	}
 }
diff --git a/vendor/google.golang.org/grpc/xds/xds.go b/vendor/google.golang.org/grpc/xds/xds.go
index 744f3f139645..2fbce34663c0 100644
--- a/vendor/google.golang.org/grpc/xds/xds.go
+++ b/vendor/google.golang.org/grpc/xds/xds.go
@@ -32,16 +32,17 @@ import (
 
 	v3statusgrpc "github.com/envoyproxy/go-control-plane/envoy/service/status/v3"
 	"google.golang.org/grpc"
+	_ "google.golang.org/grpc/credentials/tls/certprovider/pemfile" // Register the file watcher certificate provider plugin.
+	"google.golang.org/grpc/internal"
 	internaladmin "google.golang.org/grpc/internal/admin"
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/xds/csds"
-
-	_ "google.golang.org/grpc/credentials/tls/certprovider/pemfile"         // Register the file watcher certificate provider plugin.
 	_ "google.golang.org/grpc/xds/internal/balancer"                        // Register the balancers.
+	_ "google.golang.org/grpc/xds/internal/clusterspecifier/rls"            // Register the RLS cluster specifier plugin. Note that this does not register the RLS LB policy.
 	_ "google.golang.org/grpc/xds/internal/httpfilter/fault"                // Register the fault injection filter.
 	_ "google.golang.org/grpc/xds/internal/httpfilter/rbac"                 // Register the RBAC filter.
 	_ "google.golang.org/grpc/xds/internal/httpfilter/router"               // Register the router filter.
-	xdsresolver "google.golang.org/grpc/xds/internal/resolver"              // Register the xds_resolver.
+	_ "google.golang.org/grpc/xds/internal/resolver"                        // Register the xds_resolver
 	_ "google.golang.org/grpc/xds/internal/xdsclient/controller/version/v2" // Register the v2 xDS API client.
 	_ "google.golang.org/grpc/xds/internal/xdsclient/controller/version/v3" // Register the v3 xDS API client.
 )
@@ -75,8 +76,8 @@ func init() {
 	})
 }
 
-// NewXDSResolverWithConfigForTesting creates a new xds resolver builder using
-// the provided xds bootstrap config instead of the global configuration from
+// NewXDSResolverWithConfigForTesting creates a new xDS resolver builder using
+// the provided xDS bootstrap config instead of the global configuration from
 // the supported environment variables.  The resolver.Builder is meant to be
 // used in conjunction with the grpc.WithResolvers DialOption.
 //
@@ -90,5 +91,5 @@ func init() {
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
 // later release.
 func NewXDSResolverWithConfigForTesting(bootstrapConfig []byte) (resolver.Builder, error) {
-	return xdsresolver.NewBuilderForTesting(bootstrapConfig)
+	return internal.NewXDSResolverWithConfigForTesting.(func([]byte) (resolver.Builder, error))(bootstrapConfig)
 }
diff --git a/vendor/gopkg.in/fsnotify.v1/.editorconfig b/vendor/gopkg.in/fsnotify.v1/.editorconfig
deleted file mode 100644
index ba49e3c23491..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/.editorconfig
+++ /dev/null
@@ -1,5 +0,0 @@
-root = true
-
-[*]
-indent_style = tab
-indent_size = 4
diff --git a/vendor/gopkg.in/fsnotify.v1/.gitignore b/vendor/gopkg.in/fsnotify.v1/.gitignore
deleted file mode 100644
index 4cd0cbaf432c..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-# Setup a Global .gitignore for OS and editor generated files:
-# https://help.github.com/articles/ignoring-files
-# git config --global core.excludesfile ~/.gitignore_global
-
-.vagrant
-*.sublime-project
diff --git a/vendor/gopkg.in/fsnotify.v1/.travis.yml b/vendor/gopkg.in/fsnotify.v1/.travis.yml
deleted file mode 100644
index 981d1bb8132d..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/.travis.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-sudo: false
-language: go
-
-go:
-  - 1.8.x
-  - 1.9.x
-  - tip
-
-matrix:
-  allow_failures:
-    - go: tip
-  fast_finish: true
-
-before_script:
-  - go get -u github.com/golang/lint/golint
-
-script:
-  - go test -v --race ./...
-
-after_script:
-  - test -z "$(gofmt -s -l -w . | tee /dev/stderr)"
-  - test -z "$(golint ./...     | tee /dev/stderr)"
-  - go vet ./...
-
-os:
-  - linux
-  - osx
-
-notifications:
-  email: false
diff --git a/vendor/gopkg.in/fsnotify.v1/AUTHORS b/vendor/gopkg.in/fsnotify.v1/AUTHORS
deleted file mode 100644
index 5ab5d41c5472..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/AUTHORS
+++ /dev/null
@@ -1,52 +0,0 @@
-# Names should be added to this file as
-#	Name or Organization <email address>
-# The email address is not required for organizations.
-
-# You can update this list using the following command:
-#
-#   $ git shortlog -se | awk '{print $2 " " $3 " " $4}'
-
-# Please keep the list sorted.
-
-Aaron L <aaron@bettercoder.net>
-Adrien Bustany <adrien@bustany.org>
-Amit Krishnan <amit.krishnan@oracle.com>
-Anmol Sethi <me@anmol.io>
-Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com>
-Bruno Bigras <bigras.bruno@gmail.com>
-Caleb Spare <cespare@gmail.com>
-Case Nelson <case@teammating.com>
-Chris Howey <chris@howey.me> <howeyc@gmail.com>
-Christoffer Buchholz <christoffer.buchholz@gmail.com>
-Daniel Wagner-Hall <dawagner@gmail.com>
-Dave Cheney <dave@cheney.net>
-Evan Phoenix <evan@fallingsnow.net>
-Francisco Souza <f@souza.cc>
-Hari haran <hariharan.uno@gmail.com>
-John C Barstow
-Kelvin Fo <vmirage@gmail.com>
-Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
-Matt Layher <mdlayher@gmail.com>
-Nathan Youngman <git@nathany.com>
-Nickolai Zeldovich <nickolai@csail.mit.edu>
-Patrick <patrick@dropbox.com>
-Paul Hammond <paul@paulhammond.org>
-Pawel Knap <pawelknap88@gmail.com>
-Pieter Droogendijk <pieter@binky.org.uk>
-Pursuit92 <JoshChase@techpursuit.net>
-Riku Voipio <riku.voipio@linaro.org>
-Rob Figueiredo <robfig@gmail.com>
-Rodrigo Chiossi <rodrigochiossi@gmail.com>
-Slawek Ligus <root@ooz.ie>
-Soge Zhang <zhssoge@gmail.com>
-Tiffany Jernigan <tiffany.jernigan@intel.com>
-Tilak Sharma <tilaks@google.com>
-Tom Payne <twpayne@gmail.com>
-Travis Cline <travis.cline@gmail.com>
-Tudor Golubenco <tudor.g@gmail.com>
-Vahe Khachikyan <vahe@live.ca>
-Yukang <moorekang@gmail.com>
-bronze1man <bronze1man@gmail.com>
-debrando <denis.brandolini@gmail.com>
-henrikedwards <henrik.edwards@gmail.com>
-铁哥 <guotie.9@gmail.com>
diff --git a/vendor/gopkg.in/fsnotify.v1/CHANGELOG.md b/vendor/gopkg.in/fsnotify.v1/CHANGELOG.md
deleted file mode 100644
index be4d7ea2c145..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/CHANGELOG.md
+++ /dev/null
@@ -1,317 +0,0 @@
-# Changelog
-
-## v1.4.7 / 2018-01-09
-
-* BSD/macOS: Fix possible deadlock on closing the watcher on kqueue (thanks @nhooyr and @glycerine)
-* Tests: Fix missing verb on format string (thanks @rchiossi)
-* Linux: Fix deadlock in Remove (thanks @aarondl)
-* Linux: Watch.Add improvements (avoid race, fix consistency, reduce garbage) (thanks @twpayne)
-* Docs: Moved FAQ into the README (thanks @vahe)
-* Linux: Properly handle inotify's IN_Q_OVERFLOW event (thanks @zeldovich)
-* Docs: replace references to OS X with macOS
-
-## v1.4.2 / 2016-10-10
-
-* Linux: use InotifyInit1 with IN_CLOEXEC to stop leaking a file descriptor to a child process when using fork/exec [#178](https://github.com/fsnotify/fsnotify/pull/178) (thanks @pattyshack)
-
-## v1.4.1 / 2016-10-04
-
-* Fix flaky inotify stress test on Linux [#177](https://github.com/fsnotify/fsnotify/pull/177) (thanks @pattyshack)
-
-## v1.4.0 / 2016-10-01
-
-* add a String() method to Event.Op [#165](https://github.com/fsnotify/fsnotify/pull/165) (thanks @oozie)
-
-## v1.3.1 / 2016-06-28
-
-* Windows: fix for double backslash when watching the root of a drive [#151](https://github.com/fsnotify/fsnotify/issues/151) (thanks @brunoqc)
-
-## v1.3.0 / 2016-04-19
-
-* Support linux/arm64 by [patching](https://go-review.googlesource.com/#/c/21971/) x/sys/unix and switching to to it from syscall (thanks @suihkulokki) [#135](https://github.com/fsnotify/fsnotify/pull/135)
-
-## v1.2.10 / 2016-03-02
-
-* Fix golint errors in windows.go [#121](https://github.com/fsnotify/fsnotify/pull/121) (thanks @tiffanyfj)
-
-## v1.2.9 / 2016-01-13
-
-kqueue: Fix logic for CREATE after REMOVE [#111](https://github.com/fsnotify/fsnotify/pull/111) (thanks @bep)
-
-## v1.2.8 / 2015-12-17
-
-* kqueue: fix race condition in Close [#105](https://github.com/fsnotify/fsnotify/pull/105) (thanks @djui for reporting the issue and @ppknap for writing a failing test)
-* inotify: fix race in test
-* enable race detection for continuous integration (Linux, Mac, Windows)
-
-## v1.2.5 / 2015-10-17
-
-* inotify: use epoll_create1 for arm64 support (requires Linux 2.6.27 or later) [#100](https://github.com/fsnotify/fsnotify/pull/100) (thanks @suihkulokki)
-* inotify: fix path leaks [#73](https://github.com/fsnotify/fsnotify/pull/73) (thanks @chamaken)
-* kqueue: watch for rename events on subdirectories [#83](https://github.com/fsnotify/fsnotify/pull/83) (thanks @guotie)
-* kqueue: avoid infinite loops from symlinks cycles [#101](https://github.com/fsnotify/fsnotify/pull/101) (thanks @illicitonion)
-
-## v1.2.1 / 2015-10-14
-
-* kqueue: don't watch named pipes [#98](https://github.com/fsnotify/fsnotify/pull/98) (thanks @evanphx)
-
-## v1.2.0 / 2015-02-08
-
-* inotify: use epoll to wake up readEvents [#66](https://github.com/fsnotify/fsnotify/pull/66) (thanks @PieterD)
-* inotify: closing watcher should now always shut down goroutine [#63](https://github.com/fsnotify/fsnotify/pull/63) (thanks @PieterD)
-* kqueue: close kqueue after removing watches, fixes [#59](https://github.com/fsnotify/fsnotify/issues/59)
-
-## v1.1.1 / 2015-02-05
-
-* inotify: Retry read on EINTR [#61](https://github.com/fsnotify/fsnotify/issues/61) (thanks @PieterD)
-
-## v1.1.0 / 2014-12-12
-
-* kqueue: rework internals [#43](https://github.com/fsnotify/fsnotify/pull/43)
-    * add low-level functions
-    * only need to store flags on directories
-    * less mutexes [#13](https://github.com/fsnotify/fsnotify/issues/13)
-    * done can be an unbuffered channel
-    * remove calls to os.NewSyscallError
-* More efficient string concatenation for Event.String() [#52](https://github.com/fsnotify/fsnotify/pull/52) (thanks @mdlayher)
-* kqueue: fix regression in  rework causing subdirectories to be watched [#48](https://github.com/fsnotify/fsnotify/issues/48)
-* kqueue: cleanup internal watch before sending remove event [#51](https://github.com/fsnotify/fsnotify/issues/51)
-
-## v1.0.4 / 2014-09-07
-
-* kqueue: add dragonfly to the build tags.
-* Rename source code files, rearrange code so exported APIs are at the top.
-* Add done channel to example code. [#37](https://github.com/fsnotify/fsnotify/pull/37) (thanks @chenyukang)
-
-## v1.0.3 / 2014-08-19
-
-* [Fix] Windows MOVED_TO now translates to Create like on BSD and Linux. [#36](https://github.com/fsnotify/fsnotify/issues/36)
-
-## v1.0.2 / 2014-08-17
-
-* [Fix] Missing create events on macOS. [#14](https://github.com/fsnotify/fsnotify/issues/14) (thanks @zhsso)
-* [Fix] Make ./path and path equivalent. (thanks @zhsso)
-
-## v1.0.0 / 2014-08-15
-
-* [API] Remove AddWatch on Windows, use Add.
-* Improve documentation for exported identifiers. [#30](https://github.com/fsnotify/fsnotify/issues/30)
-* Minor updates based on feedback from golint.
-
-## dev / 2014-07-09
-
-* Moved to [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify).
-* Use os.NewSyscallError instead of returning errno (thanks @hariharan-uno)
-
-## dev / 2014-07-04
-
-* kqueue: fix incorrect mutex used in Close()
-* Update example to demonstrate usage of Op.
-
-## dev / 2014-06-28
-
-* [API] Don't set the Write Op for attribute notifications [#4](https://github.com/fsnotify/fsnotify/issues/4)
-* Fix for String() method on Event (thanks Alex Brainman)
-* Don't build on Plan 9 or Solaris (thanks @4ad)
-
-## dev / 2014-06-21
-
-* Events channel of type Event rather than *Event.
-* [internal] use syscall constants directly for inotify and kqueue.
-* [internal] kqueue: rename events to kevents and fileEvent to event.
-
-## dev / 2014-06-19
-
-* Go 1.3+ required on Windows (uses syscall.ERROR_MORE_DATA internally).
-* [internal] remove cookie from Event struct (unused).
-* [internal] Event struct has the same definition across every OS.
-* [internal] remove internal watch and removeWatch methods.
-
-## dev / 2014-06-12
-
-* [API] Renamed Watch() to Add() and RemoveWatch() to Remove().
-* [API] Pluralized channel names: Events and Errors.
-* [API] Renamed FileEvent struct to Event.
-* [API] Op constants replace methods like IsCreate().
-
-## dev / 2014-06-12
-
-* Fix data race on kevent buffer (thanks @tilaks) [#98](https://github.com/howeyc/fsnotify/pull/98)
-
-## dev / 2014-05-23
-
-* [API] Remove current implementation of WatchFlags.
-    * current implementation doesn't take advantage of OS for efficiency
-    * provides little benefit over filtering events as they are received, but has  extra bookkeeping and mutexes
-    * no tests for the current implementation
-    * not fully implemented on Windows [#93](https://github.com/howeyc/fsnotify/issues/93#issuecomment-39285195)
-
-## v0.9.3 / 2014-12-31
-
-* kqueue: cleanup internal watch before sending remove event [#51](https://github.com/fsnotify/fsnotify/issues/51)
-
-## v0.9.2 / 2014-08-17
-
-* [Backport] Fix missing create events on macOS. [#14](https://github.com/fsnotify/fsnotify/issues/14) (thanks @zhsso)
-
-## v0.9.1 / 2014-06-12
-
-* Fix data race on kevent buffer (thanks @tilaks) [#98](https://github.com/howeyc/fsnotify/pull/98)
-
-## v0.9.0 / 2014-01-17
-
-* IsAttrib() for events that only concern a file's metadata [#79][] (thanks @abustany)
-* [Fix] kqueue: fix deadlock [#77][] (thanks @cespare)
-* [NOTICE] Development has moved to `code.google.com/p/go.exp/fsnotify` in preparation for inclusion in the Go standard library.
-
-## v0.8.12 / 2013-11-13
-
-* [API] Remove FD_SET and friends from Linux adapter
-
-## v0.8.11 / 2013-11-02
-
-* [Doc] Add Changelog [#72][] (thanks @nathany)
-* [Doc] Spotlight and double modify events on macOS [#62][] (reported by @paulhammond)
-
-## v0.8.10 / 2013-10-19
-
-* [Fix] kqueue: remove file watches when parent directory is removed [#71][] (reported by @mdwhatcott)
-* [Fix] kqueue: race between Close and readEvents [#70][] (reported by @bernerdschaefer)
-* [Doc] specify OS-specific limits in README (thanks @debrando)
-
-## v0.8.9 / 2013-09-08
-
-* [Doc] Contributing (thanks @nathany)
-* [Doc] update package path in example code [#63][] (thanks @paulhammond)
-* [Doc] GoCI badge in README (Linux only) [#60][]
-* [Doc] Cross-platform testing with Vagrant  [#59][] (thanks @nathany)
-
-## v0.8.8 / 2013-06-17
-
-* [Fix] Windows: handle `ERROR_MORE_DATA` on Windows [#49][] (thanks @jbowtie)
-
-## v0.8.7 / 2013-06-03
-
-* [API] Make syscall flags internal
-* [Fix] inotify: ignore event changes
-* [Fix] race in symlink test [#45][] (reported by @srid)
-* [Fix] tests on Windows
-* lower case error messages
-
-## v0.8.6 / 2013-05-23
-
-* kqueue: Use EVT_ONLY flag on Darwin
-* [Doc] Update README with full example
-
-## v0.8.5 / 2013-05-09
-
-* [Fix] inotify: allow monitoring of "broken" symlinks (thanks @tsg)
-
-## v0.8.4 / 2013-04-07
-
-* [Fix] kqueue: watch all file events [#40][] (thanks @ChrisBuchholz)
-
-## v0.8.3 / 2013-03-13
-
-* [Fix] inoitfy/kqueue memory leak [#36][] (reported by @nbkolchin)
-* [Fix] kqueue: use fsnFlags for watching a directory [#33][] (reported by @nbkolchin)
-
-## v0.8.2 / 2013-02-07
-
-* [Doc] add Authors
-* [Fix] fix data races for map access [#29][] (thanks @fsouza)
-
-## v0.8.1 / 2013-01-09
-
-* [Fix] Windows path separators
-* [Doc] BSD License
-
-## v0.8.0 / 2012-11-09
-
-* kqueue: directory watching improvements (thanks @vmirage)
-* inotify: add `IN_MOVED_TO` [#25][] (requested by @cpisto)
-* [Fix] kqueue: deleting watched directory [#24][] (reported by @jakerr)
-
-## v0.7.4 / 2012-10-09
-
-* [Fix] inotify: fixes from https://codereview.appspot.com/5418045/ (ugorji)
-* [Fix] kqueue: preserve watch flags when watching for delete [#21][] (reported by @robfig)
-* [Fix] kqueue: watch the directory even if it isn't a new watch (thanks @robfig)
-* [Fix] kqueue: modify after recreation of file
-
-## v0.7.3 / 2012-09-27
-
-* [Fix] kqueue: watch with an existing folder inside the watched folder (thanks @vmirage)
-* [Fix] kqueue: no longer get duplicate CREATE events
-
-## v0.7.2 / 2012-09-01
-
-* kqueue: events for created directories
-
-## v0.7.1 / 2012-07-14
-
-* [Fix] for renaming files
-
-## v0.7.0 / 2012-07-02
-
-* [Feature] FSNotify flags
-* [Fix] inotify: Added file name back to event path
-
-## v0.6.0 / 2012-06-06
-
-* kqueue: watch files after directory created (thanks @tmc)
-
-## v0.5.1 / 2012-05-22
-
-* [Fix] inotify: remove all watches before Close()
-
-## v0.5.0 / 2012-05-03
-
-* [API] kqueue: return errors during watch instead of sending over channel
-* kqueue: match symlink behavior on Linux
-* inotify: add `DELETE_SELF` (requested by @taralx)
-* [Fix] kqueue: handle EINTR (reported by @robfig)
-* [Doc] Godoc example [#1][] (thanks @davecheney)
-
-## v0.4.0 / 2012-03-30
-
-* Go 1 released: build with go tool
-* [Feature] Windows support using winfsnotify
-* Windows does not have attribute change notifications
-* Roll attribute notifications into IsModify
-
-## v0.3.0 / 2012-02-19
-
-* kqueue: add files when watch directory
-
-## v0.2.0 / 2011-12-30
-
-* update to latest Go weekly code
-
-## v0.1.0 / 2011-10-19
-
-* kqueue: add watch on file creation to match inotify
-* kqueue: create file event
-* inotify: ignore `IN_IGNORED` events
-* event String()
-* linux: common FileEvent functions
-* initial commit
-
-[#79]: https://github.com/howeyc/fsnotify/pull/79
-[#77]: https://github.com/howeyc/fsnotify/pull/77
-[#72]: https://github.com/howeyc/fsnotify/issues/72
-[#71]: https://github.com/howeyc/fsnotify/issues/71
-[#70]: https://github.com/howeyc/fsnotify/issues/70
-[#63]: https://github.com/howeyc/fsnotify/issues/63
-[#62]: https://github.com/howeyc/fsnotify/issues/62
-[#60]: https://github.com/howeyc/fsnotify/issues/60
-[#59]: https://github.com/howeyc/fsnotify/issues/59
-[#49]: https://github.com/howeyc/fsnotify/issues/49
-[#45]: https://github.com/howeyc/fsnotify/issues/45
-[#40]: https://github.com/howeyc/fsnotify/issues/40
-[#36]: https://github.com/howeyc/fsnotify/issues/36
-[#33]: https://github.com/howeyc/fsnotify/issues/33
-[#29]: https://github.com/howeyc/fsnotify/issues/29
-[#25]: https://github.com/howeyc/fsnotify/issues/25
-[#24]: https://github.com/howeyc/fsnotify/issues/24
-[#21]: https://github.com/howeyc/fsnotify/issues/21
diff --git a/vendor/gopkg.in/fsnotify.v1/CONTRIBUTING.md b/vendor/gopkg.in/fsnotify.v1/CONTRIBUTING.md
deleted file mode 100644
index 828a60b24ba2..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/CONTRIBUTING.md
+++ /dev/null
@@ -1,77 +0,0 @@
-# Contributing
-
-## Issues
-
-* Request features and report bugs using the [GitHub Issue Tracker](https://github.com/fsnotify/fsnotify/issues).
-* Please indicate the platform you are using fsnotify on.
-* A code example to reproduce the problem is appreciated.
-
-## Pull Requests
-
-### Contributor License Agreement
-
-fsnotify is derived from code in the [golang.org/x/exp](https://godoc.org/golang.org/x/exp) package and it may be included [in the standard library](https://github.com/fsnotify/fsnotify/issues/1) in the future. Therefore fsnotify carries the same [LICENSE](https://github.com/fsnotify/fsnotify/blob/master/LICENSE) as Go. Contributors retain their copyright, so you need to fill out a short form before we can accept your contribution: [Google Individual Contributor License Agreement](https://developers.google.com/open-source/cla/individual).
-
-Please indicate that you have signed the CLA in your pull request.
-
-### How fsnotify is Developed
-
-* Development is done on feature branches.
-* Tests are run on BSD, Linux, macOS and Windows.
-* Pull requests are reviewed and [applied to master][am] using [hub][].
-  * Maintainers may modify or squash commits rather than asking contributors to.
-* To issue a new release, the maintainers will:
-  * Update the CHANGELOG
-  * Tag a version, which will become available through gopkg.in.
- 
-### How to Fork
-
-For smooth sailing, always use the original import path. Installing with `go get` makes this easy. 
-
-1. Install from GitHub (`go get -u github.com/fsnotify/fsnotify`)
-2. Create your feature branch (`git checkout -b my-new-feature`)
-3. Ensure everything works and the tests pass (see below)
-4. Commit your changes (`git commit -am 'Add some feature'`)
-
-Contribute upstream:
-
-1. Fork fsnotify on GitHub
-2. Add your remote (`git remote add fork git@github.com:mycompany/repo.git`)
-3. Push to the branch (`git push fork my-new-feature`)
-4. Create a new Pull Request on GitHub
-
-This workflow is [thoroughly explained by Katrina Owen](https://splice.com/blog/contributing-open-source-git-repositories-go/).
-
-### Testing
-
-fsnotify uses build tags to compile different code on Linux, BSD, macOS, and Windows.
-
-Before doing a pull request, please do your best to test your changes on multiple platforms, and list which platforms you were able/unable to test on.
-
-To aid in cross-platform testing there is a Vagrantfile for Linux and BSD.
-
-* Install [Vagrant](http://www.vagrantup.com/) and [VirtualBox](https://www.virtualbox.org/)
-* Setup [Vagrant Gopher](https://github.com/nathany/vagrant-gopher) in your `src` folder.
-* Run `vagrant up` from the project folder. You can also setup just one box with `vagrant up linux` or `vagrant up bsd` (note: the BSD box doesn't support Windows hosts at this time, and NFS may prompt for your host OS password)
-* Once setup, you can run the test suite on a given OS with a single command `vagrant ssh linux -c 'cd fsnotify/fsnotify; go test'`.
-* When you're done, you will want to halt or destroy the Vagrant boxes.
-
-Notice: fsnotify file system events won't trigger in shared folders. The tests get around this limitation by using the /tmp directory.
-
-Right now there is no equivalent solution for Windows and macOS, but there are Windows VMs [freely available from Microsoft](http://www.modern.ie/en-us/virtualization-tools#downloads).
-
-### Maintainers
-
-Help maintaining fsnotify is welcome. To be a maintainer:
-
-* Submit a pull request and sign the CLA as above.
-* You must be able to run the test suite on Mac, Windows, Linux and BSD.
-
-To keep master clean, the fsnotify project uses the "apply mail" workflow outlined in Nathaniel Talbott's post ["Merge pull request" Considered Harmful][am]. This requires installing [hub][].
-
-All code changes should be internal pull requests.
-
-Releases are tagged using [Semantic Versioning](http://semver.org/).
-
-[hub]: https://github.com/github/hub
-[am]: http://blog.spreedly.com/2014/06/24/merge-pull-request-considered-harmful/#.VGa5yZPF_Zs
diff --git a/vendor/gopkg.in/fsnotify.v1/LICENSE b/vendor/gopkg.in/fsnotify.v1/LICENSE
deleted file mode 100644
index f21e54080090..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/LICENSE
+++ /dev/null
@@ -1,28 +0,0 @@
-Copyright (c) 2012 The Go Authors. All rights reserved.
-Copyright (c) 2012 fsnotify Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/gopkg.in/fsnotify.v1/README.md b/vendor/gopkg.in/fsnotify.v1/README.md
deleted file mode 100644
index 3993207413a7..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/README.md
+++ /dev/null
@@ -1,79 +0,0 @@
-# File system notifications for Go
-
-[![GoDoc](https://godoc.org/github.com/fsnotify/fsnotify?status.svg)](https://godoc.org/github.com/fsnotify/fsnotify) [![Go Report Card](https://goreportcard.com/badge/github.com/fsnotify/fsnotify)](https://goreportcard.com/report/github.com/fsnotify/fsnotify)
-
-fsnotify utilizes [golang.org/x/sys](https://godoc.org/golang.org/x/sys) rather than `syscall` from the standard library. Ensure you have the latest version installed by running:
-
-```console
-go get -u golang.org/x/sys/...
-```
-
-Cross platform: Windows, Linux, BSD and macOS.
-
-|Adapter   |OS        |Status    |
-|----------|----------|----------|
-|inotify   |Linux 2.6.27 or later, Android\*|Supported [![Build Status](https://travis-ci.org/fsnotify/fsnotify.svg?branch=master)](https://travis-ci.org/fsnotify/fsnotify)|
-|kqueue    |BSD, macOS, iOS\*|Supported [![Build Status](https://travis-ci.org/fsnotify/fsnotify.svg?branch=master)](https://travis-ci.org/fsnotify/fsnotify)|
-|ReadDirectoryChangesW|Windows|Supported [![Build status](https://ci.appveyor.com/api/projects/status/ivwjubaih4r0udeh/branch/master?svg=true)](https://ci.appveyor.com/project/NathanYoungman/fsnotify/branch/master)|
-|FSEvents  |macOS         |[Planned](https://github.com/fsnotify/fsnotify/issues/11)|
-|FEN       |Solaris 11    |[In Progress](https://github.com/fsnotify/fsnotify/issues/12)|
-|fanotify  |Linux 2.6.37+ | |
-|USN Journals |Windows    |[Maybe](https://github.com/fsnotify/fsnotify/issues/53)|
-|Polling   |*All*         |[Maybe](https://github.com/fsnotify/fsnotify/issues/9)|
-
-\* Android and iOS are untested.
-
-Please see [the documentation](https://godoc.org/github.com/fsnotify/fsnotify) and consult the [FAQ](#faq) for usage information.
-
-## API stability
-
-fsnotify is a fork of [howeyc/fsnotify](https://godoc.org/github.com/howeyc/fsnotify) with a new API as of v1.0. The API is based on [this design document](http://goo.gl/MrYxyA). 
-
-All [releases](https://github.com/fsnotify/fsnotify/releases) are tagged based on [Semantic Versioning](http://semver.org/). Further API changes are [planned](https://github.com/fsnotify/fsnotify/milestones), and will be tagged with a new major revision number.
-
-Go 1.6 supports dependencies located in the `vendor/` folder. Unless you are creating a library, it is recommended that you copy fsnotify into `vendor/github.com/fsnotify/fsnotify` within your project, and likewise for `golang.org/x/sys`.
-
-## Contributing
-
-Please refer to [CONTRIBUTING][] before opening an issue or pull request.
-
-## Example
-
-See [example_test.go](https://github.com/fsnotify/fsnotify/blob/master/example_test.go).
-
-## FAQ
-
-**When a file is moved to another directory is it still being watched?**
-
-No (it shouldn't be, unless you are watching where it was moved to).
-
-**When I watch a directory, are all subdirectories watched as well?**
-
-No, you must add watches for any directory you want to watch (a recursive watcher is on the roadmap [#18][]).
-
-**Do I have to watch the Error and Event channels in a separate goroutine?**
-
-As of now, yes. Looking into making this single-thread friendly (see [howeyc #7][#7])
-
-**Why am I receiving multiple events for the same file on OS X?**
-
-Spotlight indexing on OS X can result in multiple events (see [howeyc #62][#62]). A temporary workaround is to add your folder(s) to the *Spotlight Privacy settings* until we have a native FSEvents implementation (see [#11][]).
-
-**How many files can be watched at once?**
-
-There are OS-specific limits as to how many watches can be created:
-* Linux: /proc/sys/fs/inotify/max_user_watches contains the limit, reaching this limit results in a "no space left on device" error.
-* BSD / OSX: sysctl variables "kern.maxfiles" and "kern.maxfilesperproc", reaching these limits results in a "too many open files" error.
-
-[#62]: https://github.com/howeyc/fsnotify/issues/62
-[#18]: https://github.com/fsnotify/fsnotify/issues/18
-[#11]: https://github.com/fsnotify/fsnotify/issues/11
-[#7]: https://github.com/howeyc/fsnotify/issues/7
-
-[contributing]: https://github.com/fsnotify/fsnotify/blob/master/CONTRIBUTING.md
-
-## Related Projects
-
-* [notify](https://github.com/rjeczalik/notify)
-* [fsevents](https://github.com/fsnotify/fsevents)
-
diff --git a/vendor/gopkg.in/fsnotify.v1/fen.go b/vendor/gopkg.in/fsnotify.v1/fen.go
deleted file mode 100644
index ced39cb881e6..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/fen.go
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build solaris
-
-package fsnotify
-
-import (
-	"errors"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events chan Event
-	Errors chan error
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	return nil, errors.New("FEN based watcher not yet supported for fsnotify\n")
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	return nil
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	return nil
-}
-
-// Remove stops watching the the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	return nil
-}
diff --git a/vendor/gopkg.in/fsnotify.v1/fsnotify.go b/vendor/gopkg.in/fsnotify.v1/fsnotify.go
deleted file mode 100644
index 190bf0de5756..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/fsnotify.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !plan9
-
-// Package fsnotify provides a platform-independent interface for file system notifications.
-package fsnotify
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-)
-
-// Event represents a single file system notification.
-type Event struct {
-	Name string // Relative path to the file or directory.
-	Op   Op     // File operation that triggered the event.
-}
-
-// Op describes a set of file operations.
-type Op uint32
-
-// These are the generalized file operations that can trigger a notification.
-const (
-	Create Op = 1 << iota
-	Write
-	Remove
-	Rename
-	Chmod
-)
-
-func (op Op) String() string {
-	// Use a buffer for efficient string concatenation
-	var buffer bytes.Buffer
-
-	if op&Create == Create {
-		buffer.WriteString("|CREATE")
-	}
-	if op&Remove == Remove {
-		buffer.WriteString("|REMOVE")
-	}
-	if op&Write == Write {
-		buffer.WriteString("|WRITE")
-	}
-	if op&Rename == Rename {
-		buffer.WriteString("|RENAME")
-	}
-	if op&Chmod == Chmod {
-		buffer.WriteString("|CHMOD")
-	}
-	if buffer.Len() == 0 {
-		return ""
-	}
-	return buffer.String()[1:] // Strip leading pipe
-}
-
-// String returns a string representation of the event in the form
-// "file: REMOVE|WRITE|..."
-func (e Event) String() string {
-	return fmt.Sprintf("%q: %s", e.Name, e.Op.String())
-}
-
-// Common errors that can be reported by a watcher
-var ErrEventOverflow = errors.New("fsnotify queue overflow")
diff --git a/vendor/gopkg.in/fsnotify.v1/inotify.go b/vendor/gopkg.in/fsnotify.v1/inotify.go
deleted file mode 100644
index d9fd1b88a05f..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/inotify.go
+++ /dev/null
@@ -1,337 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build linux
-
-package fsnotify
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events   chan Event
-	Errors   chan error
-	mu       sync.Mutex // Map access
-	fd       int
-	poller   *fdPoller
-	watches  map[string]*watch // Map of inotify watches (key: path)
-	paths    map[int]string    // Map of watched paths (key: watch descriptor)
-	done     chan struct{}     // Channel for sending a "quit message" to the reader goroutine
-	doneResp chan struct{}     // Channel to respond to Close
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	// Create inotify fd
-	fd, errno := unix.InotifyInit1(unix.IN_CLOEXEC)
-	if fd == -1 {
-		return nil, errno
-	}
-	// Create epoll
-	poller, err := newFdPoller(fd)
-	if err != nil {
-		unix.Close(fd)
-		return nil, err
-	}
-	w := &Watcher{
-		fd:       fd,
-		poller:   poller,
-		watches:  make(map[string]*watch),
-		paths:    make(map[int]string),
-		Events:   make(chan Event),
-		Errors:   make(chan error),
-		done:     make(chan struct{}),
-		doneResp: make(chan struct{}),
-	}
-
-	go w.readEvents()
-	return w, nil
-}
-
-func (w *Watcher) isClosed() bool {
-	select {
-	case <-w.done:
-		return true
-	default:
-		return false
-	}
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	if w.isClosed() {
-		return nil
-	}
-
-	// Send 'close' signal to goroutine, and set the Watcher to closed.
-	close(w.done)
-
-	// Wake up goroutine
-	w.poller.wake()
-
-	// Wait for goroutine to close
-	<-w.doneResp
-
-	return nil
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	name = filepath.Clean(name)
-	if w.isClosed() {
-		return errors.New("inotify instance already closed")
-	}
-
-	const agnosticEvents = unix.IN_MOVED_TO | unix.IN_MOVED_FROM |
-		unix.IN_CREATE | unix.IN_ATTRIB | unix.IN_MODIFY |
-		unix.IN_MOVE_SELF | unix.IN_DELETE | unix.IN_DELETE_SELF
-
-	var flags uint32 = agnosticEvents
-
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	watchEntry := w.watches[name]
-	if watchEntry != nil {
-		flags |= watchEntry.flags | unix.IN_MASK_ADD
-	}
-	wd, errno := unix.InotifyAddWatch(w.fd, name, flags)
-	if wd == -1 {
-		return errno
-	}
-
-	if watchEntry == nil {
-		w.watches[name] = &watch{wd: uint32(wd), flags: flags}
-		w.paths[wd] = name
-	} else {
-		watchEntry.wd = uint32(wd)
-		watchEntry.flags = flags
-	}
-
-	return nil
-}
-
-// Remove stops watching the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	name = filepath.Clean(name)
-
-	// Fetch the watch.
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	watch, ok := w.watches[name]
-
-	// Remove it from inotify.
-	if !ok {
-		return fmt.Errorf("can't remove non-existent inotify watch for: %s", name)
-	}
-
-	// We successfully removed the watch if InotifyRmWatch doesn't return an
-	// error, we need to clean up our internal state to ensure it matches
-	// inotify's kernel state.
-	delete(w.paths, int(watch.wd))
-	delete(w.watches, name)
-
-	// inotify_rm_watch will return EINVAL if the file has been deleted;
-	// the inotify will already have been removed.
-	// watches and pathes are deleted in ignoreLinux() implicitly and asynchronously
-	// by calling inotify_rm_watch() below. e.g. readEvents() goroutine receives IN_IGNORE
-	// so that EINVAL means that the wd is being rm_watch()ed or its file removed
-	// by another thread and we have not received IN_IGNORE event.
-	success, errno := unix.InotifyRmWatch(w.fd, watch.wd)
-	if success == -1 {
-		// TODO: Perhaps it's not helpful to return an error here in every case.
-		// the only two possible errors are:
-		// EBADF, which happens when w.fd is not a valid file descriptor of any kind.
-		// EINVAL, which is when fd is not an inotify descriptor or wd is not a valid watch descriptor.
-		// Watch descriptors are invalidated when they are removed explicitly or implicitly;
-		// explicitly by inotify_rm_watch, implicitly when the file they are watching is deleted.
-		return errno
-	}
-
-	return nil
-}
-
-type watch struct {
-	wd    uint32 // Watch descriptor (as returned by the inotify_add_watch() syscall)
-	flags uint32 // inotify flags of this watch (see inotify(7) for the list of valid flags)
-}
-
-// readEvents reads from the inotify file descriptor, converts the
-// received events into Event objects and sends them via the Events channel
-func (w *Watcher) readEvents() {
-	var (
-		buf   [unix.SizeofInotifyEvent * 4096]byte // Buffer for a maximum of 4096 raw events
-		n     int                                  // Number of bytes read with read()
-		errno error                                // Syscall errno
-		ok    bool                                 // For poller.wait
-	)
-
-	defer close(w.doneResp)
-	defer close(w.Errors)
-	defer close(w.Events)
-	defer unix.Close(w.fd)
-	defer w.poller.close()
-
-	for {
-		// See if we have been closed.
-		if w.isClosed() {
-			return
-		}
-
-		ok, errno = w.poller.wait()
-		if errno != nil {
-			select {
-			case w.Errors <- errno:
-			case <-w.done:
-				return
-			}
-			continue
-		}
-
-		if !ok {
-			continue
-		}
-
-		n, errno = unix.Read(w.fd, buf[:])
-		// If a signal interrupted execution, see if we've been asked to close, and try again.
-		// http://man7.org/linux/man-pages/man7/signal.7.html :
-		// "Before Linux 3.8, reads from an inotify(7) file descriptor were not restartable"
-		if errno == unix.EINTR {
-			continue
-		}
-
-		// unix.Read might have been woken up by Close. If so, we're done.
-		if w.isClosed() {
-			return
-		}
-
-		if n < unix.SizeofInotifyEvent {
-			var err error
-			if n == 0 {
-				// If EOF is received. This should really never happen.
-				err = io.EOF
-			} else if n < 0 {
-				// If an error occurred while reading.
-				err = errno
-			} else {
-				// Read was too short.
-				err = errors.New("notify: short read in readEvents()")
-			}
-			select {
-			case w.Errors <- err:
-			case <-w.done:
-				return
-			}
-			continue
-		}
-
-		var offset uint32
-		// We don't know how many events we just read into the buffer
-		// While the offset points to at least one whole event...
-		for offset <= uint32(n-unix.SizeofInotifyEvent) {
-			// Point "raw" to the event in the buffer
-			raw := (*unix.InotifyEvent)(unsafe.Pointer(&buf[offset]))
-
-			mask := uint32(raw.Mask)
-			nameLen := uint32(raw.Len)
-
-			if mask&unix.IN_Q_OVERFLOW != 0 {
-				select {
-				case w.Errors <- ErrEventOverflow:
-				case <-w.done:
-					return
-				}
-			}
-
-			// If the event happened to the watched directory or the watched file, the kernel
-			// doesn't append the filename to the event, but we would like to always fill the
-			// the "Name" field with a valid filename. We retrieve the path of the watch from
-			// the "paths" map.
-			w.mu.Lock()
-			name, ok := w.paths[int(raw.Wd)]
-			// IN_DELETE_SELF occurs when the file/directory being watched is removed.
-			// This is a sign to clean up the maps, otherwise we are no longer in sync
-			// with the inotify kernel state which has already deleted the watch
-			// automatically.
-			if ok && mask&unix.IN_DELETE_SELF == unix.IN_DELETE_SELF {
-				delete(w.paths, int(raw.Wd))
-				delete(w.watches, name)
-			}
-			w.mu.Unlock()
-
-			if nameLen > 0 {
-				// Point "bytes" at the first byte of the filename
-				bytes := (*[unix.PathMax]byte)(unsafe.Pointer(&buf[offset+unix.SizeofInotifyEvent]))
-				// The filename is padded with NULL bytes. TrimRight() gets rid of those.
-				name += "/" + strings.TrimRight(string(bytes[0:nameLen]), "\000")
-			}
-
-			event := newEvent(name, mask)
-
-			// Send the events that are not ignored on the events channel
-			if !event.ignoreLinux(mask) {
-				select {
-				case w.Events <- event:
-				case <-w.done:
-					return
-				}
-			}
-
-			// Move to the next event in the buffer
-			offset += unix.SizeofInotifyEvent + nameLen
-		}
-	}
-}
-
-// Certain types of events can be "ignored" and not sent over the Events
-// channel. Such as events marked ignore by the kernel, or MODIFY events
-// against files that do not exist.
-func (e *Event) ignoreLinux(mask uint32) bool {
-	// Ignore anything the inotify API says to ignore
-	if mask&unix.IN_IGNORED == unix.IN_IGNORED {
-		return true
-	}
-
-	// If the event is not a DELETE or RENAME, the file must exist.
-	// Otherwise the event is ignored.
-	// *Note*: this was put in place because it was seen that a MODIFY
-	// event was sent after the DELETE. This ignores that MODIFY and
-	// assumes a DELETE will come or has come if the file doesn't exist.
-	if !(e.Op&Remove == Remove || e.Op&Rename == Rename) {
-		_, statErr := os.Lstat(e.Name)
-		return os.IsNotExist(statErr)
-	}
-	return false
-}
-
-// newEvent returns an platform-independent Event based on an inotify mask.
-func newEvent(name string, mask uint32) Event {
-	e := Event{Name: name}
-	if mask&unix.IN_CREATE == unix.IN_CREATE || mask&unix.IN_MOVED_TO == unix.IN_MOVED_TO {
-		e.Op |= Create
-	}
-	if mask&unix.IN_DELETE_SELF == unix.IN_DELETE_SELF || mask&unix.IN_DELETE == unix.IN_DELETE {
-		e.Op |= Remove
-	}
-	if mask&unix.IN_MODIFY == unix.IN_MODIFY {
-		e.Op |= Write
-	}
-	if mask&unix.IN_MOVE_SELF == unix.IN_MOVE_SELF || mask&unix.IN_MOVED_FROM == unix.IN_MOVED_FROM {
-		e.Op |= Rename
-	}
-	if mask&unix.IN_ATTRIB == unix.IN_ATTRIB {
-		e.Op |= Chmod
-	}
-	return e
-}
diff --git a/vendor/gopkg.in/fsnotify.v1/inotify_poller.go b/vendor/gopkg.in/fsnotify.v1/inotify_poller.go
deleted file mode 100644
index cc7db4b22ef5..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/inotify_poller.go
+++ /dev/null
@@ -1,187 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build linux
-
-package fsnotify
-
-import (
-	"errors"
-
-	"golang.org/x/sys/unix"
-)
-
-type fdPoller struct {
-	fd   int    // File descriptor (as returned by the inotify_init() syscall)
-	epfd int    // Epoll file descriptor
-	pipe [2]int // Pipe for waking up
-}
-
-func emptyPoller(fd int) *fdPoller {
-	poller := new(fdPoller)
-	poller.fd = fd
-	poller.epfd = -1
-	poller.pipe[0] = -1
-	poller.pipe[1] = -1
-	return poller
-}
-
-// Create a new inotify poller.
-// This creates an inotify handler, and an epoll handler.
-func newFdPoller(fd int) (*fdPoller, error) {
-	var errno error
-	poller := emptyPoller(fd)
-	defer func() {
-		if errno != nil {
-			poller.close()
-		}
-	}()
-	poller.fd = fd
-
-	// Create epoll fd
-	poller.epfd, errno = unix.EpollCreate1(0)
-	if poller.epfd == -1 {
-		return nil, errno
-	}
-	// Create pipe; pipe[0] is the read end, pipe[1] the write end.
-	errno = unix.Pipe2(poller.pipe[:], unix.O_NONBLOCK)
-	if errno != nil {
-		return nil, errno
-	}
-
-	// Register inotify fd with epoll
-	event := unix.EpollEvent{
-		Fd:     int32(poller.fd),
-		Events: unix.EPOLLIN,
-	}
-	errno = unix.EpollCtl(poller.epfd, unix.EPOLL_CTL_ADD, poller.fd, &event)
-	if errno != nil {
-		return nil, errno
-	}
-
-	// Register pipe fd with epoll
-	event = unix.EpollEvent{
-		Fd:     int32(poller.pipe[0]),
-		Events: unix.EPOLLIN,
-	}
-	errno = unix.EpollCtl(poller.epfd, unix.EPOLL_CTL_ADD, poller.pipe[0], &event)
-	if errno != nil {
-		return nil, errno
-	}
-
-	return poller, nil
-}
-
-// Wait using epoll.
-// Returns true if something is ready to be read,
-// false if there is not.
-func (poller *fdPoller) wait() (bool, error) {
-	// 3 possible events per fd, and 2 fds, makes a maximum of 6 events.
-	// I don't know whether epoll_wait returns the number of events returned,
-	// or the total number of events ready.
-	// I decided to catch both by making the buffer one larger than the maximum.
-	events := make([]unix.EpollEvent, 7)
-	for {
-		n, errno := unix.EpollWait(poller.epfd, events, -1)
-		if n == -1 {
-			if errno == unix.EINTR {
-				continue
-			}
-			return false, errno
-		}
-		if n == 0 {
-			// If there are no events, try again.
-			continue
-		}
-		if n > 6 {
-			// This should never happen. More events were returned than should be possible.
-			return false, errors.New("epoll_wait returned more events than I know what to do with")
-		}
-		ready := events[:n]
-		epollhup := false
-		epollerr := false
-		epollin := false
-		for _, event := range ready {
-			if event.Fd == int32(poller.fd) {
-				if event.Events&unix.EPOLLHUP != 0 {
-					// This should not happen, but if it does, treat it as a wakeup.
-					epollhup = true
-				}
-				if event.Events&unix.EPOLLERR != 0 {
-					// If an error is waiting on the file descriptor, we should pretend
-					// something is ready to read, and let unix.Read pick up the error.
-					epollerr = true
-				}
-				if event.Events&unix.EPOLLIN != 0 {
-					// There is data to read.
-					epollin = true
-				}
-			}
-			if event.Fd == int32(poller.pipe[0]) {
-				if event.Events&unix.EPOLLHUP != 0 {
-					// Write pipe descriptor was closed, by us. This means we're closing down the
-					// watcher, and we should wake up.
-				}
-				if event.Events&unix.EPOLLERR != 0 {
-					// If an error is waiting on the pipe file descriptor.
-					// This is an absolute mystery, and should never ever happen.
-					return false, errors.New("Error on the pipe descriptor.")
-				}
-				if event.Events&unix.EPOLLIN != 0 {
-					// This is a regular wakeup, so we have to clear the buffer.
-					err := poller.clearWake()
-					if err != nil {
-						return false, err
-					}
-				}
-			}
-		}
-
-		if epollhup || epollerr || epollin {
-			return true, nil
-		}
-		return false, nil
-	}
-}
-
-// Close the write end of the poller.
-func (poller *fdPoller) wake() error {
-	buf := make([]byte, 1)
-	n, errno := unix.Write(poller.pipe[1], buf)
-	if n == -1 {
-		if errno == unix.EAGAIN {
-			// Buffer is full, poller will wake.
-			return nil
-		}
-		return errno
-	}
-	return nil
-}
-
-func (poller *fdPoller) clearWake() error {
-	// You have to be woken up a LOT in order to get to 100!
-	buf := make([]byte, 100)
-	n, errno := unix.Read(poller.pipe[0], buf)
-	if n == -1 {
-		if errno == unix.EAGAIN {
-			// Buffer is empty, someone else cleared our wake.
-			return nil
-		}
-		return errno
-	}
-	return nil
-}
-
-// Close all poller file descriptors, but not the one passed to it.
-func (poller *fdPoller) close() {
-	if poller.pipe[1] != -1 {
-		unix.Close(poller.pipe[1])
-	}
-	if poller.pipe[0] != -1 {
-		unix.Close(poller.pipe[0])
-	}
-	if poller.epfd != -1 {
-		unix.Close(poller.epfd)
-	}
-}
diff --git a/vendor/gopkg.in/fsnotify.v1/kqueue.go b/vendor/gopkg.in/fsnotify.v1/kqueue.go
deleted file mode 100644
index 86e76a3d6768..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/kqueue.go
+++ /dev/null
@@ -1,521 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build freebsd openbsd netbsd dragonfly darwin
-
-package fsnotify
-
-import (
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events chan Event
-	Errors chan error
-	done   chan struct{} // Channel for sending a "quit message" to the reader goroutine
-
-	kq int // File descriptor (as returned by the kqueue() syscall).
-
-	mu              sync.Mutex        // Protects access to watcher data
-	watches         map[string]int    // Map of watched file descriptors (key: path).
-	externalWatches map[string]bool   // Map of watches added by user of the library.
-	dirFlags        map[string]uint32 // Map of watched directories to fflags used in kqueue.
-	paths           map[int]pathInfo  // Map file descriptors to path names for processing kqueue events.
-	fileExists      map[string]bool   // Keep track of if we know this file exists (to stop duplicate create events).
-	isClosed        bool              // Set to true when Close() is first called
-}
-
-type pathInfo struct {
-	name  string
-	isDir bool
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	kq, err := kqueue()
-	if err != nil {
-		return nil, err
-	}
-
-	w := &Watcher{
-		kq:              kq,
-		watches:         make(map[string]int),
-		dirFlags:        make(map[string]uint32),
-		paths:           make(map[int]pathInfo),
-		fileExists:      make(map[string]bool),
-		externalWatches: make(map[string]bool),
-		Events:          make(chan Event),
-		Errors:          make(chan error),
-		done:            make(chan struct{}),
-	}
-
-	go w.readEvents()
-	return w, nil
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	w.mu.Lock()
-	if w.isClosed {
-		w.mu.Unlock()
-		return nil
-	}
-	w.isClosed = true
-
-	// copy paths to remove while locked
-	var pathsToRemove = make([]string, 0, len(w.watches))
-	for name := range w.watches {
-		pathsToRemove = append(pathsToRemove, name)
-	}
-	w.mu.Unlock()
-	// unlock before calling Remove, which also locks
-
-	for _, name := range pathsToRemove {
-		w.Remove(name)
-	}
-
-	// send a "quit" message to the reader goroutine
-	close(w.done)
-
-	return nil
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	w.mu.Lock()
-	w.externalWatches[name] = true
-	w.mu.Unlock()
-	_, err := w.addWatch(name, noteAllEvents)
-	return err
-}
-
-// Remove stops watching the the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	name = filepath.Clean(name)
-	w.mu.Lock()
-	watchfd, ok := w.watches[name]
-	w.mu.Unlock()
-	if !ok {
-		return fmt.Errorf("can't remove non-existent kevent watch for: %s", name)
-	}
-
-	const registerRemove = unix.EV_DELETE
-	if err := register(w.kq, []int{watchfd}, registerRemove, 0); err != nil {
-		return err
-	}
-
-	unix.Close(watchfd)
-
-	w.mu.Lock()
-	isDir := w.paths[watchfd].isDir
-	delete(w.watches, name)
-	delete(w.paths, watchfd)
-	delete(w.dirFlags, name)
-	w.mu.Unlock()
-
-	// Find all watched paths that are in this directory that are not external.
-	if isDir {
-		var pathsToRemove []string
-		w.mu.Lock()
-		for _, path := range w.paths {
-			wdir, _ := filepath.Split(path.name)
-			if filepath.Clean(wdir) == name {
-				if !w.externalWatches[path.name] {
-					pathsToRemove = append(pathsToRemove, path.name)
-				}
-			}
-		}
-		w.mu.Unlock()
-		for _, name := range pathsToRemove {
-			// Since these are internal, not much sense in propagating error
-			// to the user, as that will just confuse them with an error about
-			// a path they did not explicitly watch themselves.
-			w.Remove(name)
-		}
-	}
-
-	return nil
-}
-
-// Watch all events (except NOTE_EXTEND, NOTE_LINK, NOTE_REVOKE)
-const noteAllEvents = unix.NOTE_DELETE | unix.NOTE_WRITE | unix.NOTE_ATTRIB | unix.NOTE_RENAME
-
-// keventWaitTime to block on each read from kevent
-var keventWaitTime = durationToTimespec(100 * time.Millisecond)
-
-// addWatch adds name to the watched file set.
-// The flags are interpreted as described in kevent(2).
-// Returns the real path to the file which was added, if any, which may be different from the one passed in the case of symlinks.
-func (w *Watcher) addWatch(name string, flags uint32) (string, error) {
-	var isDir bool
-	// Make ./name and name equivalent
-	name = filepath.Clean(name)
-
-	w.mu.Lock()
-	if w.isClosed {
-		w.mu.Unlock()
-		return "", errors.New("kevent instance already closed")
-	}
-	watchfd, alreadyWatching := w.watches[name]
-	// We already have a watch, but we can still override flags.
-	if alreadyWatching {
-		isDir = w.paths[watchfd].isDir
-	}
-	w.mu.Unlock()
-
-	if !alreadyWatching {
-		fi, err := os.Lstat(name)
-		if err != nil {
-			return "", err
-		}
-
-		// Don't watch sockets.
-		if fi.Mode()&os.ModeSocket == os.ModeSocket {
-			return "", nil
-		}
-
-		// Don't watch named pipes.
-		if fi.Mode()&os.ModeNamedPipe == os.ModeNamedPipe {
-			return "", nil
-		}
-
-		// Follow Symlinks
-		// Unfortunately, Linux can add bogus symlinks to watch list without
-		// issue, and Windows can't do symlinks period (AFAIK). To  maintain
-		// consistency, we will act like everything is fine. There will simply
-		// be no file events for broken symlinks.
-		// Hence the returns of nil on errors.
-		if fi.Mode()&os.ModeSymlink == os.ModeSymlink {
-			name, err = filepath.EvalSymlinks(name)
-			if err != nil {
-				return "", nil
-			}
-
-			w.mu.Lock()
-			_, alreadyWatching = w.watches[name]
-			w.mu.Unlock()
-
-			if alreadyWatching {
-				return name, nil
-			}
-
-			fi, err = os.Lstat(name)
-			if err != nil {
-				return "", nil
-			}
-		}
-
-		watchfd, err = unix.Open(name, openMode, 0700)
-		if watchfd == -1 {
-			return "", err
-		}
-
-		isDir = fi.IsDir()
-	}
-
-	const registerAdd = unix.EV_ADD | unix.EV_CLEAR | unix.EV_ENABLE
-	if err := register(w.kq, []int{watchfd}, registerAdd, flags); err != nil {
-		unix.Close(watchfd)
-		return "", err
-	}
-
-	if !alreadyWatching {
-		w.mu.Lock()
-		w.watches[name] = watchfd
-		w.paths[watchfd] = pathInfo{name: name, isDir: isDir}
-		w.mu.Unlock()
-	}
-
-	if isDir {
-		// Watch the directory if it has not been watched before,
-		// or if it was watched before, but perhaps only a NOTE_DELETE (watchDirectoryFiles)
-		w.mu.Lock()
-
-		watchDir := (flags&unix.NOTE_WRITE) == unix.NOTE_WRITE &&
-			(!alreadyWatching || (w.dirFlags[name]&unix.NOTE_WRITE) != unix.NOTE_WRITE)
-		// Store flags so this watch can be updated later
-		w.dirFlags[name] = flags
-		w.mu.Unlock()
-
-		if watchDir {
-			if err := w.watchDirectoryFiles(name); err != nil {
-				return "", err
-			}
-		}
-	}
-	return name, nil
-}
-
-// readEvents reads from kqueue and converts the received kevents into
-// Event values that it sends down the Events channel.
-func (w *Watcher) readEvents() {
-	eventBuffer := make([]unix.Kevent_t, 10)
-
-loop:
-	for {
-		// See if there is a message on the "done" channel
-		select {
-		case <-w.done:
-			break loop
-		default:
-		}
-
-		// Get new events
-		kevents, err := read(w.kq, eventBuffer, &keventWaitTime)
-		// EINTR is okay, the syscall was interrupted before timeout expired.
-		if err != nil && err != unix.EINTR {
-			select {
-			case w.Errors <- err:
-			case <-w.done:
-				break loop
-			}
-			continue
-		}
-
-		// Flush the events we received to the Events channel
-		for len(kevents) > 0 {
-			kevent := &kevents[0]
-			watchfd := int(kevent.Ident)
-			mask := uint32(kevent.Fflags)
-			w.mu.Lock()
-			path := w.paths[watchfd]
-			w.mu.Unlock()
-			event := newEvent(path.name, mask)
-
-			if path.isDir && !(event.Op&Remove == Remove) {
-				// Double check to make sure the directory exists. This can happen when
-				// we do a rm -fr on a recursively watched folders and we receive a
-				// modification event first but the folder has been deleted and later
-				// receive the delete event
-				if _, err := os.Lstat(event.Name); os.IsNotExist(err) {
-					// mark is as delete event
-					event.Op |= Remove
-				}
-			}
-
-			if event.Op&Rename == Rename || event.Op&Remove == Remove {
-				w.Remove(event.Name)
-				w.mu.Lock()
-				delete(w.fileExists, event.Name)
-				w.mu.Unlock()
-			}
-
-			if path.isDir && event.Op&Write == Write && !(event.Op&Remove == Remove) {
-				w.sendDirectoryChangeEvents(event.Name)
-			} else {
-				// Send the event on the Events channel.
-				select {
-				case w.Events <- event:
-				case <-w.done:
-					break loop
-				}
-			}
-
-			if event.Op&Remove == Remove {
-				// Look for a file that may have overwritten this.
-				// For example, mv f1 f2 will delete f2, then create f2.
-				if path.isDir {
-					fileDir := filepath.Clean(event.Name)
-					w.mu.Lock()
-					_, found := w.watches[fileDir]
-					w.mu.Unlock()
-					if found {
-						// make sure the directory exists before we watch for changes. When we
-						// do a recursive watch and perform rm -fr, the parent directory might
-						// have gone missing, ignore the missing directory and let the
-						// upcoming delete event remove the watch from the parent directory.
-						if _, err := os.Lstat(fileDir); err == nil {
-							w.sendDirectoryChangeEvents(fileDir)
-						}
-					}
-				} else {
-					filePath := filepath.Clean(event.Name)
-					if fileInfo, err := os.Lstat(filePath); err == nil {
-						w.sendFileCreatedEventIfNew(filePath, fileInfo)
-					}
-				}
-			}
-
-			// Move to next event
-			kevents = kevents[1:]
-		}
-	}
-
-	// cleanup
-	err := unix.Close(w.kq)
-	if err != nil {
-		// only way the previous loop breaks is if w.done was closed so we need to async send to w.Errors.
-		select {
-		case w.Errors <- err:
-		default:
-		}
-	}
-	close(w.Events)
-	close(w.Errors)
-}
-
-// newEvent returns an platform-independent Event based on kqueue Fflags.
-func newEvent(name string, mask uint32) Event {
-	e := Event{Name: name}
-	if mask&unix.NOTE_DELETE == unix.NOTE_DELETE {
-		e.Op |= Remove
-	}
-	if mask&unix.NOTE_WRITE == unix.NOTE_WRITE {
-		e.Op |= Write
-	}
-	if mask&unix.NOTE_RENAME == unix.NOTE_RENAME {
-		e.Op |= Rename
-	}
-	if mask&unix.NOTE_ATTRIB == unix.NOTE_ATTRIB {
-		e.Op |= Chmod
-	}
-	return e
-}
-
-func newCreateEvent(name string) Event {
-	return Event{Name: name, Op: Create}
-}
-
-// watchDirectoryFiles to mimic inotify when adding a watch on a directory
-func (w *Watcher) watchDirectoryFiles(dirPath string) error {
-	// Get all files
-	files, err := ioutil.ReadDir(dirPath)
-	if err != nil {
-		return err
-	}
-
-	for _, fileInfo := range files {
-		filePath := filepath.Join(dirPath, fileInfo.Name())
-		filePath, err = w.internalWatch(filePath, fileInfo)
-		if err != nil {
-			return err
-		}
-
-		w.mu.Lock()
-		w.fileExists[filePath] = true
-		w.mu.Unlock()
-	}
-
-	return nil
-}
-
-// sendDirectoryEvents searches the directory for newly created files
-// and sends them over the event channel. This functionality is to have
-// the BSD version of fsnotify match Linux inotify which provides a
-// create event for files created in a watched directory.
-func (w *Watcher) sendDirectoryChangeEvents(dirPath string) {
-	// Get all files
-	files, err := ioutil.ReadDir(dirPath)
-	if err != nil {
-		select {
-		case w.Errors <- err:
-		case <-w.done:
-			return
-		}
-	}
-
-	// Search for new files
-	for _, fileInfo := range files {
-		filePath := filepath.Join(dirPath, fileInfo.Name())
-		err := w.sendFileCreatedEventIfNew(filePath, fileInfo)
-
-		if err != nil {
-			return
-		}
-	}
-}
-
-// sendFileCreatedEvent sends a create event if the file isn't already being tracked.
-func (w *Watcher) sendFileCreatedEventIfNew(filePath string, fileInfo os.FileInfo) (err error) {
-	w.mu.Lock()
-	_, doesExist := w.fileExists[filePath]
-	w.mu.Unlock()
-	if !doesExist {
-		// Send create event
-		select {
-		case w.Events <- newCreateEvent(filePath):
-		case <-w.done:
-			return
-		}
-	}
-
-	// like watchDirectoryFiles (but without doing another ReadDir)
-	filePath, err = w.internalWatch(filePath, fileInfo)
-	if err != nil {
-		return err
-	}
-
-	w.mu.Lock()
-	w.fileExists[filePath] = true
-	w.mu.Unlock()
-
-	return nil
-}
-
-func (w *Watcher) internalWatch(name string, fileInfo os.FileInfo) (string, error) {
-	if fileInfo.IsDir() {
-		// mimic Linux providing delete events for subdirectories
-		// but preserve the flags used if currently watching subdirectory
-		w.mu.Lock()
-		flags := w.dirFlags[name]
-		w.mu.Unlock()
-
-		flags |= unix.NOTE_DELETE | unix.NOTE_RENAME
-		return w.addWatch(name, flags)
-	}
-
-	// watch file to mimic Linux inotify
-	return w.addWatch(name, noteAllEvents)
-}
-
-// kqueue creates a new kernel event queue and returns a descriptor.
-func kqueue() (kq int, err error) {
-	kq, err = unix.Kqueue()
-	if kq == -1 {
-		return kq, err
-	}
-	return kq, nil
-}
-
-// register events with the queue
-func register(kq int, fds []int, flags int, fflags uint32) error {
-	changes := make([]unix.Kevent_t, len(fds))
-
-	for i, fd := range fds {
-		// SetKevent converts int to the platform-specific types:
-		unix.SetKevent(&changes[i], fd, unix.EVFILT_VNODE, flags)
-		changes[i].Fflags = fflags
-	}
-
-	// register the events
-	success, err := unix.Kevent(kq, changes, nil, nil)
-	if success == -1 {
-		return err
-	}
-	return nil
-}
-
-// read retrieves pending events, or waits until an event occurs.
-// A timeout of nil blocks indefinitely, while 0 polls the queue.
-func read(kq int, events []unix.Kevent_t, timeout *unix.Timespec) ([]unix.Kevent_t, error) {
-	n, err := unix.Kevent(kq, nil, events, timeout)
-	if err != nil {
-		return nil, err
-	}
-	return events[0:n], nil
-}
-
-// durationToTimespec prepares a timeout value
-func durationToTimespec(d time.Duration) unix.Timespec {
-	return unix.NsecToTimespec(d.Nanoseconds())
-}
diff --git a/vendor/gopkg.in/fsnotify.v1/open_mode_bsd.go b/vendor/gopkg.in/fsnotify.v1/open_mode_bsd.go
deleted file mode 100644
index 7d8de14513ed..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/open_mode_bsd.go
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build freebsd openbsd netbsd dragonfly
-
-package fsnotify
-
-import "golang.org/x/sys/unix"
-
-const openMode = unix.O_NONBLOCK | unix.O_RDONLY
diff --git a/vendor/gopkg.in/fsnotify.v1/open_mode_darwin.go b/vendor/gopkg.in/fsnotify.v1/open_mode_darwin.go
deleted file mode 100644
index 9139e17161bf..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/open_mode_darwin.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build darwin
-
-package fsnotify
-
-import "golang.org/x/sys/unix"
-
-// note: this constant is not defined on BSD
-const openMode = unix.O_EVTONLY
diff --git a/vendor/gopkg.in/fsnotify.v1/windows.go b/vendor/gopkg.in/fsnotify.v1/windows.go
deleted file mode 100644
index 09436f31d821..000000000000
--- a/vendor/gopkg.in/fsnotify.v1/windows.go
+++ /dev/null
@@ -1,561 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build windows
-
-package fsnotify
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync"
-	"syscall"
-	"unsafe"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events   chan Event
-	Errors   chan error
-	isClosed bool           // Set to true when Close() is first called
-	mu       sync.Mutex     // Map access
-	port     syscall.Handle // Handle to completion port
-	watches  watchMap       // Map of watches (key: i-number)
-	input    chan *input    // Inputs to the reader are sent on this channel
-	quit     chan chan<- error
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	port, e := syscall.CreateIoCompletionPort(syscall.InvalidHandle, 0, 0, 0)
-	if e != nil {
-		return nil, os.NewSyscallError("CreateIoCompletionPort", e)
-	}
-	w := &Watcher{
-		port:    port,
-		watches: make(watchMap),
-		input:   make(chan *input, 1),
-		Events:  make(chan Event, 50),
-		Errors:  make(chan error),
-		quit:    make(chan chan<- error, 1),
-	}
-	go w.readEvents()
-	return w, nil
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	if w.isClosed {
-		return nil
-	}
-	w.isClosed = true
-
-	// Send "quit" message to the reader goroutine
-	ch := make(chan error)
-	w.quit <- ch
-	if err := w.wakeupReader(); err != nil {
-		return err
-	}
-	return <-ch
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	if w.isClosed {
-		return errors.New("watcher already closed")
-	}
-	in := &input{
-		op:    opAddWatch,
-		path:  filepath.Clean(name),
-		flags: sysFSALLEVENTS,
-		reply: make(chan error),
-	}
-	w.input <- in
-	if err := w.wakeupReader(); err != nil {
-		return err
-	}
-	return <-in.reply
-}
-
-// Remove stops watching the the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	in := &input{
-		op:    opRemoveWatch,
-		path:  filepath.Clean(name),
-		reply: make(chan error),
-	}
-	w.input <- in
-	if err := w.wakeupReader(); err != nil {
-		return err
-	}
-	return <-in.reply
-}
-
-const (
-	// Options for AddWatch
-	sysFSONESHOT = 0x80000000
-	sysFSONLYDIR = 0x1000000
-
-	// Events
-	sysFSACCESS     = 0x1
-	sysFSALLEVENTS  = 0xfff
-	sysFSATTRIB     = 0x4
-	sysFSCLOSE      = 0x18
-	sysFSCREATE     = 0x100
-	sysFSDELETE     = 0x200
-	sysFSDELETESELF = 0x400
-	sysFSMODIFY     = 0x2
-	sysFSMOVE       = 0xc0
-	sysFSMOVEDFROM  = 0x40
-	sysFSMOVEDTO    = 0x80
-	sysFSMOVESELF   = 0x800
-
-	// Special events
-	sysFSIGNORED   = 0x8000
-	sysFSQOVERFLOW = 0x4000
-)
-
-func newEvent(name string, mask uint32) Event {
-	e := Event{Name: name}
-	if mask&sysFSCREATE == sysFSCREATE || mask&sysFSMOVEDTO == sysFSMOVEDTO {
-		e.Op |= Create
-	}
-	if mask&sysFSDELETE == sysFSDELETE || mask&sysFSDELETESELF == sysFSDELETESELF {
-		e.Op |= Remove
-	}
-	if mask&sysFSMODIFY == sysFSMODIFY {
-		e.Op |= Write
-	}
-	if mask&sysFSMOVE == sysFSMOVE || mask&sysFSMOVESELF == sysFSMOVESELF || mask&sysFSMOVEDFROM == sysFSMOVEDFROM {
-		e.Op |= Rename
-	}
-	if mask&sysFSATTRIB == sysFSATTRIB {
-		e.Op |= Chmod
-	}
-	return e
-}
-
-const (
-	opAddWatch = iota
-	opRemoveWatch
-)
-
-const (
-	provisional uint64 = 1 << (32 + iota)
-)
-
-type input struct {
-	op    int
-	path  string
-	flags uint32
-	reply chan error
-}
-
-type inode struct {
-	handle syscall.Handle
-	volume uint32
-	index  uint64
-}
-
-type watch struct {
-	ov     syscall.Overlapped
-	ino    *inode            // i-number
-	path   string            // Directory path
-	mask   uint64            // Directory itself is being watched with these notify flags
-	names  map[string]uint64 // Map of names being watched and their notify flags
-	rename string            // Remembers the old name while renaming a file
-	buf    [4096]byte
-}
-
-type indexMap map[uint64]*watch
-type watchMap map[uint32]indexMap
-
-func (w *Watcher) wakeupReader() error {
-	e := syscall.PostQueuedCompletionStatus(w.port, 0, 0, nil)
-	if e != nil {
-		return os.NewSyscallError("PostQueuedCompletionStatus", e)
-	}
-	return nil
-}
-
-func getDir(pathname string) (dir string, err error) {
-	attr, e := syscall.GetFileAttributes(syscall.StringToUTF16Ptr(pathname))
-	if e != nil {
-		return "", os.NewSyscallError("GetFileAttributes", e)
-	}
-	if attr&syscall.FILE_ATTRIBUTE_DIRECTORY != 0 {
-		dir = pathname
-	} else {
-		dir, _ = filepath.Split(pathname)
-		dir = filepath.Clean(dir)
-	}
-	return
-}
-
-func getIno(path string) (ino *inode, err error) {
-	h, e := syscall.CreateFile(syscall.StringToUTF16Ptr(path),
-		syscall.FILE_LIST_DIRECTORY,
-		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
-		nil, syscall.OPEN_EXISTING,
-		syscall.FILE_FLAG_BACKUP_SEMANTICS|syscall.FILE_FLAG_OVERLAPPED, 0)
-	if e != nil {
-		return nil, os.NewSyscallError("CreateFile", e)
-	}
-	var fi syscall.ByHandleFileInformation
-	if e = syscall.GetFileInformationByHandle(h, &fi); e != nil {
-		syscall.CloseHandle(h)
-		return nil, os.NewSyscallError("GetFileInformationByHandle", e)
-	}
-	ino = &inode{
-		handle: h,
-		volume: fi.VolumeSerialNumber,
-		index:  uint64(fi.FileIndexHigh)<<32 | uint64(fi.FileIndexLow),
-	}
-	return ino, nil
-}
-
-// Must run within the I/O thread.
-func (m watchMap) get(ino *inode) *watch {
-	if i := m[ino.volume]; i != nil {
-		return i[ino.index]
-	}
-	return nil
-}
-
-// Must run within the I/O thread.
-func (m watchMap) set(ino *inode, watch *watch) {
-	i := m[ino.volume]
-	if i == nil {
-		i = make(indexMap)
-		m[ino.volume] = i
-	}
-	i[ino.index] = watch
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) addWatch(pathname string, flags uint64) error {
-	dir, err := getDir(pathname)
-	if err != nil {
-		return err
-	}
-	if flags&sysFSONLYDIR != 0 && pathname != dir {
-		return nil
-	}
-	ino, err := getIno(dir)
-	if err != nil {
-		return err
-	}
-	w.mu.Lock()
-	watchEntry := w.watches.get(ino)
-	w.mu.Unlock()
-	if watchEntry == nil {
-		if _, e := syscall.CreateIoCompletionPort(ino.handle, w.port, 0, 0); e != nil {
-			syscall.CloseHandle(ino.handle)
-			return os.NewSyscallError("CreateIoCompletionPort", e)
-		}
-		watchEntry = &watch{
-			ino:   ino,
-			path:  dir,
-			names: make(map[string]uint64),
-		}
-		w.mu.Lock()
-		w.watches.set(ino, watchEntry)
-		w.mu.Unlock()
-		flags |= provisional
-	} else {
-		syscall.CloseHandle(ino.handle)
-	}
-	if pathname == dir {
-		watchEntry.mask |= flags
-	} else {
-		watchEntry.names[filepath.Base(pathname)] |= flags
-	}
-	if err = w.startRead(watchEntry); err != nil {
-		return err
-	}
-	if pathname == dir {
-		watchEntry.mask &= ^provisional
-	} else {
-		watchEntry.names[filepath.Base(pathname)] &= ^provisional
-	}
-	return nil
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) remWatch(pathname string) error {
-	dir, err := getDir(pathname)
-	if err != nil {
-		return err
-	}
-	ino, err := getIno(dir)
-	if err != nil {
-		return err
-	}
-	w.mu.Lock()
-	watch := w.watches.get(ino)
-	w.mu.Unlock()
-	if watch == nil {
-		return fmt.Errorf("can't remove non-existent watch for: %s", pathname)
-	}
-	if pathname == dir {
-		w.sendEvent(watch.path, watch.mask&sysFSIGNORED)
-		watch.mask = 0
-	} else {
-		name := filepath.Base(pathname)
-		w.sendEvent(filepath.Join(watch.path, name), watch.names[name]&sysFSIGNORED)
-		delete(watch.names, name)
-	}
-	return w.startRead(watch)
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) deleteWatch(watch *watch) {
-	for name, mask := range watch.names {
-		if mask&provisional == 0 {
-			w.sendEvent(filepath.Join(watch.path, name), mask&sysFSIGNORED)
-		}
-		delete(watch.names, name)
-	}
-	if watch.mask != 0 {
-		if watch.mask&provisional == 0 {
-			w.sendEvent(watch.path, watch.mask&sysFSIGNORED)
-		}
-		watch.mask = 0
-	}
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) startRead(watch *watch) error {
-	if e := syscall.CancelIo(watch.ino.handle); e != nil {
-		w.Errors <- os.NewSyscallError("CancelIo", e)
-		w.deleteWatch(watch)
-	}
-	mask := toWindowsFlags(watch.mask)
-	for _, m := range watch.names {
-		mask |= toWindowsFlags(m)
-	}
-	if mask == 0 {
-		if e := syscall.CloseHandle(watch.ino.handle); e != nil {
-			w.Errors <- os.NewSyscallError("CloseHandle", e)
-		}
-		w.mu.Lock()
-		delete(w.watches[watch.ino.volume], watch.ino.index)
-		w.mu.Unlock()
-		return nil
-	}
-	e := syscall.ReadDirectoryChanges(watch.ino.handle, &watch.buf[0],
-		uint32(unsafe.Sizeof(watch.buf)), false, mask, nil, &watch.ov, 0)
-	if e != nil {
-		err := os.NewSyscallError("ReadDirectoryChanges", e)
-		if e == syscall.ERROR_ACCESS_DENIED && watch.mask&provisional == 0 {
-			// Watched directory was probably removed
-			if w.sendEvent(watch.path, watch.mask&sysFSDELETESELF) {
-				if watch.mask&sysFSONESHOT != 0 {
-					watch.mask = 0
-				}
-			}
-			err = nil
-		}
-		w.deleteWatch(watch)
-		w.startRead(watch)
-		return err
-	}
-	return nil
-}
-
-// readEvents reads from the I/O completion port, converts the
-// received events into Event objects and sends them via the Events channel.
-// Entry point to the I/O thread.
-func (w *Watcher) readEvents() {
-	var (
-		n, key uint32
-		ov     *syscall.Overlapped
-	)
-	runtime.LockOSThread()
-
-	for {
-		e := syscall.GetQueuedCompletionStatus(w.port, &n, &key, &ov, syscall.INFINITE)
-		watch := (*watch)(unsafe.Pointer(ov))
-
-		if watch == nil {
-			select {
-			case ch := <-w.quit:
-				w.mu.Lock()
-				var indexes []indexMap
-				for _, index := range w.watches {
-					indexes = append(indexes, index)
-				}
-				w.mu.Unlock()
-				for _, index := range indexes {
-					for _, watch := range index {
-						w.deleteWatch(watch)
-						w.startRead(watch)
-					}
-				}
-				var err error
-				if e := syscall.CloseHandle(w.port); e != nil {
-					err = os.NewSyscallError("CloseHandle", e)
-				}
-				close(w.Events)
-				close(w.Errors)
-				ch <- err
-				return
-			case in := <-w.input:
-				switch in.op {
-				case opAddWatch:
-					in.reply <- w.addWatch(in.path, uint64(in.flags))
-				case opRemoveWatch:
-					in.reply <- w.remWatch(in.path)
-				}
-			default:
-			}
-			continue
-		}
-
-		switch e {
-		case syscall.ERROR_MORE_DATA:
-			if watch == nil {
-				w.Errors <- errors.New("ERROR_MORE_DATA has unexpectedly null lpOverlapped buffer")
-			} else {
-				// The i/o succeeded but the buffer is full.
-				// In theory we should be building up a full packet.
-				// In practice we can get away with just carrying on.
-				n = uint32(unsafe.Sizeof(watch.buf))
-			}
-		case syscall.ERROR_ACCESS_DENIED:
-			// Watched directory was probably removed
-			w.sendEvent(watch.path, watch.mask&sysFSDELETESELF)
-			w.deleteWatch(watch)
-			w.startRead(watch)
-			continue
-		case syscall.ERROR_OPERATION_ABORTED:
-			// CancelIo was called on this handle
-			continue
-		default:
-			w.Errors <- os.NewSyscallError("GetQueuedCompletionPort", e)
-			continue
-		case nil:
-		}
-
-		var offset uint32
-		for {
-			if n == 0 {
-				w.Events <- newEvent("", sysFSQOVERFLOW)
-				w.Errors <- errors.New("short read in readEvents()")
-				break
-			}
-
-			// Point "raw" to the event in the buffer
-			raw := (*syscall.FileNotifyInformation)(unsafe.Pointer(&watch.buf[offset]))
-			buf := (*[syscall.MAX_PATH]uint16)(unsafe.Pointer(&raw.FileName))
-			name := syscall.UTF16ToString(buf[:raw.FileNameLength/2])
-			fullname := filepath.Join(watch.path, name)
-
-			var mask uint64
-			switch raw.Action {
-			case syscall.FILE_ACTION_REMOVED:
-				mask = sysFSDELETESELF
-			case syscall.FILE_ACTION_MODIFIED:
-				mask = sysFSMODIFY
-			case syscall.FILE_ACTION_RENAMED_OLD_NAME:
-				watch.rename = name
-			case syscall.FILE_ACTION_RENAMED_NEW_NAME:
-				if watch.names[watch.rename] != 0 {
-					watch.names[name] |= watch.names[watch.rename]
-					delete(watch.names, watch.rename)
-					mask = sysFSMOVESELF
-				}
-			}
-
-			sendNameEvent := func() {
-				if w.sendEvent(fullname, watch.names[name]&mask) {
-					if watch.names[name]&sysFSONESHOT != 0 {
-						delete(watch.names, name)
-					}
-				}
-			}
-			if raw.Action != syscall.FILE_ACTION_RENAMED_NEW_NAME {
-				sendNameEvent()
-			}
-			if raw.Action == syscall.FILE_ACTION_REMOVED {
-				w.sendEvent(fullname, watch.names[name]&sysFSIGNORED)
-				delete(watch.names, name)
-			}
-			if w.sendEvent(fullname, watch.mask&toFSnotifyFlags(raw.Action)) {
-				if watch.mask&sysFSONESHOT != 0 {
-					watch.mask = 0
-				}
-			}
-			if raw.Action == syscall.FILE_ACTION_RENAMED_NEW_NAME {
-				fullname = filepath.Join(watch.path, watch.rename)
-				sendNameEvent()
-			}
-
-			// Move to the next event in the buffer
-			if raw.NextEntryOffset == 0 {
-				break
-			}
-			offset += raw.NextEntryOffset
-
-			// Error!
-			if offset >= n {
-				w.Errors <- errors.New("Windows system assumed buffer larger than it is, events have likely been missed.")
-				break
-			}
-		}
-
-		if err := w.startRead(watch); err != nil {
-			w.Errors <- err
-		}
-	}
-}
-
-func (w *Watcher) sendEvent(name string, mask uint64) bool {
-	if mask == 0 {
-		return false
-	}
-	event := newEvent(name, uint32(mask))
-	select {
-	case ch := <-w.quit:
-		w.quit <- ch
-	case w.Events <- event:
-	}
-	return true
-}
-
-func toWindowsFlags(mask uint64) uint32 {
-	var m uint32
-	if mask&sysFSACCESS != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_LAST_ACCESS
-	}
-	if mask&sysFSMODIFY != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_LAST_WRITE
-	}
-	if mask&sysFSATTRIB != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_ATTRIBUTES
-	}
-	if mask&(sysFSMOVE|sysFSCREATE|sysFSDELETE) != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_FILE_NAME | syscall.FILE_NOTIFY_CHANGE_DIR_NAME
-	}
-	return m
-}
-
-func toFSnotifyFlags(action uint32) uint64 {
-	switch action {
-	case syscall.FILE_ACTION_ADDED:
-		return sysFSCREATE
-	case syscall.FILE_ACTION_REMOVED:
-		return sysFSDELETE
-	case syscall.FILE_ACTION_MODIFIED:
-		return sysFSMODIFY
-	case syscall.FILE_ACTION_RENAMED_OLD_NAME:
-		return sysFSMOVEDFROM
-	case syscall.FILE_ACTION_RENAMED_NEW_NAME:
-		return sysFSMOVEDTO
-	}
-	return 0
-}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index a62489467aae..0bb553cf93a4 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -90,10 +90,10 @@ github.com/Azure/go-autorest/tracing
 # github.com/Masterminds/goutils v1.1.1
 ## explicit
 github.com/Masterminds/goutils
-# github.com/Masterminds/semver/v3 v3.1.1
-## explicit; go 1.12
+# github.com/Masterminds/semver/v3 v3.2.0
+## explicit; go 1.18
 github.com/Masterminds/semver/v3
-# github.com/Masterminds/sprig/v3 v3.2.2
+# github.com/Masterminds/sprig/v3 v3.2.3
 ## explicit; go 1.13
 github.com/Masterminds/sprig/v3
 # github.com/Microsoft/go-winio v0.5.1
@@ -120,7 +120,7 @@ github.com/alecthomas/units
 # github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a
 ## explicit
 github.com/alicebob/gopher-json
-# github.com/alicebob/miniredis/v2 v2.22.0
+# github.com/alicebob/miniredis/v2 v2.30.0
 ## explicit; go 1.14
 github.com/alicebob/miniredis/v2
 github.com/alicebob/miniredis/v2/geohash
@@ -134,7 +134,7 @@ github.com/armon/go-metrics/prometheus
 # github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 ## explicit; go 1.13
 github.com/asaskevich/govalidator
-# github.com/aws/aws-sdk-go v1.44.128
+# github.com/aws/aws-sdk-go v1.44.156
 ## explicit; go 1.11
 github.com/aws/aws-sdk-go/aws
 github.com/aws/aws-sdk-go/aws/arn
@@ -293,12 +293,9 @@ github.com/census-instrumentation/opencensus-proto/gen-go/trace/v1
 # github.com/cespare/xxhash v1.1.0
 ## explicit
 github.com/cespare/xxhash
-# github.com/cespare/xxhash/v2 v2.1.2
+# github.com/cespare/xxhash/v2 v2.2.0
 ## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/cloudflare/cloudflare-go v0.27.0 => github.com/cyriltovena/cloudflare-go v0.27.1-0.20211118103540-ff77400bcb93
-## explicit; go 1.15
-github.com/cloudflare/cloudflare-go
 # github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4
 ## explicit; go 1.11
 github.com/cncf/udpa/go/udpa/type/v1
@@ -510,7 +507,7 @@ github.com/fsouza/fake-gcs-server/internal/backend
 ## explicit; go 1.17
 github.com/go-kit/kit/log
 github.com/go-kit/kit/log/level
-# github.com/go-kit/log v0.2.1 => github.com/dannykopping/go-kit-log v0.2.2-0.20221002180827-5591c1641b6b
+# github.com/go-kit/log v0.2.1
 ## explicit; go 1.17
 github.com/go-kit/log
 github.com/go-kit/log/level
@@ -524,7 +521,7 @@ github.com/go-logr/logr/funcr
 # github.com/go-logr/stdr v1.2.2
 ## explicit; go 1.16
 github.com/go-logr/stdr
-# github.com/go-openapi/analysis v0.21.2
+# github.com/go-openapi/analysis v0.21.4
 ## explicit; go 1.13
 github.com/go-openapi/analysis
 github.com/go-openapi/analysis/internal/debug
@@ -533,7 +530,7 @@ github.com/go-openapi/analysis/internal/flatten/operations
 github.com/go-openapi/analysis/internal/flatten/replace
 github.com/go-openapi/analysis/internal/flatten/schutils
 github.com/go-openapi/analysis/internal/flatten/sortref
-# github.com/go-openapi/errors v0.20.2
+# github.com/go-openapi/errors v0.20.3
 ## explicit; go 1.14
 github.com/go-openapi/errors
 # github.com/go-openapi/jsonpointer v0.19.5
@@ -543,19 +540,19 @@ github.com/go-openapi/jsonpointer
 ## explicit; go 1.13
 github.com/go-openapi/jsonreference
 github.com/go-openapi/jsonreference/internal
-# github.com/go-openapi/loads v0.21.1
+# github.com/go-openapi/loads v0.21.2
 ## explicit; go 1.13
 github.com/go-openapi/loads
-# github.com/go-openapi/spec v0.20.5
+# github.com/go-openapi/spec v0.20.7
 ## explicit; go 1.13
 github.com/go-openapi/spec
 # github.com/go-openapi/strfmt v0.21.3
 ## explicit; go 1.13
 github.com/go-openapi/strfmt
-# github.com/go-openapi/swag v0.21.1
-## explicit; go 1.11
+# github.com/go-openapi/swag v0.22.3
+## explicit; go 1.18
 github.com/go-openapi/swag
-# github.com/go-openapi/validate v0.21.0
+# github.com/go-openapi/validate v0.22.0
 ## explicit; go 1.14
 github.com/go-openapi/validate
 # github.com/go-redis/redis/v8 v8.11.5
@@ -678,7 +675,10 @@ github.com/gorilla/mux
 # github.com/gorilla/websocket v1.5.0
 ## explicit; go 1.12
 github.com/gorilla/websocket
-# github.com/grafana/dskit v0.0.0-20221212120341-3e308a49441b
+# github.com/grafana/cloudflare-go v0.0.0-20230110200409-c627cf6792f2
+## explicit; go 1.17
+github.com/grafana/cloudflare-go
+# github.com/grafana/dskit v0.0.0-20230109170026-7242706251b9
 ## explicit; go 1.18
 github.com/grafana/dskit/backoff
 github.com/grafana/dskit/concurrency
@@ -688,6 +688,7 @@ github.com/grafana/dskit/grpcclient
 github.com/grafana/dskit/grpcencoding/snappy
 github.com/grafana/dskit/grpcutil
 github.com/grafana/dskit/internal/math
+github.com/grafana/dskit/internal/slices
 github.com/grafana/dskit/kv
 github.com/grafana/dskit/kv/codec
 github.com/grafana/dskit/kv/consul
@@ -700,7 +701,6 @@ github.com/grafana/dskit/netutil
 github.com/grafana/dskit/ring
 github.com/grafana/dskit/ring/client
 github.com/grafana/dskit/ring/shard
-github.com/grafana/dskit/ring/util
 github.com/grafana/dskit/runtimeconfig
 github.com/grafana/dskit/services
 github.com/grafana/dskit/spanlogger
@@ -708,8 +708,8 @@ github.com/grafana/dskit/tenant
 # github.com/grafana/go-gelf/v2 v2.0.1
 ## explicit; go 1.17
 github.com/grafana/go-gelf/v2/gelf
-# github.com/grafana/gomemcache v0.0.0-20221213170046-b5da8a745d41
-## explicit; go 1.12
+# github.com/grafana/gomemcache v0.0.0-20230105173749-11f792309e1f
+## explicit; go 1.18
 github.com/grafana/gomemcache/memcache
 # github.com/grafana/regexp v0.0.0-20221005093135-b4c2bcb0a4b6
 ## explicit; go 1.17
@@ -741,7 +741,7 @@ github.com/hashicorp/errwrap
 # github.com/hashicorp/go-cleanhttp v0.5.2
 ## explicit; go 1.13
 github.com/hashicorp/go-cleanhttp
-# github.com/hashicorp/go-hclog v0.16.2
+# github.com/hashicorp/go-hclog v1.2.0
 ## explicit; go 1.13
 github.com/hashicorp/go-hclog
 # github.com/hashicorp/go-immutable-radix v1.3.1
@@ -753,6 +753,8 @@ github.com/hashicorp/go-msgpack/codec
 # github.com/hashicorp/go-multierror v1.1.1
 ## explicit; go 1.13
 github.com/hashicorp/go-multierror
+# github.com/hashicorp/go-retryablehttp v0.7.2
+## explicit; go 1.13
 # github.com/hashicorp/go-rootcerts v1.0.2
 ## explicit; go 1.12
 github.com/hashicorp/go-rootcerts
@@ -762,11 +764,11 @@ github.com/hashicorp/go-sockaddr
 # github.com/hashicorp/go-uuid v1.0.2
 ## explicit
 github.com/hashicorp/go-uuid
-# github.com/hashicorp/golang-lru v0.5.4
+# github.com/hashicorp/golang-lru v0.6.0
 ## explicit; go 1.12
 github.com/hashicorp/golang-lru
 github.com/hashicorp/golang-lru/simplelru
-# github.com/hashicorp/memberlist v0.3.1 => github.com/grafana/memberlist v0.3.1-0.20220714140823-09ffed8adbbe
+# github.com/hashicorp/memberlist v0.5.0 => github.com/grafana/memberlist v0.3.1-0.20220714140823-09ffed8adbbe
 ## explicit; go 1.12
 github.com/hashicorp/memberlist
 # github.com/hashicorp/serf v0.9.7
@@ -775,10 +777,10 @@ github.com/hashicorp/serf/coordinate
 # github.com/heroku/x v0.0.50
 ## explicit; go 1.12
 github.com/heroku/x/logplex/encoding
-# github.com/huandu/xstrings v1.3.1
+# github.com/huandu/xstrings v1.3.3
 ## explicit; go 1.12
 github.com/huandu/xstrings
-# github.com/imdario/mergo v0.3.12
+# github.com/imdario/mergo v0.3.13
 ## explicit; go 1.13
 github.com/imdario/mergo
 # github.com/influxdata/go-syslog/v3 v3.0.1-0.20201128200927-a1889d947b48
@@ -892,7 +894,7 @@ github.com/mattn/go-ieproxy
 # github.com/mattn/go-isatty v0.0.14
 ## explicit; go 1.12
 github.com/mattn/go-isatty
-# github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369
+# github.com/matttproud/golang_protobuf_extensions v1.0.4
 ## explicit; go 1.9
 github.com/matttproud/golang_protobuf_extensions/pbutil
 # github.com/miekg/dns v1.1.50
@@ -995,11 +997,11 @@ github.com/pkg/errors
 # github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 ## explicit
 github.com/pmezard/go-difflib/difflib
-# github.com/prometheus/alertmanager v0.24.0
-## explicit; go 1.16
+# github.com/prometheus/alertmanager v0.25.0
+## explicit; go 1.18
 github.com/prometheus/alertmanager/api/v2/models
 github.com/prometheus/alertmanager/pkg/modtimevfs
-# github.com/prometheus/client_golang v1.13.1
+# github.com/prometheus/client_golang v1.14.0
 ## explicit; go 1.17
 github.com/prometheus/client_golang/api
 github.com/prometheus/client_golang/api/prometheus/v1
@@ -1014,8 +1016,8 @@ github.com/prometheus/client_golang/prometheus/testutil/promlint
 # github.com/prometheus/client_model v0.3.0
 ## explicit; go 1.9
 github.com/prometheus/client_model/go
-# github.com/prometheus/common v0.37.0
-## explicit; go 1.16
+# github.com/prometheus/common v0.39.0
+## explicit; go 1.17
 github.com/prometheus/common/config
 github.com/prometheus/common/expfmt
 github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg
@@ -1098,8 +1100,6 @@ github.com/prometheus/prometheus/web/api/v1
 # github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
 ## explicit
 github.com/rcrowley/go-metrics
-# github.com/rogpeppe/go-internal v1.9.0
-## explicit; go 1.17
 # github.com/rs/xid v1.4.0
 ## explicit; go 1.12
 github.com/rs/xid
@@ -1151,6 +1151,7 @@ github.com/stretchr/objx
 github.com/stretchr/testify/assert
 github.com/stretchr/testify/mock
 github.com/stretchr/testify/require
+github.com/stretchr/testify/suite
 # github.com/thanos-io/objstore v0.0.0-20220715165016-ce338803bc1e
 ## explicit; go 1.17
 github.com/thanos-io/objstore
@@ -1235,8 +1236,8 @@ github.com/xdg-go/scram
 # github.com/xdg-go/stringprep v1.0.3
 ## explicit; go 1.11
 github.com/xdg-go/stringprep
-# github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9
-## explicit; go 1.14
+# github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64
+## explicit; go 1.17
 github.com/yuin/gopher-lua
 github.com/yuin/gopher-lua/ast
 github.com/yuin/gopher-lua/parse
@@ -1266,8 +1267,8 @@ go.etcd.io/etcd/client/v3
 go.etcd.io/etcd/client/v3/credentials
 go.etcd.io/etcd/client/v3/internal/endpoint
 go.etcd.io/etcd/client/v3/internal/resolver
-# go.mongodb.org/mongo-driver v1.10.2
-## explicit; go 1.10
+# go.mongodb.org/mongo-driver v1.11.0
+## explicit; go 1.13
 go.mongodb.org/mongo-driver/bson
 go.mongodb.org/mongo-driver/bson/bsoncodec
 go.mongodb.org/mongo-driver/bson/bsonoptions
@@ -1365,10 +1366,10 @@ golang.org/x/crypto/sha3
 ## explicit; go 1.18
 golang.org/x/exp/constraints
 golang.org/x/exp/slices
-# golang.org/x/mod v0.6.0
+# golang.org/x/mod v0.7.0
 ## explicit; go 1.17
 golang.org/x/mod/semver
-# golang.org/x/net v0.3.0
+# golang.org/x/net v0.5.0
 ## explicit; go 1.17
 golang.org/x/net/bpf
 golang.org/x/net/context
@@ -1388,7 +1389,7 @@ golang.org/x/net/netutil
 golang.org/x/net/proxy
 golang.org/x/net/publicsuffix
 golang.org/x/net/trace
-# golang.org/x/oauth2 v0.1.0
+# golang.org/x/oauth2 v0.4.0
 ## explicit; go 1.17
 golang.org/x/oauth2
 golang.org/x/oauth2/authhandler
@@ -1402,7 +1403,7 @@ golang.org/x/oauth2/jwt
 ## explicit
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
-# golang.org/x/sys v0.3.0
+# golang.org/x/sys v0.4.0
 ## explicit; go 1.17
 golang.org/x/sys/cpu
 golang.org/x/sys/execabs
@@ -1412,10 +1413,10 @@ golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
 golang.org/x/sys/windows/svc/eventlog
-# golang.org/x/term v0.3.0
+# golang.org/x/term v0.4.0
 ## explicit; go 1.17
 golang.org/x/term
-# golang.org/x/text v0.5.0
+# golang.org/x/text v0.6.0
 ## explicit; go 1.17
 golang.org/x/text/cases
 golang.org/x/text/encoding
@@ -1439,22 +1440,22 @@ golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
 golang.org/x/text/unicode/bidi
 golang.org/x/text/unicode/norm
-# golang.org/x/time v0.1.0
+# golang.org/x/time v0.3.0
 ## explicit
 golang.org/x/time/rate
-# golang.org/x/tools v0.2.0
+# golang.org/x/tools v0.4.0
 ## explicit; go 1.18
 golang.org/x/tools/go/gcexportdata
-golang.org/x/tools/go/internal/gcimporter
 golang.org/x/tools/go/internal/packagesdriver
-golang.org/x/tools/go/internal/pkgbits
 golang.org/x/tools/go/packages
 golang.org/x/tools/internal/event
 golang.org/x/tools/internal/event/core
 golang.org/x/tools/internal/event/keys
 golang.org/x/tools/internal/event/label
+golang.org/x/tools/internal/gcimporter
 golang.org/x/tools/internal/gocommand
 golang.org/x/tools/internal/packagesinternal
+golang.org/x/tools/internal/pkgbits
 golang.org/x/tools/internal/typeparams
 golang.org/x/tools/internal/typesinternal
 # golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
@@ -1513,8 +1514,8 @@ google.golang.org/genproto/googleapis/rpc/status
 google.golang.org/genproto/googleapis/type/date
 google.golang.org/genproto/googleapis/type/expr
 google.golang.org/genproto/protobuf/field_mask
-# google.golang.org/grpc v1.50.1 => google.golang.org/grpc v1.45.0
-## explicit; go 1.14
+# google.golang.org/grpc v1.50.1
+## explicit; go 1.17
 google.golang.org/grpc
 google.golang.org/grpc/attributes
 google.golang.org/grpc/backoff
@@ -1528,6 +1529,7 @@ google.golang.org/grpc/balancer/weightedroundrobin
 google.golang.org/grpc/balancer/weightedtarget
 google.golang.org/grpc/balancer/weightedtarget/weightedaggregator
 google.golang.org/grpc/binarylog/grpc_binarylog_v1
+google.golang.org/grpc/channelz
 google.golang.org/grpc/codes
 google.golang.org/grpc/connectivity
 google.golang.org/grpc/credentials
@@ -1551,6 +1553,7 @@ google.golang.org/grpc/health/grpc_health_v1
 google.golang.org/grpc/internal
 google.golang.org/grpc/internal/admin
 google.golang.org/grpc/internal/backoff
+google.golang.org/grpc/internal/balancer/gracefulswitch
 google.golang.org/grpc/internal/balancergroup
 google.golang.org/grpc/internal/balancerload
 google.golang.org/grpc/internal/binarylog
@@ -1568,6 +1571,7 @@ google.golang.org/grpc/internal/grpcutil
 google.golang.org/grpc/internal/hierarchy
 google.golang.org/grpc/internal/metadata
 google.golang.org/grpc/internal/pretty
+google.golang.org/grpc/internal/proto/grpc_lookup_v1
 google.golang.org/grpc/internal/resolver
 google.golang.org/grpc/internal/resolver/dns
 google.golang.org/grpc/internal/resolver/passthrough
@@ -1601,9 +1605,11 @@ google.golang.org/grpc/xds/internal/balancer/clusterimpl
 google.golang.org/grpc/xds/internal/balancer/clustermanager
 google.golang.org/grpc/xds/internal/balancer/clusterresolver
 google.golang.org/grpc/xds/internal/balancer/loadstore
+google.golang.org/grpc/xds/internal/balancer/outlierdetection
 google.golang.org/grpc/xds/internal/balancer/priority
 google.golang.org/grpc/xds/internal/balancer/ringhash
 google.golang.org/grpc/xds/internal/clusterspecifier
+google.golang.org/grpc/xds/internal/clusterspecifier/rls
 google.golang.org/grpc/xds/internal/httpfilter
 google.golang.org/grpc/xds/internal/httpfilter/fault
 google.golang.org/grpc/xds/internal/httpfilter/rbac
@@ -1661,9 +1667,6 @@ google.golang.org/protobuf/types/known/wrapperspb
 # gopkg.in/alecthomas/kingpin.v2 v2.2.6
 ## explicit
 gopkg.in/alecthomas/kingpin.v2
-# gopkg.in/fsnotify.v1 v1.4.7
-## explicit
-gopkg.in/fsnotify.v1
 # gopkg.in/fsnotify/fsnotify.v1 v1.4.7
 ## explicit
 gopkg.in/fsnotify/fsnotify.v1
@@ -1953,7 +1956,4 @@ sigs.k8s.io/yaml
 # github.com/Azure/azure-storage-blob-go => github.com/MasslessParticle/azure-storage-blob-go v0.14.1-0.20220216145902-b5e698eff68e
 # github.com/hashicorp/consul => github.com/hashicorp/consul v1.5.1
 # github.com/gocql/gocql => github.com/grafana/gocql v0.0.0-20200605141915-ba5dc39ece85
-# github.com/cloudflare/cloudflare-go => github.com/cyriltovena/cloudflare-go v0.27.1-0.20211118103540-ff77400bcb93
-# google.golang.org/grpc => google.golang.org/grpc v1.45.0
 # github.com/hashicorp/memberlist => github.com/grafana/memberlist v0.3.1-0.20220714140823-09ffed8adbbe
-# github.com/go-kit/log => github.com/dannykopping/go-kit-log v0.2.2-0.20221002180827-5591c1641b6b