go.mod: Bump k8s deps to v0.24.0

This ends up bumping the prometheus client as well.

Signed-off-by: Daniel Canter <dcanter@microsoft.com>

vendor/k8s.io/api/authentication/v1/generated.pb.go

@@ -316,64 +316,64 @@ func init() {
 }
 
 var fileDescriptor_2953ea822e7ffe1e = []byte{
-	// 906 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x55, 0xcf, 0x6f, 0xe3, 0xc4,
-	0x17, 0x8f, 0xf3, 0xa3, 0x4a, 0x26, 0xdb, 0x7e, 0xdb, 0xd9, 0xef, 0x4a, 0x51, 0x81, 0xa4, 0x78,
-	0x25, 0x54, 0x01, 0x6b, 0x6f, 0x22, 0x04, 0xab, 0x45, 0x42, 0xaa, 0x69, 0x04, 0x11, 0x82, 0x5d,
-	0xcd, 0x6e, 0x0b, 0xe2, 0xc4, 0xc4, 0x7e, 0x4d, 0x87, 0xe0, 0xb1, 0xb1, 0xc7, 0x61, 0x73, 0xdb,
-	0x3f, 0x81, 0x23, 0x48, 0x1c, 0xf8, 0x23, 0x90, 0xf8, 0x17, 0x7a, 0x5c, 0x71, 0xda, 0x03, 0x8a,
-	0xa8, 0xb9, 0x72, 0xe4, 0xc4, 0x09, 0xcd, 0x78, 0x5a, 0xc7, 0x49, 0x9b, 0xe6, 0xc4, 0x2d, 0x7e,
-	0xef, 0xf3, 0x3e, 0xef, 0xbd, 0xcf, 0x7c, 0x32, 0x83, 0xfa, 0xe3, 0x07, 0xb1, 0xc5, 0x02, 0x7b,
-	0x9c, 0x0c, 0x21, 0xe2, 0x20, 0x20, 0xb6, 0x27, 0xc0, 0xbd, 0x20, 0xb2, 0x75, 0x82, 0x86, 0xcc,
-	0xa6, 0x89, 0x38, 0x05, 0x2e, 0x98, 0x4b, 0x05, 0x0b, 0xb8, 0x3d, 0xe9, 0xda, 0x23, 0xe0, 0x10,
-	0x51, 0x01, 0x9e, 0x15, 0x46, 0x81, 0x08, 0xf0, 0xab, 0x19, 0xda, 0xa2, 0x21, 0xb3, 0x8a, 0x68,
-	0x6b, 0xd2, 0xdd, 0xbd, 0x37, 0x62, 0xe2, 0x34, 0x19, 0x5a, 0x6e, 0xe0, 0xdb, 0xa3, 0x60, 0x14,
-	0xd8, 0xaa, 0x68, 0x98, 0x9c, 0xa8, 0x2f, 0xf5, 0xa1, 0x7e, 0x65, 0x64, 0xbb, 0xef, 0xe4, 0xad,
-	0x7d, 0xea, 0x9e, 0x32, 0x0e, 0xd1, 0xd4, 0x0e, 0xc7, 0x23, 0x19, 0x88, 0x6d, 0x1f, 0x04, 0xbd,
-	0x62, 0x84, 0x5d, 0xfb, 0xba, 0xaa, 0x28, 0xe1, 0x82, 0xf9, 0xb0, 0x54, 0xf0, 0xee, 0x4d, 0x05,
-	0xb1, 0x7b, 0x0a, 0x3e, 0x5d, 0xac, 0x33, 0x7f, 0x33, 0xd0, 0xff, 0x9d, 0x20, 0xe1, 0xde, 0xa3,
-	0xe1, 0xd7, 0xe0, 0x0a, 0x02, 0x27, 0x10, 0x01, 0x77, 0x01, 0xef, 0xa1, 0xea, 0x98, 0x71, 0xaf,
-	0x65, 0xec, 0x19, 0xfb, 0x0d, 0xe7, 0xd6, 0xd9, 0xac, 0x53, 0x4a, 0x67, 0x9d, 0xea, 0x27, 0x8c,
-	0x7b, 0x44, 0x65, 0x70, 0x0f, 0x21, 0x1a, 0xb2, 0x63, 0x88, 0x62, 0x16, 0xf0, 0x56, 0x59, 0xe1,
-	0xb0, 0xc6, 0xa1, 0x83, 0xc7, 0x03, 0x9d, 0x21, 0x73, 0x28, 0xc9, 0xca, 0xa9, 0x0f, 0xad, 0x4a,
-	0x91, 0xf5, 0x33, 0xea, 0x03, 0x51, 0x19, 0xec, 0xa0, 0x4a, 0x32, 0x38, 0x6c, 0x55, 0x15, 0xe0,
-	0xbe, 0x06, 0x54, 0x8e, 0x06, 0x87, 0xff, 0xcc, 0x3a, 0xaf, 0x5f, 0xb7, 0xa4, 0x98, 0x86, 0x10,
-	0x5b, 0x47, 0x83, 0x43, 0x22, 0x8b, 0xcd, 0xf7, 0x10, 0xea, 0x3f, 0x13, 0x11, 0x3d, 0xa6, 0xdf,
-	0x24, 0x80, 0x3b, 0xa8, 0xc6, 0x04, 0xf8, 0x71, 0xcb, 0xd8, 0xab, 0xec, 0x37, 0x9c, 0x46, 0x3a,
-	0xeb, 0xd4, 0x06, 0x32, 0x40, 0xb2, 0xf8, 0xc3, 0xfa, 0x0f, 0x3f, 0x77, 0x4a, 0xcf, 0x7f, 0xdf,
-	0x2b, 0x99, 0x3f, 0x95, 0xd1, 0xad, 0xa7, 0xc1, 0x18, 0x38, 0x81, 0x6f, 0x13, 0x88, 0x05, 0xfe,
-	0x0a, 0xd5, 0xe5, 0x11, 0x79, 0x54, 0x50, 0xa5, 0x44, 0xb3, 0x77, 0xdf, 0xca, 0xdd, 0x71, 0x39,
-	0x84, 0x15, 0x8e, 0x47, 0x32, 0x10, 0x5b, 0x12, 0x6d, 0x4d, 0xba, 0x56, 0x26, 0xe7, 0xa7, 0x20,
-	0x68, 0xae, 0x49, 0x1e, 0x23, 0x97, 0xac, 0xf8, 0x31, 0xaa, 0xc6, 0x21, 0xb8, 0x4a, 0xbf, 0x66,
-	0xcf, 0xb2, 0x56, 0x79, 0xcf, 0x9a, 0x9f, 0xed, 0x49, 0x08, 0x6e, 0xae, 0xa0, 0xfc, 0x22, 0x8a,
-	0x09, 0x7f, 0x81, 0x36, 0x62, 0x41, 0x45, 0x12, 0x2b, 0x95, 0x8b, 0x13, 0xdf, 0xc4, 0xa9, 0xea,
-	0x9c, 0x2d, 0xcd, 0xba, 0x91, 0x7d, 0x13, 0xcd, 0x67, 0xfe, 0x6d, 0xa0, 0xed, 0xc5, 0x11, 0xf0,
-	0x5b, 0xa8, 0x41, 0x13, 0x8f, 0x49, 0xd3, 0x5c, 0x48, 0xbc, 0x99, 0xce, 0x3a, 0x8d, 0x83, 0x8b,
-	0x20, 0xc9, 0xf3, 0xf8, 0x43, 0xb4, 0x03, 0xcf, 0x42, 0x16, 0xa9, 0xee, 0x4f, 0xc0, 0x0d, 0xb8,
-	0x17, 0xab, 0xb3, 0xae, 0x38, 0x77, 0xd2, 0x59, 0x67, 0xa7, 0xbf, 0x98, 0x24, 0xcb, 0x78, 0xcc,
-	0xd1, 0xd6, 0xb0, 0x60, 0x59, 0xbd, 0x68, 0x6f, 0xf5, 0xa2, 0x57, 0xd9, 0xdc, 0xc1, 0xe9, 0xac,
-	0xb3, 0x55, 0xcc, 0x90, 0x05, 0x76, 0xf3, 0x17, 0x03, 0xe1, 0x65, 0x95, 0xf0, 0x5d, 0x54, 0x13,
-	0x32, 0xaa, 0xff, 0x22, 0x9b, 0x5a, 0xb4, 0x5a, 0x06, 0xcd, 0x72, 0x78, 0x8a, 0x6e, 0xe7, 0x0b,
-	0x3c, 0x65, 0x3e, 0xc4, 0x82, 0xfa, 0xa1, 0x3e, 0xed, 0x37, 0xd7, 0xf3, 0x92, 0x2c, 0x73, 0x5e,
-	0xd1, 0xf4, 0xb7, 0xfb, 0xcb, 0x74, 0xe4, 0xaa, 0x1e, 0xe6, 0x8f, 0x65, 0xd4, 0xd4, 0x63, 0x4f,
-	0x18, 0x7c, 0xf7, 0x1f, 0x78, 0xf9, 0x51, 0xc1, 0xcb, 0xf7, 0xd6, 0xf2, 0x9d, 0x1c, 0xed, 0x5a,
-	0x2b, 0x7f, 0xbe, 0x60, 0x65, 0x7b, 0x7d, 0xca, 0xd5, 0x4e, 0x76, 0xd1, 0xff, 0x16, 0xfa, 0xaf,
-	0x77, 0x9c, 0x05, 0xb3, 0x97, 0x57, 0x9b, 0xdd, 0xfc, 0xcb, 0x40, 0x3b, 0x4b, 0x23, 0xe1, 0xf7,
-	0xd1, 0xe6, 0xdc, 0xe4, 0x90, 0xdd, 0xb0, 0x75, 0xe7, 0x8e, 0xee, 0xb7, 0x79, 0x30, 0x9f, 0x24,
-	0x45, 0x2c, 0xfe, 0x18, 0x55, 0x93, 0x18, 0x22, 0xad, 0xf0, 0x1b, 0xab, 0xe5, 0x38, 0x8a, 0x21,
-	0x1a, 0xf0, 0x93, 0x20, 0x97, 0x56, 0x46, 0x88, 0x62, 0x28, 0x6e, 0x52, 0xbd, 0xe1, 0x6f, 0x7b,
-	0x17, 0xd5, 0x20, 0x8a, 0x82, 0x48, 0xdf, 0xdb, 0x97, 0xda, 0xf4, 0x65, 0x90, 0x64, 0x39, 0xf3,
-	0xd7, 0x32, 0xaa, 0x5f, 0xb4, 0xc4, 0x6f, 0xa3, 0xba, 0x6c, 0xa3, 0x2e, 0xfb, 0x4c, 0xd0, 0x6d,
-	0x5d, 0xa4, 0x30, 0x32, 0x4e, 0x2e, 0x11, 0xf8, 0x35, 0x54, 0x49, 0x98, 0xa7, 0xdf, 0x90, 0xe6,
-	0xdc, 0xa5, 0x4f, 0x64, 0x1c, 0x9b, 0x68, 0x63, 0x14, 0x05, 0x49, 0x28, 0x6d, 0x20, 0x07, 0x45,
-	0xf2, 0x44, 0x3f, 0x52, 0x11, 0xa2, 0x33, 0xf8, 0x18, 0xd5, 0x40, 0xde, 0xf9, 0x6a, 0x97, 0x66,
-	0xaf, 0xbb, 0x9e, 0x34, 0x96, 0x7a, 0x27, 0xfa, 0x5c, 0x44, 0xd3, 0xb9, 0xad, 0x64, 0x8c, 0x64,
-	0x74, 0xbb, 0x43, 0xfd, 0x96, 0x28, 0x0c, 0xde, 0x46, 0x95, 0x31, 0x4c, 0xb3, 0x8d, 0x88, 0xfc,
-	0x89, 0x3f, 0x40, 0xb5, 0x89, 0x7c, 0x66, 0xf4, 0x91, 0xec, 0xaf, 0xee, 0x9b, 0x3f, 0x4b, 0x24,
-	0x2b, 0x7b, 0x58, 0x7e, 0x60, 0x38, 0xfb, 0x67, 0xe7, 0xed, 0xd2, 0x8b, 0xf3, 0x76, 0xe9, 0xe5,
-	0x79, 0xbb, 0xf4, 0x3c, 0x6d, 0x1b, 0x67, 0x69, 0xdb, 0x78, 0x91, 0xb6, 0x8d, 0x97, 0x69, 0xdb,
-	0xf8, 0x23, 0x6d, 0x1b, 0xdf, 0xff, 0xd9, 0x2e, 0x7d, 0x59, 0x9e, 0x74, 0xff, 0x0d, 0x00, 0x00,
-	0xff, 0xff, 0x51, 0xcc, 0x53, 0x28, 0xe2, 0x08, 0x00, 0x00,
+	// 907 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0xcf, 0x6f, 0xe3, 0x44,
+	0x14, 0x8e, 0xf3, 0xa3, 0x4a, 0x26, 0xdb, 0xd2, 0xce, 0xb2, 0x52, 0x54, 0x96, 0xa4, 0x78, 0x25,
+	0x54, 0x01, 0x6b, 0x6f, 0x23, 0x04, 0xab, 0x45, 0x42, 0xaa, 0x69, 0x04, 0x11, 0x82, 0x5d, 0xcd,
+	0x6e, 0x0b, 0xe2, 0xc4, 0xc4, 0x7e, 0x4d, 0x87, 0xe0, 0xb1, 0xb1, 0xc7, 0x61, 0x73, 0xdb, 0x3f,
+	0x81, 0x23, 0x48, 0x1c, 0xf8, 0x23, 0x90, 0xf8, 0x17, 0x7a, 0x5c, 0x71, 0xea, 0x01, 0x45, 0xd4,
+	0x5c, 0x39, 0x72, 0xe2, 0x84, 0x66, 0x3c, 0xad, 0xe3, 0xa4, 0x4d, 0x73, 0xe2, 0x96, 0x79, 0xef,
+	0x7b, 0xdf, 0xbc, 0xf7, 0xcd, 0xe7, 0x99, 0xa0, 0xde, 0xe8, 0x61, 0x6c, 0xb1, 0xc0, 0x1e, 0x25,
+	0x03, 0x88, 0x38, 0x08, 0x88, 0xed, 0x31, 0x70, 0x2f, 0x88, 0x6c, 0x9d, 0xa0, 0x21, 0xb3, 0x69,
+	0x22, 0x4e, 0x80, 0x0b, 0xe6, 0x52, 0xc1, 0x02, 0x6e, 0x8f, 0xf7, 0xec, 0x21, 0x70, 0x88, 0xa8,
+	0x00, 0xcf, 0x0a, 0xa3, 0x40, 0x04, 0xf8, 0x6e, 0x86, 0xb6, 0x68, 0xc8, 0xac, 0x22, 0xda, 0x1a,
+	0xef, 0x6d, 0xdf, 0x1f, 0x32, 0x71, 0x92, 0x0c, 0x2c, 0x37, 0xf0, 0xed, 0x61, 0x30, 0x0c, 0x6c,
+	0x55, 0x34, 0x48, 0x8e, 0xd5, 0x4a, 0x2d, 0xd4, 0xaf, 0x8c, 0x6c, 0xfb, 0xdd, 0x7c, 0x6b, 0x9f,
+	0xba, 0x27, 0x8c, 0x43, 0x34, 0xb1, 0xc3, 0xd1, 0x50, 0x06, 0x62, 0xdb, 0x07, 0x41, 0xaf, 0x68,
+	0x61, 0xdb, 0xbe, 0xae, 0x2a, 0x4a, 0xb8, 0x60, 0x3e, 0x2c, 0x14, 0xbc, 0x77, 0x53, 0x41, 0xec,
+	0x9e, 0x80, 0x4f, 0xe7, 0xeb, 0xcc, 0xdf, 0x0d, 0xf4, 0xaa, 0x13, 0x24, 0xdc, 0x7b, 0x3c, 0xf8,
+	0x06, 0x5c, 0x41, 0xe0, 0x18, 0x22, 0xe0, 0x2e, 0xe0, 0x1d, 0x54, 0x1d, 0x31, 0xee, 0xb5, 0x8c,
+	0x1d, 0x63, 0xb7, 0xe1, 0xdc, 0x3a, 0x9d, 0x76, 0x4a, 0xe9, 0xb4, 0x53, 0xfd, 0x94, 0x71, 0x8f,
+	0xa8, 0x0c, 0xee, 0x22, 0x44, 0x43, 0x76, 0x04, 0x51, 0xcc, 0x02, 0xde, 0x2a, 0x2b, 0x1c, 0xd6,
+	0x38, 0xb4, 0xff, 0xa4, 0xaf, 0x33, 0x64, 0x06, 0x25, 0x59, 0x39, 0xf5, 0xa1, 0x55, 0x29, 0xb2,
+	0x7e, 0x4e, 0x7d, 0x20, 0x2a, 0x83, 0x1d, 0x54, 0x49, 0xfa, 0x07, 0xad, 0xaa, 0x02, 0x3c, 0xd0,
+	0x80, 0xca, 0x61, 0xff, 0xe0, 0xdf, 0x69, 0xe7, 0x8d, 0xeb, 0x86, 0x14, 0x93, 0x10, 0x62, 0xeb,
+	0xb0, 0x7f, 0x40, 0x64, 0xb1, 0xf9, 0x3e, 0x42, 0xbd, 0xe7, 0x22, 0xa2, 0x47, 0xf4, 0xdb, 0x04,
+	0x70, 0x07, 0xd5, 0x98, 0x00, 0x3f, 0x6e, 0x19, 0x3b, 0x95, 0xdd, 0x86, 0xd3, 0x48, 0xa7, 0x9d,
+	0x5a, 0x5f, 0x06, 0x48, 0x16, 0x7f, 0x54, 0xff, 0xf1, 0x97, 0x4e, 0xe9, 0xc5, 0x1f, 0x3b, 0x25,
+	0xf3, 0xe7, 0x32, 0xba, 0xf5, 0x2c, 0x18, 0x01, 0x27, 0xf0, 0x5d, 0x02, 0xb1, 0xc0, 0x5f, 0xa3,
+	0xba, 0x3c, 0x22, 0x8f, 0x0a, 0xaa, 0x94, 0x68, 0x76, 0x1f, 0x58, 0xb9, 0x3b, 0x2e, 0x9b, 0xb0,
+	0xc2, 0xd1, 0x50, 0x06, 0x62, 0x4b, 0xa2, 0xad, 0xf1, 0x9e, 0x95, 0xc9, 0xf9, 0x19, 0x08, 0x9a,
+	0x6b, 0x92, 0xc7, 0xc8, 0x25, 0x2b, 0x7e, 0x82, 0xaa, 0x71, 0x08, 0xae, 0xd2, 0xaf, 0xd9, 0xb5,
+	0xac, 0x65, 0xde, 0xb3, 0x66, 0x7b, 0x7b, 0x1a, 0x82, 0x9b, 0x2b, 0x28, 0x57, 0x44, 0x31, 0xe1,
+	0x2f, 0xd1, 0x5a, 0x2c, 0xa8, 0x48, 0x62, 0xa5, 0x72, 0xb1, 0xe3, 0x9b, 0x38, 0x55, 0x9d, 0xb3,
+	0xa1, 0x59, 0xd7, 0xb2, 0x35, 0xd1, 0x7c, 0xe6, 0x3f, 0x06, 0xda, 0x9c, 0x6f, 0x01, 0xbf, 0x8d,
+	0x1a, 0x34, 0xf1, 0x98, 0x34, 0xcd, 0x85, 0xc4, 0xeb, 0xe9, 0xb4, 0xd3, 0xd8, 0xbf, 0x08, 0x92,
+	0x3c, 0x8f, 0x3f, 0x42, 0x5b, 0xf0, 0x3c, 0x64, 0x91, 0xda, 0xfd, 0x29, 0xb8, 0x01, 0xf7, 0x62,
+	0x75, 0xd6, 0x15, 0xe7, 0x4e, 0x3a, 0xed, 0x6c, 0xf5, 0xe6, 0x93, 0x64, 0x11, 0x8f, 0x39, 0xda,
+	0x18, 0x14, 0x2c, 0xab, 0x07, 0xed, 0x2e, 0x1f, 0xf4, 0x2a, 0x9b, 0x3b, 0x38, 0x9d, 0x76, 0x36,
+	0x8a, 0x19, 0x32, 0xc7, 0x6e, 0xfe, 0x6a, 0x20, 0xbc, 0xa8, 0x12, 0xbe, 0x87, 0x6a, 0x42, 0x46,
+	0xf5, 0x27, 0xb2, 0xae, 0x45, 0xab, 0x65, 0xd0, 0x2c, 0x87, 0x27, 0xe8, 0x76, 0x3e, 0xc0, 0x33,
+	0xe6, 0x43, 0x2c, 0xa8, 0x1f, 0xea, 0xd3, 0x7e, 0x6b, 0x35, 0x2f, 0xc9, 0x32, 0xe7, 0x35, 0x4d,
+	0x7f, 0xbb, 0xb7, 0x48, 0x47, 0xae, 0xda, 0xc3, 0xfc, 0xa9, 0x8c, 0x9a, 0xba, 0xed, 0x31, 0x83,
+	0xef, 0xff, 0x07, 0x2f, 0x3f, 0x2e, 0x78, 0xf9, 0xfe, 0x4a, 0xbe, 0x93, 0xad, 0x5d, 0x6b, 0xe5,
+	0x2f, 0xe6, 0xac, 0x6c, 0xaf, 0x4e, 0xb9, 0xdc, 0xc9, 0x2e, 0x7a, 0x65, 0x6e, 0xff, 0xd5, 0x8e,
+	0xb3, 0x60, 0xf6, 0xf2, 0x72, 0xb3, 0x9b, 0x7f, 0x1b, 0x68, 0x6b, 0xa1, 0x25, 0xfc, 0x01, 0x5a,
+	0x9f, 0xe9, 0x1c, 0xb2, 0x1b, 0xb6, 0xee, 0xdc, 0xd1, 0xfb, 0xad, 0xef, 0xcf, 0x26, 0x49, 0x11,
+	0x8b, 0x3f, 0x41, 0xd5, 0x24, 0x86, 0x48, 0x2b, 0xfc, 0xe6, 0x72, 0x39, 0x0e, 0x63, 0x88, 0xfa,
+	0xfc, 0x38, 0xc8, 0xa5, 0x95, 0x11, 0xa2, 0x18, 0x8a, 0x93, 0x54, 0x6f, 0xf8, 0x6c, 0xef, 0xa1,
+	0x1a, 0x44, 0x51, 0x10, 0xe9, 0x7b, 0xfb, 0x52, 0x9b, 0x9e, 0x0c, 0x92, 0x2c, 0x67, 0xfe, 0x56,
+	0x46, 0xf5, 0x8b, 0x2d, 0xf1, 0x3b, 0xa8, 0x2e, 0xb7, 0x51, 0x97, 0x7d, 0x26, 0xe8, 0xa6, 0x2e,
+	0x52, 0x18, 0x19, 0x27, 0x97, 0x08, 0xfc, 0x3a, 0xaa, 0x24, 0xcc, 0xd3, 0x6f, 0x48, 0x73, 0xe6,
+	0xd2, 0x27, 0x32, 0x8e, 0x4d, 0xb4, 0x36, 0x8c, 0x82, 0x24, 0x94, 0x36, 0x90, 0x8d, 0x22, 0x79,
+	0xa2, 0x1f, 0xab, 0x08, 0xd1, 0x19, 0x7c, 0x84, 0x6a, 0x20, 0xef, 0x7c, 0x35, 0x4b, 0xb3, 0xbb,
+	0xb7, 0x9a, 0x34, 0x96, 0x7a, 0x27, 0x7a, 0x5c, 0x44, 0x93, 0x99, 0xa9, 0x64, 0x8c, 0x64, 0x74,
+	0xdb, 0x03, 0xfd, 0x96, 0x28, 0x0c, 0xde, 0x44, 0x95, 0x11, 0x4c, 0xb2, 0x89, 0x88, 0xfc, 0x89,
+	0x3f, 0x44, 0xb5, 0xb1, 0x7c, 0x66, 0xf4, 0x91, 0xec, 0x2e, 0xdf, 0x37, 0x7f, 0x96, 0x48, 0x56,
+	0xf6, 0xa8, 0xfc, 0xd0, 0x70, 0x9c, 0xd3, 0xf3, 0x76, 0xe9, 0xe5, 0x79, 0xbb, 0x74, 0x76, 0xde,
+	0x2e, 0xbd, 0x48, 0xdb, 0xc6, 0x69, 0xda, 0x36, 0x5e, 0xa6, 0x6d, 0xe3, 0x2c, 0x6d, 0x1b, 0x7f,
+	0xa6, 0x6d, 0xe3, 0x87, 0xbf, 0xda, 0xa5, 0xaf, 0xee, 0x2e, 0xfb, 0x13, 0xf3, 0x5f, 0x00, 0x00,
+	0x00, 0xff, 0xff, 0x12, 0xb8, 0x31, 0x91, 0xfc, 0x08, 0x00, 0x00,
 }
 
 func (m *BoundObjectReference) Marshal() (dAtA []byte, err error) {

vendor/k8s.io/api/authentication/v1/generated.proto

@@ -26,7 +26,7 @@ import "k8s.io/apimachinery/pkg/runtime/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 
 // Package-wide variables from generator "generated".
-option go_package = "v1";
+option go_package = "k8s.io/api/authentication/v1";
 
 // BoundObjectReference is a reference to an object that a token is bound to.
 message BoundObjectReference {

vendor/k8s.io/api/authentication/v1/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/api/core/v1/annotation_key_constants.go

@@ -121,7 +121,7 @@ const (
 	EndpointsLastChangeTriggerTime = "endpoints.kubernetes.io/last-change-trigger-time"
 
 	// EndpointsOverCapacity will be set on an Endpoints resource when it
-	// exceeds the maximum capacity of 1000 addresses. Inititially the Endpoints
+	// exceeds the maximum capacity of 1000 addresses. Initially the Endpoints
 	// controller will set this annotation with a value of "warning". In a
 	// future release, the controller may set this annotation with a value of
 	// "truncated" to indicate that any addresses exceeding the limit of 1000

vendor/k8s.io/api/core/v1/well_known_taints.go

@@ -45,4 +45,8 @@ const (
 	// TaintNodePIDPressure will be added when node has pid pressure
 	// and removed when node has enough pid.
 	TaintNodePIDPressure = "node.kubernetes.io/pid-pressure"
+
+	// TaintNodeOutOfService can be added when node is out of service in case of
+	// a non-graceful shutdown
+	TaintNodeOutOfService = "node.kubernetes.io/out-of-service"
 )

vendor/k8s.io/api/core/v1/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*
@@ -1668,6 +1669,27 @@ func (in *GCEPersistentDiskVolumeSource) DeepCopy() *GCEPersistentDiskVolumeSour
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GRPCAction) DeepCopyInto(out *GRPCAction) {
+	*out = *in
+	if in.Service != nil {
+		in, out := &in.Service, &out.Service
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCAction.
+func (in *GRPCAction) DeepCopy() *GRPCAction {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCAction)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GitRepoVolumeSource) DeepCopyInto(out *GitRepoVolumeSource) {
 	*out = *in
@@ -1759,37 +1781,6 @@ func (in *HTTPHeader) DeepCopy() *HTTPHeader {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Handler) DeepCopyInto(out *Handler) {
-	*out = *in
-	if in.Exec != nil {
-		in, out := &in.Exec, &out.Exec
-		*out = new(ExecAction)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.HTTPGet != nil {
-		in, out := &in.HTTPGet, &out.HTTPGet
-		*out = new(HTTPGetAction)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.TCPSocket != nil {
-		in, out := &in.TCPSocket, &out.TCPSocket
-		*out = new(TCPSocketAction)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Handler.
-func (in *Handler) DeepCopy() *Handler {
-	if in == nil {
-		return nil
-	}
-	out := new(Handler)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HostAlias) DeepCopyInto(out *HostAlias) {
 	*out = *in
@@ -1920,12 +1911,12 @@ func (in *Lifecycle) DeepCopyInto(out *Lifecycle) {
 	*out = *in
 	if in.PostStart != nil {
 		in, out := &in.PostStart, &out.PostStart
-		*out = new(Handler)
+		*out = new(LifecycleHandler)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.PreStop != nil {
 		in, out := &in.PreStop, &out.PreStop
-		*out = new(Handler)
+		*out = new(LifecycleHandler)
 		(*in).DeepCopyInto(*out)
 	}
 	return
@@ -1941,6 +1932,37 @@ func (in *Lifecycle) DeepCopy() *Lifecycle {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LifecycleHandler) DeepCopyInto(out *LifecycleHandler) {
+	*out = *in
+	if in.Exec != nil {
+		in, out := &in.Exec, &out.Exec
+		*out = new(ExecAction)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTPGet != nil {
+		in, out := &in.HTTPGet, &out.HTTPGet
+		*out = new(HTTPGetAction)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCPSocket != nil {
+		in, out := &in.TCPSocket, &out.TCPSocket
+		*out = new(TCPSocketAction)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LifecycleHandler.
+func (in *LifecycleHandler) DeepCopy() *LifecycleHandler {
+	if in == nil {
+		return nil
+	}
+	out := new(LifecycleHandler)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LimitRange) DeepCopyInto(out *LimitRange) {
 	*out = *in
@@ -2974,6 +2996,18 @@ func (in *PersistentVolumeClaimStatus) DeepCopyInto(out *PersistentVolumeClaimSt
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.AllocatedResources != nil {
+		in, out := &in.AllocatedResources, &out.AllocatedResources
+		*out = make(ResourceList, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val.DeepCopy()
+		}
+	}
+	if in.ResizeStatus != nil {
+		in, out := &in.ResizeStatus, &out.ResizeStatus
+		*out = new(PersistentVolumeClaimResizeStatus)
+		**out = **in
+	}
 	return
 }
 
@@ -3600,6 +3634,22 @@ func (in *PodLogOptions) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodOS) DeepCopyInto(out *PodOS) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodOS.
+func (in *PodOS) DeepCopy() *PodOS {
+	if in == nil {
+		return nil
+	}
+	out := new(PodOS)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PodPortForwardOptions) DeepCopyInto(out *PodPortForwardOptions) {
 	*out = *in
@@ -3894,6 +3944,11 @@ func (in *PodSpec) DeepCopyInto(out *PodSpec) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.OS != nil {
+		in, out := &in.OS, &out.OS
+		*out = new(PodOS)
+		**out = **in
+	}
 	return
 }
 
@@ -4161,7 +4216,7 @@ func (in *PreferredSchedulingTerm) DeepCopy() *PreferredSchedulingTerm {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Probe) DeepCopyInto(out *Probe) {
 	*out = *in
-	in.Handler.DeepCopyInto(&out.Handler)
+	in.ProbeHandler.DeepCopyInto(&out.ProbeHandler)
 	if in.TerminationGracePeriodSeconds != nil {
 		in, out := &in.TerminationGracePeriodSeconds, &out.TerminationGracePeriodSeconds
 		*out = new(int64)
@@ -4180,6 +4235,42 @@ func (in *Probe) DeepCopy() *Probe {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProbeHandler) DeepCopyInto(out *ProbeHandler) {
+	*out = *in
+	if in.Exec != nil {
+		in, out := &in.Exec, &out.Exec
+		*out = new(ExecAction)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTPGet != nil {
+		in, out := &in.HTTPGet, &out.HTTPGet
+		*out = new(HTTPGetAction)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCPSocket != nil {
+		in, out := &in.TCPSocket, &out.TCPSocket
+		*out = new(TCPSocketAction)
+		**out = **in
+	}
+	if in.GRPC != nil {
+		in, out := &in.GRPC, &out.GRPC
+		*out = new(GRPCAction)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProbeHandler.
+func (in *ProbeHandler) DeepCopy() *ProbeHandler {
+	if in == nil {
+		return nil
+	}
+	out := new(ProbeHandler)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProjectedVolumeSource) DeepCopyInto(out *ProjectedVolumeSource) {
 	*out = *in
@@ -5553,6 +5644,11 @@ func (in *TopologySpreadConstraint) DeepCopyInto(out *TopologySpreadConstraint)
 		*out = new(metav1.LabelSelector)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.MinDomains != nil {
+		in, out := &in.MinDomains, &out.MinDomains
+		*out = new(int32)
+		**out = **in
+	}
 	return
 }
 

vendor/k8s.io/apimachinery/pkg/api/errors/OWNERS

@@ -1,20 +1,17 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
-- thockin
-- lavalamp
-- smarterclayton
-- wojtek-t
-- deads2k
-- brendandburns
-- derekwaynecarr
-- caesarxuchao
-- mikedanese
-- liggitt
-- saad-ali
-- janetkuo
-- tallclair
-- dims
-- hongchaodeng
-- krousey
-- cjcullen
+  - thockin
+  - lavalamp
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - mikedanese
+  - liggitt
+  - saad-ali
+  - janetkuo
+  - tallclair
+  - dims
+  - cjcullen

vendor/k8s.io/apimachinery/pkg/api/errors/errors.go

@@ -44,6 +44,28 @@ type APIStatus interface {
 
 var _ error = &StatusError{}
 
+var knownReasons = map[metav1.StatusReason]struct{}{
+	// metav1.StatusReasonUnknown : {}
+	metav1.StatusReasonUnauthorized:          {},
+	metav1.StatusReasonForbidden:             {},
+	metav1.StatusReasonNotFound:              {},
+	metav1.StatusReasonAlreadyExists:         {},
+	metav1.StatusReasonConflict:              {},
+	metav1.StatusReasonGone:                  {},
+	metav1.StatusReasonInvalid:               {},
+	metav1.StatusReasonServerTimeout:         {},
+	metav1.StatusReasonTimeout:               {},
+	metav1.StatusReasonTooManyRequests:       {},
+	metav1.StatusReasonBadRequest:            {},
+	metav1.StatusReasonMethodNotAllowed:      {},
+	metav1.StatusReasonNotAcceptable:         {},
+	metav1.StatusReasonRequestEntityTooLarge: {},
+	metav1.StatusReasonUnsupportedMediaType:  {},
+	metav1.StatusReasonInternalError:         {},
+	metav1.StatusReasonExpired:               {},
+	metav1.StatusReasonServiceUnavailable:    {},
+}
+
 // Error implements the Error interface.
 func (e *StatusError) Error() string {
 	return e.ErrStatus.Message
@@ -148,6 +170,25 @@ func NewAlreadyExists(qualifiedResource schema.GroupResource, name string) *Stat
 	}}
 }
 
+// NewGenerateNameConflict returns an error indicating the server
+// was not able to generate a valid name for a resource.
+func NewGenerateNameConflict(qualifiedResource schema.GroupResource, name string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonAlreadyExists,
+		Details: &metav1.StatusDetails{
+			Group:             qualifiedResource.Group,
+			Kind:              qualifiedResource.Resource,
+			Name:              name,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: fmt.Sprintf(
+			"%s %q already exists, the server was not able to generate a unique name for the object",
+			qualifiedResource.String(), name),
+	}}
+}
+
 // NewUnauthorized returns an error indicating the client is not authorized to perform the requested
 // action.
 func NewUnauthorized(reason string) *StatusError {
@@ -248,7 +289,7 @@ func NewInvalid(qualifiedKind schema.GroupKind, name string, errs field.ErrorLis
 			Field:   err.Field,
 		})
 	}
-	return &StatusError{metav1.Status{
+	err := &StatusError{metav1.Status{
 		Status: metav1.StatusFailure,
 		Code:   http.StatusUnprocessableEntity,
 		Reason: metav1.StatusReasonInvalid,
@@ -258,8 +299,14 @@ func NewInvalid(qualifiedKind schema.GroupKind, name string, errs field.ErrorLis
 			Name:   name,
 			Causes: causes,
 		},
-		Message: fmt.Sprintf("%s %q is invalid: %v", qualifiedKind.String(), name, errs.ToAggregate()),
 	}}
+	aggregatedErrs := errs.ToAggregate()
+	if aggregatedErrs == nil {
+		err.ErrStatus.Message = fmt.Sprintf("%s %q is invalid", qualifiedKind.String(), name)
+	} else {
+		err.ErrStatus.Message = fmt.Sprintf("%s %q is invalid: %v", qualifiedKind.String(), name, aggregatedErrs)
+	}
+	return err
 }
 
 // NewBadRequest creates an error that indicates that the request is invalid and can not be processed.
@@ -476,136 +523,239 @@ func NewGenericServerResponse(code int, verb string, qualifiedResource schema.Gr
 }
 
 // IsNotFound returns true if the specified error was created by NewNotFound.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsNotFound(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonNotFound
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonNotFound {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusNotFound {
+		return true
+	}
+	return false
 }
 
 // IsAlreadyExists determines if the err is an error which indicates that a specified resource already exists.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsAlreadyExists(err error) bool {
 	return ReasonForError(err) == metav1.StatusReasonAlreadyExists
 }
 
 // IsConflict determines if the err is an error which indicates the provided update conflicts.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsConflict(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonConflict
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonConflict {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusConflict {
+		return true
+	}
+	return false
 }
 
 // IsInvalid determines if the err is an error which indicates the provided resource is not valid.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsInvalid(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonInvalid
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonInvalid {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnprocessableEntity {
+		return true
+	}
+	return false
 }
 
 // IsGone is true if the error indicates the requested resource is no longer available.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsGone(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonGone
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonGone {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusGone {
+		return true
+	}
+	return false
 }
 
 // IsResourceExpired is true if the error indicates the resource has expired and the current action is
 // no longer possible.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsResourceExpired(err error) bool {
 	return ReasonForError(err) == metav1.StatusReasonExpired
 }
 
 // IsNotAcceptable determines if err is an error which indicates that the request failed due to an invalid Accept header
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsNotAcceptable(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonNotAcceptable
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonNotAcceptable {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusNotAcceptable {
+		return true
+	}
+	return false
 }
 
 // IsUnsupportedMediaType determines if err is an error which indicates that the request failed due to an invalid Content-Type header
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsUnsupportedMediaType(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonUnsupportedMediaType
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonUnsupportedMediaType {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnsupportedMediaType {
+		return true
+	}
+	return false
 }
 
 // IsMethodNotSupported determines if the err is an error which indicates the provided action could not
 // be performed because it is not supported by the server.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsMethodNotSupported(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonMethodNotAllowed
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonMethodNotAllowed {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusMethodNotAllowed {
+		return true
+	}
+	return false
 }
 
 // IsServiceUnavailable is true if the error indicates the underlying service is no longer available.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsServiceUnavailable(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonServiceUnavailable
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonServiceUnavailable {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusServiceUnavailable {
+		return true
+	}
+	return false
 }
 
 // IsBadRequest determines if err is an error which indicates that the request is invalid.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsBadRequest(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonBadRequest
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonBadRequest {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusBadRequest {
+		return true
+	}
+	return false
 }
 
 // IsUnauthorized determines if err is an error which indicates that the request is unauthorized and
 // requires authentication by the user.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsUnauthorized(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonUnauthorized
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonUnauthorized {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnauthorized {
+		return true
+	}
+	return false
 }
 
 // IsForbidden determines if err is an error which indicates that the request is forbidden and cannot
 // be completed as requested.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsForbidden(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonForbidden
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonForbidden {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusForbidden {
+		return true
+	}
+	return false
 }
 
 // IsTimeout determines if err is an error which indicates that request times out due to long
 // processing.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsTimeout(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonTimeout
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonTimeout {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusGatewayTimeout {
+		return true
+	}
+	return false
 }
 
 // IsServerTimeout determines if err is an error which indicates that the request needs to be retried
 // by the client.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsServerTimeout(err error) bool {
+	// do not check the status code, because no https status code exists that can
+	// be scoped to retryable timeouts.
 	return ReasonForError(err) == metav1.StatusReasonServerTimeout
 }
 
 // IsInternalError determines if err is an error which indicates an internal server error.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsInternalError(err error) bool {
-	return ReasonForError(err) == metav1.StatusReasonInternalError
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonInternalError {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusInternalServerError {
+		return true
+	}
+	return false
 }
 
 // IsTooManyRequests determines if err is an error which indicates that there are too many requests
 // that the server cannot handle.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsTooManyRequests(err error) bool {
-	if ReasonForError(err) == metav1.StatusReasonTooManyRequests {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonTooManyRequests {
 		return true
 	}
-	if status := APIStatus(nil); errors.As(err, &status) {
-		return status.Status().Code == http.StatusTooManyRequests
+
+	// IsTooManyRequests' checking of code predates the checking of the code in
+	// the other Is* functions. In order to maintain backward compatibility, this
+	// does not check that the reason is unknown.
+	if code == http.StatusTooManyRequests {
+		return true
 	}
 	return false
 }
 
 // IsRequestEntityTooLargeError determines if err is an error which indicates
 // the request entity is too large.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsRequestEntityTooLargeError(err error) bool {
-	if ReasonForError(err) == metav1.StatusReasonRequestEntityTooLarge {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonRequestEntityTooLarge {
 		return true
 	}
-	if status := APIStatus(nil); errors.As(err, &status) {
-		return status.Status().Code == http.StatusRequestEntityTooLarge
+
+	// IsRequestEntityTooLargeError's checking of code predates the checking of
+	// the code in the other Is* functions. In order to maintain backward
+	// compatibility, this does not check that the reason is unknown.
+	if code == http.StatusRequestEntityTooLarge {
+		return true
 	}
 	return false
 }
 
 // IsUnexpectedServerError returns true if the server response was not in the expected API format,
 // and may be the result of another HTTP actor.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsUnexpectedServerError(err error) bool {
 	if status := APIStatus(nil); errors.As(err, &status) && status.Status().Details != nil {
 		for _, cause := range status.Status().Details.Causes {
@@ -618,7 +768,7 @@ func IsUnexpectedServerError(err error) bool {
 }
 
 // IsUnexpectedObjectError determines if err is due to an unexpected object from the master.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func IsUnexpectedObjectError(err error) bool {
 	uoe := &UnexpectedObjectError{}
 	return err != nil && errors.As(err, &uoe)
@@ -628,7 +778,7 @@ func IsUnexpectedObjectError(err error) bool {
 // suggested seconds to wait, or false if the error does not imply a wait. It does not
 // address whether the error *should* be retried, since some errors (like a 3xx) may
 // request delay without retry.
-// It supports wrapped errors.
+// It supports wrapped errors and returns false when the error is nil.
 func SuggestsClientDelay(err error) (int, bool) {
 	if t := APIStatus(nil); errors.As(err, &t) && t.Status().Details != nil {
 		switch t.Status().Reason {
@@ -645,7 +795,8 @@ func SuggestsClientDelay(err error) (int, bool) {
 }
 
 // ReasonForError returns the HTTP status for a particular error.
-// It supports wrapped errors.
+// It supports wrapped errors and returns StatusReasonUnknown when
+// the error is nil or doesn't have a status.
 func ReasonForError(err error) metav1.StatusReason {
 	if status := APIStatus(nil); errors.As(err, &status) {
 		return status.Status().Reason
@@ -653,6 +804,13 @@ func ReasonForError(err error) metav1.StatusReason {
 	return metav1.StatusReasonUnknown
 }
 
+func reasonAndCodeForError(err error) (metav1.StatusReason, int32) {
+	if status := APIStatus(nil); errors.As(err, &status) {
+		return status.Status().Reason, status.Status().Code
+	}
+	return metav1.StatusReasonUnknown, 0
+}
+
 // ErrorReporter converts generic errors into runtime.Object errors without
 // requiring the caller to take a dependency on meta/v1 (where Status lives).
 // This prevents circular dependencies in core watch code.

vendor/k8s.io/apimachinery/pkg/api/meta/OWNERS

@@ -1,18 +1,14 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
-- thockin
-- smarterclayton
-- wojtek-t
-- deads2k
-- brendandburns
-- derekwaynecarr
-- caesarxuchao
-- mikedanese
-- liggitt
-- janetkuo
-- ncdc
-- dims
-- krousey
-- resouer
-- mfojtik
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - mikedanese
+  - liggitt
+  - janetkuo
+  - ncdc
+  - dims

vendor/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go

@@ -23,6 +23,10 @@ import (
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 )
 
+var (
+	_ ResettableRESTMapper = &FirstHitRESTMapper{}
+)
+
 // FirstHitRESTMapper is a wrapper for multiple RESTMappers which returns the
 // first successful result for the singular requests
 type FirstHitRESTMapper struct {
@@ -75,6 +79,10 @@ func (m FirstHitRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string)
 	return nil, collapseAggregateErrors(errors)
 }
 
+func (m FirstHitRESTMapper) Reset() {
+	m.MultiRESTMapper.Reset()
+}
+
 // collapseAggregateErrors returns the minimal errors.  it handles empty as nil, handles one item in a list
 // by returning the item, and collapses all NoMatchErrors to a single one (since they should all be the same)
 func collapseAggregateErrors(errors []error) error {

vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go

@@ -132,3 +132,12 @@ type RESTMapper interface {
 
 	ResourceSingularizer(resource string) (singular string, err error)
 }
+
+// ResettableRESTMapper is a RESTMapper which is capable of resetting itself
+// from discovery.
+// All rest mappers that delegate to other rest mappers must implement this interface and dynamically
+// check if the delegate mapper supports the Reset() operation.
+type ResettableRESTMapper interface {
+	RESTMapper
+	Reset()
+}

vendor/k8s.io/apimachinery/pkg/api/meta/lazy.go

@@ -32,7 +32,7 @@ type lazyObject struct {
 	mapper RESTMapper
 }
 
-// NewLazyObjectLoader handles unrecoverable errors when creating a RESTMapper / ObjectTyper by
+// NewLazyRESTMapperLoader handles unrecoverable errors when creating a RESTMapper / ObjectTyper by
 // returning those initialization errors when the interface methods are invoked. This defers the
 // initialization and any server calls until a client actually needs to perform the action.
 func NewLazyRESTMapperLoader(fn func() (RESTMapper, error)) RESTMapper {
@@ -52,7 +52,7 @@ func (o *lazyObject) init() error {
 	return o.err
 }
 
-var _ RESTMapper = &lazyObject{}
+var _ ResettableRESTMapper = &lazyObject{}
 
 func (o *lazyObject) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
 	if err := o.init(); err != nil {
@@ -102,3 +102,11 @@ func (o *lazyObject) ResourceSingularizer(resource string) (singular string, err
 	}
 	return o.mapper.ResourceSingularizer(resource)
 }
+
+func (o *lazyObject) Reset() {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	if o.loaded && o.err == nil {
+		MaybeResetRESTMapper(o.mapper)
+	}
+}

vendor/k8s.io/apimachinery/pkg/api/meta/meta.go

@@ -130,7 +130,7 @@ func AsPartialObjectMetadata(m metav1.Object) *metav1.PartialObjectMetadata {
 				Annotations:                m.GetAnnotations(),
 				OwnerReferences:            m.GetOwnerReferences(),
 				Finalizers:                 m.GetFinalizers(),
-				ClusterName:                m.GetClusterName(),
+				ZZZ_DeprecatedClusterName:  m.GetZZZ_DeprecatedClusterName(),
 				ManagedFields:              m.GetManagedFields(),
 			},
 		}

vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go

@@ -24,11 +24,15 @@ import (
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 )
 
+var (
+	_ ResettableRESTMapper = MultiRESTMapper{}
+)
+
 // MultiRESTMapper is a wrapper for multiple RESTMappers.
 type MultiRESTMapper []RESTMapper
 
 func (m MultiRESTMapper) String() string {
-	nested := []string{}
+	nested := make([]string, 0, len(m))
 	for _, t := range m {
 		currString := fmt.Sprintf("%v", t)
 		splitStrings := strings.Split(currString, "\n")
@@ -208,3 +212,9 @@ func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) (
 	}
 	return allMappings, nil
 }
+
+func (m MultiRESTMapper) Reset() {
+	for _, t := range m {
+		MaybeResetRESTMapper(t)
+	}
+}

vendor/k8s.io/apimachinery/pkg/api/meta/priority.go

@@ -29,6 +29,10 @@ const (
 	AnyKind     = "*"
 )
 
+var (
+	_ ResettableRESTMapper = PriorityRESTMapper{}
+)
+
 // PriorityRESTMapper is a wrapper for automatically choosing a particular Resource or Kind
 // when multiple matches are possible
 type PriorityRESTMapper struct {
@@ -220,3 +224,7 @@ func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.Group
 func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
 	return m.Delegate.KindsFor(partiallySpecifiedResource)
 }
+
+func (m PriorityRESTMapper) Reset() {
+	MaybeResetRESTMapper(m.Delegate)
+}

vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go

@@ -519,3 +519,11 @@ func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string
 	}
 	return mappings, nil
 }
+
+// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper.
+func MaybeResetRESTMapper(mapper RESTMapper) {
+	m, ok := mapper.(ResettableRESTMapper)
+	if ok {
+		m.Reset()
+	}
+}

vendor/k8s.io/apimachinery/pkg/api/resource/OWNERS

@@ -1,12 +1,11 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
-- thockin
-- lavalamp
-- smarterclayton
-- wojtek-t
-- derekwaynecarr
-- mikedanese
-- saad-ali
-- janetkuo
-- xiang90
+  - thockin
+  - lavalamp
+  - smarterclayton
+  - wojtek-t
+  - derekwaynecarr
+  - mikedanese
+  - saad-ali
+  - janetkuo

vendor/k8s.io/apimachinery/pkg/api/resource/generated.pb.go

@@ -61,8 +61,32 @@ func (m *Quantity) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_Quantity proto.InternalMessageInfo
 
+func (m *QuantityValue) Reset()      { *m = QuantityValue{} }
+func (*QuantityValue) ProtoMessage() {}
+func (*QuantityValue) Descriptor() ([]byte, []int) {
+	return fileDescriptor_612bba87bd70906c, []int{1}
+}
+func (m *QuantityValue) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_QuantityValue.Unmarshal(m, b)
+}
+func (m *QuantityValue) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_QuantityValue.Marshal(b, m, deterministic)
+}
+func (m *QuantityValue) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_QuantityValue.Merge(m, src)
+}
+func (m *QuantityValue) XXX_Size() int {
+	return xxx_messageInfo_QuantityValue.Size(m)
+}
+func (m *QuantityValue) XXX_DiscardUnknown() {
+	xxx_messageInfo_QuantityValue.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_QuantityValue proto.InternalMessageInfo
+
 func init() {
 	proto.RegisterType((*Quantity)(nil), "k8s.io.apimachinery.pkg.api.resource.Quantity")
+	proto.RegisterType((*QuantityValue)(nil), "k8s.io.apimachinery.pkg.api.resource.QuantityValue")
 }
 
 func init() {
@@ -70,20 +94,21 @@ func init() {
 }
 
 var fileDescriptor_612bba87bd70906c = []byte{
-	// 237 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x4c, 0x8e, 0xb1, 0x4e, 0xc3, 0x30,
-	0x10, 0x40, 0xcf, 0x0b, 0x2a, 0x19, 0x2b, 0x84, 0x10, 0xc3, 0xa5, 0x42, 0x0c, 0x2c, 0xd8, 0x6b,
-	0xc5, 0xc8, 0xce, 0x00, 0x23, 0x5b, 0x92, 0x1e, 0xae, 0x15, 0xd5, 0x8e, 0x2e, 0x36, 0x52, 0xb7,
-	0x8e, 0x8c, 0x1d, 0x19, 0x9b, 0xbf, 0xe9, 0xd8, 0xb1, 0x03, 0x03, 0x31, 0x3f, 0x82, 0xea, 0x36,
-	0x52, 0xb7, 0x7b, 0xef, 0xf4, 0x4e, 0x97, 0xbd, 0xd4, 0xd3, 0x56, 0x1a, 0xa7, 0xea, 0x50, 0x12,
-	0x5b, 0xf2, 0xd4, 0xaa, 0x4f, 0xb2, 0x33, 0xc7, 0xea, 0xb4, 0x28, 0x1a, 0xb3, 0x28, 0xaa, 0xb9,
-	0xb1, 0xc4, 0x4b, 0xd5, 0xd4, 0xfa, 0x20, 0x14, 0x53, 0xeb, 0x02, 0x57, 0xa4, 0x34, 0x59, 0xe2,
-	0xc2, 0xd3, 0x4c, 0x36, 0xec, 0xbc, 0x1b, 0xdf, 0x1f, 0x2b, 0x79, 0x5e, 0xc9, 0xa6, 0xd6, 0x07,
-	0x21, 0x87, 0xea, 0xf6, 0x51, 0x1b, 0x3f, 0x0f, 0xa5, 0xac, 0xdc, 0x42, 0x69, 0xa7, 0x9d, 0x4a,
-	0x71, 0x19, 0x3e, 0x12, 0x25, 0x48, 0xd3, 0xf1, 0xe8, 0xdd, 0x34, 0x1b, 0xbd, 0x86, 0xc2, 0x7a,
-	0xe3, 0x97, 0xe3, 0xeb, 0xec, 0xa2, 0xf5, 0x6c, 0xac, 0xbe, 0x11, 0x13, 0xf1, 0x70, 0xf9, 0x76,
-	0xa2, 0xa7, 0xab, 0xef, 0x4d, 0x0e, 0x5f, 0x5d, 0x0e, 0xeb, 0x2e, 0x87, 0x4d, 0x97, 0xc3, 0xea,
-	0x67, 0x02, 0xcf, 0x72, 0xdb, 0x23, 0xec, 0x7a, 0x84, 0x7d, 0x8f, 0xb0, 0x8a, 0x28, 0xb6, 0x11,
-	0xc5, 0x2e, 0xa2, 0xd8, 0x47, 0x14, 0xbf, 0x11, 0xc5, 0xfa, 0x0f, 0xe1, 0x7d, 0x34, 0x3c, 0xf6,
-	0x1f, 0x00, 0x00, 0xff, 0xff, 0x3c, 0x08, 0x88, 0x49, 0x0e, 0x01, 0x00, 0x00,
+	// 254 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xf2, 0xcd, 0xb6, 0x28, 0xd6,
+	0xcb, 0xcc, 0xd7, 0xcf, 0x2e, 0x4d, 0x4a, 0x2d, 0xca, 0x4b, 0x2d, 0x49, 0x2d, 0xd6, 0x2f, 0x4b,
+	0xcd, 0x4b, 0xc9, 0x2f, 0xd2, 0x87, 0x4a, 0x24, 0x16, 0x64, 0xe6, 0x26, 0x26, 0x67, 0x64, 0xe6,
+	0xa5, 0x16, 0x55, 0xea, 0x17, 0x64, 0xa7, 0x83, 0x04, 0xf4, 0x8b, 0x52, 0x8b, 0xf3, 0x4b, 0x8b,
+	0x92, 0x53, 0xf5, 0xd3, 0x53, 0xf3, 0x52, 0x8b, 0x12, 0x4b, 0x52, 0x53, 0xf4, 0x0a, 0x8a, 0xf2,
+	0x4b, 0xf2, 0x85, 0x54, 0x20, 0xba, 0xf4, 0x90, 0x75, 0xe9, 0x15, 0x64, 0xa7, 0x83, 0x04, 0xf4,
+	0x60, 0xba, 0xa4, 0x74, 0xd3, 0x33, 0x4b, 0x32, 0x4a, 0x93, 0xf4, 0x92, 0xf3, 0x73, 0xf5, 0xd3,
+	0xf3, 0xd3, 0xf3, 0xf5, 0xc1, 0x9a, 0x93, 0x4a, 0xd3, 0xc0, 0x3c, 0x30, 0x07, 0xcc, 0x82, 0x18,
+	0xaa, 0x64, 0xc1, 0xc5, 0x11, 0x58, 0x9a, 0x98, 0x57, 0x92, 0x59, 0x52, 0x29, 0x24, 0xc6, 0xc5,
+	0x56, 0x5c, 0x52, 0x94, 0x99, 0x97, 0x2e, 0xc1, 0xa8, 0xc0, 0xa8, 0xc1, 0x19, 0x04, 0xe5, 0x59,
+	0x89, 0xcc, 0x58, 0x20, 0xcf, 0xd0, 0xb1, 0x50, 0x9e, 0x61, 0xc2, 0x42, 0x79, 0x86, 0x05, 0x0b,
+	0xe5, 0x19, 0x1a, 0xee, 0x28, 0x30, 0x28, 0xd9, 0x72, 0xf1, 0xc2, 0x74, 0x86, 0x25, 0xe6, 0x94,
+	0xa6, 0x92, 0xa6, 0xdd, 0xc9, 0xeb, 0xc4, 0x43, 0x39, 0x86, 0x0b, 0x0f, 0xe5, 0x18, 0x6e, 0x3c,
+	0x94, 0x63, 0x68, 0x78, 0x24, 0xc7, 0x78, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x37,
+	0x1e, 0xc9, 0x31, 0x3e, 0x78, 0x24, 0xc7, 0x38, 0xe1, 0xb1, 0x1c, 0x43, 0x94, 0x0a, 0x31, 0x21,
+	0x05, 0x08, 0x00, 0x00, 0xff, 0xff, 0x8e, 0x70, 0x98, 0xa3, 0x69, 0x01, 0x00, 0x00,
 }

vendor/k8s.io/apimachinery/pkg/api/resource/generated.proto

@@ -22,7 +22,7 @@ syntax = "proto2";
 package k8s.io.apimachinery.pkg.api.resource;
 
 // Package-wide variables from generator "generated".
-option go_package = "resource";
+option go_package = "k8s.io/apimachinery/pkg/api/resource";
 
 // Quantity is a fixed-point representation of a number.
 // It provides convenient marshaling/unmarshaling in JSON and YAML,
@@ -86,3 +86,15 @@ message Quantity {
   optional string string = 1;
 }
 
+// QuantityValue makes it possible to use a Quantity as value for a command
+// line parameter.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+message QuantityValue {
+  optional string string = 1;
+}
+

vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go

@@ -397,6 +397,10 @@ func (_ Quantity) OpenAPISchemaType() []string { return []string{"string"} }
 // the OpenAPI spec of this type.
 func (_ Quantity) OpenAPISchemaFormat() string { return "" }
 
+// OpenAPIV3OneOfTypes is used by the kube-openapi generator when constructing
+// the OpenAPI v3 spec of this type.
+func (Quantity) OpenAPIV3OneOfTypes() []string { return []string{"string", "number"} }
+
 // CanonicalizeBytes returns the canonical form of q and its suffix (see comment on Quantity).
 //
 // Note about BinarySI:
@@ -460,17 +464,7 @@ func (q *Quantity) AsApproximateFloat64() float64 {
 		return base
 	}
 
-	// multiply by the appropriate exponential scale
-	switch q.Format {
-	case DecimalExponent, DecimalSI:
-		return base * math.Pow10(exponent)
-	default:
-		// fast path for exponents that can fit in 64 bits
-		if exponent > 0 && exponent < 7 {
-			return base * float64(int64(1)<<(exponent*10))
-		}
-		return base * math.Pow(2, float64(exponent*10))
-	}
+	return base * math.Pow10(exponent)
 }
 
 // AsInt64 returns a representation of the current value as an int64 if a fast conversion
@@ -774,3 +768,30 @@ func (q *Quantity) SetScaled(value int64, scale Scale) {
 	q.d.Dec = nil
 	q.i = int64Amount{value: value, scale: scale}
 }
+
+// QuantityValue makes it possible to use a Quantity as value for a command
+// line parameter.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+type QuantityValue struct {
+	Quantity
+}
+
+// Set implements pflag.Value.Set and Go flag.Value.Set.
+func (q *QuantityValue) Set(s string) error {
+	quantity, err := ParseQuantity(s)
+	if err != nil {
+		return err
+	}
+	q.Quantity = quantity
+	return nil
+}
+
+// Type implements pflag.Value.Type.
+func (q QuantityValue) Type() string {
+	return "quantity"
+}

vendor/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*
@@ -25,3 +26,20 @@ func (in *Quantity) DeepCopyInto(out *Quantity) {
 	*out = in.DeepCopy()
 	return
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *QuantityValue) DeepCopyInto(out *QuantityValue) {
+	*out = *in
+	out.Quantity = in.Quantity.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new QuantityValue.
+func (in *QuantityValue) DeepCopy() *QuantityValue {
+	if in == nil {
+		return nil
+	}
+	out := new(QuantityValue)
+	in.DeepCopyInto(out)
+	return out
+}

vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS

@@ -1,23 +1,16 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
-- thockin
-- smarterclayton
-- wojtek-t
-- deads2k
-- brendandburns
-- caesarxuchao
-- liggitt
-- davidopp
-- sttts
-- quinton-hoole
-- luxas
-- janetkuo
-- justinsb
-- ncdc
-- soltysh
-- dims
-- hongchaodeng
-- krousey
-- therc
-- kevin-wangzefeng
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - caesarxuchao
+  - liggitt
+  - sttts
+  - luxas
+  - janetkuo
+  - justinsb
+  - ncdc
+  - soltysh
+  - dims

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go

@@ -1326,184 +1326,187 @@ func init() {
 }
 
 var fileDescriptor_cf52fa777ced5367 = []byte{
-	// 2829 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x3a, 0xcb, 0x6f, 0x24, 0x47,
-	0xf9, 0xee, 0x19, 0x8f, 0x3d, 0xf3, 0x8d, 0xc7, 0x8f, 0x5a, 0xef, 0xef, 0x37, 0x6b, 0x84, 0xc7,
-	0xe9, 0xa0, 0x68, 0x03, 0xc9, 0x38, 0x5e, 0x42, 0xb4, 0xd9, 0x90, 0x80, 0xc7, 0xb3, 0xde, 0x98,
-	0xac, 0x63, 0xab, 0xbc, 0xbb, 0x40, 0x88, 0x50, 0xda, 0xdd, 0xe5, 0x71, 0xe3, 0x9e, 0xee, 0x49,
-	0x55, 0x8f, 0x37, 0x03, 0x07, 0x72, 0x00, 0x01, 0x12, 0x44, 0xe1, 0xc6, 0x09, 0x25, 0x82, 0xbf,
-	0x80, 0x0b, 0xfc, 0x01, 0x48, 0xe4, 0x18, 0xc4, 0x25, 0x12, 0x68, 0x94, 0x98, 0x03, 0x47, 0xc4,
-	0xd5, 0x17, 0x50, 0x3d, 0xba, 0xbb, 0x7a, 0x1e, 0xeb, 0x9e, 0xec, 0x12, 0x71, 0x9b, 0xfe, 0xde,
-	0x55, 0xf5, 0xd5, 0xf7, 0xaa, 0x81, 0xdd, 0x93, 0xeb, 0xac, 0xee, 0x06, 0xeb, 0x27, 0xdd, 0x43,
-	0x42, 0x7d, 0x12, 0x12, 0xb6, 0x7e, 0x4a, 0x7c, 0x27, 0xa0, 0xeb, 0x0a, 0x61, 0x75, 0xdc, 0xb6,
-	0x65, 0x1f, 0xbb, 0x3e, 0xa1, 0xbd, 0xf5, 0xce, 0x49, 0x8b, 0x03, 0xd8, 0x7a, 0x9b, 0x84, 0xd6,
-	0xfa, 0xe9, 0xc6, 0x7a, 0x8b, 0xf8, 0x84, 0x5a, 0x21, 0x71, 0xea, 0x1d, 0x1a, 0x84, 0x01, 0xfa,
-	0x82, 0xe4, 0xaa, 0xeb, 0x5c, 0xf5, 0xce, 0x49, 0x8b, 0x03, 0x58, 0x9d, 0x73, 0xd5, 0x4f, 0x37,
-	0x56, 0x9e, 0x6e, 0xb9, 0xe1, 0x71, 0xf7, 0xb0, 0x6e, 0x07, 0xed, 0xf5, 0x56, 0xd0, 0x0a, 0xd6,
-	0x05, 0xf3, 0x61, 0xf7, 0x48, 0x7c, 0x89, 0x0f, 0xf1, 0x4b, 0x0a, 0x5d, 0x19, 0x6b, 0x0a, 0xed,
-	0xfa, 0xa1, 0xdb, 0x26, 0x83, 0x56, 0xac, 0x3c, 0x77, 0x11, 0x03, 0xb3, 0x8f, 0x49, 0xdb, 0x1a,
-	0xe4, 0x33, 0xff, 0x94, 0x87, 0xe2, 0xe6, 0xfe, 0xce, 0x2d, 0x1a, 0x74, 0x3b, 0x68, 0x0d, 0xa6,
-	0x7d, 0xab, 0x4d, 0xaa, 0xc6, 0x9a, 0x71, 0xb5, 0xd4, 0x98, 0xfb, 0xa0, 0x5f, 0x9b, 0x3a, 0xeb,
-	0xd7, 0xa6, 0x5f, 0xb5, 0xda, 0x04, 0x0b, 0x0c, 0xf2, 0xa0, 0x78, 0x4a, 0x28, 0x73, 0x03, 0x9f,
-	0x55, 0x73, 0x6b, 0xf9, 0xab, 0xe5, 0x6b, 0x2f, 0xd5, 0xb3, 0xac, 0xbf, 0x2e, 0x14, 0xdc, 0x93,
-	0xac, 0xdb, 0x01, 0x6d, 0xba, 0xcc, 0x0e, 0x4e, 0x09, 0xed, 0x35, 0x16, 0x95, 0x96, 0xa2, 0x42,
-	0x32, 0x1c, 0x6b, 0x40, 0x3f, 0x32, 0x60, 0xb1, 0x43, 0xc9, 0x11, 0xa1, 0x94, 0x38, 0x0a, 0x5f,
-	0xcd, 0xaf, 0x19, 0x8f, 0x40, 0x6d, 0x55, 0xa9, 0x5d, 0xdc, 0x1f, 0x90, 0x8f, 0x87, 0x34, 0xa2,
-	0xdf, 0x18, 0xb0, 0xc2, 0x08, 0x3d, 0x25, 0x74, 0xd3, 0x71, 0x28, 0x61, 0xac, 0xd1, 0xdb, 0xf2,
-	0x5c, 0xe2, 0x87, 0x5b, 0x3b, 0x4d, 0xcc, 0xaa, 0xd3, 0x62, 0x1f, 0xbe, 0x96, 0xcd, 0xa0, 0x83,
-	0x71, 0x72, 0x1a, 0xa6, 0xb2, 0x68, 0x65, 0x2c, 0x09, 0xc3, 0x0f, 0x30, 0xc3, 0x3c, 0x82, 0xb9,
-	0xe8, 0x20, 0x6f, 0xbb, 0x2c, 0x44, 0xf7, 0x60, 0xa6, 0xc5, 0x3f, 0x58, 0xd5, 0x10, 0x06, 0xd6,
-	0xb3, 0x19, 0x18, 0xc9, 0x68, 0xcc, 0x2b, 0x7b, 0x66, 0xc4, 0x27, 0xc3, 0x4a, 0x9a, 0xf9, 0xb3,
-	0x69, 0x28, 0x6f, 0xee, 0xef, 0x60, 0xc2, 0x82, 0x2e, 0xb5, 0x49, 0x06, 0xa7, 0xb9, 0x0e, 0x73,
-	0xcc, 0xf5, 0x5b, 0x5d, 0xcf, 0xa2, 0x1c, 0x5a, 0x9d, 0x11, 0x94, 0xcb, 0x8a, 0x72, 0xee, 0x40,
-	0xc3, 0xe1, 0x14, 0x25, 0xba, 0x06, 0xc0, 0x25, 0xb0, 0x8e, 0x65, 0x13, 0xa7, 0x9a, 0x5b, 0x33,
-	0xae, 0x16, 0x1b, 0x48, 0xf1, 0xc1, 0xab, 0x31, 0x06, 0x6b, 0x54, 0xe8, 0x71, 0x28, 0x08, 0x4b,
-	0xab, 0x45, 0xa1, 0xa6, 0xa2, 0xc8, 0x0b, 0x62, 0x19, 0x58, 0xe2, 0xd0, 0x93, 0x30, 0xab, 0xbc,
-	0xac, 0x5a, 0x12, 0x64, 0x0b, 0x8a, 0x6c, 0x36, 0x72, 0x83, 0x08, 0xcf, 0xd7, 0x77, 0xe2, 0xfa,
-	0x8e, 0xf0, 0x3b, 0x6d, 0x7d, 0xaf, 0xb8, 0xbe, 0x83, 0x05, 0x06, 0xdd, 0x86, 0xc2, 0x29, 0xa1,
-	0x87, 0xdc, 0x13, 0xb8, 0x6b, 0x7e, 0x29, 0xdb, 0x46, 0xdf, 0xe3, 0x2c, 0x8d, 0x12, 0x37, 0x4d,
-	0xfc, 0xc4, 0x52, 0x08, 0xaa, 0x03, 0xb0, 0xe3, 0x80, 0x86, 0x62, 0x79, 0xd5, 0xc2, 0x5a, 0xfe,
-	0x6a, 0xa9, 0x31, 0xcf, 0xd7, 0x7b, 0x10, 0x43, 0xb1, 0x46, 0xc1, 0xe9, 0x6d, 0x2b, 0x24, 0xad,
-	0x80, 0xba, 0x84, 0x55, 0x67, 0x13, 0xfa, 0xad, 0x18, 0x8a, 0x35, 0x0a, 0xf4, 0x0d, 0x40, 0x2c,
-	0x0c, 0xa8, 0xd5, 0x22, 0x6a, 0xa9, 0x2f, 0x5b, 0xec, 0xb8, 0x0a, 0x62, 0x75, 0x2b, 0x6a, 0x75,
-	0xe8, 0x60, 0x88, 0x02, 0x8f, 0xe0, 0x32, 0x7f, 0x67, 0xc0, 0x82, 0xe6, 0x0b, 0xc2, 0xef, 0xae,
-	0xc3, 0x5c, 0x4b, 0xbb, 0x75, 0xca, 0x2f, 0xe2, 0xd3, 0xd6, 0x6f, 0x24, 0x4e, 0x51, 0x22, 0x02,
-	0x25, 0xaa, 0x24, 0x45, 0xd1, 0x65, 0x23, 0xb3, 0xd3, 0x46, 0x36, 0x24, 0x9a, 0x34, 0x20, 0xc3,
-	0x89, 0x64, 0xf3, 0x1f, 0x86, 0x70, 0xe0, 0x28, 0xde, 0xa0, 0xab, 0x5a, 0x4c, 0x33, 0xc4, 0xf6,
-	0xcd, 0x8d, 0x89, 0x47, 0x17, 0x04, 0x82, 0xdc, 0xff, 0x44, 0x20, 0xb8, 0x51, 0xfc, 0xd5, 0x7b,
-	0xb5, 0xa9, 0xb7, 0xff, 0xb6, 0x36, 0x65, 0xfe, 0xd2, 0x80, 0xb9, 0xcd, 0x4e, 0xc7, 0xeb, 0xed,
-	0x75, 0x42, 0xb1, 0x00, 0x13, 0x66, 0x1c, 0xda, 0xc3, 0x5d, 0x5f, 0x2d, 0x14, 0xf8, 0xfd, 0x6e,
-	0x0a, 0x08, 0x56, 0x18, 0x7e, 0x7f, 0x8e, 0x02, 0x6a, 0x13, 0x75, 0xdd, 0xe2, 0xfb, 0xb3, 0xcd,
-	0x81, 0x58, 0xe2, 0xf8, 0x21, 0x1f, 0xb9, 0xc4, 0x73, 0x76, 0x2d, 0xdf, 0x6a, 0x11, 0xaa, 0x2e,
-	0x47, 0xbc, 0xf5, 0xdb, 0x1a, 0x0e, 0xa7, 0x28, 0xcd, 0x7f, 0xe7, 0xa0, 0xb4, 0x15, 0xf8, 0x8e,
-	0x1b, 0xaa, 0xcb, 0x15, 0xf6, 0x3a, 0x43, 0xc1, 0xe3, 0x4e, 0xaf, 0x43, 0xb0, 0xc0, 0xa0, 0xe7,
-	0x61, 0x86, 0x85, 0x56, 0xd8, 0x65, 0xc2, 0x9e, 0x52, 0xe3, 0xb1, 0x28, 0x2c, 0x1d, 0x08, 0xe8,
-	0x79, 0xbf, 0xb6, 0x10, 0x8b, 0x93, 0x20, 0xac, 0x18, 0xb8, 0xa7, 0x07, 0x87, 0x62, 0xa3, 0x9c,
-	0x5b, 0x32, 0xed, 0x45, 0xf9, 0x23, 0x9f, 0x78, 0xfa, 0xde, 0x10, 0x05, 0x1e, 0xc1, 0x85, 0x4e,
-	0x01, 0x79, 0x16, 0x0b, 0xef, 0x50, 0xcb, 0x67, 0x42, 0xd7, 0x1d, 0xb7, 0x4d, 0xd4, 0x85, 0xff,
-	0x62, 0xb6, 0x13, 0xe7, 0x1c, 0x89, 0xde, 0xdb, 0x43, 0xd2, 0xf0, 0x08, 0x0d, 0xe8, 0x09, 0x98,
-	0xa1, 0xc4, 0x62, 0x81, 0x5f, 0x2d, 0x88, 0xe5, 0xc7, 0x51, 0x19, 0x0b, 0x28, 0x56, 0x58, 0x1e,
-	0xd0, 0xda, 0x84, 0x31, 0xab, 0x15, 0x85, 0xd7, 0x38, 0xa0, 0xed, 0x4a, 0x30, 0x8e, 0xf0, 0x66,
-	0x1b, 0x2a, 0x5b, 0x94, 0x58, 0x21, 0x99, 0xc4, 0x2b, 0x3e, 0xfd, 0x81, 0xff, 0x24, 0x0f, 0x95,
-	0x26, 0xf1, 0x48, 0xa2, 0x6f, 0x1b, 0x50, 0x8b, 0x5a, 0x36, 0xd9, 0x27, 0xd4, 0x0d, 0x9c, 0x03,
-	0x62, 0x07, 0xbe, 0xc3, 0x84, 0x0b, 0xe4, 0x1b, 0xff, 0xc7, 0xf7, 0xe6, 0xd6, 0x10, 0x16, 0x8f,
-	0xe0, 0x40, 0x1e, 0x54, 0x3a, 0x54, 0xfc, 0x16, 0xfb, 0x25, 0x3d, 0xa4, 0x7c, 0xed, 0xcb, 0xd9,
-	0x8e, 0x63, 0x5f, 0x67, 0x6d, 0x2c, 0x9d, 0xf5, 0x6b, 0x95, 0x14, 0x08, 0xa7, 0x85, 0xa3, 0xaf,
-	0xc3, 0x62, 0x40, 0x3b, 0xc7, 0x96, 0xdf, 0x24, 0x1d, 0xe2, 0x3b, 0xc4, 0x0f, 0x99, 0xd8, 0x85,
-	0x62, 0x63, 0x99, 0xd7, 0x11, 0x7b, 0x03, 0x38, 0x3c, 0x44, 0x8d, 0x5e, 0x83, 0xa5, 0x0e, 0x0d,
-	0x3a, 0x56, 0x4b, 0xb8, 0xd4, 0x7e, 0xe0, 0xb9, 0x76, 0x4f, 0xb8, 0x50, 0xa9, 0xf1, 0xd4, 0x59,
-	0xbf, 0xb6, 0xb4, 0x3f, 0x88, 0x3c, 0xef, 0xd7, 0x2e, 0x89, 0xad, 0xe3, 0x90, 0x04, 0x89, 0x87,
-	0xc5, 0x68, 0x67, 0x58, 0x18, 0x77, 0x86, 0xe6, 0x0e, 0x14, 0x9b, 0x5d, 0xe5, 0xcf, 0x2f, 0x42,
-	0xd1, 0x51, 0xbf, 0xd5, 0xce, 0x47, 0x17, 0x2b, 0xa6, 0x39, 0xef, 0xd7, 0x2a, 0xbc, 0x74, 0xac,
-	0x47, 0x00, 0x1c, 0xb3, 0x98, 0x4f, 0x40, 0x51, 0x1c, 0x39, 0xbb, 0xb7, 0x81, 0x16, 0x21, 0x8f,
-	0xad, 0xfb, 0x42, 0xca, 0x1c, 0xe6, 0x3f, 0xb5, 0x08, 0xb4, 0x07, 0x70, 0x8b, 0x84, 0xd1, 0xc1,
-	0x6f, 0xc2, 0x42, 0x14, 0x86, 0xd3, 0xd9, 0xe1, 0xff, 0x95, 0xee, 0x05, 0x9c, 0x46, 0xe3, 0x41,
-	0x7a, 0xf3, 0x75, 0x28, 0x89, 0x0c, 0xc2, 0xd3, 0x6f, 0x92, 0xea, 0x8d, 0x07, 0xa4, 0xfa, 0x28,
-	0x7f, 0xe7, 0xc6, 0xe5, 0x6f, 0xcd, 0x5c, 0x0f, 0x2a, 0x92, 0x37, 0x2a, 0x6e, 0x32, 0x69, 0x78,
-	0x0a, 0x8a, 0x91, 0x99, 0x4a, 0x4b, 0x5c, 0xd4, 0x46, 0x82, 0x70, 0x4c, 0xa1, 0x69, 0x3b, 0x86,
-	0x54, 0x36, 0xcc, 0xa6, 0x4c, 0xab, 0x5c, 0x72, 0x0f, 0xae, 0x5c, 0x34, 0x4d, 0x3f, 0x84, 0xea,
-	0xb8, 0x4a, 0xf8, 0x21, 0xf2, 0x75, 0x76, 0x53, 0xcc, 0x77, 0x0c, 0x58, 0xd4, 0x25, 0x65, 0x3f,
-	0xbe, 0xec, 0x4a, 0x2e, 0xae, 0xd4, 0xb4, 0x1d, 0xf9, 0xb5, 0x01, 0xcb, 0xa9, 0xa5, 0x4d, 0x74,
-	0xe2, 0x13, 0x18, 0xa5, 0x3b, 0x47, 0x7e, 0x02, 0xe7, 0xf8, 0x4b, 0x0e, 0x2a, 0xb7, 0xad, 0x43,
-	0xe2, 0x1d, 0x10, 0x8f, 0xd8, 0x61, 0x40, 0xd1, 0x0f, 0xa0, 0xdc, 0xb6, 0x42, 0xfb, 0x58, 0x40,
-	0xa3, 0xaa, 0xbe, 0x99, 0x2d, 0xd8, 0xa5, 0x24, 0xd5, 0x77, 0x13, 0x31, 0x37, 0xfd, 0x90, 0xf6,
-	0x1a, 0x97, 0x94, 0x49, 0x65, 0x0d, 0x83, 0x75, 0x6d, 0xa2, 0x15, 0x13, 0xdf, 0x37, 0xdf, 0xea,
-	0xf0, 0x92, 0x63, 0xf2, 0x0e, 0x30, 0x65, 0x02, 0x26, 0x6f, 0x76, 0x5d, 0x4a, 0xda, 0xc4, 0x0f,
-	0x93, 0x56, 0x6c, 0x77, 0x40, 0x3e, 0x1e, 0xd2, 0xb8, 0xf2, 0x12, 0x2c, 0x0e, 0x1a, 0xcf, 0xe3,
-	0xcf, 0x09, 0xe9, 0xc9, 0xf3, 0xc2, 0xfc, 0x27, 0x5a, 0x86, 0xc2, 0xa9, 0xe5, 0x75, 0xd5, 0x6d,
-	0xc4, 0xf2, 0xe3, 0x46, 0xee, 0xba, 0x61, 0xfe, 0xd6, 0x80, 0xea, 0x38, 0x43, 0xd0, 0xe7, 0x35,
-	0x41, 0x8d, 0xb2, 0xb2, 0x2a, 0xff, 0x0a, 0xe9, 0x49, 0xa9, 0x37, 0xa1, 0x18, 0x74, 0x78, 0x3d,
-	0x10, 0x50, 0x75, 0xea, 0x4f, 0x46, 0x27, 0xb9, 0xa7, 0xe0, 0xe7, 0xfd, 0xda, 0xe5, 0x94, 0xf8,
-	0x08, 0x81, 0x63, 0x56, 0x1e, 0xa9, 0x85, 0x3d, 0x3c, 0x7b, 0xc4, 0x91, 0xfa, 0x9e, 0x80, 0x60,
-	0x85, 0x31, 0xff, 0x60, 0xc0, 0xb4, 0x28, 0xa6, 0x5f, 0x87, 0x22, 0xdf, 0x3f, 0xc7, 0x0a, 0x2d,
-	0x61, 0x57, 0xe6, 0x36, 0x8e, 0x73, 0xef, 0x92, 0xd0, 0x4a, 0xbc, 0x2d, 0x82, 0xe0, 0x58, 0x22,
-	0xc2, 0x50, 0x70, 0x43, 0xd2, 0x8e, 0x0e, 0xf2, 0xe9, 0xb1, 0xa2, 0xd5, 0x10, 0xa1, 0x8e, 0xad,
-	0xfb, 0x37, 0xdf, 0x0a, 0x89, 0xcf, 0x0f, 0x23, 0xb9, 0x1a, 0x3b, 0x5c, 0x06, 0x96, 0xa2, 0xcc,
-	0x7f, 0x19, 0x10, 0xab, 0xe2, 0xce, 0xcf, 0x88, 0x77, 0x74, 0xdb, 0xf5, 0x4f, 0xd4, 0xb6, 0xc6,
-	0xe6, 0x1c, 0x28, 0x38, 0x8e, 0x29, 0x46, 0xa5, 0x87, 0xdc, 0x64, 0xe9, 0x81, 0x2b, 0xb4, 0x03,
-	0x3f, 0x74, 0xfd, 0xee, 0xd0, 0x6d, 0xdb, 0x52, 0x70, 0x1c, 0x53, 0xf0, 0x42, 0x84, 0x92, 0xb6,
-	0xe5, 0xfa, 0xae, 0xdf, 0xe2, 0x8b, 0xd8, 0x0a, 0xba, 0x7e, 0x28, 0x32, 0xb2, 0x2a, 0x44, 0xf0,
-	0x10, 0x16, 0x8f, 0xe0, 0x30, 0x7f, 0x3f, 0x0d, 0x65, 0xbe, 0xe6, 0x28, 0xcf, 0xbd, 0x00, 0x15,
-	0x4f, 0xf7, 0x02, 0xb5, 0xf6, 0xcb, 0xca, 0x94, 0xf4, 0xbd, 0xc6, 0x69, 0x5a, 0xce, 0x2c, 0xea,
-	0xa7, 0x98, 0x39, 0x97, 0x66, 0xde, 0xd6, 0x91, 0x38, 0x4d, 0xcb, 0xa3, 0xd7, 0x7d, 0x7e, 0x3f,
-	0x54, 0x65, 0x12, 0x1f, 0xd1, 0x37, 0x39, 0x10, 0x4b, 0x1c, 0xda, 0x85, 0x4b, 0x96, 0xe7, 0x05,
-	0xf7, 0x05, 0xb0, 0x11, 0x04, 0x27, 0x6d, 0x8b, 0x9e, 0x30, 0xd1, 0x08, 0x17, 0x1b, 0x9f, 0x53,
-	0x2c, 0x97, 0x36, 0x87, 0x49, 0xf0, 0x28, 0xbe, 0x51, 0xc7, 0x36, 0x3d, 0xe1, 0xb1, 0x1d, 0xc3,
-	0xf2, 0x00, 0x48, 0xdc, 0x72, 0xd5, 0x95, 0x3e, 0xab, 0xe4, 0x2c, 0xe3, 0x11, 0x34, 0xe7, 0x63,
-	0xe0, 0x78, 0xa4, 0x44, 0x74, 0x03, 0xe6, 0xb9, 0x27, 0x07, 0xdd, 0x30, 0xaa, 0x3b, 0x0b, 0xe2,
-	0xb8, 0xd1, 0x59, 0xbf, 0x36, 0x7f, 0x27, 0x85, 0xc1, 0x03, 0x94, 0x7c, 0x73, 0x3d, 0xb7, 0xed,
-	0x86, 0xd5, 0x59, 0xc1, 0x12, 0x6f, 0xee, 0x6d, 0x0e, 0xc4, 0x12, 0x97, 0xf2, 0xc0, 0xe2, 0x45,
-	0x1e, 0x68, 0xfe, 0x39, 0x0f, 0x48, 0x16, 0xca, 0x8e, 0xac, 0xa7, 0x64, 0x48, 0xe3, 0xd5, 0xbc,
-	0x2a, 0xb4, 0x8d, 0x81, 0x6a, 0x5e, 0xd5, 0xd8, 0x11, 0x1e, 0xed, 0x42, 0x49, 0x86, 0x96, 0xe4,
-	0xba, 0xac, 0x2b, 0xe2, 0xd2, 0x5e, 0x84, 0x38, 0xef, 0xd7, 0x56, 0x52, 0x6a, 0x62, 0x8c, 0xe8,
-	0xb4, 0x12, 0x09, 0xe8, 0x1a, 0x80, 0xd5, 0x71, 0xf5, 0x59, 0x5b, 0x29, 0x99, 0xb8, 0x24, 0x5d,
-	0x33, 0xd6, 0xa8, 0xd0, 0xcb, 0x30, 0x1d, 0x7e, 0xba, 0x6e, 0xa8, 0x28, 0x9a, 0x3d, 0xde, 0xfb,
-	0x08, 0x09, 0x5c, 0xbb, 0xf0, 0x67, 0xc6, 0xcd, 0x52, 0x8d, 0x4c, 0xac, 0x7d, 0x3b, 0xc6, 0x60,
-	0x8d, 0x0a, 0x7d, 0x0b, 0x8a, 0x47, 0xaa, 0x14, 0x15, 0x07, 0x93, 0x39, 0x44, 0x46, 0x05, 0xac,
-	0x6c, 0xf7, 0xa3, 0x2f, 0x1c, 0x4b, 0x43, 0x5f, 0x81, 0x32, 0xeb, 0x1e, 0xc6, 0xd9, 0x5b, 0x9e,
-	0x66, 0x9c, 0x2a, 0x0f, 0x12, 0x14, 0xd6, 0xe9, 0xcc, 0x37, 0xa1, 0xb4, 0xeb, 0xda, 0x34, 0x10,
-	0xfd, 0xdb, 0x93, 0x30, 0xcb, 0x52, 0x0d, 0x4e, 0x7c, 0x92, 0x91, 0x97, 0x45, 0x78, 0xee, 0x5e,
-	0xbe, 0xe5, 0x07, 0xb2, 0x8d, 0x29, 0x24, 0xee, 0xf5, 0x2a, 0x07, 0x62, 0x89, 0xbb, 0xb1, 0xcc,
-	0x0b, 0x84, 0x9f, 0xbe, 0x5f, 0x9b, 0x7a, 0xf7, 0xfd, 0xda, 0xd4, 0x7b, 0xef, 0xab, 0x62, 0xe1,
-	0x1c, 0x00, 0xf6, 0x0e, 0xbf, 0x47, 0x6c, 0x19, 0x76, 0x33, 0x8d, 0xe4, 0xa2, 0x49, 0xb0, 0x18,
-	0xc9, 0xe5, 0x06, 0x8a, 0x3e, 0x0d, 0x87, 0x53, 0x94, 0x68, 0x1d, 0x4a, 0xf1, 0xb0, 0x4d, 0xf9,
-	0xc7, 0x52, 0xe4, 0x6f, 0xf1, 0x44, 0x0e, 0x27, 0x34, 0xa9, 0x1c, 0x30, 0x7d, 0x61, 0x0e, 0x68,
-	0x40, 0xbe, 0xeb, 0x3a, 0xaa, 0xd9, 0x7d, 0x26, 0xca, 0xc1, 0x77, 0x77, 0x9a, 0xe7, 0xfd, 0xda,
-	0x63, 0xe3, 0x66, 0xdc, 0x61, 0xaf, 0x43, 0x58, 0xfd, 0xee, 0x4e, 0x13, 0x73, 0xe6, 0x51, 0x01,
-	0x69, 0x66, 0xc2, 0x80, 0x74, 0x0d, 0xa0, 0x95, 0x8c, 0x0c, 0xe4, 0x7d, 0x8f, 0x1d, 0x51, 0x1b,
-	0x15, 0x68, 0x54, 0x88, 0xc1, 0x92, 0xcd, 0xfb, 0x6a, 0xd5, 0xba, 0xb3, 0xd0, 0x6a, 0xcb, 0x21,
-	0xe4, 0x64, 0x77, 0xe2, 0x8a, 0x52, 0xb3, 0xb4, 0x35, 0x28, 0x0c, 0x0f, 0xcb, 0x47, 0x01, 0x2c,
-	0x39, 0xaa, 0x43, 0x4c, 0x94, 0x96, 0x26, 0x56, 0x7a, 0x99, 0x2b, 0x6c, 0x0e, 0x0a, 0xc2, 0xc3,
-	0xb2, 0xd1, 0x77, 0x61, 0x25, 0x02, 0x0e, 0xb7, 0xe9, 0x22, 0x60, 0xe7, 0x1b, 0xab, 0x67, 0xfd,
-	0xda, 0x4a, 0x73, 0x2c, 0x15, 0x7e, 0x80, 0x04, 0xe4, 0xc0, 0x8c, 0x27, 0x0b, 0xdc, 0xb2, 0x28,
-	0x4a, 0xbe, 0x9a, 0x6d, 0x15, 0x89, 0xf7, 0xd7, 0xf5, 0xc2, 0x36, 0x1e, 0x97, 0xa8, 0x9a, 0x56,
-	0xc9, 0x46, 0x6f, 0x41, 0xd9, 0xf2, 0xfd, 0x20, 0xb4, 0xe4, 0xe0, 0x60, 0x4e, 0xa8, 0xda, 0x9c,
-	0x58, 0xd5, 0x66, 0x22, 0x63, 0xa0, 0x90, 0xd6, 0x30, 0x58, 0x57, 0x85, 0xee, 0xc3, 0x42, 0x70,
-	0xdf, 0x27, 0x14, 0x93, 0x23, 0x42, 0x89, 0x6f, 0x13, 0x56, 0xad, 0x08, 0xed, 0xcf, 0x66, 0xd4,
-	0x9e, 0x62, 0x4e, 0x5c, 0x3a, 0x0d, 0x67, 0x78, 0x50, 0x0b, 0xaa, 0xf3, 0xd8, 0xea, 0x5b, 0x9e,
-	0xfb, 0x7d, 0x42, 0x59, 0x75, 0x3e, 0x99, 0x13, 0x6f, 0xc7, 0x50, 0xac, 0x51, 0xf0, 0xe8, 0x67,
-	0x7b, 0x5d, 0x16, 0x12, 0x39, 0xb4, 0x5f, 0x48, 0x47, 0xbf, 0xad, 0x04, 0x85, 0x75, 0x3a, 0xd4,
-	0x85, 0x4a, 0x5b, 0xcf, 0x34, 0xd5, 0x25, 0xb1, 0xba, 0xeb, 0xd9, 0x56, 0x37, 0x9c, 0x0b, 0x93,
-	0xc2, 0x27, 0x85, 0xc3, 0x69, 0x2d, 0x2b, 0xcf, 0x43, 0xf9, 0x53, 0xf6, 0x04, 0xbc, 0xa7, 0x18,
-	0x3c, 0xc7, 0x89, 0x7a, 0x8a, 0x3f, 0xe6, 0x60, 0x3e, 0xbd, 0xfb, 0x03, 0x59, 0xb4, 0x90, 0x29,
-	0x8b, 0x46, 0xdd, 0xab, 0x31, 0xf6, 0x9d, 0x21, 0x0a, 0xeb, 0xf9, 0xb1, 0x61, 0x5d, 0x45, 0xcf,
-	0xe9, 0x87, 0x89, 0x9e, 0x75, 0x00, 0x5e, 0x9e, 0xd0, 0xc0, 0xf3, 0x08, 0x15, 0x81, 0xb3, 0xa8,
-	0xde, 0x13, 0x62, 0x28, 0xd6, 0x28, 0x78, 0x11, 0x7d, 0xe8, 0x05, 0xf6, 0x89, 0xd8, 0x82, 0xe8,
-	0xd2, 0x8b, 0x90, 0x59, 0x94, 0x45, 0x74, 0x63, 0x08, 0x8b, 0x47, 0x70, 0x98, 0x3d, 0xb8, 0xbc,
-	0x6f, 0xd1, 0xd0, 0xb5, 0xbc, 0xe4, 0x82, 0x89, 0x2e, 0xe5, 0x8d, 0xa1, 0x1e, 0xe8, 0x99, 0x49,
-	0x2f, 0x6a, 0xb2, 0xf9, 0x09, 0x2c, 0xe9, 0x83, 0xcc, 0xbf, 0x1a, 0x70, 0x65, 0xa4, 0xee, 0xcf,
-	0xa0, 0x07, 0x7b, 0x23, 0xdd, 0x83, 0xbd, 0x90, 0x71, 0x78, 0x39, 0xca, 0xda, 0x31, 0x1d, 0xd9,
-	0x2c, 0x14, 0xf6, 0x79, 0xed, 0x6b, 0xfe, 0xc2, 0x80, 0x39, 0xf1, 0x6b, 0x92, 0xc1, 0x6f, 0x2d,
-	0xfd, 0x1c, 0x50, 0x7a, 0x84, 0x4f, 0x01, 0xef, 0x18, 0x90, 0x1e, 0xb9, 0xa2, 0x97, 0xa4, 0xff,
-	0x1a, 0xf1, 0x4c, 0x74, 0x42, 0xdf, 0x7d, 0x71, 0x5c, 0x07, 0x79, 0x29, 0xd3, 0x70, 0xf1, 0x29,
-	0x28, 0xe1, 0x20, 0x08, 0xf7, 0xad, 0xf0, 0x98, 0xf1, 0x85, 0x77, 0xf8, 0x0f, 0xb5, 0x37, 0x62,
-	0xe1, 0x02, 0x83, 0x25, 0xdc, 0xfc, 0xb9, 0x01, 0x57, 0xc6, 0x3e, 0xd1, 0xf0, 0x10, 0x60, 0xc7,
-	0x5f, 0x6a, 0x45, 0xb1, 0x17, 0x26, 0x74, 0x58, 0xa3, 0xe2, 0xad, 0x5f, 0xea, 0x5d, 0x67, 0xb0,
-	0xf5, 0x4b, 0x69, 0xc3, 0x69, 0x5a, 0xf3, 0x9f, 0x39, 0x50, 0x6f, 0x22, 0xff, 0x65, 0x8f, 0x7d,
-	0x62, 0xe0, 0x45, 0x66, 0x3e, 0xfd, 0x22, 0x13, 0x3f, 0xbf, 0x68, 0x4f, 0x12, 0xf9, 0x07, 0x3f,
-	0x49, 0xa0, 0xe7, 0xe2, 0x57, 0x0e, 0x19, 0xba, 0x56, 0xd3, 0xaf, 0x1c, 0xe7, 0xfd, 0xda, 0x9c,
-	0x12, 0x9e, 0x7e, 0xf5, 0x78, 0x0d, 0x66, 0x1d, 0x12, 0x5a, 0xae, 0x27, 0xdb, 0xb8, 0xcc, 0xb3,
-	0x7f, 0x29, 0xac, 0x29, 0x59, 0x1b, 0x65, 0x6e, 0x93, 0xfa, 0xc0, 0x91, 0x40, 0x1e, 0x6d, 0xed,
-	0xc0, 0x91, 0x5d, 0x48, 0x21, 0x89, 0xb6, 0x5b, 0x81, 0x43, 0xb0, 0xc0, 0x98, 0xef, 0x1a, 0x50,
-	0x96, 0x92, 0xb6, 0xac, 0x2e, 0x23, 0x68, 0x23, 0x5e, 0x85, 0x3c, 0xee, 0x2b, 0xfa, 0x73, 0xd6,
-	0x79, 0xbf, 0x56, 0x12, 0x64, 0xa2, 0x81, 0x19, 0xf1, 0x6c, 0x93, 0xbb, 0x60, 0x8f, 0x1e, 0x87,
-	0x82, 0xb8, 0x3d, 0x6a, 0x33, 0x93, 0x77, 0x39, 0x0e, 0xc4, 0x12, 0x67, 0x7e, 0x9c, 0x83, 0x4a,
-	0x6a, 0x71, 0x19, 0x7a, 0x81, 0x78, 0xe2, 0x99, 0xcb, 0x30, 0x45, 0x1f, 0xff, 0x0a, 0xae, 0x72,
-	0xcf, 0xcc, 0xc3, 0xe4, 0x9e, 0x6f, 0xc3, 0x8c, 0xcd, 0xf7, 0x28, 0xfa, 0x53, 0xc5, 0xc6, 0x24,
-	0xc7, 0x29, 0x76, 0x37, 0xf1, 0x46, 0xf1, 0xc9, 0xb0, 0x12, 0x88, 0x6e, 0xc1, 0x12, 0x25, 0x21,
-	0xed, 0x6d, 0x1e, 0x85, 0x84, 0xea, 0xbd, 0x7f, 0x21, 0xa9, 0xb8, 0xf1, 0x20, 0x01, 0x1e, 0xe6,
-	0x31, 0x0f, 0x61, 0xee, 0x8e, 0x75, 0xe8, 0xc5, 0xaf, 0x59, 0x18, 0x2a, 0xae, 0x6f, 0x7b, 0x5d,
-	0x87, 0xc8, 0x68, 0x1c, 0x45, 0xaf, 0xe8, 0xd2, 0xee, 0xe8, 0xc8, 0xf3, 0x7e, 0xed, 0x52, 0x0a,
-	0x20, 0x9f, 0x6f, 0x70, 0x5a, 0x84, 0xe9, 0xc1, 0xf4, 0x67, 0xd8, 0x3d, 0x7e, 0x07, 0x4a, 0x49,
-	0x7d, 0xff, 0x88, 0x55, 0x9a, 0x6f, 0x40, 0x91, 0x7b, 0x7c, 0xd4, 0x97, 0x5e, 0x50, 0xe2, 0xa4,
-	0x0b, 0xa7, 0x5c, 0x96, 0xc2, 0xc9, 0x6c, 0x43, 0xe5, 0x6e, 0xc7, 0x79, 0xc8, 0xf7, 0xcc, 0x5c,
-	0xe6, 0xac, 0x75, 0x0d, 0xe4, 0xff, 0x35, 0x78, 0x82, 0x90, 0x99, 0x5b, 0x4b, 0x10, 0x7a, 0xe2,
-	0xd5, 0x86, 0xf9, 0x3f, 0x36, 0x00, 0xc4, 0xd4, 0xec, 0xe6, 0x29, 0xf1, 0xc3, 0x0c, 0xaf, 0xde,
-	0x77, 0x61, 0x26, 0x90, 0xde, 0x24, 0xdf, 0x34, 0x27, 0x1c, 0xcd, 0xc6, 0x97, 0x40, 0xfa, 0x13,
-	0x56, 0xc2, 0x1a, 0x57, 0x3f, 0xf8, 0x64, 0x75, 0xea, 0xc3, 0x4f, 0x56, 0xa7, 0x3e, 0xfa, 0x64,
-	0x75, 0xea, 0xed, 0xb3, 0x55, 0xe3, 0x83, 0xb3, 0x55, 0xe3, 0xc3, 0xb3, 0x55, 0xe3, 0xa3, 0xb3,
-	0x55, 0xe3, 0xe3, 0xb3, 0x55, 0xe3, 0xdd, 0xbf, 0xaf, 0x4e, 0xbd, 0x96, 0x3b, 0xdd, 0xf8, 0x4f,
-	0x00, 0x00, 0x00, 0xff, 0xff, 0x0d, 0x18, 0xc5, 0x8c, 0x25, 0x27, 0x00, 0x00,
+	// 2879 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x3a, 0xcd, 0x6f, 0x24, 0x47,
+	0xbd, 0xee, 0x19, 0x8f, 0x3d, 0xf3, 0x1b, 0x8f, 0x3f, 0x6a, 0xbd, 0xef, 0xcd, 0xfa, 0xe9, 0x79,
+	0x9c, 0x4e, 0x14, 0x6d, 0xde, 0x4b, 0xc6, 0xd9, 0x25, 0x44, 0x9b, 0x0d, 0x09, 0x78, 0x3c, 0xeb,
+	0x8d, 0x93, 0x75, 0x6c, 0x95, 0x77, 0x17, 0x58, 0x22, 0x48, 0xbb, 0xbb, 0x3c, 0x6e, 0xdc, 0xd3,
+	0x3d, 0xa9, 0xea, 0xf1, 0x66, 0xe0, 0x40, 0x0e, 0x20, 0x82, 0x84, 0xa2, 0x70, 0xe3, 0x84, 0x12,
+	0xc1, 0x1f, 0x80, 0xb8, 0xc0, 0x1f, 0x80, 0x44, 0x8e, 0x41, 0x5c, 0x22, 0x81, 0x46, 0x89, 0x39,
+	0x70, 0x44, 0x5c, 0x7d, 0x01, 0xd5, 0x47, 0x77, 0x57, 0xcf, 0xc7, 0xba, 0x27, 0xbb, 0x44, 0xdc,
+	0xa6, 0x7f, 0xdf, 0x55, 0xf5, 0xab, 0xdf, 0x57, 0x0d, 0xec, 0x1c, 0x5f, 0x63, 0x75, 0x37, 0x58,
+	0x3f, 0xee, 0x1e, 0x10, 0xea, 0x93, 0x90, 0xb0, 0xf5, 0x13, 0xe2, 0x3b, 0x01, 0x5d, 0x57, 0x08,
+	0xab, 0xe3, 0xb6, 0x2d, 0xfb, 0xc8, 0xf5, 0x09, 0xed, 0xad, 0x77, 0x8e, 0x5b, 0x1c, 0xc0, 0xd6,
+	0xdb, 0x24, 0xb4, 0xd6, 0x4f, 0xae, 0xac, 0xb7, 0x88, 0x4f, 0xa8, 0x15, 0x12, 0xa7, 0xde, 0xa1,
+	0x41, 0x18, 0xa0, 0x27, 0x24, 0x57, 0x5d, 0xe7, 0xaa, 0x77, 0x8e, 0x5b, 0x1c, 0xc0, 0xea, 0x9c,
+	0xab, 0x7e, 0x72, 0x65, 0xe5, 0x99, 0x96, 0x1b, 0x1e, 0x75, 0x0f, 0xea, 0x76, 0xd0, 0x5e, 0x6f,
+	0x05, 0xad, 0x60, 0x5d, 0x30, 0x1f, 0x74, 0x0f, 0xc5, 0x97, 0xf8, 0x10, 0xbf, 0xa4, 0xd0, 0x95,
+	0xb1, 0xa6, 0xd0, 0xae, 0x1f, 0xba, 0x6d, 0x32, 0x68, 0xc5, 0xca, 0xf3, 0xe7, 0x31, 0x30, 0xfb,
+	0x88, 0xb4, 0xad, 0x41, 0x3e, 0xf3, 0x0f, 0x79, 0x28, 0x6e, 0xec, 0x6d, 0xdf, 0xa4, 0x41, 0xb7,
+	0x83, 0xd6, 0x60, 0xda, 0xb7, 0xda, 0xa4, 0x6a, 0xac, 0x19, 0x97, 0x4b, 0x8d, 0xb9, 0x8f, 0xfa,
+	0xb5, 0xa9, 0xd3, 0x7e, 0x6d, 0xfa, 0x75, 0xab, 0x4d, 0xb0, 0xc0, 0x20, 0x0f, 0x8a, 0x27, 0x84,
+	0x32, 0x37, 0xf0, 0x59, 0x35, 0xb7, 0x96, 0xbf, 0x5c, 0xbe, 0xfa, 0x72, 0x3d, 0xcb, 0xfa, 0xeb,
+	0x42, 0xc1, 0x5d, 0xc9, 0xba, 0x15, 0xd0, 0xa6, 0xcb, 0xec, 0xe0, 0x84, 0xd0, 0x5e, 0x63, 0x51,
+	0x69, 0x29, 0x2a, 0x24, 0xc3, 0xb1, 0x06, 0xf4, 0x43, 0x03, 0x16, 0x3b, 0x94, 0x1c, 0x12, 0x4a,
+	0x89, 0xa3, 0xf0, 0xd5, 0xfc, 0x9a, 0xf1, 0x08, 0xd4, 0x56, 0x95, 0xda, 0xc5, 0xbd, 0x01, 0xf9,
+	0x78, 0x48, 0x23, 0xfa, 0xa5, 0x01, 0x2b, 0x8c, 0xd0, 0x13, 0x42, 0x37, 0x1c, 0x87, 0x12, 0xc6,
+	0x1a, 0xbd, 0x4d, 0xcf, 0x25, 0x7e, 0xb8, 0xb9, 0xdd, 0xc4, 0xac, 0x3a, 0x2d, 0xf6, 0xe1, 0xab,
+	0xd9, 0x0c, 0xda, 0x1f, 0x27, 0xa7, 0x61, 0x2a, 0x8b, 0x56, 0xc6, 0x92, 0x30, 0xfc, 0x00, 0x33,
+	0xcc, 0x43, 0x98, 0x8b, 0x0e, 0xf2, 0x96, 0xcb, 0x42, 0x74, 0x17, 0x66, 0x5a, 0xfc, 0x83, 0x55,
+	0x0d, 0x61, 0x60, 0x3d, 0x9b, 0x81, 0x91, 0x8c, 0xc6, 0xbc, 0xb2, 0x67, 0x46, 0x7c, 0x32, 0xac,
+	0xa4, 0x99, 0x3f, 0x99, 0x86, 0xf2, 0xc6, 0xde, 0x36, 0x26, 0x2c, 0xe8, 0x52, 0x9b, 0x64, 0x70,
+	0x9a, 0x6b, 0x30, 0xc7, 0x5c, 0xbf, 0xd5, 0xf5, 0x2c, 0xca, 0xa1, 0xd5, 0x19, 0x41, 0xb9, 0xac,
+	0x28, 0xe7, 0xf6, 0x35, 0x1c, 0x4e, 0x51, 0xa2, 0xab, 0x00, 0x5c, 0x02, 0xeb, 0x58, 0x36, 0x71,
+	0xaa, 0xb9, 0x35, 0xe3, 0x72, 0xb1, 0x81, 0x14, 0x1f, 0xbc, 0x1e, 0x63, 0xb0, 0x46, 0x85, 0x1e,
+	0x87, 0x82, 0xb0, 0xb4, 0x5a, 0x14, 0x6a, 0x2a, 0x8a, 0xbc, 0x20, 0x96, 0x81, 0x25, 0x0e, 0x3d,
+	0x05, 0xb3, 0xca, 0xcb, 0xaa, 0x25, 0x41, 0xb6, 0xa0, 0xc8, 0x66, 0x23, 0x37, 0x88, 0xf0, 0x7c,
+	0x7d, 0xc7, 0xae, 0xef, 0x08, 0xbf, 0xd3, 0xd6, 0xf7, 0x9a, 0xeb, 0x3b, 0x58, 0x60, 0xd0, 0x2d,
+	0x28, 0x9c, 0x10, 0x7a, 0xc0, 0x3d, 0x81, 0xbb, 0xe6, 0xff, 0x67, 0xdb, 0xe8, 0xbb, 0x9c, 0xa5,
+	0x51, 0xe2, 0xa6, 0x89, 0x9f, 0x58, 0x0a, 0x41, 0x75, 0x00, 0x76, 0x14, 0xd0, 0x50, 0x2c, 0xaf,
+	0x5a, 0x58, 0xcb, 0x5f, 0x2e, 0x35, 0xe6, 0xf9, 0x7a, 0xf7, 0x63, 0x28, 0xd6, 0x28, 0x38, 0xbd,
+	0x6d, 0x85, 0xa4, 0x15, 0x50, 0x97, 0xb0, 0xea, 0x6c, 0x42, 0xbf, 0x19, 0x43, 0xb1, 0x46, 0x81,
+	0x5e, 0x05, 0xc4, 0xc2, 0x80, 0x5a, 0x2d, 0xa2, 0x96, 0xfa, 0x8a, 0xc5, 0x8e, 0xaa, 0x20, 0x56,
+	0xb7, 0xa2, 0x56, 0x87, 0xf6, 0x87, 0x28, 0xf0, 0x08, 0x2e, 0xf3, 0x37, 0x06, 0x2c, 0x68, 0xbe,
+	0x20, 0xfc, 0xee, 0x1a, 0xcc, 0xb5, 0xb4, 0x5b, 0xa7, 0xfc, 0x22, 0x3e, 0x6d, 0xfd, 0x46, 0xe2,
+	0x14, 0x25, 0x22, 0x50, 0xa2, 0x4a, 0x52, 0x14, 0x5d, 0xae, 0x64, 0x76, 0xda, 0xc8, 0x86, 0x44,
+	0x93, 0x06, 0x64, 0x38, 0x91, 0x6c, 0xfe, 0xcd, 0x10, 0x0e, 0x1c, 0xc5, 0x1b, 0x74, 0x59, 0x8b,
+	0x69, 0x86, 0xd8, 0xbe, 0xb9, 0x31, 0xf1, 0xe8, 0x9c, 0x40, 0x90, 0xfb, 0x8f, 0x08, 0x04, 0xd7,
+	0x8b, 0x3f, 0xff, 0xa0, 0x36, 0xf5, 0xce, 0x5f, 0xd6, 0xa6, 0xcc, 0x9f, 0x19, 0x30, 0xb7, 0xd1,
+	0xe9, 0x78, 0xbd, 0xdd, 0x4e, 0x28, 0x16, 0x60, 0xc2, 0x8c, 0x43, 0x7b, 0xb8, 0xeb, 0xab, 0x85,
+	0x02, 0xbf, 0xdf, 0x4d, 0x01, 0xc1, 0x0a, 0xc3, 0xef, 0xcf, 0x61, 0x40, 0x6d, 0xa2, 0xae, 0x5b,
+	0x7c, 0x7f, 0xb6, 0x38, 0x10, 0x4b, 0x1c, 0x3f, 0xe4, 0x43, 0x97, 0x78, 0xce, 0x8e, 0xe5, 0x5b,
+	0x2d, 0x42, 0xd5, 0xe5, 0x88, 0xb7, 0x7e, 0x4b, 0xc3, 0xe1, 0x14, 0xa5, 0xf9, 0xcf, 0x1c, 0x94,
+	0x36, 0x03, 0xdf, 0x71, 0x43, 0x75, 0xb9, 0xc2, 0x5e, 0x67, 0x28, 0x78, 0xdc, 0xee, 0x75, 0x08,
+	0x16, 0x18, 0xf4, 0x02, 0xcc, 0xb0, 0xd0, 0x0a, 0xbb, 0x4c, 0xd8, 0x53, 0x6a, 0x3c, 0x16, 0x85,
+	0xa5, 0x7d, 0x01, 0x3d, 0xeb, 0xd7, 0x16, 0x62, 0x71, 0x12, 0x84, 0x15, 0x03, 0xf7, 0xf4, 0xe0,
+	0x40, 0x6c, 0x94, 0x73, 0x53, 0xa6, 0xbd, 0x28, 0x7f, 0xe4, 0x13, 0x4f, 0xdf, 0x1d, 0xa2, 0xc0,
+	0x23, 0xb8, 0xd0, 0x09, 0x20, 0xcf, 0x62, 0xe1, 0x6d, 0x6a, 0xf9, 0x4c, 0xe8, 0xba, 0xed, 0xb6,
+	0x89, 0xba, 0xf0, 0xff, 0x97, 0xed, 0xc4, 0x39, 0x47, 0xa2, 0xf7, 0xd6, 0x90, 0x34, 0x3c, 0x42,
+	0x03, 0x7a, 0x12, 0x66, 0x28, 0xb1, 0x58, 0xe0, 0x57, 0x0b, 0x62, 0xf9, 0x71, 0x54, 0xc6, 0x02,
+	0x8a, 0x15, 0x96, 0x07, 0xb4, 0x36, 0x61, 0xcc, 0x6a, 0x45, 0xe1, 0x35, 0x0e, 0x68, 0x3b, 0x12,
+	0x8c, 0x23, 0xbc, 0xf9, 0x6b, 0x03, 0x2a, 0x9b, 0x94, 0x58, 0x21, 0x99, 0xc4, 0x2d, 0x3e, 0xf7,
+	0x89, 0xa3, 0x0d, 0x58, 0x10, 0xdf, 0x77, 0x2d, 0xcf, 0x75, 0xe4, 0x19, 0x4c, 0x0b, 0xe6, 0xff,
+	0x56, 0xcc, 0x0b, 0x5b, 0x69, 0x34, 0x1e, 0xa4, 0x37, 0x7f, 0x9c, 0x87, 0x4a, 0x93, 0x78, 0x24,
+	0x31, 0x79, 0x0b, 0x50, 0x8b, 0x5a, 0x36, 0xd9, 0x23, 0xd4, 0x0d, 0x9c, 0x7d, 0x62, 0x07, 0xbe,
+	0xc3, 0x84, 0x1b, 0xe5, 0x1b, 0xff, 0xc5, 0xf7, 0xf7, 0xe6, 0x10, 0x16, 0x8f, 0xe0, 0x40, 0x1e,
+	0x54, 0x3a, 0x54, 0xfc, 0x16, 0x7b, 0x2e, 0xbd, 0xac, 0x7c, 0xf5, 0x4b, 0xd9, 0x8e, 0x74, 0x4f,
+	0x67, 0x6d, 0x2c, 0x9d, 0xf6, 0x6b, 0x95, 0x14, 0x08, 0xa7, 0x85, 0xa3, 0xaf, 0xc1, 0x62, 0x40,
+	0x3b, 0x47, 0x96, 0xdf, 0x24, 0x1d, 0xe2, 0x3b, 0xc4, 0x0f, 0x99, 0xd8, 0xc8, 0x62, 0x63, 0x99,
+	0xd7, 0x22, 0xbb, 0x03, 0x38, 0x3c, 0x44, 0x8d, 0xee, 0xc1, 0x52, 0x87, 0x06, 0x1d, 0xab, 0x25,
+	0x36, 0x66, 0x2f, 0xf0, 0x5c, 0xbb, 0xa7, 0xb6, 0xf3, 0xe9, 0xd3, 0x7e, 0x6d, 0x69, 0x6f, 0x10,
+	0x79, 0xd6, 0xaf, 0x5d, 0x10, 0x5b, 0xc7, 0x21, 0x09, 0x12, 0x0f, 0x8b, 0xd1, 0xdc, 0xa0, 0x30,
+	0xce, 0x0d, 0xcc, 0x6d, 0x28, 0x36, 0xbb, 0xea, 0x4e, 0xbc, 0x04, 0x45, 0x47, 0xfd, 0x56, 0x3b,
+	0x1f, 0x5d, 0xce, 0x98, 0xe6, 0xac, 0x5f, 0xab, 0xf0, 0xf2, 0xb3, 0x1e, 0x01, 0x70, 0xcc, 0x62,
+	0x3e, 0x09, 0x45, 0x71, 0xf0, 0xec, 0xee, 0x15, 0xb4, 0x08, 0x79, 0x6c, 0xdd, 0x17, 0x52, 0xe6,
+	0x30, 0xff, 0xa9, 0x45, 0xb1, 0x5d, 0x80, 0x9b, 0x24, 0x8c, 0x0e, 0x7e, 0x03, 0x16, 0xa2, 0x50,
+	0x9e, 0xce, 0x30, 0xb1, 0x37, 0xe1, 0x34, 0x1a, 0x0f, 0xd2, 0x9b, 0x6f, 0x40, 0x49, 0x64, 0x21,
+	0x9e, 0xc2, 0x93, 0x72, 0xc1, 0x78, 0x40, 0xb9, 0x10, 0xd5, 0x00, 0xb9, 0x71, 0x35, 0x80, 0x66,
+	0xae, 0x07, 0x15, 0xc9, 0x1b, 0x15, 0x48, 0x99, 0x34, 0x3c, 0x0d, 0xc5, 0xc8, 0x4c, 0xa5, 0x25,
+	0x2e, 0x8c, 0x23, 0x41, 0x38, 0xa6, 0xd0, 0xb4, 0x1d, 0x41, 0x2a, 0xa3, 0x66, 0x53, 0xa6, 0x55,
+	0x3f, 0xb9, 0x07, 0x57, 0x3f, 0x9a, 0xa6, 0x1f, 0x40, 0x75, 0x5c, 0x35, 0xfd, 0x10, 0x39, 0x3f,
+	0xbb, 0x29, 0xe6, 0x7b, 0x06, 0x2c, 0xea, 0x92, 0xb2, 0x1f, 0x5f, 0x76, 0x25, 0xe7, 0x57, 0x7b,
+	0xda, 0x8e, 0xfc, 0xc2, 0x80, 0xe5, 0xd4, 0xd2, 0x26, 0x3a, 0xf1, 0x09, 0x8c, 0xd2, 0x9d, 0x23,
+	0x3f, 0x81, 0x73, 0xfc, 0x29, 0x07, 0x95, 0x5b, 0xd6, 0x01, 0xf1, 0xf6, 0x89, 0x47, 0xec, 0x30,
+	0xa0, 0xe8, 0xfb, 0x50, 0x6e, 0x5b, 0xa1, 0x7d, 0x24, 0xa0, 0x51, 0x67, 0xd0, 0xcc, 0x16, 0xec,
+	0x52, 0x92, 0xea, 0x3b, 0x89, 0x98, 0x1b, 0x7e, 0x48, 0x7b, 0x8d, 0x0b, 0xca, 0xa4, 0xb2, 0x86,
+	0xc1, 0xba, 0x36, 0xd1, 0xce, 0x89, 0xef, 0x1b, 0x6f, 0x77, 0x78, 0xd9, 0x32, 0x79, 0x17, 0x99,
+	0x32, 0x01, 0x93, 0xb7, 0xba, 0x2e, 0x25, 0x6d, 0xe2, 0x87, 0x49, 0x3b, 0xb7, 0x33, 0x20, 0x1f,
+	0x0f, 0x69, 0x5c, 0x79, 0x19, 0x16, 0x07, 0x8d, 0xe7, 0xf1, 0xe7, 0x98, 0xf4, 0xe4, 0x79, 0x61,
+	0xfe, 0x13, 0x2d, 0x43, 0xe1, 0xc4, 0xf2, 0xba, 0xea, 0x36, 0x62, 0xf9, 0x71, 0x3d, 0x77, 0xcd,
+	0x30, 0x7f, 0x65, 0x40, 0x75, 0x9c, 0x21, 0xe8, 0x7f, 0x35, 0x41, 0x8d, 0xb2, 0xb2, 0x2a, 0xff,
+	0x1a, 0xe9, 0x49, 0xa9, 0x37, 0xa0, 0x18, 0x74, 0x78, 0x4d, 0x11, 0x50, 0x75, 0xea, 0x4f, 0x45,
+	0x27, 0xb9, 0xab, 0xe0, 0x67, 0xfd, 0xda, 0xc5, 0x94, 0xf8, 0x08, 0x81, 0x63, 0x56, 0x1e, 0xa9,
+	0x85, 0x3d, 0x3c, 0x7b, 0xc4, 0x91, 0xfa, 0xae, 0x80, 0x60, 0x85, 0x31, 0x7f, 0x67, 0xc0, 0xb4,
+	0x28, 0xc8, 0xdf, 0x80, 0x22, 0xdf, 0x3f, 0xc7, 0x0a, 0x2d, 0x61, 0x57, 0xe6, 0x56, 0x90, 0x73,
+	0xef, 0x90, 0xd0, 0x4a, 0xbc, 0x2d, 0x82, 0xe0, 0x58, 0x22, 0xc2, 0x50, 0x70, 0x43, 0xd2, 0x8e,
+	0x0e, 0xf2, 0x99, 0xb1, 0xa2, 0xd5, 0x20, 0xa2, 0x8e, 0xad, 0xfb, 0x37, 0xde, 0x0e, 0x89, 0xcf,
+	0x0f, 0x23, 0xb9, 0x1a, 0xdb, 0x5c, 0x06, 0x96, 0xa2, 0xcc, 0x7f, 0x18, 0x10, 0xab, 0xe2, 0xce,
+	0xcf, 0x88, 0x77, 0x78, 0xcb, 0xf5, 0x8f, 0xd5, 0xb6, 0xc6, 0xe6, 0xec, 0x2b, 0x38, 0x8e, 0x29,
+	0x46, 0xa5, 0x87, 0xdc, 0x64, 0xe9, 0x81, 0x2b, 0xb4, 0x03, 0x3f, 0x74, 0xfd, 0xee, 0xd0, 0x6d,
+	0xdb, 0x54, 0x70, 0x1c, 0x53, 0xf0, 0x42, 0x84, 0x92, 0xb6, 0xe5, 0xfa, 0xae, 0xdf, 0xe2, 0x8b,
+	0xd8, 0x0c, 0xba, 0x7e, 0x28, 0x32, 0xb2, 0x2a, 0x44, 0xf0, 0x10, 0x16, 0x8f, 0xe0, 0x30, 0x7f,
+	0x3b, 0x0d, 0x65, 0xbe, 0xe6, 0x28, 0xcf, 0xbd, 0x08, 0x15, 0x4f, 0xf7, 0x02, 0xb5, 0xf6, 0x8b,
+	0xca, 0x94, 0xf4, 0xbd, 0xc6, 0x69, 0x5a, 0xce, 0x2c, 0x4a, 0xa8, 0x98, 0x39, 0x97, 0x66, 0xde,
+	0xd2, 0x91, 0x38, 0x4d, 0xcb, 0xa3, 0xd7, 0x7d, 0x7e, 0x3f, 0x54, 0x65, 0x12, 0x1f, 0xd1, 0xd7,
+	0x39, 0x10, 0x4b, 0x1c, 0xda, 0x81, 0x0b, 0x96, 0xe7, 0x05, 0xf7, 0x05, 0xb0, 0x11, 0x04, 0xc7,
+	0x6d, 0x8b, 0x1e, 0x33, 0xd1, 0x4c, 0x17, 0x1b, 0xff, 0xa3, 0x58, 0x2e, 0x6c, 0x0c, 0x93, 0xe0,
+	0x51, 0x7c, 0xa3, 0x8e, 0x6d, 0x7a, 0xc2, 0x63, 0x3b, 0x82, 0xe5, 0x01, 0x90, 0xb8, 0xe5, 0xaa,
+	0xb3, 0x7d, 0x4e, 0xc9, 0x59, 0xc6, 0x23, 0x68, 0xce, 0xc6, 0xc0, 0xf1, 0x48, 0x89, 0xe8, 0x3a,
+	0xcc, 0x73, 0x4f, 0x0e, 0xba, 0x61, 0x54, 0x77, 0x16, 0xc4, 0x71, 0xa3, 0xd3, 0x7e, 0x6d, 0xfe,
+	0x76, 0x0a, 0x83, 0x07, 0x28, 0xf9, 0xe6, 0x7a, 0x6e, 0xdb, 0x0d, 0xab, 0xb3, 0x82, 0x25, 0xde,
+	0xdc, 0x5b, 0x1c, 0x88, 0x25, 0x2e, 0xe5, 0x81, 0xc5, 0xf3, 0x3c, 0xd0, 0xfc, 0x63, 0x1e, 0x90,
+	0xac, 0xb5, 0x1d, 0x59, 0x4f, 0xc9, 0x90, 0xc6, 0x3b, 0x02, 0x55, 0xab, 0x1b, 0x03, 0x1d, 0x81,
+	0x2a, 0xd3, 0x23, 0x3c, 0xda, 0x81, 0x92, 0x0c, 0x2d, 0xc9, 0x75, 0x59, 0x57, 0xc4, 0xa5, 0xdd,
+	0x08, 0x71, 0xd6, 0xaf, 0xad, 0xa4, 0xd4, 0xc4, 0x18, 0xd1, 0xad, 0x25, 0x12, 0xd0, 0x55, 0x00,
+	0xab, 0xe3, 0xea, 0xf3, 0xba, 0x52, 0x32, 0xb5, 0x49, 0x3a, 0x6f, 0xac, 0x51, 0xa1, 0x57, 0x60,
+	0x3a, 0xfc, 0x7c, 0x1d, 0x55, 0x51, 0x34, 0x8c, 0xbc, 0x7f, 0x12, 0x12, 0xb8, 0x76, 0xe1, 0xcf,
+	0x8c, 0x9b, 0xa5, 0x9a, 0xa1, 0x58, 0xfb, 0x56, 0x8c, 0xc1, 0x1a, 0x15, 0xfa, 0x06, 0x14, 0x0f,
+	0x55, 0x29, 0x2a, 0x0e, 0x26, 0x73, 0x88, 0x8c, 0x0a, 0x58, 0x39, 0x32, 0x88, 0xbe, 0x70, 0x2c,
+	0x0d, 0x7d, 0x19, 0xca, 0xac, 0x7b, 0x10, 0x67, 0x6f, 0x79, 0x9a, 0x71, 0xaa, 0xdc, 0x4f, 0x50,
+	0x58, 0xa7, 0x33, 0xdf, 0x82, 0xd2, 0x8e, 0x6b, 0xd3, 0x40, 0xf4, 0x80, 0x4f, 0xc1, 0x2c, 0x4b,
+	0x35, 0x38, 0xf1, 0x49, 0x46, 0x5e, 0x16, 0xe1, 0xb9, 0x7b, 0xf9, 0x96, 0x1f, 0xc8, 0x36, 0xa6,
+	0x90, 0xb8, 0xd7, 0xeb, 0x1c, 0x88, 0x25, 0xee, 0xfa, 0x32, 0x2f, 0x10, 0xde, 0xfd, 0xb0, 0x36,
+	0xf5, 0xfe, 0x87, 0xb5, 0xa9, 0x0f, 0x3e, 0x54, 0xc5, 0xc2, 0xbb, 0x65, 0x80, 0xdd, 0x83, 0xef,
+	0x12, 0x5b, 0x86, 0xdd, 0x4c, 0x63, 0xbd, 0x68, 0x9a, 0x2c, 0xc6, 0x7a, 0xb9, 0x81, 0xa2, 0x4f,
+	0xc3, 0xe1, 0x14, 0x25, 0x5a, 0x87, 0x52, 0x3c, 0xb0, 0x53, 0xfe, 0xb1, 0x14, 0xf9, 0x5b, 0x3c,
+	0xd5, 0xc3, 0x09, 0x4d, 0x2a, 0x07, 0x4c, 0x9f, 0x9b, 0x03, 0x1a, 0x90, 0xef, 0xba, 0x8e, 0x6a,
+	0x98, 0x9f, 0x8d, 0x72, 0xf0, 0x9d, 0xed, 0xe6, 0x59, 0xbf, 0xf6, 0xd8, 0xb8, 0x39, 0x79, 0xd8,
+	0xeb, 0x10, 0x56, 0xbf, 0xb3, 0xdd, 0xc4, 0x9c, 0x79, 0x54, 0x40, 0x9a, 0x99, 0x30, 0x20, 0x5d,
+	0x05, 0x68, 0x25, 0x63, 0x07, 0x79, 0xdf, 0x63, 0x47, 0xd4, 0xc6, 0x0d, 0x1a, 0x15, 0x62, 0xb0,
+	0x64, 0xf3, 0xd6, 0x5c, 0xb5, 0xff, 0x2c, 0xb4, 0xda, 0x72, 0x90, 0x39, 0xd9, 0x9d, 0xb8, 0xa4,
+	0xd4, 0x2c, 0x6d, 0x0e, 0x0a, 0xc3, 0xc3, 0xf2, 0x51, 0x00, 0x4b, 0x8e, 0xea, 0x10, 0x13, 0xa5,
+	0xa5, 0x89, 0x95, 0x5e, 0xe4, 0x0a, 0x9b, 0x83, 0x82, 0xf0, 0xb0, 0x6c, 0xf4, 0x6d, 0x58, 0x89,
+	0x80, 0xc3, 0x6d, 0xba, 0x08, 0xd8, 0xf9, 0xc6, 0xea, 0x69, 0xbf, 0xb6, 0xd2, 0x1c, 0x4b, 0x85,
+	0x1f, 0x20, 0x01, 0x39, 0x30, 0xe3, 0xc9, 0x02, 0xb7, 0x2c, 0x8a, 0x92, 0xaf, 0x64, 0x5b, 0x45,
+	0xe2, 0xfd, 0x75, 0xbd, 0xb0, 0x8d, 0x47, 0x2e, 0xaa, 0xa6, 0x55, 0xb2, 0xd1, 0xdb, 0x50, 0xb6,
+	0x7c, 0x3f, 0x08, 0x2d, 0x39, 0x38, 0x98, 0x13, 0xaa, 0x36, 0x26, 0x56, 0xb5, 0x91, 0xc8, 0x18,
+	0x28, 0xa4, 0x35, 0x0c, 0xd6, 0x55, 0xa1, 0xfb, 0xb0, 0x10, 0xdc, 0xf7, 0x09, 0xc5, 0xe4, 0x90,
+	0x50, 0xe2, 0xdb, 0x84, 0x55, 0x2b, 0x42, 0xfb, 0x73, 0x19, 0xb5, 0xa7, 0x98, 0x13, 0x97, 0x4e,
+	0xc3, 0x19, 0x1e, 0xd4, 0x82, 0xea, 0x3c, 0xb6, 0xfa, 0x96, 0xe7, 0x7e, 0x8f, 0x50, 0x56, 0x9d,
+	0x4f, 0x66, 0xcd, 0x5b, 0x31, 0x14, 0x6b, 0x14, 0x68, 0x13, 0xca, 0xb6, 0xd7, 0x65, 0x21, 0x91,
+	0x83, 0xff, 0x85, 0xd4, 0x04, 0xef, 0xd2, 0xbd, 0x7b, 0xf7, 0xbe, 0xd3, 0x24, 0x1d, 0x4a, 0x6c,
+	0x2b, 0x24, 0xce, 0x66, 0x42, 0x88, 0x75, 0x2e, 0xd4, 0x85, 0x4a, 0x5b, 0xcf, 0x3b, 0xd5, 0x25,
+	0xb1, 0xd6, 0x6b, 0xd9, 0xd6, 0x3a, 0x9c, 0x19, 0x93, 0x32, 0x28, 0x85, 0xc3, 0x69, 0x2d, 0x2b,
+	0x2f, 0x40, 0xf9, 0x73, 0x76, 0x08, 0xbc, 0xc3, 0x18, 0x3c, 0xd5, 0x89, 0x3a, 0x8c, 0xdf, 0xe7,
+	0x60, 0x3e, 0x7d, 0x16, 0x03, 0x39, 0xb5, 0x90, 0x29, 0xa7, 0x46, 0xbd, 0xac, 0x31, 0xf6, 0xe5,
+	0x22, 0x0a, 0xf2, 0xf9, 0xb1, 0x41, 0x5e, 0xc5, 0xd2, 0xe9, 0x87, 0x89, 0xa5, 0x75, 0x00, 0x5e,
+	0xac, 0xd0, 0xc0, 0xf3, 0x08, 0x15, 0x61, 0xb4, 0xa8, 0x5e, 0x28, 0x62, 0x28, 0xd6, 0x28, 0x78,
+	0x49, 0x7d, 0xe0, 0x05, 0xf6, 0xb1, 0xd8, 0x82, 0x28, 0x04, 0x88, 0x00, 0x5a, 0x94, 0x25, 0x75,
+	0x63, 0x08, 0x8b, 0x47, 0x70, 0x98, 0x3d, 0xb8, 0xb8, 0x67, 0xd1, 0xd0, 0xb5, 0xbc, 0xe4, 0xba,
+	0x89, 0x9e, 0xe5, 0xcd, 0xa1, 0x8e, 0xe8, 0xd9, 0x49, 0xaf, 0x6d, 0xb2, 0xf9, 0x09, 0x2c, 0xe9,
+	0x8a, 0xcc, 0x3f, 0x1b, 0x70, 0x69, 0xa4, 0xee, 0x2f, 0xa0, 0x23, 0x7b, 0x33, 0xdd, 0x91, 0xbd,
+	0x98, 0x71, 0x94, 0x39, 0xca, 0xda, 0x31, 0xfd, 0xd9, 0x2c, 0x14, 0xf6, 0x78, 0x25, 0x6c, 0x7e,
+	0x6c, 0xc0, 0x9c, 0xf8, 0x35, 0xc9, 0x24, 0xb9, 0x96, 0x7e, 0x60, 0x28, 0x3d, 0xba, 0xc7, 0x85,
+	0x47, 0x31, 0x6a, 0x7e, 0xcf, 0x80, 0xf4, 0x0c, 0x17, 0xbd, 0x2c, 0xaf, 0x80, 0x11, 0x0f, 0x59,
+	0x27, 0x74, 0xff, 0x97, 0xc6, 0xb5, 0xa4, 0x17, 0x32, 0x4d, 0x2b, 0x9f, 0x86, 0x12, 0x0e, 0x82,
+	0x70, 0xcf, 0x0a, 0x8f, 0x18, 0xdf, 0xbb, 0x0e, 0xff, 0xa1, 0xb6, 0x57, 0xec, 0x9d, 0xc0, 0x60,
+	0x09, 0x37, 0x7f, 0x6a, 0xc0, 0xa5, 0xb1, 0xef, 0x46, 0x3c, 0x8a, 0xd8, 0xf1, 0x97, 0x5a, 0x51,
+	0xec, 0xc8, 0x09, 0x1d, 0xd6, 0xa8, 0x78, 0x2f, 0x99, 0x7a, 0x6c, 0x1a, 0xec, 0x25, 0x53, 0xda,
+	0x70, 0x9a, 0xd6, 0xfc, 0x7b, 0x0e, 0xd4, 0x43, 0xcd, 0xbf, 0xd9, 0xe9, 0x9f, 0x1c, 0x78, 0x26,
+	0x9a, 0x4f, 0x3f, 0x13, 0xc5, 0x6f, 0x42, 0xda, 0x3b, 0x49, 0xfe, 0xc1, 0xef, 0x24, 0xe8, 0xf9,
+	0xf8, 0xe9, 0x45, 0xfa, 0xd0, 0x6a, 0xfa, 0xe9, 0xe5, 0xac, 0x5f, 0x9b, 0x53, 0xc2, 0xd3, 0x4f,
+	0x31, 0xf7, 0x60, 0xd6, 0x21, 0xa1, 0xe5, 0x7a, 0xb2, 0x2f, 0xcc, 0xfc, 0x98, 0x20, 0x85, 0x35,
+	0x25, 0x6b, 0xa3, 0xcc, 0x6d, 0x52, 0x1f, 0x38, 0x12, 0xc8, 0x03, 0xb6, 0x1d, 0x38, 0xb2, 0xad,
+	0x29, 0x24, 0x01, 0x7b, 0x33, 0x70, 0x08, 0x16, 0x18, 0xf3, 0x7d, 0x03, 0xca, 0x52, 0xd2, 0xa6,
+	0xd5, 0x65, 0x04, 0x5d, 0x89, 0x57, 0x21, 0x8f, 0xfb, 0x92, 0xfe, 0xc6, 0x76, 0xd6, 0xaf, 0x95,
+	0x04, 0x99, 0xe8, 0x88, 0x46, 0xbc, 0x25, 0xe5, 0xce, 0xd9, 0xa3, 0xc7, 0xa1, 0x20, 0x2e, 0x90,
+	0xda, 0xcc, 0xe4, 0xb1, 0x90, 0x03, 0xb1, 0xc4, 0x99, 0x9f, 0xe6, 0xa0, 0x92, 0x5a, 0x5c, 0x86,
+	0xe6, 0x22, 0x1e, 0xa1, 0xe6, 0x32, 0x8c, 0xe5, 0xc7, 0x3f, 0xcd, 0xab, 0xf4, 0x35, 0xf3, 0x30,
+	0xe9, 0xeb, 0x9b, 0x30, 0x63, 0xf3, 0x3d, 0x8a, 0xfe, 0xe9, 0x71, 0x65, 0x92, 0xe3, 0x14, 0xbb,
+	0x9b, 0x78, 0xa3, 0xf8, 0x64, 0x58, 0x09, 0x44, 0x37, 0x61, 0x89, 0x92, 0x90, 0xf6, 0x36, 0x0e,
+	0x43, 0x42, 0xf5, 0x61, 0x42, 0x21, 0x29, 0xe1, 0xf1, 0x20, 0x01, 0x1e, 0xe6, 0x31, 0x0f, 0x60,
+	0xee, 0xb6, 0x75, 0xe0, 0xc5, 0xcf, 0x63, 0x18, 0x2a, 0xae, 0x6f, 0x7b, 0x5d, 0x87, 0xc8, 0x80,
+	0x1e, 0x45, 0xaf, 0xe8, 0xd2, 0x6e, 0xeb, 0xc8, 0xb3, 0x7e, 0xed, 0x42, 0x0a, 0x20, 0xdf, 0x83,
+	0x70, 0x5a, 0x84, 0xe9, 0xc1, 0xf4, 0x17, 0xd8, 0x8e, 0x7e, 0x0b, 0x4a, 0x49, 0xc3, 0xf0, 0x88,
+	0x55, 0x9a, 0x6f, 0x42, 0x91, 0x7b, 0x7c, 0xd4, 0xe8, 0x9e, 0x53, 0x25, 0xa5, 0x6b, 0xaf, 0x5c,
+	0x96, 0xda, 0x4b, 0x3c, 0xb2, 0xde, 0xe9, 0x38, 0x0f, 0xf9, 0xc8, 0x9a, 0x7b, 0x98, 0xcc, 0x97,
+	0x9f, 0x30, 0xf3, 0x5d, 0x05, 0xf9, 0x47, 0x14, 0x9e, 0x64, 0x64, 0x01, 0xa1, 0x25, 0x19, 0x3d,
+	0xff, 0x6b, 0x2f, 0x0c, 0x3f, 0x32, 0x00, 0xc4, 0x28, 0xef, 0xc6, 0x09, 0xf1, 0xc3, 0x0c, 0xcf,
+	0xf9, 0x77, 0x60, 0x26, 0x90, 0x1e, 0x29, 0x1f, 0x5a, 0x27, 0x9c, 0x17, 0xc7, 0x17, 0x49, 0xfa,
+	0x24, 0x56, 0xc2, 0x1a, 0xaf, 0x7e, 0xf4, 0xd9, 0xea, 0xd4, 0xc7, 0x9f, 0xad, 0x4e, 0x7d, 0xf2,
+	0xd9, 0xea, 0xd4, 0x3b, 0xa7, 0xab, 0xc6, 0x47, 0xa7, 0xab, 0xc6, 0xc7, 0xa7, 0xab, 0xc6, 0x27,
+	0xa7, 0xab, 0xc6, 0xa7, 0xa7, 0xab, 0xc6, 0xfb, 0x7f, 0x5d, 0x9d, 0xba, 0xf7, 0x44, 0x96, 0x3f,
+	0xf8, 0xfd, 0x2b, 0x00, 0x00, 0xff, 0xff, 0x2d, 0x24, 0x60, 0xec, 0x20, 0x28, 0x00, 0x00,
 }
 
 func (m *APIGroup) Marshal() (dAtA []byte, err error) {
@@ -1909,6 +1912,11 @@ func (m *CreateOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x22
 	i -= len(m.FieldManager)
 	copy(dAtA[i:], m.FieldManager)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
@@ -2657,9 +2665,9 @@ func (m *ObjectMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x8a
 		}
 	}
-	i -= len(m.ClusterName)
-	copy(dAtA[i:], m.ClusterName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ClusterName)))
+	i -= len(m.ZZZ_DeprecatedClusterName)
+	copy(dAtA[i:], m.ZZZ_DeprecatedClusterName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ZZZ_DeprecatedClusterName)))
 	i--
 	dAtA[i] = 0x7a
 	if len(m.Finalizers) > 0 {
@@ -2982,6 +2990,11 @@ func (m *PatchOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x22
 	i -= len(m.FieldManager)
 	copy(dAtA[i:], m.FieldManager)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
@@ -3382,6 +3395,11 @@ func (m *UpdateOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x1a
 	i -= len(m.FieldManager)
 	copy(dAtA[i:], m.FieldManager)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
@@ -3648,6 +3666,8 @@ func (m *CreateOptions) Size() (n int) {
 	}
 	l = len(m.FieldManager)
 	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -3981,7 +4001,7 @@ func (m *ObjectMeta) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	l = len(m.ClusterName)
+	l = len(m.ZZZ_DeprecatedClusterName)
 	n += 1 + l + sovGenerated(uint64(l))
 	if len(m.ManagedFields) > 0 {
 		for _, e := range m.ManagedFields {
@@ -4069,6 +4089,8 @@ func (m *PatchOptions) Size() (n int) {
 	}
 	l = len(m.FieldManager)
 	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -4227,6 +4249,8 @@ func (m *UpdateOptions) Size() (n int) {
 	}
 	l = len(m.FieldManager)
 	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -4371,6 +4395,7 @@ func (this *CreateOptions) String() string {
 	s := strings.Join([]string{`&CreateOptions{`,
 		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
 		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4570,7 +4595,7 @@ func (this *ObjectMeta) String() string {
 		`Annotations:` + mapStringForAnnotations + `,`,
 		`OwnerReferences:` + repeatedStringForOwnerReferences + `,`,
 		`Finalizers:` + fmt.Sprintf("%v", this.Finalizers) + `,`,
-		`ClusterName:` + fmt.Sprintf("%v", this.ClusterName) + `,`,
+		`ZZZ_DeprecatedClusterName:` + fmt.Sprintf("%v", this.ZZZ_DeprecatedClusterName) + `,`,
 		`ManagedFields:` + repeatedStringForManagedFields + `,`,
 		`}`,
 	}, "")
@@ -4634,6 +4659,7 @@ func (this *PatchOptions) String() string {
 		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
 		`Force:` + valueToStringGenerated(this.Force) + `,`,
 		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4756,6 +4782,7 @@ func (this *UpdateOptions) String() string {
 	s := strings.Join([]string{`&UpdateOptions{`,
 		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
 		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -6097,6 +6124,38 @@ func (m *CreateOptions) Unmarshal(dAtA []byte) error {
 			}
 			m.FieldManager = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9155,7 +9214,7 @@ func (m *ObjectMeta) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 15:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusterName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ZZZ_DeprecatedClusterName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9183,7 +9242,7 @@ func (m *ObjectMeta) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusterName = string(dAtA[iNdEx:postIndex])
+			m.ZZZ_DeprecatedClusterName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 17:
 			if wireType != 2 {
@@ -9824,6 +9883,38 @@ func (m *PatchOptions) Unmarshal(dAtA []byte) error {
 			}
 			m.FieldManager = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -11145,6 +11236,38 @@ func (m *UpdateOptions) Unmarshal(dAtA []byte) error {
 			}
 			m.FieldManager = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto

@@ -25,7 +25,7 @@ import "k8s.io/apimachinery/pkg/runtime/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 
 // Package-wide variables from generator "generated".
-option go_package = "v1";
+option go_package = "k8s.io/apimachinery/pkg/apis/meta/v1";
 
 // APIGroup contains the name, the supported versions, and the preferred version
 // of a group.
@@ -242,6 +242,28 @@ message CreateOptions {
   // as defined by https://golang.org/pkg/unicode/#IsPrint.
   // +optional
   optional string fieldManager = 3;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields, provided that the `ServerSideFieldValidation`
+  // feature gate is also enabled. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23 and is the default behavior when the
+  // `ServerSideFieldValidation` feature gate is disabled.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default when the
+  // `ServerSideFieldValidation` feature gate is enabled.
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 4;
 }
 
 // DeleteOptions may be provided when deleting an API object.
@@ -362,7 +384,7 @@ message GroupVersionForDiscovery {
 }
 
 // GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
-// to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 message GroupVersionKind {
@@ -374,7 +396,7 @@ message GroupVersionKind {
 }
 
 // GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
-// to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 message GroupVersionResource {
@@ -435,13 +457,7 @@ message List {
 // ListMeta describes metadata that synthetic resources must have, including lists and
 // various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
 message ListMeta {
-  // selfLink is a URL representing this object.
-  // Populated by the system.
-  // Read-only.
-  //
-  // DEPRECATED
-  // Kubernetes will stop propagating this field in 1.20 release and the field is planned
-  // to be removed in 1.21 release.
+  // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
   // +optional
   optional string selfLink = 1;
 
@@ -576,7 +592,11 @@ message ManagedFieldsEntry {
   // set because it cannot be automatically converted.
   optional string apiVersion = 3;
 
-  // Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'
+  // Time is the timestamp of when the ManagedFields entry was added. The
+  // timestamp will also be updated if a field is added, the manager
+  // changes any of the owned fields value or removes a field. The
+  // timestamp does not update when a field is removed from the entry
+  // because another manager took it over.
   // +optional
   optional Time time = 4;
 
@@ -636,10 +656,7 @@ message ObjectMeta {
   // and may be truncated by the length of the suffix required to make the value
   // unique on the server.
   //
-  // If this field is specified and the generated name exists, the server will
-  // NOT return a 409 - instead, it will either return 201 Created or 500 with Reason
-  // ServerTimeout indicating a unique name could not be found in the time allotted, and the client
-  // should retry (optionally after the time indicated in the Retry-After header).
+  // If this field is specified and the generated name exists, the server will return a 409.
   //
   // Applied only if Name is not specified.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
@@ -657,13 +674,7 @@ message ObjectMeta {
   // +optional
   optional string namespace = 3;
 
-  // SelfLink is a URL representing this object.
-  // Populated by the system.
-  // Read-only.
-  //
-  // DEPRECATED
-  // Kubernetes will stop propagating this field in 1.20 release and the field is planned
-  // to be removed in 1.21 release.
+  // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
   // +optional
   optional string selfLink = 4;
 
@@ -774,9 +785,12 @@ message ObjectMeta {
   // +patchStrategy=merge
   repeated string finalizers = 14;
 
-  // The name of the cluster which the object belongs to.
-  // This is used to distinguish resources with same name and namespace in different clusters.
-  // This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
+  // Deprecated: ClusterName is a legacy field that was always cleared by
+  // the system and never used; it will be removed completely in 1.25.
+  //
+  // The name in the go struct is changed to help clients detect
+  // accidental use.
+  //
   // +optional
   optional string clusterName = 15;
 
@@ -819,6 +833,8 @@ message OwnerReference {
   // If true, AND if the owner has the "foregroundDeletion" finalizer, then
   // the owner cannot be deleted from the key-value store until this
   // reference is removed.
+  // See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+  // for how the garbage collector interacts with this field and enforces the foreground deletion.
   // Defaults to false.
   // To set this field, a user needs "delete" permission of the owner,
   // otherwise 422 (Unprocessable Entity) will be returned.
@@ -878,6 +894,28 @@ message PatchOptions {
   // types (JsonPatch, MergePatch, StrategicMergePatch).
   // +optional
   optional string fieldManager = 3;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields, provided that the `ServerSideFieldValidation`
+  // feature gate is also enabled. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23 and is the default behavior when the
+  // `ServerSideFieldValidation` feature gate is disabled.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default when the
+  // `ServerSideFieldValidation` feature gate is enabled.
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 4;
 }
 
 // Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
@@ -1095,6 +1133,28 @@ message UpdateOptions {
   // as defined by https://golang.org/pkg/unicode/#IsPrint.
   // +optional
   optional string fieldManager = 2;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields, provided that the `ServerSideFieldValidation`
+  // feature gate is also enabled. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23 and is the default behavior when the
+  // `ServerSideFieldValidation` feature gate is disabled.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default when the
+  // `ServerSideFieldValidation` feature gate is enabled.
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 3;
 }
 
 // Verbs masks the value so protobuf can generate

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go

@@ -44,7 +44,7 @@ func (gr *GroupResource) String() string {
 }
 
 // GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
-// to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 type GroupVersionResource struct {
@@ -80,7 +80,7 @@ func (gk *GroupKind) String() string {
 }
 
 // GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
-// to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 type GroupVersionKind struct {

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go

@@ -59,8 +59,8 @@ type Object interface {
 	SetFinalizers(finalizers []string)
 	GetOwnerReferences() []OwnerReference
 	SetOwnerReferences([]OwnerReference)
-	GetClusterName() string
-	SetClusterName(clusterName string)
+	GetZZZ_DeprecatedClusterName() string
+	SetZZZ_DeprecatedClusterName(clusterName string)
 	GetManagedFields() []ManagedFieldsEntry
 	SetManagedFields(managedFields []ManagedFieldsEntry)
 }
@@ -172,8 +172,10 @@ func (meta *ObjectMeta) GetOwnerReferences() []OwnerReference         { return m
 func (meta *ObjectMeta) SetOwnerReferences(references []OwnerReference) {
 	meta.OwnerReferences = references
 }
-func (meta *ObjectMeta) GetClusterName() string                 { return meta.ClusterName }
-func (meta *ObjectMeta) SetClusterName(clusterName string)      { meta.ClusterName = clusterName }
+func (meta *ObjectMeta) GetZZZ_DeprecatedClusterName() string { return meta.ZZZ_DeprecatedClusterName }
+func (meta *ObjectMeta) SetZZZ_DeprecatedClusterName(clusterName string) {
+	meta.ZZZ_DeprecatedClusterName = clusterName
+}
 func (meta *ObjectMeta) GetManagedFields() []ManagedFieldsEntry { return meta.ManagedFields }
 func (meta *ObjectMeta) SetManagedFields(managedFields []ManagedFieldsEntry) {
 	meta.ManagedFields = managedFields

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go

@@ -1,3 +1,4 @@
+//go:build !notest
 // +build !notest
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go

@@ -1,3 +1,4 @@
+//go:build !notest
 // +build !notest
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go

@@ -58,13 +58,7 @@ type TypeMeta struct {
 // ListMeta describes metadata that synthetic resources must have, including lists and
 // various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
 type ListMeta struct {
-	// selfLink is a URL representing this object.
-	// Populated by the system.
-	// Read-only.
-	//
-	// DEPRECATED
-	// Kubernetes will stop propagating this field in 1.20 release and the field is planned
-	// to be removed in 1.21 release.
+	// Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
 	// +optional
 	SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,1,opt,name=selfLink"`
 
@@ -131,10 +125,7 @@ type ObjectMeta struct {
 	// and may be truncated by the length of the suffix required to make the value
 	// unique on the server.
 	//
-	// If this field is specified and the generated name exists, the server will
-	// NOT return a 409 - instead, it will either return 201 Created or 500 with Reason
-	// ServerTimeout indicating a unique name could not be found in the time allotted, and the client
-	// should retry (optionally after the time indicated in the Retry-After header).
+	// If this field is specified and the generated name exists, the server will return a 409.
 	//
 	// Applied only if Name is not specified.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
@@ -152,13 +143,7 @@ type ObjectMeta struct {
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
 
-	// SelfLink is a URL representing this object.
-	// Populated by the system.
-	// Read-only.
-	//
-	// DEPRECATED
-	// Kubernetes will stop propagating this field in 1.20 release and the field is planned
-	// to be removed in 1.21 release.
+	// Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
 	// +optional
 	SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,4,opt,name=selfLink"`
 
@@ -269,11 +254,14 @@ type ObjectMeta struct {
 	// +patchStrategy=merge
 	Finalizers []string `json:"finalizers,omitempty" patchStrategy:"merge" protobuf:"bytes,14,rep,name=finalizers"`
 
-	// The name of the cluster which the object belongs to.
-	// This is used to distinguish resources with same name and namespace in different clusters.
-	// This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
+	// Deprecated: ClusterName is a legacy field that was always cleared by
+	// the system and never used; it will be removed completely in 1.25.
+	//
+	// The name in the go struct is changed to help clients detect
+	// accidental use.
+	//
 	// +optional
-	ClusterName string `json:"clusterName,omitempty" protobuf:"bytes,15,opt,name=clusterName"`
+	ZZZ_DeprecatedClusterName string `json:"clusterName,omitempty" protobuf:"bytes,15,opt,name=clusterName"`
 
 	// ManagedFields maps workflow-id and version to the set of fields
 	// that are managed by that workflow. This is mostly for internal
@@ -322,6 +310,8 @@ type OwnerReference struct {
 	// If true, AND if the owner has the "foregroundDeletion" finalizer, then
 	// the owner cannot be deleted from the key-value store until this
 	// reference is removed.
+	// See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+	// for how the garbage collector interacts with this field and enforces the foreground deletion.
 	// Defaults to false.
 	// To set this field, a user needs "delete" permission of the owner,
 	// otherwise 422 (Unprocessable Entity) will be returned.
@@ -522,6 +512,15 @@ type DeleteOptions struct {
 	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,5,rep,name=dryRun"`
 }
 
+const (
+	// FieldValidationIgnore ignores unknown/duplicate fields
+	FieldValidationIgnore = "Ignore"
+	// FieldValidationWarn responds with a warning, but successfully serve the request
+	FieldValidationWarn = "Warn"
+	// FieldValidationStrict fails the request on unknown/duplicate fields
+	FieldValidationStrict = "Strict"
+)
+
 // +k8s:conversion-gen:explicit-from=net/url.Values
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
@@ -544,6 +543,28 @@ type CreateOptions struct {
 	// as defined by https://golang.org/pkg/unicode/#IsPrint.
 	// +optional
 	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,3,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields, provided that the `ServerSideFieldValidation`
+	// feature gate is also enabled. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23 and is the default behavior when the
+	// `ServerSideFieldValidation` feature gate is disabled.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default when the
+	// `ServerSideFieldValidation` feature gate is enabled.
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,4,name=fieldValidation"`
 }
 
 // +k8s:conversion-gen:explicit-from=net/url.Values
@@ -577,6 +598,28 @@ type PatchOptions struct {
 	// types (JsonPatch, MergePatch, StrategicMergePatch).
 	// +optional
 	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,3,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields, provided that the `ServerSideFieldValidation`
+	// feature gate is also enabled. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23 and is the default behavior when the
+	// `ServerSideFieldValidation` feature gate is disabled.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default when the
+	// `ServerSideFieldValidation` feature gate is enabled.
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,4,name=fieldValidation"`
 }
 
 // ApplyOptions may be provided when applying an API object.
@@ -632,6 +675,28 @@ type UpdateOptions struct {
 	// as defined by https://golang.org/pkg/unicode/#IsPrint.
 	// +optional
 	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,2,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields, provided that the `ServerSideFieldValidation`
+	// feature gate is also enabled. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23 and is the default behavior when the
+	// `ServerSideFieldValidation` feature gate is disabled.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default when the
+	// `ServerSideFieldValidation` feature gate is enabled.
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,3,name=fieldValidation"`
 }
 
 // Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
@@ -1166,7 +1231,11 @@ type ManagedFieldsEntry struct {
 	// APIVersion field. It is necessary to track the version of a field
 	// set because it cannot be automatically converted.
 	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,3,opt,name=apiVersion"`
-	// Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'
+	// Time is the timestamp of when the ManagedFields entry was added. The
+	// timestamp will also be updated if a field is added, the manager
+	// changes any of the owned fields value or removes a field. The
+	// timestamp does not update when a field is removed from the entry
+	// because another manager took it over.
 	// +optional
 	Time *Time `json:"time,omitempty" protobuf:"bytes,4,opt,name=time"`
 

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go

@@ -112,9 +112,10 @@ func (Condition) SwaggerDoc() map[string]string {
 }
 
 var map_CreateOptions = map[string]string{
-	"":             "CreateOptions may be provided when creating an API object.",
-	"dryRun":       "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
-	"fieldManager": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"":                "CreateOptions may be provided when creating an API object.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields, provided that the `ServerSideFieldValidation` feature gate is also enabled. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23 and is the default behavior when the `ServerSideFieldValidation` feature gate is disabled. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default when the `ServerSideFieldValidation` feature gate is enabled. - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
 }
 
 func (CreateOptions) SwaggerDoc() map[string]string {
@@ -194,7 +195,7 @@ func (List) SwaggerDoc() map[string]string {
 
 var map_ListMeta = map[string]string{
 	"":                   "ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.",
-	"selfLink":           "selfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.",
+	"selfLink":           "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
 	"resourceVersion":    "String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
 	"continue":           "continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.",
 	"remainingItemCount": "remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.",
@@ -226,7 +227,7 @@ var map_ManagedFieldsEntry = map[string]string{
 	"manager":     "Manager is an identifier of the workflow managing these fields.",
 	"operation":   "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.",
 	"apiVersion":  "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.",
-	"time":        "Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'",
+	"time":        "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.",
 	"fieldsType":  "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"",
 	"fieldsV1":    "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type.",
 	"subresource": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.",
@@ -239,9 +240,9 @@ func (ManagedFieldsEntry) SwaggerDoc() map[string]string {
 var map_ObjectMeta = map[string]string{
 	"":                           "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.",
 	"name":                       "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names",
-	"generateName":               "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
+	"generateName":               "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
 	"namespace":                  "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces",
-	"selfLink":                   "SelfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.",
+	"selfLink":                   "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
 	"uid":                        "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids",
 	"resourceVersion":            "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
 	"generation":                 "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.",
@@ -252,7 +253,7 @@ var map_ObjectMeta = map[string]string{
 	"annotations":                "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations",
 	"ownerReferences":            "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.",
 	"finalizers":                 "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order.  Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.",
-	"clusterName":                "The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.",
+	"clusterName":                "Deprecated: ClusterName is a legacy field that was always cleared by the system and never used; it will be removed completely in 1.25.\n\nThe name in the go struct is changed to help clients detect accidental use.",
 	"managedFields":              "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.",
 }
 
@@ -267,7 +268,7 @@ var map_OwnerReference = map[string]string{
 	"name":               "Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names",
 	"uid":                "UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids",
 	"controller":         "If true, this reference points to the managing controller.",
-	"blockOwnerDeletion": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
+	"blockOwnerDeletion": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
 }
 
 func (OwnerReference) SwaggerDoc() map[string]string {
@@ -302,10 +303,11 @@ func (Patch) SwaggerDoc() map[string]string {
 }
 
 var map_PatchOptions = map[string]string{
-	"":             "PatchOptions may be provided when patching an API object. PatchOptions is meant to be a superset of UpdateOptions.",
-	"dryRun":       "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
-	"force":        "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.",
-	"fieldManager": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).",
+	"":                "PatchOptions may be provided when patching an API object. PatchOptions is meant to be a superset of UpdateOptions.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"force":           "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields, provided that the `ServerSideFieldValidation` feature gate is also enabled. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23 and is the default behavior when the `ServerSideFieldValidation` feature gate is disabled. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default when the `ServerSideFieldValidation` feature gate is enabled. - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
 }
 
 func (PatchOptions) SwaggerDoc() map[string]string {
@@ -447,9 +449,10 @@ func (TypeMeta) SwaggerDoc() map[string]string {
 }
 
 var map_UpdateOptions = map[string]string{
-	"":             "UpdateOptions may be provided when updating an API object. All fields in UpdateOptions should also be present in PatchOptions.",
-	"dryRun":       "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
-	"fieldManager": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"":                "UpdateOptions may be provided when updating an API object. All fields in UpdateOptions should also be present in PatchOptions.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields, provided that the `ServerSideFieldValidation` feature gate is also enabled. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23 and is the default behavior when the `ServerSideFieldValidation` feature gate is disabled. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default when the `ServerSideFieldValidation` feature gate is enabled. - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
 }
 
 func (UpdateOptions) SwaggerDoc() map[string]string {

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go

@@ -340,6 +340,7 @@ func (s unstructuredJSONScheme) Decode(data []byte, _ *schema.GroupVersionKind,
 	if len(gvk.Kind) == 0 {
 		return nil, &gvk, runtime.NewMissingKindErr(string(data))
 	}
+	// TODO(109023): require apiVersion here as well
 
 	return obj, &gvk, nil
 }
@@ -382,7 +383,7 @@ func (unstructuredJSONScheme) Identifier() runtime.Identifier {
 
 func (s unstructuredJSONScheme) decode(data []byte) (runtime.Object, error) {
 	type detector struct {
-		Items gojson.RawMessage
+		Items gojson.RawMessage `json:"items"`
 	}
 	var det detector
 	if err := json.Unmarshal(data, &det); err != nil {
@@ -425,7 +426,7 @@ func (unstructuredJSONScheme) decodeToUnstructured(data []byte, unstruct *Unstru
 
 func (s unstructuredJSONScheme) decodeToList(data []byte, list *UnstructuredList) error {
 	type decodeList struct {
-		Items []gojson.RawMessage
+		Items []gojson.RawMessage `json:"items"`
 	}
 
 	var dList decodeList

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go

@@ -444,11 +444,11 @@ func (u *Unstructured) SetFinalizers(finalizers []string) {
 	u.setNestedStringSlice(finalizers, "metadata", "finalizers")
 }
 
-func (u *Unstructured) GetClusterName() string {
+func (u *Unstructured) GetZZZ_DeprecatedClusterName() string {
 	return getNestedString(u.Object, "metadata", "clusterName")
 }
 
-func (u *Unstructured) SetClusterName(clusterName string) {
+func (u *Unstructured) SetZZZ_DeprecatedClusterName(clusterName string) {
 	if len(clusterName) == 0 {
 		RemoveNestedField(u.Object, "metadata", "clusterName")
 		return

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go

@@ -96,17 +96,19 @@ func ValidateDeleteOptions(options *metav1.DeleteOptions) field.ErrorList {
 }
 
 func ValidateCreateOptions(options *metav1.CreateOptions) field.ErrorList {
-	return append(
-		ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager")),
-		ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...,
-	)
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
 }
 
 func ValidateUpdateOptions(options *metav1.UpdateOptions) field.ErrorList {
-	return append(
-		ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager")),
-		ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...,
-	)
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
 }
 
 func ValidatePatchOptions(options *metav1.PatchOptions, patchType types.PatchType) field.ErrorList {
@@ -123,6 +125,7 @@ func ValidatePatchOptions(options *metav1.PatchOptions, patchType types.PatchTyp
 	}
 	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
 	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
 	return allErrs
 }
 
@@ -159,6 +162,18 @@ func ValidateDryRun(fldPath *field.Path, dryRun []string) field.ErrorList {
 	return allErrs
 }
 
+var allowedFieldValidationValues = sets.NewString("", metav1.FieldValidationIgnore, metav1.FieldValidationWarn, metav1.FieldValidationStrict)
+
+// ValidateFieldValidation validates that a fieldValidation query param only contains allowed values.
+func ValidateFieldValidation(fldPath *field.Path, fieldValidation string) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !allowedFieldValidationValues.Has(fieldValidation) {
+		allErrs = append(allErrs, field.NotSupported(fldPath, fieldValidation, allowedFieldValidationValues.List()))
+	}
+	return allErrs
+
+}
+
 const UninitializedStatusUpdateErrorMsg string = `must not update status when the object is uninitialized`
 
 // ValidateTableOptions returns any invalid flags on TableOptions.

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*
@@ -293,6 +294,13 @@ func autoConvert_url_Values_To_v1_CreateOptions(in *url.Values, out *CreateOptio
 	} else {
 		out.FieldManager = ""
 	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
 	return nil
 }
 
@@ -448,6 +456,13 @@ func autoConvert_url_Values_To_v1_PatchOptions(in *url.Values, out *PatchOptions
 	} else {
 		out.FieldManager = ""
 	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
 	return nil
 }
 
@@ -496,6 +511,13 @@ func autoConvert_url_Values_To_v1_UpdateOptions(in *url.Values, out *UpdateOptio
 	} else {
 		out.FieldManager = ""
 	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
 	return nil
 }
 

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go

@@ -82,26 +82,26 @@ func init() {
 
 var fileDescriptor_90ec10f86b91f9a8 = []byte{
 	// 317 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x91, 0x41, 0x4b, 0xf3, 0x30,
-	0x1c, 0xc6, 0x9b, 0xf7, 0x65, 0x38, 0x3a, 0x04, 0xd9, 0x69, 0xee, 0x90, 0x0d, 0x4f, 0xf3, 0xb0,
-	0x84, 0x0d, 0x11, 0xc1, 0xdb, 0x6e, 0x82, 0xa2, 0xec, 0x28, 0x1e, 0x4c, 0xbb, 0xbf, 0x5d, 0xac,
-	0x69, 0x4a, 0xf2, 0xef, 0xc0, 0x9b, 0x1f, 0xc1, 0x8f, 0xb5, 0xe3, 0x8e, 0x03, 0x61, 0xb8, 0xf8,
-	0x45, 0x24, 0x5d, 0x15, 0x19, 0x0a, 0xbb, 0xf5, 0x79, 0xca, 0xef, 0x97, 0x27, 0x24, 0x1c, 0xa7,
-	0x67, 0x96, 0x49, 0xcd, 0xd3, 0x22, 0x02, 0x93, 0x01, 0x82, 0xe5, 0x33, 0xc8, 0x26, 0xda, 0xf0,
-	0xea, 0x87, 0xc8, 0xa5, 0x12, 0xf1, 0x54, 0x66, 0x60, 0x9e, 0x79, 0x9e, 0x26, 0xbe, 0xb0, 0x5c,
-	0x01, 0x0a, 0x3e, 0x1b, 0x44, 0x80, 0x62, 0xc0, 0x13, 0xc8, 0xc0, 0x08, 0x84, 0x09, 0xcb, 0x8d,
-	0x46, 0xdd, 0x3c, 0xde, 0xa0, 0xec, 0x27, 0xca, 0xf2, 0x34, 0xf1, 0x85, 0x65, 0x1e, 0x65, 0x15,
-	0xda, 0xee, 0x27, 0x12, 0xa7, 0x45, 0xc4, 0x62, 0xad, 0x78, 0xa2, 0x13, 0xcd, 0x4b, 0x43, 0x54,
-	0x3c, 0x94, 0xa9, 0x0c, 0xe5, 0xd7, 0xc6, 0xdc, 0x3e, 0xd9, 0x65, 0xd4, 0xf6, 0x9e, 0xf6, 0xe9,
-	0x5f, 0x94, 0x29, 0x32, 0x94, 0x0a, 0xb8, 0x8d, 0xa7, 0xa0, 0xc4, 0x36, 0x77, 0xf4, 0x46, 0xc2,
-	0xc3, 0x1b, 0x61, 0x50, 0x8a, 0xa7, 0xeb, 0xe8, 0x11, 0x62, 0xbc, 0x02, 0x14, 0x13, 0x81, 0xe2,
-	0x52, 0x5a, 0x6c, 0xde, 0x85, 0x75, 0x55, 0xe5, 0xd6, 0xbf, 0x2e, 0xe9, 0x35, 0x86, 0x8c, 0xed,
-	0x72, 0x71, 0xe6, 0x69, 0x6f, 0x1a, 0x1d, 0xcc, 0x57, 0x9d, 0xc0, 0xad, 0x3a, 0xf5, 0xaf, 0x66,
-	0xfc, 0x6d, 0x6c, 0xde, 0x87, 0x35, 0x89, 0xa0, 0x6c, 0x8b, 0x74, 0xff, 0xf7, 0x1a, 0xc3, 0xf3,
-	0xdd, 0xd4, 0xbf, 0xae, 0x1d, 0xed, 0x57, 0xe7, 0xd4, 0x2e, 0xbc, 0x71, 0xbc, 0x11, 0x8f, 0xfa,
-	0xf3, 0x35, 0x0d, 0x16, 0x6b, 0x1a, 0x2c, 0xd7, 0x34, 0x78, 0x71, 0x94, 0xcc, 0x1d, 0x25, 0x0b,
-	0x47, 0xc9, 0xd2, 0x51, 0xf2, 0xee, 0x28, 0x79, 0xfd, 0xa0, 0xc1, 0xed, 0x5e, 0xf5, 0x52, 0x9f,
-	0x01, 0x00, 0x00, 0xff, 0xff, 0xf7, 0x82, 0x5b, 0x80, 0x29, 0x02, 0x00, 0x00,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x92, 0x41, 0x4b, 0xf3, 0x30,
+	0x1c, 0xc6, 0x9b, 0xf7, 0x65, 0x30, 0x3a, 0x04, 0xd9, 0x69, 0xee, 0x90, 0x0d, 0x4f, 0xdb, 0xc1,
+	0x84, 0x0d, 0x11, 0xc1, 0xdb, 0x6e, 0x82, 0x32, 0xd9, 0x51, 0x3c, 0x98, 0x76, 0x7f, 0xbb, 0x58,
+	0xd3, 0x94, 0xe4, 0xdf, 0x81, 0x37, 0x3f, 0x82, 0x1f, 0x6b, 0xc7, 0x1d, 0x07, 0xc2, 0x70, 0xf5,
+	0x8b, 0x48, 0xda, 0x2a, 0x32, 0x14, 0x7a, 0xeb, 0xf3, 0x94, 0xdf, 0x2f, 0x4f, 0x20, 0xfe, 0x2c,
+	0x3e, 0xb7, 0x4c, 0x6a, 0x1e, 0x67, 0x01, 0x98, 0x04, 0x10, 0x2c, 0x5f, 0x42, 0x32, 0xd7, 0x86,
+	0x57, 0x3f, 0x44, 0x2a, 0x95, 0x08, 0x17, 0x32, 0x01, 0xf3, 0xcc, 0xd3, 0x38, 0x72, 0x85, 0xe5,
+	0x0a, 0x50, 0xf0, 0xe5, 0x28, 0x00, 0x14, 0x23, 0x1e, 0x41, 0x02, 0x46, 0x20, 0xcc, 0x59, 0x6a,
+	0x34, 0xea, 0xf6, 0xb0, 0x44, 0xd9, 0x4f, 0x94, 0xa5, 0x71, 0xe4, 0x0a, 0xcb, 0x1c, 0xca, 0x2a,
+	0xb4, 0x7b, 0x12, 0x49, 0x5c, 0x64, 0x01, 0x0b, 0xb5, 0xe2, 0x91, 0x8e, 0x34, 0x2f, 0x0c, 0x41,
+	0xf6, 0x50, 0xa4, 0x22, 0x14, 0x5f, 0xa5, 0xb9, 0x7b, 0x5a, 0x67, 0xd4, 0xfe, 0x9e, 0xee, 0xd9,
+	0x5f, 0x94, 0xc9, 0x12, 0x94, 0x0a, 0xb8, 0x0d, 0x17, 0xa0, 0xc4, 0x3e, 0x77, 0xfc, 0x46, 0xfc,
+	0xa3, 0x1b, 0x61, 0x50, 0x8a, 0xa7, 0x69, 0xf0, 0x08, 0x21, 0x5e, 0x03, 0x8a, 0xb9, 0x40, 0x71,
+	0x25, 0x2d, 0xb6, 0xef, 0xfc, 0xa6, 0xaa, 0x72, 0xe7, 0x5f, 0x9f, 0x0c, 0x5a, 0x63, 0xc6, 0xea,
+	0x5c, 0x9c, 0x39, 0xda, 0x99, 0x26, 0x87, 0xab, 0x6d, 0xcf, 0xcb, 0xb7, 0xbd, 0xe6, 0x57, 0x33,
+	0xfb, 0x36, 0xb6, 0xef, 0xfd, 0x86, 0x44, 0x50, 0xb6, 0x43, 0xfa, 0xff, 0x07, 0xad, 0xf1, 0x45,
+	0x3d, 0xf5, 0xaf, 0x6b, 0x27, 0x07, 0xd5, 0x39, 0x8d, 0x4b, 0x67, 0x9c, 0x95, 0xe2, 0xc9, 0x74,
+	0xb5, 0xa3, 0xde, 0x7a, 0x47, 0xbd, 0xcd, 0x8e, 0x7a, 0x2f, 0x39, 0x25, 0xab, 0x9c, 0x92, 0x75,
+	0x4e, 0xc9, 0x26, 0xa7, 0xe4, 0x3d, 0xa7, 0xe4, 0xf5, 0x83, 0x7a, 0xb7, 0xc3, 0xda, 0xcf, 0xe0,
+	0x33, 0x00, 0x00, 0xff, 0xff, 0x30, 0x97, 0x8b, 0x11, 0x4b, 0x02, 0x00, 0x00,
 }
 
 func (m *PartialObjectMetadataList) Marshal() (dAtA []byte, err error) {

vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto

@@ -25,7 +25,7 @@ import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 
 // Package-wide variables from generator "generated".
-option go_package = "v1beta1";
+option go_package = "k8s.io/apimachinery/pkg/apis/meta/v1beta1";
 
 // PartialObjectMetadataList contains a list of objects containing only their metadata.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/conversion/converter.go

@@ -44,23 +44,16 @@ type Converter struct {
 	generatedConversionFuncs ConversionFuncs
 
 	// Set of conversions that should be treated as a no-op
-	ignoredConversions        map[typePair]struct{}
 	ignoredUntypedConversions map[typePair]struct{}
-
-	// nameFunc is called to retrieve the name of a type; this name is used for the
-	// purpose of deciding whether two types match or not (i.e., will we attempt to
-	// do a conversion). The default returns the go type name.
-	nameFunc func(t reflect.Type) string
 }
 
 // NewConverter creates a new Converter object.
-func NewConverter(nameFn NameFunc) *Converter {
+// Arg NameFunc is just for backward compatibility.
+func NewConverter(NameFunc) *Converter {
 	c := &Converter{
 		conversionFuncs:           NewConversionFuncs(),
 		generatedConversionFuncs:  NewConversionFuncs(),
-		ignoredConversions:        make(map[typePair]struct{}),
 		ignoredUntypedConversions: make(map[typePair]struct{}),
-		nameFunc:                  nameFn,
 	}
 	c.RegisterUntypedConversionFunc(
 		(*[]byte)(nil), (*[]byte)(nil),
@@ -186,13 +179,12 @@ func (c *Converter) RegisterGeneratedUntypedConversionFunc(a, b interface{}, fn
 func (c *Converter) RegisterIgnoredConversion(from, to interface{}) error {
 	typeFrom := reflect.TypeOf(from)
 	typeTo := reflect.TypeOf(to)
-	if reflect.TypeOf(from).Kind() != reflect.Ptr {
+	if typeFrom.Kind() != reflect.Ptr {
 		return fmt.Errorf("expected pointer arg for 'from' param 0, got: %v", typeFrom)
 	}
 	if typeTo.Kind() != reflect.Ptr {
 		return fmt.Errorf("expected pointer arg for 'to' param 1, got: %v", typeTo)
 	}
-	c.ignoredConversions[typePair{typeFrom.Elem(), typeTo.Elem()}] = struct{}{}
 	c.ignoredUntypedConversions[typePair{typeFrom, typeTo}] = struct{}{}
 	return nil
 }

vendor/k8s.io/apimachinery/pkg/labels/selector.go

@@ -22,12 +22,12 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/google/go-cmp/cmp"
 	"k8s.io/apimachinery/pkg/selection"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/klog/v2"
+	stringslices "k8s.io/utils/strings/slices"
 )
 
 var (
@@ -288,7 +288,7 @@ func (r Requirement) Equal(x Requirement) bool {
 	if r.operator != x.operator {
 		return false
 	}
-	return cmp.Equal(r.strValues, x.strValues)
+	return stringslices.Equal(r.strValues, x.strValues)
 }
 
 // Empty returns true if the internalSelector doesn't restrict selection space

vendor/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/runtime/allocator.go

@@ -0,0 +1,74 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"sync"
+)
+
+// AllocatorPool simply stores Allocator objects to avoid additional memory allocations
+// by caching created but unused items for later reuse, relieving pressure on the garbage collector.
+//
+// Usage:
+//  memoryAllocator := runtime.AllocatorPool.Get().(*runtime.Allocator)
+//  defer runtime.AllocatorPool.Put(memoryAllocator)
+//
+// A note for future:
+//  consider introducing multiple pools for storing buffers of different sizes
+//  perhaps this could allow us to be more efficient.
+var AllocatorPool = sync.Pool{
+	New: func() interface{} {
+		return &Allocator{}
+	},
+}
+
+// Allocator knows how to allocate memory
+// It exists to make the cost of object serialization cheaper.
+// In some cases, it allows for allocating memory only once and then reusing it.
+// This approach puts less load on GC and leads to less fragmented memory in general.
+type Allocator struct {
+	buf []byte
+}
+
+var _ MemoryAllocator = &Allocator{}
+
+// Allocate reserves memory for n bytes only if the underlying array doesn't have enough capacity
+// otherwise it returns previously allocated block of memory.
+//
+// Note that the returned array is not zeroed, it is the caller's
+// responsibility to clean the memory if needed.
+func (a *Allocator) Allocate(n uint64) []byte {
+	if uint64(cap(a.buf)) >= n {
+		a.buf = a.buf[:n]
+		return a.buf
+	}
+	// grow the buffer
+	size := uint64(2*cap(a.buf)) + n
+	a.buf = make([]byte, size, size)
+	a.buf = a.buf[:n]
+	return a.buf
+}
+
+// SimpleAllocator a wrapper around make([]byte)
+// conforms to the MemoryAllocator interface
+type SimpleAllocator struct{}
+
+var _ MemoryAllocator = &SimpleAllocator{}
+
+func (sa *SimpleAllocator) Allocate(n uint64) []byte {
+	return make([]byte, n, n)
+}

vendor/k8s.io/apimachinery/pkg/runtime/converter.go

@@ -22,6 +22,7 @@ import (
 	"math"
 	"os"
 	"reflect"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -109,21 +110,141 @@ type unstructuredConverter struct {
 // to Go types via reflection. It performs mismatch detection automatically and is intended for use by external
 // test tools. Use DefaultUnstructuredConverter if you do not explicitly need mismatch detection.
 func NewTestUnstructuredConverter(comparison conversion.Equalities) UnstructuredConverter {
+	return NewTestUnstructuredConverterWithValidation(comparison)
+}
+
+// NewTestUnstrucutredConverterWithValidation allows for access to
+// FromUnstructuredWithValidation from within tests.
+func NewTestUnstructuredConverterWithValidation(comparison conversion.Equalities) *unstructuredConverter {
 	return &unstructuredConverter{
 		mismatchDetection: true,
 		comparison:        comparison,
 	}
 }
 
-// FromUnstructured converts an object from map[string]interface{} representation into a concrete type.
+// fromUnstructuredContext provides options for informing the converter
+// the state of its recursive walk through the conversion process.
+type fromUnstructuredContext struct {
+	// isInlined indicates whether the converter is currently in
+	// an inlined field or not to determine whether it should
+	// validate the matchedKeys yet or only collect them.
+	// This should only be set from `structFromUnstructured`
+	isInlined bool
+	// matchedKeys is a stack of the set of all fields that exist in the
+	// concrete go type of the object being converted into.
+	// This should only be manipulated via `pushMatchedKeyTracker`,
+	// `recordMatchedKey`, or `popAndVerifyMatchedKeys`
+	matchedKeys []map[string]struct{}
+	// parentPath collects the path that the conversion
+	// takes as it traverses the unstructured json map.
+	// It is used to report the full path to any unknown
+	// fields that the converter encounters.
+	parentPath []string
+	// returnUnknownFields indicates whether or not
+	// unknown field errors should be collected and
+	// returned to the caller
+	returnUnknownFields bool
+	// unknownFieldErrors are the collection of
+	// the full path to each unknown field in the
+	// object.
+	unknownFieldErrors []error
+}
+
+// pushMatchedKeyTracker adds a placeholder set for tracking
+// matched keys for the given level. This should only be
+// called from `structFromUnstructured`.
+func (c *fromUnstructuredContext) pushMatchedKeyTracker() {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	c.matchedKeys = append(c.matchedKeys, nil)
+}
+
+// recordMatchedKey initializes the last element of matchedKeys
+// (if needed) and sets 'key'. This should only be called from
+// `structFromUnstructured`.
+func (c *fromUnstructuredContext) recordMatchedKey(key string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	last := len(c.matchedKeys) - 1
+	if c.matchedKeys[last] == nil {
+		c.matchedKeys[last] = map[string]struct{}{}
+	}
+	c.matchedKeys[last][key] = struct{}{}
+}
+
+// popAndVerifyMatchedKeys pops the last element of matchedKeys,
+// checks the matched keys against the data, and adds unknown
+// field errors for any matched keys.
+// `mapValue` is the value of sv containing all of the keys that exist at this level
+// (ie. sv.MapKeys) in the source data.
+// `matchedKeys` are all the keys found for that level in the destination object.
+// This should only be called from `structFromUnstructured`.
+func (c *fromUnstructuredContext) popAndVerifyMatchedKeys(mapValue reflect.Value) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	last := len(c.matchedKeys) - 1
+	curMatchedKeys := c.matchedKeys[last]
+	c.matchedKeys[last] = nil
+	c.matchedKeys = c.matchedKeys[:last]
+	for _, key := range mapValue.MapKeys() {
+		if _, ok := curMatchedKeys[key.String()]; !ok {
+			c.recordUnknownField(key.String())
+		}
+	}
+}
+
+func (c *fromUnstructuredContext) recordUnknownField(field string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	pathLen := len(c.parentPath)
+	c.pushKey(field)
+	errPath := strings.Join(c.parentPath, "")
+	c.parentPath = c.parentPath[:pathLen]
+	c.unknownFieldErrors = append(c.unknownFieldErrors, fmt.Errorf(`unknown field "%s"`, errPath))
+}
+
+func (c *fromUnstructuredContext) pushIndex(index int) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	c.parentPath = append(c.parentPath, "[", strconv.Itoa(index), "]")
+}
+
+func (c *fromUnstructuredContext) pushKey(key string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	if len(c.parentPath) > 0 {
+		c.parentPath = append(c.parentPath, ".")
+	}
+	c.parentPath = append(c.parentPath, key)
+
+}
+
+// FromUnstructuredWIthValidation converts an object from map[string]interface{} representation into a concrete type.
 // It uses encoding/json/Unmarshaler if object implements it or reflection if not.
-func (c *unstructuredConverter) FromUnstructured(u map[string]interface{}, obj interface{}) error {
+// It takes a validationDirective that indicates how to behave when it encounters unknown fields.
+func (c *unstructuredConverter) FromUnstructuredWithValidation(u map[string]interface{}, obj interface{}, returnUnknownFields bool) error {
 	t := reflect.TypeOf(obj)
 	value := reflect.ValueOf(obj)
 	if t.Kind() != reflect.Ptr || value.IsNil() {
 		return fmt.Errorf("FromUnstructured requires a non-nil pointer to an object, got %v", t)
 	}
-	err := fromUnstructured(reflect.ValueOf(u), value.Elem())
+
+	fromUnstructuredContext := &fromUnstructuredContext{
+		returnUnknownFields: returnUnknownFields,
+	}
+	err := fromUnstructured(reflect.ValueOf(u), value.Elem(), fromUnstructuredContext)
 	if c.mismatchDetection {
 		newObj := reflect.New(t.Elem()).Interface()
 		newErr := fromUnstructuredViaJSON(u, newObj)
@@ -134,7 +255,23 @@ func (c *unstructuredConverter) FromUnstructured(u map[string]interface{}, obj i
 			klog.Fatalf("FromUnstructured mismatch\nobj1: %#v\nobj2: %#v", obj, newObj)
 		}
 	}
-	return err
+	if err != nil {
+		return err
+	}
+	if returnUnknownFields && len(fromUnstructuredContext.unknownFieldErrors) > 0 {
+		sort.Slice(fromUnstructuredContext.unknownFieldErrors, func(i, j int) bool {
+			return fromUnstructuredContext.unknownFieldErrors[i].Error() <
+				fromUnstructuredContext.unknownFieldErrors[j].Error()
+		})
+		return NewStrictDecodingError(fromUnstructuredContext.unknownFieldErrors)
+	}
+	return nil
+}
+
+// FromUnstructured converts an object from map[string]interface{} representation into a concrete type.
+// It uses encoding/json/Unmarshaler if object implements it or reflection if not.
+func (c *unstructuredConverter) FromUnstructured(u map[string]interface{}, obj interface{}) error {
+	return c.FromUnstructuredWithValidation(u, obj, false)
 }
 
 func fromUnstructuredViaJSON(u map[string]interface{}, obj interface{}) error {
@@ -145,7 +282,7 @@ func fromUnstructuredViaJSON(u map[string]interface{}, obj interface{}) error {
 	return json.Unmarshal(data, obj)
 }
 
-func fromUnstructured(sv, dv reflect.Value) error {
+func fromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
 	sv = unwrapInterface(sv)
 	if !sv.IsValid() {
 		dv.Set(reflect.Zero(dv.Type()))
@@ -213,18 +350,19 @@ func fromUnstructured(sv, dv reflect.Value) error {
 
 	switch dt.Kind() {
 	case reflect.Map:
-		return mapFromUnstructured(sv, dv)
+		return mapFromUnstructured(sv, dv, ctx)
 	case reflect.Slice:
-		return sliceFromUnstructured(sv, dv)
+		return sliceFromUnstructured(sv, dv, ctx)
 	case reflect.Ptr:
-		return pointerFromUnstructured(sv, dv)
+		return pointerFromUnstructured(sv, dv, ctx)
 	case reflect.Struct:
-		return structFromUnstructured(sv, dv)
+		return structFromUnstructured(sv, dv, ctx)
 	case reflect.Interface:
 		return interfaceFromUnstructured(sv, dv)
 	default:
 		return fmt.Errorf("unrecognized type: %v", dt.Kind())
 	}
+
 }
 
 func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo {
@@ -275,7 +413,7 @@ func unwrapInterface(v reflect.Value) reflect.Value {
 	return v
 }
 
-func mapFromUnstructured(sv, dv reflect.Value) error {
+func mapFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
 	st, dt := sv.Type(), dv.Type()
 	if st.Kind() != reflect.Map {
 		return fmt.Errorf("cannot restore map from %v", st.Kind())
@@ -293,7 +431,7 @@ func mapFromUnstructured(sv, dv reflect.Value) error {
 	for _, key := range sv.MapKeys() {
 		value := reflect.New(dt.Elem()).Elem()
 		if val := unwrapInterface(sv.MapIndex(key)); val.IsValid() {
-			if err := fromUnstructured(val, value); err != nil {
+			if err := fromUnstructured(val, value, ctx); err != nil {
 				return err
 			}
 		} else {
@@ -308,7 +446,7 @@ func mapFromUnstructured(sv, dv reflect.Value) error {
 	return nil
 }
 
-func sliceFromUnstructured(sv, dv reflect.Value) error {
+func sliceFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
 	st, dt := sv.Type(), dv.Type()
 	if st.Kind() == reflect.String && dt.Elem().Kind() == reflect.Uint8 {
 		// We store original []byte representation as string.
@@ -340,15 +478,22 @@ func sliceFromUnstructured(sv, dv reflect.Value) error {
 		return nil
 	}
 	dv.Set(reflect.MakeSlice(dt, sv.Len(), sv.Cap()))
+
+	pathLen := len(ctx.parentPath)
+	defer func() {
+		ctx.parentPath = ctx.parentPath[:pathLen]
+	}()
 	for i := 0; i < sv.Len(); i++ {
-		if err := fromUnstructured(sv.Index(i), dv.Index(i)); err != nil {
+		ctx.pushIndex(i)
+		if err := fromUnstructured(sv.Index(i), dv.Index(i), ctx); err != nil {
 			return err
 		}
+		ctx.parentPath = ctx.parentPath[:pathLen]
 	}
 	return nil
 }
 
-func pointerFromUnstructured(sv, dv reflect.Value) error {
+func pointerFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
 	st, dt := sv.Type(), dv.Type()
 
 	if st.Kind() == reflect.Ptr && sv.IsNil() {
@@ -358,38 +503,63 @@ func pointerFromUnstructured(sv, dv reflect.Value) error {
 	dv.Set(reflect.New(dt.Elem()))
 	switch st.Kind() {
 	case reflect.Ptr, reflect.Interface:
-		return fromUnstructured(sv.Elem(), dv.Elem())
+		return fromUnstructured(sv.Elem(), dv.Elem(), ctx)
 	default:
-		return fromUnstructured(sv, dv.Elem())
+		return fromUnstructured(sv, dv.Elem(), ctx)
 	}
 }
 
-func structFromUnstructured(sv, dv reflect.Value) error {
+func structFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
 	st, dt := sv.Type(), dv.Type()
 	if st.Kind() != reflect.Map {
 		return fmt.Errorf("cannot restore struct from: %v", st.Kind())
 	}
 
+	pathLen := len(ctx.parentPath)
+	svInlined := ctx.isInlined
+	defer func() {
+		ctx.parentPath = ctx.parentPath[:pathLen]
+		ctx.isInlined = svInlined
+	}()
+	if !svInlined {
+		ctx.pushMatchedKeyTracker()
+	}
 	for i := 0; i < dt.NumField(); i++ {
 		fieldInfo := fieldInfoFromField(dt, i)
 		fv := dv.Field(i)
 
 		if len(fieldInfo.name) == 0 {
-			// This field is inlined.
-			if err := fromUnstructured(sv, fv); err != nil {
+			// This field is inlined, recurse into fromUnstructured again
+			// with the same set of matched keys.
+			ctx.isInlined = true
+			if err := fromUnstructured(sv, fv, ctx); err != nil {
 				return err
 			}
+			ctx.isInlined = svInlined
 		} else {
+			// This field is not inlined so we recurse into
+			// child field of sv corresponding to field i of
+			// dv, with a new set of matchedKeys and updating
+			// the parentPath to indicate that we are one level
+			// deeper.
+			ctx.recordMatchedKey(fieldInfo.name)
 			value := unwrapInterface(sv.MapIndex(fieldInfo.nameValue))
 			if value.IsValid() {
-				if err := fromUnstructured(value, fv); err != nil {
+				ctx.isInlined = false
+				ctx.pushKey(fieldInfo.name)
+				if err := fromUnstructured(value, fv, ctx); err != nil {
 					return err
 				}
+				ctx.parentPath = ctx.parentPath[:pathLen]
+				ctx.isInlined = svInlined
 			} else {
 				fv.Set(reflect.Zero(fv.Type()))
 			}
 		}
 	}
+	if !svInlined {
+		ctx.popAndVerifyMatchedKeys(sv)
+	}
 	return nil
 }
 
@@ -535,24 +705,13 @@ func mapToUnstructured(sv, dv reflect.Value) error {
 	}
 	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
 		if st.Key().Kind() == reflect.String {
-			switch st.Elem().Kind() {
-			// TODO It should be possible to reuse the slice for primitive types.
-			// However, it is panicing in the following form.
-			// case reflect.String, reflect.Bool,
-			// 	reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
-			// 	reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-			// 	sv.Set(sv)
-			// 	return nil
-			default:
-				// We need to do a proper conversion.
-			}
+			dv.Set(reflect.MakeMap(mapStringInterfaceType))
+			dv = dv.Elem()
+			dt = dv.Type()
 		}
-		dv.Set(reflect.MakeMap(mapStringInterfaceType))
-		dv = dv.Elem()
-		dt = dv.Type()
 	}
 	if dt.Kind() != reflect.Map {
-		return fmt.Errorf("cannot convert struct to: %v", dt.Kind())
+		return fmt.Errorf("cannot convert map to: %v", dt.Kind())
 	}
 
 	if !st.Key().AssignableTo(dt.Key()) && !st.Key().ConvertibleTo(dt.Key()) {
@@ -593,20 +752,9 @@ func sliceToUnstructured(sv, dv reflect.Value) error {
 		return nil
 	}
 	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
-		switch st.Elem().Kind() {
-		// TODO It should be possible to reuse the slice for primitive types.
-		// However, it is panicing in the following form.
-		// case reflect.String, reflect.Bool,
-		// 	reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
-		// 	reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		// 	sv.Set(sv)
-		// 	return nil
-		default:
-			// We need to do a proper conversion.
-			dv.Set(reflect.MakeSlice(reflect.SliceOf(dt), sv.Len(), sv.Cap()))
-			dv = dv.Elem()
-			dt = dv.Type()
-		}
+		dv.Set(reflect.MakeSlice(reflect.SliceOf(dt), sv.Len(), sv.Cap()))
+		dv = dv.Elem()
+		dt = dv.Type()
 	}
 	if dt.Kind() != reflect.Slice {
 		return fmt.Errorf("cannot convert slice to: %v", dt.Kind())

vendor/k8s.io/apimachinery/pkg/runtime/error.go

@@ -19,6 +19,7 @@ package runtime
 import (
 	"fmt"
 	"reflect"
+	"strings"
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
@@ -124,20 +125,30 @@ func IsMissingVersion(err error) bool {
 // strictDecodingError is a base error type that is returned by a strict Decoder such
 // as UniversalStrictDecoder.
 type strictDecodingError struct {
-	message string
-	data    string
+	errors []error
 }
 
 // NewStrictDecodingError creates a new strictDecodingError object.
-func NewStrictDecodingError(message string, data string) error {
+func NewStrictDecodingError(errors []error) error {
 	return &strictDecodingError{
-		message: message,
-		data:    data,
+		errors: errors,
 	}
 }
 
 func (e *strictDecodingError) Error() string {
-	return fmt.Sprintf("strict decoder error for %s: %s", e.data, e.message)
+	var s strings.Builder
+	s.WriteString("strict decoding error: ")
+	for i, err := range e.errors {
+		if i != 0 {
+			s.WriteString(", ")
+		}
+		s.WriteString(err.Error())
+	}
+	return s.String()
+}
+
+func (e *strictDecodingError) Errors() []error {
+	return e.errors
 }
 
 // IsStrictDecodingError returns true if the error indicates that the provided object
@@ -149,3 +160,13 @@ func IsStrictDecodingError(err error) bool {
 	_, ok := err.(*strictDecodingError)
 	return ok
 }
+
+// AsStrictDecodingError returns a strict decoding error
+// containing all the strictness violations.
+func AsStrictDecodingError(err error) (*strictDecodingError, bool) {
+	if err == nil {
+		return nil, false
+	}
+	strictErr, ok := err.(*strictDecodingError)
+	return strictErr, ok
+}

vendor/k8s.io/apimachinery/pkg/runtime/generated.pb.go

@@ -137,31 +137,31 @@ func init() {
 }
 
 var fileDescriptor_9d3c45d7f546725c = []byte{
-	// 378 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x8f, 0x4f, 0xab, 0x13, 0x31,
-	0x14, 0xc5, 0x27, 0xaf, 0x85, 0x3e, 0xd3, 0xc2, 0x93, 0xb8, 0x70, 0x74, 0x91, 0x79, 0x74, 0xe5,
-	0x5b, 0xbc, 0x04, 0x1e, 0x08, 0x6e, 0x3b, 0xa5, 0xa0, 0x88, 0x20, 0xc1, 0x3f, 0xe0, 0xca, 0x74,
-	0x26, 0x4e, 0xc3, 0xd0, 0x9b, 0x21, 0xcd, 0x38, 0x76, 0xe7, 0x47, 0xf0, 0x63, 0x75, 0xd9, 0x65,
-	0x57, 0xc5, 0x8e, 0x1f, 0xc2, 0xad, 0x34, 0x4d, 0x6b, 0xd5, 0x85, 0xbb, 0xe4, 0x9e, 0xf3, 0x3b,
-	0xf7, 0x1e, 0xfc, 0xbc, 0x7c, 0xb6, 0x60, 0xda, 0xf0, 0xb2, 0x9e, 0x2a, 0x0b, 0xca, 0xa9, 0x05,
-	0xff, 0xac, 0x20, 0x37, 0x96, 0x07, 0x41, 0x56, 0x7a, 0x2e, 0xb3, 0x99, 0x06, 0x65, 0x97, 0xbc,
-	0x2a, 0x0b, 0x6e, 0x6b, 0x70, 0x7a, 0xae, 0x78, 0xa1, 0x40, 0x59, 0xe9, 0x54, 0xce, 0x2a, 0x6b,
-	0x9c, 0x21, 0xc9, 0x01, 0x60, 0xe7, 0x00, 0xab, 0xca, 0x82, 0x05, 0xe0, 0xf1, 0x6d, 0xa1, 0xdd,
-	0xac, 0x9e, 0xb2, 0xcc, 0xcc, 0x79, 0x61, 0x0a, 0xc3, 0x3d, 0x37, 0xad, 0x3f, 0xf9, 0x9f, 0xff,
-	0xf8, 0xd7, 0x21, 0x6f, 0x78, 0x83, 0x07, 0x42, 0x36, 0x93, 0x2f, 0x4e, 0xc1, 0x42, 0x1b, 0x20,
-	0x8f, 0x70, 0xc7, 0xca, 0x26, 0x46, 0xd7, 0xe8, 0xc9, 0x20, 0xed, 0xb5, 0xdb, 0xa4, 0x23, 0x64,
-	0x23, 0xf6, 0xb3, 0xe1, 0x47, 0x7c, 0xf9, 0x66, 0x59, 0xa9, 0x57, 0xca, 0x49, 0x72, 0x87, 0xb1,
-	0xac, 0xf4, 0x3b, 0x65, 0xf7, 0x90, 0x77, 0xdf, 0x4b, 0xc9, 0x6a, 0x9b, 0x44, 0xed, 0x36, 0xc1,
-	0xa3, 0xd7, 0x2f, 0x82, 0x22, 0xce, 0x5c, 0xe4, 0x1a, 0x77, 0x4b, 0x0d, 0x79, 0x7c, 0xe1, 0xdd,
-	0x83, 0xe0, 0xee, 0xbe, 0xd4, 0x90, 0x0b, 0xaf, 0x0c, 0x7f, 0x22, 0xdc, 0x7b, 0x0b, 0x25, 0x98,
-	0x06, 0xc8, 0x7b, 0x7c, 0xe9, 0xc2, 0x36, 0x9f, 0xdf, 0xbf, 0xbb, 0x61, 0xff, 0xe9, 0xce, 0x8e,
-	0xe7, 0xa5, 0xf7, 0x43, 0xf8, 0xe9, 0x60, 0x71, 0x0a, 0x3b, 0x36, 0xbc, 0xf8, 0xb7, 0x21, 0x19,
-	0xe1, 0xab, 0xcc, 0x80, 0x53, 0xe0, 0x26, 0x90, 0x99, 0x5c, 0x43, 0x11, 0x77, 0xfc, 0xb1, 0x0f,
-	0x43, 0xde, 0xd5, 0xf8, 0x4f, 0x59, 0xfc, 0xed, 0x27, 0x4f, 0x71, 0x3f, 0x8c, 0xf6, 0xab, 0xe3,
-	0xae, 0xc7, 0x1f, 0x04, 0xbc, 0x3f, 0xfe, 0x2d, 0x89, 0x73, 0x5f, 0x7a, 0xbb, 0xda, 0xd1, 0x68,
-	0xbd, 0xa3, 0xd1, 0x66, 0x47, 0xa3, 0xaf, 0x2d, 0x45, 0xab, 0x96, 0xa2, 0x75, 0x4b, 0xd1, 0xa6,
-	0xa5, 0xe8, 0x7b, 0x4b, 0xd1, 0xb7, 0x1f, 0x34, 0xfa, 0xd0, 0x0b, 0x45, 0x7f, 0x05, 0x00, 0x00,
-	0xff, 0xff, 0xe3, 0x33, 0x18, 0x0b, 0x50, 0x02, 0x00, 0x00,
+	// 380 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x92, 0xcf, 0xaa, 0x13, 0x31,
+	0x14, 0xc6, 0x27, 0xb7, 0x85, 0x7b, 0x4d, 0x0b, 0x57, 0xe2, 0xc2, 0xd1, 0x45, 0xe6, 0xd2, 0x95,
+	0x77, 0x61, 0x02, 0x17, 0x04, 0xb7, 0x9d, 0x52, 0x50, 0x44, 0x90, 0xe0, 0x1f, 0x70, 0x65, 0x3a,
+	0x13, 0xa7, 0x61, 0xe8, 0xc9, 0x90, 0x66, 0x1c, 0xbb, 0xf3, 0x11, 0x7c, 0xac, 0x2e, 0xbb, 0xec,
+	0xaa, 0xd8, 0xf1, 0x21, 0xdc, 0x4a, 0xd3, 0xb4, 0x56, 0x5d, 0x74, 0x97, 0x73, 0xbe, 0xef, 0xf7,
+	0x9d, 0x73, 0x20, 0xf8, 0x45, 0xf9, 0x7c, 0xce, 0xb4, 0xe1, 0x65, 0x3d, 0x51, 0x16, 0x94, 0x53,
+	0x73, 0xfe, 0x45, 0x41, 0x6e, 0x2c, 0x0f, 0x82, 0xac, 0xf4, 0x4c, 0x66, 0x53, 0x0d, 0xca, 0x2e,
+	0x78, 0x55, 0x16, 0xdc, 0xd6, 0xe0, 0xf4, 0x4c, 0xf1, 0x42, 0x81, 0xb2, 0xd2, 0xa9, 0x9c, 0x55,
+	0xd6, 0x38, 0x43, 0x92, 0x3d, 0xc0, 0x4e, 0x01, 0x56, 0x95, 0x05, 0x0b, 0xc0, 0xe3, 0xa7, 0x85,
+	0x76, 0xd3, 0x7a, 0xc2, 0x32, 0x33, 0xe3, 0x85, 0x29, 0x0c, 0xf7, 0xdc, 0xa4, 0xfe, 0xec, 0x2b,
+	0x5f, 0xf8, 0xd7, 0x3e, 0x6f, 0x70, 0x8b, 0xfb, 0x42, 0x36, 0xe3, 0xaf, 0x4e, 0xc1, 0x5c, 0x1b,
+	0x20, 0x8f, 0x70, 0xc7, 0xca, 0x26, 0x46, 0x37, 0xe8, 0x49, 0x3f, 0xbd, 0x6c, 0x37, 0x49, 0x47,
+	0xc8, 0x46, 0xec, 0x7a, 0x83, 0x4f, 0xf8, 0xea, 0xed, 0xa2, 0x52, 0xaf, 0x95, 0x93, 0xe4, 0x0e,
+	0x63, 0x59, 0xe9, 0xf7, 0xca, 0xee, 0x20, 0xef, 0xbe, 0x97, 0x92, 0xe5, 0x26, 0x89, 0xda, 0x4d,
+	0x82, 0x87, 0x6f, 0x5e, 0x06, 0x45, 0x9c, 0xb8, 0xc8, 0x0d, 0xee, 0x96, 0x1a, 0xf2, 0xf8, 0xc2,
+	0xbb, 0xfb, 0xc1, 0xdd, 0x7d, 0xa5, 0x21, 0x17, 0x5e, 0x19, 0xfc, 0x42, 0xf8, 0xf2, 0x1d, 0x94,
+	0x60, 0x1a, 0x20, 0x1f, 0xf0, 0x95, 0x0b, 0xd3, 0x7c, 0x7e, 0xef, 0xee, 0x96, 0x9d, 0xb9, 0x9d,
+	0x1d, 0xd6, 0x4b, 0xef, 0x87, 0xf0, 0xe3, 0xc2, 0xe2, 0x18, 0x76, 0xb8, 0xf0, 0xe2, 0xff, 0x0b,
+	0xc9, 0x10, 0x5f, 0x67, 0x06, 0x9c, 0x02, 0x37, 0x86, 0xcc, 0xe4, 0x1a, 0x8a, 0xb8, 0xe3, 0x97,
+	0x7d, 0x18, 0xf2, 0xae, 0x47, 0x7f, 0xcb, 0xe2, 0x5f, 0x3f, 0x79, 0x86, 0x7b, 0xa1, 0xb5, 0x1b,
+	0x1d, 0x77, 0x3d, 0xfe, 0x20, 0xe0, 0xbd, 0xd1, 0x1f, 0x49, 0x9c, 0xfa, 0xd2, 0xf1, 0x72, 0x4b,
+	0xa3, 0xd5, 0x96, 0x46, 0xeb, 0x2d, 0x8d, 0xbe, 0xb5, 0x14, 0x2d, 0x5b, 0x8a, 0x56, 0x2d, 0x45,
+	0xeb, 0x96, 0xa2, 0x1f, 0x2d, 0x45, 0xdf, 0x7f, 0xd2, 0xe8, 0x63, 0x72, 0xe6, 0xb7, 0xfc, 0x0e,
+	0x00, 0x00, 0xff, 0xff, 0x1f, 0x32, 0xd5, 0x68, 0x68, 0x02, 0x00, 0x00,
 }
 
 func (m *RawExtension) Marshal() (dAtA []byte, err error) {

vendor/k8s.io/apimachinery/pkg/runtime/generated.proto

@@ -22,7 +22,7 @@ syntax = "proto2";
 package k8s.io.apimachinery.pkg.runtime;
 
 // Package-wide variables from generator "generated".
-option go_package = "runtime";
+option go_package = "k8s.io/apimachinery/pkg/runtime";
 
 // RawExtension is used to hold extensions in external versions.
 //

vendor/k8s.io/apimachinery/pkg/runtime/interfaces.go

@@ -69,6 +69,24 @@ type Encoder interface {
 	Identifier() Identifier
 }
 
+// MemoryAllocator is responsible for allocating memory.
+// By encapsulating memory allocation into its own interface, we can reuse the memory
+// across many operations in places we know it can significantly improve the performance.
+type MemoryAllocator interface {
+	// Allocate reserves memory for n bytes.
+	// Note that implementations of this method are not required to zero the returned array.
+	// It is the caller's responsibility to clean the memory if needed.
+	Allocate(n uint64) []byte
+}
+
+// EncoderWithAllocator  serializes objects in a way that allows callers to manage any additional memory allocations.
+type EncoderWithAllocator interface {
+	Encoder
+	// EncodeWithAllocator writes an object to a stream as Encode does.
+	// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization
+	EncodeWithAllocator(obj Object, w io.Writer, memAlloc MemoryAllocator) error
+}
+
 // Decoder attempts to load an object from data.
 type Decoder interface {
 	// Decode attempts to deserialize the provided data using either the innate typing of the scheme or the
@@ -125,6 +143,9 @@ type SerializerInfo struct {
 	// PrettySerializer, if set, can serialize this object in a form biased towards
 	// readability.
 	PrettySerializer Serializer
+	// StrictSerializer, if set, deserializes this object strictly,
+	// erring on unknown fields.
+	StrictSerializer Serializer
 	// StreamSerializer, if set, describes the streaming serialization format
 	// for this media type.
 	StreamSerializer *StreamSerializerInfo
@@ -150,7 +171,7 @@ type NegotiatedSerializer interface {
 	// EncoderForVersion returns an encoder that ensures objects being written to the provided
 	// serializer are in the provided group version.
 	EncoderForVersion(serializer Encoder, gv GroupVersioner) Encoder
-	// DecoderForVersion returns a decoder that ensures objects being read by the provided
+	// DecoderToVersion returns a decoder that ensures objects being read by the provided
 	// serializer are in the provided group version by default.
 	DecoderToVersion(serializer Decoder, gv GroupVersioner) Decoder
 }
@@ -204,6 +225,12 @@ type NestedObjectEncoder interface {
 
 // NestedObjectDecoder is an optional interface that objects may implement to be given
 // an opportunity to decode any nested Objects / RawExtensions during serialization.
+// It is possible for DecodeNestedObjects to return a non-nil error but for the decoding
+// to have succeeded in the case of strict decoding errors (e.g. unknown/duplicate fields).
+// As such it is important for callers of DecodeNestedObjects to check to confirm whether
+// an error is a runtime.StrictDecodingError before short circuiting.
+// Similarly, implementations of DecodeNestedObjects should ensure that a runtime.StrictDecodingError
+// is only returned when the rest of decoding has succeeded.
 type NestedObjectDecoder interface {
 	DecodeNestedObjects(d Decoder) error
 }
@@ -281,14 +308,11 @@ type ResourceVersioner interface {
 	ResourceVersion(obj Object) (string, error)
 }
 
-// SelfLinker provides methods for setting and retrieving the SelfLink field of an API object.
-type SelfLinker interface {
-	SetSelfLink(obj Object, selfLink string) error
-	SelfLink(obj Object) (string, error)
-
-	// Knowing Name is sometimes necessary to use a SelfLinker.
+// Namer provides methods for retrieving name and namespace of an API object.
+type Namer interface {
+	// Name returns the name of a given object.
 	Name(obj Object) (string, error)
-	// Knowing Namespace is sometimes necessary to use a SelfLinker
+	// Namespace returns the name of a given object.
 	Namespace(obj Object) (string, error)
 }
 

vendor/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go

@@ -43,17 +43,17 @@ func init() {
 }
 
 var fileDescriptor_0462724132518e0d = []byte{
-	// 185 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x4c, 0xcc, 0xaf, 0x6e, 0xc3, 0x30,
-	0x10, 0xc7, 0x71, 0x9b, 0x0c, 0x0c, 0x0e, 0x0e, 0x1c, 0x1c, 0xda, 0x7c, 0x74, 0xb8, 0x2f, 0x50,
-	0x5e, 0xe6, 0x24, 0x57, 0xc7, 0xb2, 0xfc, 0x47, 0x8e, 0x5d, 0xa9, 0xac, 0x8f, 0xd0, 0xc7, 0x0a,
-	0x0c, 0x0c, 0x6c, 0xdc, 0x17, 0xa9, 0x64, 0x07, 0x94, 0xdd, 0x4f, 0xa7, 0xcf, 0xf7, 0xf3, 0x68,
-	0xfe, 0x27, 0xa1, 0x3d, 0x9a, 0xdc, 0x51, 0x74, 0x94, 0x68, 0xc2, 0x0b, 0xb9, 0xc1, 0x47, 0xdc,
-	0x1f, 0x32, 0x68, 0x2b, 0xfb, 0x51, 0x3b, 0x8a, 0x57, 0x0c, 0x46, 0x61, 0xcc, 0x2e, 0x69, 0x4b,
-	0x38, 0xf5, 0x23, 0x59, 0x89, 0x8a, 0x1c, 0x45, 0x99, 0x68, 0x10, 0x21, 0xfa, 0xe4, 0xbf, 0x7e,
-	0x9a, 0x13, 0xef, 0x4e, 0x04, 0xa3, 0xc4, 0xee, 0x44, 0x73, 0xdf, 0x7f, 0x4a, 0xa7, 0x31, 0x77,
-	0xa2, 0xf7, 0x16, 0x95, 0x57, 0x1e, 0x2b, 0xef, 0xf2, 0xb9, 0xae, 0x3a, 0xea, 0xd5, 0xb2, 0x87,
-	0xdf, 0x79, 0x03, 0xb6, 0x6c, 0xc0, 0xd6, 0x0d, 0xd8, 0xad, 0x00, 0x9f, 0x0b, 0xf0, 0xa5, 0x00,
-	0x5f, 0x0b, 0xf0, 0x47, 0x01, 0x7e, 0x7f, 0x02, 0x3b, 0x7d, 0xb4, 0xf8, 0x2b, 0x00, 0x00, 0xff,
-	0xff, 0xba, 0x7e, 0x65, 0xf4, 0xd6, 0x00, 0x00, 0x00,
+	// 186 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0xce, 0xad, 0x8e, 0xc3, 0x30,
+	0x0c, 0xc0, 0xf1, 0x84, 0x1e, 0x3c, 0x78, 0xc0, 0xb0, 0xec, 0x62, 0x7a, 0xf8, 0xf0, 0xa4, 0xf1,
+	0xb1, 0xb4, 0xf5, 0xd2, 0x28, 0xca, 0x87, 0xd2, 0x64, 0xd2, 0xd8, 0x1e, 0x61, 0x8f, 0x55, 0x58,
+	0x58, 0xb8, 0x66, 0x2f, 0x32, 0x29, 0x2d, 0x18, 0x1c, 0xf3, 0x5f, 0xd6, 0xcf, 0xf2, 0xd7, 0xd1,
+	0xfc, 0x8d, 0x42, 0x7b, 0x34, 0xb9, 0xa5, 0xe8, 0x28, 0xd1, 0x88, 0x17, 0x72, 0xbd, 0x8f, 0xb8,
+	0x2f, 0x64, 0xd0, 0x56, 0x76, 0x83, 0x76, 0x14, 0xaf, 0x18, 0x8c, 0xc2, 0x98, 0x5d, 0xd2, 0x96,
+	0x70, 0xec, 0x06, 0xb2, 0x12, 0x15, 0x39, 0x8a, 0x32, 0x51, 0x2f, 0x42, 0xf4, 0xc9, 0x7f, 0x37,
+	0x9b, 0x13, 0xef, 0x4e, 0x04, 0xa3, 0xc4, 0xee, 0xc4, 0xe6, 0x7e, 0x7e, 0x95, 0x4e, 0x43, 0x6e,
+	0x45, 0xe7, 0x2d, 0x2a, 0xaf, 0x3c, 0x56, 0xde, 0xe6, 0x73, 0xad, 0x1a, 0x75, 0xda, 0xce, 0xfe,
+	0x1f, 0xa6, 0x15, 0xd8, 0xbc, 0x02, 0x5b, 0x56, 0x60, 0xb7, 0x02, 0x7c, 0x2a, 0xc0, 0xe7, 0x02,
+	0x7c, 0x29, 0xc0, 0x1f, 0x05, 0xf8, 0xfd, 0x09, 0xec, 0xd4, 0x7c, 0xf6, 0xf4, 0x2b, 0x00, 0x00,
+	0xff, 0xff, 0x12, 0xb4, 0xae, 0x48, 0xf6, 0x00, 0x00, 0x00,
 }

vendor/k8s.io/apimachinery/pkg/runtime/schema/generated.proto

@@ -22,5 +22,5 @@ syntax = "proto2";
 package k8s.io.apimachinery.pkg.runtime.schema;
 
 // Package-wide variables from generator "generated".
-option go_package = "schema";
+option go_package = "k8s.io/apimachinery/pkg/runtime/schema";
 

vendor/k8s.io/apimachinery/pkg/runtime/scheme.go

@@ -44,11 +44,11 @@ import (
 // Schemes are not expected to change at runtime and are only threadsafe after
 // registration is complete.
 type Scheme struct {
-	// versionMap allows one to figure out the go type of an object with
+	// gvkToType allows one to figure out the go type of an object with
 	// the given version and name.
 	gvkToType map[schema.GroupVersionKind]reflect.Type
 
-	// typeToGroupVersion allows one to find metadata for a given go object.
+	// typeToGVK allows one to find metadata for a given go object.
 	// The reflect.Type we index by should *not* be a pointer.
 	typeToGVK map[reflect.Type][]schema.GroupVersionKind
 
@@ -64,7 +64,7 @@ type Scheme struct {
 	// resource field labels in that version to internal version.
 	fieldLabelConversionFuncs map[schema.GroupVersionKind]FieldLabelConversionFunc
 
-	// defaulterFuncs is an array of interfaces to be called with an object to provide defaulting
+	// defaulterFuncs is a map to funcs to be called with an object to provide defaulting
 	// the provided object must be a pointer.
 	defaulterFuncs map[reflect.Type]func(interface{})
 
@@ -99,7 +99,7 @@ func NewScheme() *Scheme {
 		versionPriority:           map[string][]string{},
 		schemeName:                naming.GetNameFromCallsite(internalPackages...),
 	}
-	s.converter = conversion.NewConverter(s.nameFunc)
+	s.converter = conversion.NewConverter(nil)
 
 	// Enable couple default conversions by default.
 	utilruntime.Must(RegisterEmbeddedConversions(s))
@@ -107,28 +107,6 @@ func NewScheme() *Scheme {
 	return s
 }
 
-// nameFunc returns the name of the type that we wish to use to determine when two types attempt
-// a conversion. Defaults to the go name of the type if the type is not registered.
-func (s *Scheme) nameFunc(t reflect.Type) string {
-	// find the preferred names for this type
-	gvks, ok := s.typeToGVK[t]
-	if !ok {
-		return t.Name()
-	}
-
-	for _, gvk := range gvks {
-		internalGV := gvk.GroupVersion()
-		internalGV.Version = APIVersionInternal // this is hacky and maybe should be passed in
-		internalGVK := internalGV.WithKind(gvk.Kind)
-
-		if internalType, exists := s.gvkToType[internalGVK]; exists {
-			return s.typeToGVK[internalType][0].Kind
-		}
-	}
-
-	return gvks[0].Kind
-}
-
 // Converter allows access to the converter for the scheme
 func (s *Scheme) Converter() *conversion.Converter {
 	return s.converter

vendor/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go

@@ -40,6 +40,7 @@ type serializerType struct {
 
 	Serializer       runtime.Serializer
 	PrettySerializer runtime.Serializer
+	StrictSerializer runtime.Serializer
 
 	AcceptStreamContentTypes []string
 	StreamContentType        string
@@ -70,10 +71,20 @@ func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, option
 		)
 	}
 
+	strictJSONSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: false, Pretty: false, Strict: true},
+	)
+	jsonSerializerType.StrictSerializer = strictJSONSerializer
+
 	yamlSerializer := json.NewSerializerWithOptions(
 		mf, scheme, scheme,
 		json.SerializerOptions{Yaml: true, Pretty: false, Strict: options.Strict},
 	)
+	strictYAMLSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: true, Pretty: false, Strict: true},
+	)
 	protoSerializer := protobuf.NewSerializer(scheme, scheme)
 	protoRawSerializer := protobuf.NewRawSerializer(scheme, scheme)
 
@@ -85,12 +96,16 @@ func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, option
 			FileExtensions:     []string{"yaml"},
 			EncodesAsText:      true,
 			Serializer:         yamlSerializer,
+			StrictSerializer:   strictYAMLSerializer,
 		},
 		{
 			AcceptContentTypes: []string{runtime.ContentTypeProtobuf},
 			ContentType:        runtime.ContentTypeProtobuf,
 			FileExtensions:     []string{"pb"},
 			Serializer:         protoSerializer,
+			// note, strict decoding is unsupported for protobuf,
+			// fall back to regular serializing
+			StrictSerializer: protoSerializer,
 
 			Framer:           protobuf.LengthDelimitedFramer,
 			StreamSerializer: protoRawSerializer,
@@ -187,6 +202,7 @@ func newCodecFactory(scheme *runtime.Scheme, serializers []serializerType) Codec
 				EncodesAsText:    d.EncodesAsText,
 				Serializer:       d.Serializer,
 				PrettySerializer: d.PrettySerializer,
+				StrictSerializer: d.StrictSerializer,
 			}
 
 			mediaType, _, err := mime.ParseMediaType(info.MediaType)

vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go

@@ -20,10 +20,8 @@ import (
 	"encoding/json"
 	"io"
 	"strconv"
-	"unsafe"
 
-	jsoniter "github.com/json-iterator/go"
-	"github.com/modern-go/reflect2"
+	kjson "sigs.k8s.io/json"
 	"sigs.k8s.io/yaml"
 
 	"k8s.io/apimachinery/pkg/runtime"
@@ -68,6 +66,7 @@ func identifier(options SerializerOptions) runtime.Identifier {
 		"name":   "json",
 		"yaml":   strconv.FormatBool(options.Yaml),
 		"pretty": strconv.FormatBool(options.Pretty),
+		"strict": strconv.FormatBool(options.Strict),
 	}
 	identifier, err := json.Marshal(result)
 	if err != nil {
@@ -110,79 +109,6 @@ type Serializer struct {
 var _ runtime.Serializer = &Serializer{}
 var _ recognizer.RecognizingDecoder = &Serializer{}
 
-type customNumberExtension struct {
-	jsoniter.DummyExtension
-}
-
-func (cne *customNumberExtension) CreateDecoder(typ reflect2.Type) jsoniter.ValDecoder {
-	if typ.String() == "interface {}" {
-		return customNumberDecoder{}
-	}
-	return nil
-}
-
-type customNumberDecoder struct {
-}
-
-func (customNumberDecoder) Decode(ptr unsafe.Pointer, iter *jsoniter.Iterator) {
-	switch iter.WhatIsNext() {
-	case jsoniter.NumberValue:
-		var number jsoniter.Number
-		iter.ReadVal(&number)
-		i64, err := strconv.ParseInt(string(number), 10, 64)
-		if err == nil {
-			*(*interface{})(ptr) = i64
-			return
-		}
-		f64, err := strconv.ParseFloat(string(number), 64)
-		if err == nil {
-			*(*interface{})(ptr) = f64
-			return
-		}
-		iter.ReportError("DecodeNumber", err.Error())
-	default:
-		*(*interface{})(ptr) = iter.Read()
-	}
-}
-
-// CaseSensitiveJSONIterator returns a jsoniterator API that's configured to be
-// case-sensitive when unmarshalling, and otherwise compatible with
-// the encoding/json standard library.
-func CaseSensitiveJSONIterator() jsoniter.API {
-	config := jsoniter.Config{
-		EscapeHTML:             true,
-		SortMapKeys:            true,
-		ValidateJsonRawMessage: true,
-		CaseSensitive:          true,
-	}.Froze()
-	// Force jsoniter to decode number to interface{} via int64/float64, if possible.
-	config.RegisterExtension(&customNumberExtension{})
-	return config
-}
-
-// StrictCaseSensitiveJSONIterator returns a jsoniterator API that's configured to be
-// case-sensitive, but also disallows unknown fields when unmarshalling. It is compatible with
-// the encoding/json standard library.
-func StrictCaseSensitiveJSONIterator() jsoniter.API {
-	config := jsoniter.Config{
-		EscapeHTML:             true,
-		SortMapKeys:            true,
-		ValidateJsonRawMessage: true,
-		CaseSensitive:          true,
-		DisallowUnknownFields:  true,
-	}.Froze()
-	// Force jsoniter to decode number to interface{} via int64/float64, if possible.
-	config.RegisterExtension(&customNumberExtension{})
-	return config
-}
-
-// Private copies of jsoniter to try to shield against possible mutations
-// from outside. Still does not protect from package level jsoniter.Register*() functions - someone calling them
-// in some other library will mess with every usage of the jsoniter library in the whole program.
-// See https://github.com/json-iterator/go/issues/265
-var caseSensitiveJSONIterator = CaseSensitiveJSONIterator()
-var strictCaseSensitiveJSONIterator = StrictCaseSensitiveJSONIterator()
-
 // gvkWithDefaults returns group kind and version defaulting from provided default
 func gvkWithDefaults(actual, defaultGVK schema.GroupVersionKind) schema.GroupVersionKind {
 	if len(actual.Kind) == 0 {
@@ -237,9 +163,25 @@ func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, i
 		types, _, err := s.typer.ObjectKinds(into)
 		switch {
 		case runtime.IsNotRegisteredError(err), isUnstructured:
-			if err := caseSensitiveJSONIterator.Unmarshal(data, into); err != nil {
+			strictErrs, err := s.unmarshal(into, data, originalData)
+			if err != nil {
 				return nil, actual, err
 			}
+
+			// when decoding directly into a provided unstructured object,
+			// extract the actual gvk decoded from the provided data,
+			// and ensure it is non-empty.
+			if isUnstructured {
+				*actual = into.GetObjectKind().GroupVersionKind()
+				if len(actual.Kind) == 0 {
+					return nil, actual, runtime.NewMissingKindErr(string(originalData))
+				}
+				// TODO(109023): require apiVersion here as well once unstructuredJSONScheme#Decode does
+			}
+
+			if len(strictErrs) > 0 {
+				return into, actual, runtime.NewStrictDecodingError(strictErrs)
+			}
 			return into, actual, nil
 		case err != nil:
 			return nil, actual, err
@@ -261,35 +203,12 @@ func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, i
 		return nil, actual, err
 	}
 
-	if err := caseSensitiveJSONIterator.Unmarshal(data, obj); err != nil {
-		return nil, actual, err
-	}
-
-	// If the deserializer is non-strict, return successfully here.
-	if !s.options.Strict {
-		return obj, actual, nil
-	}
-
-	// In strict mode pass the data trough the YAMLToJSONStrict converter.
-	// This is done to catch duplicate fields regardless of encoding (JSON or YAML). For JSON data,
-	// the output would equal the input, unless there is a parsing error such as duplicate fields.
-	// As we know this was successful in the non-strict case, the only error that may be returned here
-	// is because of the newly-added strictness. hence we know we can return the typed strictDecoderError
-	// the actual error is that the object contains duplicate fields.
-	altered, err := yaml.YAMLToJSONStrict(originalData)
+	strictErrs, err := s.unmarshal(obj, data, originalData)
 	if err != nil {
-		return nil, actual, runtime.NewStrictDecodingError(err.Error(), string(originalData))
+		return nil, actual, err
+	} else if len(strictErrs) > 0 {
+		return obj, actual, runtime.NewStrictDecodingError(strictErrs)
 	}
-	// As performance is not an issue for now for the strict deserializer (one has regardless to do
-	// the unmarshal twice), we take the sanitized, altered data that is guaranteed to have no duplicated
-	// fields, and unmarshal this into a copy of the already-populated obj. Any error that occurs here is
-	// due to that a matching field doesn't exist in the object. hence we can return a typed strictDecoderError,
-	// the actual error is that the object contains unknown field.
-	strictObj := obj.DeepCopyObject()
-	if err := strictCaseSensitiveJSONIterator.Unmarshal(altered, strictObj); err != nil {
-		return nil, actual, runtime.NewStrictDecodingError(err.Error(), string(originalData))
-	}
-	// Always return the same object as the non-strict serializer to avoid any deviations.
 	return obj, actual, nil
 }
 
@@ -303,7 +222,7 @@ func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
 
 func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
 	if s.options.Yaml {
-		json, err := caseSensitiveJSONIterator.Marshal(obj)
+		json, err := json.Marshal(obj)
 		if err != nil {
 			return err
 		}
@@ -316,7 +235,7 @@ func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
 	}
 
 	if s.options.Pretty {
-		data, err := caseSensitiveJSONIterator.MarshalIndent(obj, "", "  ")
+		data, err := json.MarshalIndent(obj, "", "  ")
 		if err != nil {
 			return err
 		}
@@ -327,6 +246,50 @@ func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
 	return encoder.Encode(obj)
 }
 
+// IsStrict indicates whether the serializer
+// uses strict decoding or not
+func (s *Serializer) IsStrict() bool {
+	return s.options.Strict
+}
+
+func (s *Serializer) unmarshal(into runtime.Object, data, originalData []byte) (strictErrs []error, err error) {
+	// If the deserializer is non-strict, return here.
+	if !s.options.Strict {
+		if err := kjson.UnmarshalCaseSensitivePreserveInts(data, into); err != nil {
+			return nil, err
+		}
+		return nil, nil
+	}
+
+	if s.options.Yaml {
+		// In strict mode pass the original data through the YAMLToJSONStrict converter.
+		// This is done to catch duplicate fields in YAML that would have been dropped in the original YAMLToJSON conversion.
+		// TODO: rework YAMLToJSONStrict to return warnings about duplicate fields without terminating so we don't have to do this twice.
+		_, err := yaml.YAMLToJSONStrict(originalData)
+		if err != nil {
+			strictErrs = append(strictErrs, err)
+		}
+	}
+
+	var strictJSONErrs []error
+	if u, isUnstructured := into.(runtime.Unstructured); isUnstructured {
+		// Unstructured is a custom unmarshaler that gets delegated
+		// to, so in order to detect strict JSON errors we need
+		// to unmarshal directly into the object.
+		m := map[string]interface{}{}
+		strictJSONErrs, err = kjson.UnmarshalStrict(data, &m)
+		u.SetUnstructuredContent(m)
+	} else {
+		strictJSONErrs, err = kjson.UnmarshalStrict(data, into)
+	}
+	if err != nil {
+		// fatal decoding error, not due to strictness
+		return nil, err
+	}
+	strictErrs = append(strictErrs, strictJSONErrs...)
+	return strictErrs, nil
+}
+
 // Identifier implements runtime.Encoder interface.
 func (s *Serializer) Identifier() runtime.Identifier {
 	return s.identifier

vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go

@@ -30,6 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
 	"k8s.io/apimachinery/pkg/util/framer"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -86,6 +87,7 @@ type Serializer struct {
 }
 
 var _ runtime.Serializer = &Serializer{}
+var _ runtime.EncoderWithAllocator = &Serializer{}
 var _ recognizer.RecognizingDecoder = &Serializer{}
 
 const serializerIdentifier runtime.Identifier = "protobuf"
@@ -161,22 +163,36 @@ func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, i
 	return unmarshalToObject(s.typer, s.creater, &actual, into, unk.Raw)
 }
 
-// Encode serializes the provided object to the given writer.
-func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
-	if co, ok := obj.(runtime.CacheableObject); ok {
-		return co.CacheEncode(s.Identifier(), s.doEncode, w)
-	}
-	return s.doEncode(obj, w)
+// EncodeWithAllocator writes an object to the provided writer.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (s *Serializer) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return s.encode(obj, w, memAlloc)
 }
 
-func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
+// Encode serializes the provided object to the given writer.
+func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(obj, w, &runtime.SimpleAllocator{})
+}
+
+func (s *Serializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), func(obj runtime.Object, w io.Writer) error { return s.doEncode(obj, w, memAlloc) }, w)
+	}
+	return s.doEncode(obj, w, memAlloc)
+}
+
+func (s *Serializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if memAlloc == nil {
+		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
+		memAlloc = &runtime.SimpleAllocator{}
+	}
 	prefixSize := uint64(len(s.prefix))
 
 	var unk runtime.Unknown
 	switch t := obj.(type) {
 	case *runtime.Unknown:
 		estimatedSize := prefixSize + uint64(t.Size())
-		data := make([]byte, estimatedSize)
+		data := memAlloc.Allocate(estimatedSize)
 		i, err := t.MarshalTo(data[prefixSize:])
 		if err != nil {
 			return err
@@ -196,11 +212,11 @@ func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
 
 	switch t := obj.(type) {
 	case bufferedMarshaller:
-		// this path performs a single allocation during write but requires the caller to implement
-		// the more efficient Size and MarshalToSizedBuffer methods
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
 		encodedSize := uint64(t.Size())
 		estimatedSize := prefixSize + estimateUnknownSize(&unk, encodedSize)
-		data := make([]byte, estimatedSize)
+		data := memAlloc.Allocate(estimatedSize)
 
 		i, err := unk.NestedMarshalTo(data[prefixSize:], t, encodedSize)
 		if err != nil {
@@ -221,7 +237,7 @@ func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
 		unk.Raw = data
 
 		estimatedSize := prefixSize + uint64(unk.Size())
-		data = make([]byte, estimatedSize)
+		data = memAlloc.Allocate(estimatedSize)
 
 		i, err := unk.MarshalTo(data[prefixSize:])
 		if err != nil {
@@ -395,19 +411,33 @@ func unmarshalToObject(typer runtime.ObjectTyper, creater runtime.ObjectCreater,
 
 // Encode serializes the provided object to the given writer. Overrides is ignored.
 func (s *RawSerializer) Encode(obj runtime.Object, w io.Writer) error {
-	if co, ok := obj.(runtime.CacheableObject); ok {
-		return co.CacheEncode(s.Identifier(), s.doEncode, w)
-	}
-	return s.doEncode(obj, w)
+	return s.encode(obj, w, &runtime.SimpleAllocator{})
 }
 
-func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer) error {
+// EncodeWithAllocator writes an object to the provided writer.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (s *RawSerializer) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return s.encode(obj, w, memAlloc)
+}
+
+func (s *RawSerializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), func(obj runtime.Object, w io.Writer) error { return s.doEncode(obj, w, memAlloc) }, w)
+	}
+	return s.doEncode(obj, w, memAlloc)
+}
+
+func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if memAlloc == nil {
+		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
+		memAlloc = &runtime.SimpleAllocator{}
+	}
 	switch t := obj.(type) {
 	case bufferedReverseMarshaller:
-		// this path performs a single allocation during write but requires the caller to implement
-		// the more efficient Size and MarshalToSizedBuffer methods
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
 		encodedSize := uint64(t.Size())
-		data := make([]byte, encodedSize)
+		data := memAlloc.Allocate(encodedSize)
 
 		n, err := t.MarshalToSizedBuffer(data)
 		if err != nil {
@@ -417,10 +447,10 @@ func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer) error {
 		return err
 
 	case bufferedMarshaller:
-		// this path performs a single allocation during write but requires the caller to implement
-		// the more efficient Size and MarshalTo methods
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalTo methods
 		encodedSize := uint64(t.Size())
-		data := make([]byte, encodedSize)
+		data := memAlloc.Allocate(encodedSize)
 
 		n, err := t.MarshalTo(data)
 		if err != nil {

vendor/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go

@@ -109,10 +109,16 @@ func (d *decoder) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime
 	for _, r := range skipped {
 		out, actual, err := r.Decode(data, gvk, into)
 		if err != nil {
-			lastErr = err
-			continue
+			// if we got an object back from the decoder, and the
+			// error was a strict decoding error (e.g. unknown or
+			// duplicate fields), we still consider the recognizer
+			// to have understood the object
+			if out == nil || !runtime.IsStrictDecodingError(err) {
+				lastErr = err
+				continue
+			}
 		}
-		return out, actual, nil
+		return out, actual, err
 	}
 
 	if lastErr == nil {

vendor/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go

@@ -90,7 +90,6 @@ func (d *decoder) Decode(defaults *schema.GroupVersionKind, into runtime.Object)
 			}
 			// must read the rest of the frame (until we stop getting ErrShortBuffer)
 			d.resetRead = true
-			base = 0
 			return nil, nil, ErrObjectTooLarge
 		}
 		if err != nil {
@@ -135,3 +134,23 @@ func (e *encoder) Encode(obj runtime.Object) error {
 	e.buf.Reset()
 	return err
 }
+
+type encoderWithAllocator struct {
+	writer       io.Writer
+	encoder      runtime.EncoderWithAllocator
+	memAllocator runtime.MemoryAllocator
+}
+
+// NewEncoderWithAllocator returns a new streaming encoder
+func NewEncoderWithAllocator(w io.Writer, e runtime.EncoderWithAllocator, a runtime.MemoryAllocator) Encoder {
+	return &encoderWithAllocator{
+		writer:       w,
+		encoder:      e,
+		memAllocator: a,
+	}
+}
+
+// Encode writes the provided object to the nested writer
+func (e *encoderWithAllocator) Encode(obj runtime.Object) error {
+	return e.encoder.EncodeWithAllocator(obj, e.writer, e.memAllocator)
+}

vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go

@@ -89,6 +89,8 @@ type codec struct {
 	originalSchemeName string
 }
 
+var _ runtime.EncoderWithAllocator = &codec{}
+
 var identifiersMap sync.Map
 
 type codecIdentifier struct {
@@ -133,17 +135,34 @@ func (c *codec) Decode(data []byte, defaultGVK *schema.GroupVersionKind, into ru
 		}
 	}
 
+	var strictDecodingErrs []error
 	obj, gvk, err := c.decoder.Decode(data, defaultGVK, decodeInto)
 	if err != nil {
-		return nil, gvk, err
-	}
-
-	if d, ok := obj.(runtime.NestedObjectDecoder); ok {
-		if err := d.DecodeNestedObjects(runtime.WithoutVersionDecoder{c.decoder}); err != nil {
+		if strictErr, ok := runtime.AsStrictDecodingError(err); obj != nil && ok {
+			// save the strictDecodingError and let the caller decide what to do with it
+			strictDecodingErrs = append(strictDecodingErrs, strictErr.Errors()...)
+		} else {
 			return nil, gvk, err
 		}
 	}
 
+	if d, ok := obj.(runtime.NestedObjectDecoder); ok {
+		if err := d.DecodeNestedObjects(runtime.WithoutVersionDecoder{c.decoder}); err != nil {
+			if strictErr, ok := runtime.AsStrictDecodingError(err); ok {
+				// save the strictDecodingError let and the caller decide what to do with it
+				strictDecodingErrs = append(strictDecodingErrs, strictErr.Errors()...)
+			} else {
+				return nil, gvk, err
+
+			}
+		}
+	}
+
+	// aggregate the strict decoding errors into one
+	var strictDecodingErr error
+	if len(strictDecodingErrs) > 0 {
+		strictDecodingErr = runtime.NewStrictDecodingError(strictDecodingErrs)
+	}
 	// if we specify a target, use generic conversion.
 	if into != nil {
 		// perform defaulting if requested
@@ -153,14 +172,14 @@ func (c *codec) Decode(data []byte, defaultGVK *schema.GroupVersionKind, into ru
 
 		// Short-circuit conversion if the into object is same object
 		if into == obj {
-			return into, gvk, nil
+			return into, gvk, strictDecodingErr
 		}
 
 		if err := c.convertor.Convert(obj, into, c.decodeVersion); err != nil {
 			return nil, gvk, err
 		}
 
-		return into, gvk, nil
+		return into, gvk, strictDecodingErr
 	}
 
 	// perform defaulting if requested
@@ -172,22 +191,43 @@ func (c *codec) Decode(data []byte, defaultGVK *schema.GroupVersionKind, into ru
 	if err != nil {
 		return nil, gvk, err
 	}
-	return out, gvk, nil
+	return out, gvk, strictDecodingErr
+}
+
+// EncodeWithAllocator ensures the provided object is output in the appropriate group and version, invoking
+// conversion if necessary. Unversioned objects (according to the ObjectTyper) are output as is.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (c *codec) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return c.encode(obj, w, memAlloc)
 }
 
 // Encode ensures the provided object is output in the appropriate group and version, invoking
 // conversion if necessary. Unversioned objects (according to the ObjectTyper) are output as is.
 func (c *codec) Encode(obj runtime.Object, w io.Writer) error {
-	if co, ok := obj.(runtime.CacheableObject); ok {
-		return co.CacheEncode(c.Identifier(), c.doEncode, w)
-	}
-	return c.doEncode(obj, w)
+	return c.encode(obj, w, nil)
 }
 
-func (c *codec) doEncode(obj runtime.Object, w io.Writer) error {
+func (c *codec) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(c.Identifier(), func(obj runtime.Object, w io.Writer) error { return c.doEncode(obj, w, memAlloc) }, w)
+	}
+	return c.doEncode(obj, w, memAlloc)
+}
+
+func (c *codec) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	encodeFn := c.encoder.Encode
+	if memAlloc != nil {
+		if encoder, supportsAllocator := c.encoder.(runtime.EncoderWithAllocator); supportsAllocator {
+			encodeFn = func(obj runtime.Object, w io.Writer) error {
+				return encoder.EncodeWithAllocator(obj, w, memAlloc)
+			}
+		} else {
+			klog.V(6).Infof("a memory allocator was provided but the encoder %s doesn't implement the runtime.EncoderWithAllocator, using regular encoder.Encode method", c.encoder.Identifier())
+		}
+	}
 	switch obj := obj.(type) {
 	case *runtime.Unknown:
-		return c.encoder.Encode(obj, w)
+		return encodeFn(obj, w)
 	case runtime.Unstructured:
 		// An unstructured list can contain objects of multiple group version kinds. don't short-circuit just
 		// because the top-level type matches our desired destination type. actually send the object to the converter
@@ -196,14 +236,14 @@ func (c *codec) doEncode(obj runtime.Object, w io.Writer) error {
 			// avoid conversion roundtrip if GVK is the right one already or is empty (yes, this is a hack, but the old behaviour we rely on in kubectl)
 			objGVK := obj.GetObjectKind().GroupVersionKind()
 			if len(objGVK.Version) == 0 {
-				return c.encoder.Encode(obj, w)
+				return encodeFn(obj, w)
 			}
 			targetGVK, ok := c.encodeVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{objGVK})
 			if !ok {
 				return runtime.NewNotRegisteredGVKErrForTarget(c.originalSchemeName, objGVK, c.encodeVersion)
 			}
 			if targetGVK == objGVK {
-				return c.encoder.Encode(obj, w)
+				return encodeFn(obj, w)
 			}
 		}
 	}
@@ -225,7 +265,7 @@ func (c *codec) doEncode(obj runtime.Object, w io.Writer) error {
 			}
 		}
 		objectKind.SetGroupVersionKind(gvks[0])
-		return c.encoder.Encode(obj, w)
+		return encodeFn(obj, w)
 	}
 
 	// Perform a conversion if necessary
@@ -241,7 +281,7 @@ func (c *codec) doEncode(obj runtime.Object, w io.Writer) error {
 	}
 
 	// Conversion is responsible for setting the proper group, version, and kind onto the outgoing object
-	return c.encoder.Encode(out, w)
+	return encodeFn(out, w)
 }
 
 // Identifier implements runtime.Encoder interface.

vendor/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/pkg/util/clock/clock.go

@@ -1,445 +0,0 @@
-/*
-Copyright 2014 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package clock
-
-import (
-	"sync"
-	"time"
-)
-
-// PassiveClock allows for injecting fake or real clocks into code
-// that needs to read the current time but does not support scheduling
-// activity in the future.
-type PassiveClock interface {
-	Now() time.Time
-	Since(time.Time) time.Duration
-}
-
-// Clock allows for injecting fake or real clocks into code that
-// needs to do arbitrary things based on time.
-type Clock interface {
-	PassiveClock
-	After(time.Duration) <-chan time.Time
-	AfterFunc(time.Duration, func()) Timer
-	NewTimer(time.Duration) Timer
-	Sleep(time.Duration)
-	NewTicker(time.Duration) Ticker
-}
-
-// RealClock really calls time.Now()
-type RealClock struct{}
-
-// Now returns the current time.
-func (RealClock) Now() time.Time {
-	return time.Now()
-}
-
-// Since returns time since the specified timestamp.
-func (RealClock) Since(ts time.Time) time.Duration {
-	return time.Since(ts)
-}
-
-// After is the same as time.After(d).
-func (RealClock) After(d time.Duration) <-chan time.Time {
-	return time.After(d)
-}
-
-// AfterFunc is the same as time.AfterFunc(d, f).
-func (RealClock) AfterFunc(d time.Duration, f func()) Timer {
-	return &realTimer{
-		timer: time.AfterFunc(d, f),
-	}
-}
-
-// NewTimer returns a new Timer.
-func (RealClock) NewTimer(d time.Duration) Timer {
-	return &realTimer{
-		timer: time.NewTimer(d),
-	}
-}
-
-// NewTicker returns a new Ticker.
-func (RealClock) NewTicker(d time.Duration) Ticker {
-	return &realTicker{
-		ticker: time.NewTicker(d),
-	}
-}
-
-// Sleep pauses the RealClock for duration d.
-func (RealClock) Sleep(d time.Duration) {
-	time.Sleep(d)
-}
-
-// FakePassiveClock implements PassiveClock, but returns an arbitrary time.
-type FakePassiveClock struct {
-	lock sync.RWMutex
-	time time.Time
-}
-
-// FakeClock implements Clock, but returns an arbitrary time.
-type FakeClock struct {
-	FakePassiveClock
-
-	// waiters are waiting for the fake time to pass their specified time
-	waiters []fakeClockWaiter
-}
-
-type fakeClockWaiter struct {
-	targetTime    time.Time
-	stepInterval  time.Duration
-	skipIfBlocked bool
-	destChan      chan time.Time
-	afterFunc     func()
-}
-
-// NewFakePassiveClock returns a new FakePassiveClock.
-func NewFakePassiveClock(t time.Time) *FakePassiveClock {
-	return &FakePassiveClock{
-		time: t,
-	}
-}
-
-// NewFakeClock returns a new FakeClock
-func NewFakeClock(t time.Time) *FakeClock {
-	return &FakeClock{
-		FakePassiveClock: *NewFakePassiveClock(t),
-	}
-}
-
-// Now returns f's time.
-func (f *FakePassiveClock) Now() time.Time {
-	f.lock.RLock()
-	defer f.lock.RUnlock()
-	return f.time
-}
-
-// Since returns time since the time in f.
-func (f *FakePassiveClock) Since(ts time.Time) time.Duration {
-	f.lock.RLock()
-	defer f.lock.RUnlock()
-	return f.time.Sub(ts)
-}
-
-// SetTime sets the time on the FakePassiveClock.
-func (f *FakePassiveClock) SetTime(t time.Time) {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	f.time = t
-}
-
-// After is the Fake version of time.After(d).
-func (f *FakeClock) After(d time.Duration) <-chan time.Time {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	stopTime := f.time.Add(d)
-	ch := make(chan time.Time, 1) // Don't block!
-	f.waiters = append(f.waiters, fakeClockWaiter{
-		targetTime: stopTime,
-		destChan:   ch,
-	})
-	return ch
-}
-
-// AfterFunc is the Fake version of time.AfterFunc(d, callback).
-func (f *FakeClock) AfterFunc(d time.Duration, cb func()) Timer {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	stopTime := f.time.Add(d)
-	ch := make(chan time.Time, 1) // Don't block!
-
-	timer := &fakeTimer{
-		fakeClock: f,
-		waiter: fakeClockWaiter{
-			targetTime: stopTime,
-			destChan:   ch,
-			afterFunc:  cb,
-		},
-	}
-	f.waiters = append(f.waiters, timer.waiter)
-	return timer
-}
-
-// NewTimer is the Fake version of time.NewTimer(d).
-func (f *FakeClock) NewTimer(d time.Duration) Timer {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	stopTime := f.time.Add(d)
-	ch := make(chan time.Time, 1) // Don't block!
-	timer := &fakeTimer{
-		fakeClock: f,
-		waiter: fakeClockWaiter{
-			targetTime: stopTime,
-			destChan:   ch,
-		},
-	}
-	f.waiters = append(f.waiters, timer.waiter)
-	return timer
-}
-
-// NewTicker returns a new Ticker.
-func (f *FakeClock) NewTicker(d time.Duration) Ticker {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	tickTime := f.time.Add(d)
-	ch := make(chan time.Time, 1) // hold one tick
-	f.waiters = append(f.waiters, fakeClockWaiter{
-		targetTime:    tickTime,
-		stepInterval:  d,
-		skipIfBlocked: true,
-		destChan:      ch,
-	})
-
-	return &fakeTicker{
-		c: ch,
-	}
-}
-
-// Step moves clock by Duration, notifies anyone that's called After, Tick, or NewTimer
-func (f *FakeClock) Step(d time.Duration) {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	f.setTimeLocked(f.time.Add(d))
-}
-
-// SetTime sets the time on a FakeClock.
-func (f *FakeClock) SetTime(t time.Time) {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-	f.setTimeLocked(t)
-}
-
-// Actually changes the time and checks any waiters. f must be write-locked.
-func (f *FakeClock) setTimeLocked(t time.Time) {
-	f.time = t
-	newWaiters := make([]fakeClockWaiter, 0, len(f.waiters))
-	for i := range f.waiters {
-		w := &f.waiters[i]
-		if !w.targetTime.After(t) {
-
-			if w.skipIfBlocked {
-				select {
-				case w.destChan <- t:
-				default:
-				}
-			} else {
-				w.destChan <- t
-			}
-
-			if w.afterFunc != nil {
-				w.afterFunc()
-			}
-
-			if w.stepInterval > 0 {
-				for !w.targetTime.After(t) {
-					w.targetTime = w.targetTime.Add(w.stepInterval)
-				}
-				newWaiters = append(newWaiters, *w)
-			}
-
-		} else {
-			newWaiters = append(newWaiters, f.waiters[i])
-		}
-	}
-	f.waiters = newWaiters
-}
-
-// HasWaiters returns true if After or AfterFunc has been called on f but not yet satisfied
-// (so you can write race-free tests).
-func (f *FakeClock) HasWaiters() bool {
-	f.lock.RLock()
-	defer f.lock.RUnlock()
-	return len(f.waiters) > 0
-}
-
-// Sleep pauses the FakeClock for duration d.
-func (f *FakeClock) Sleep(d time.Duration) {
-	f.Step(d)
-}
-
-// IntervalClock implements Clock, but each invocation of Now steps the clock forward the specified duration
-type IntervalClock struct {
-	Time     time.Time
-	Duration time.Duration
-}
-
-// Now returns i's time.
-func (i *IntervalClock) Now() time.Time {
-	i.Time = i.Time.Add(i.Duration)
-	return i.Time
-}
-
-// Since returns time since the time in i.
-func (i *IntervalClock) Since(ts time.Time) time.Duration {
-	return i.Time.Sub(ts)
-}
-
-// After is currently unimplemented, will panic.
-// TODO: make interval clock use FakeClock so this can be implemented.
-func (*IntervalClock) After(d time.Duration) <-chan time.Time {
-	panic("IntervalClock doesn't implement After")
-}
-
-// AfterFunc is currently unimplemented, will panic.
-// TODO: make interval clock use FakeClock so this can be implemented.
-func (*IntervalClock) AfterFunc(d time.Duration, cb func()) Timer {
-	panic("IntervalClock doesn't implement AfterFunc")
-}
-
-// NewTimer is currently unimplemented, will panic.
-// TODO: make interval clock use FakeClock so this can be implemented.
-func (*IntervalClock) NewTimer(d time.Duration) Timer {
-	panic("IntervalClock doesn't implement NewTimer")
-}
-
-// NewTicker is currently unimplemented, will panic.
-// TODO: make interval clock use FakeClock so this can be implemented.
-func (*IntervalClock) NewTicker(d time.Duration) Ticker {
-	panic("IntervalClock doesn't implement NewTicker")
-}
-
-// Sleep is currently unimplemented; will panic.
-func (*IntervalClock) Sleep(d time.Duration) {
-	panic("IntervalClock doesn't implement Sleep")
-}
-
-// Timer allows for injecting fake or real timers into code that
-// needs to do arbitrary things based on time.
-type Timer interface {
-	C() <-chan time.Time
-	Stop() bool
-	Reset(d time.Duration) bool
-}
-
-// realTimer is backed by an actual time.Timer.
-type realTimer struct {
-	timer *time.Timer
-}
-
-// C returns the underlying timer's channel.
-func (r *realTimer) C() <-chan time.Time {
-	return r.timer.C
-}
-
-// Stop calls Stop() on the underlying timer.
-func (r *realTimer) Stop() bool {
-	return r.timer.Stop()
-}
-
-// Reset calls Reset() on the underlying timer.
-func (r *realTimer) Reset(d time.Duration) bool {
-	return r.timer.Reset(d)
-}
-
-// fakeTimer implements Timer based on a FakeClock.
-type fakeTimer struct {
-	fakeClock *FakeClock
-	waiter    fakeClockWaiter
-}
-
-// C returns the channel that notifies when this timer has fired.
-func (f *fakeTimer) C() <-chan time.Time {
-	return f.waiter.destChan
-}
-
-// Stop conditionally stops the timer.  If the timer has neither fired
-// nor been stopped then this call stops the timer and returns true,
-// otherwise this call returns false.  This is like time.Timer::Stop.
-func (f *fakeTimer) Stop() bool {
-	f.fakeClock.lock.Lock()
-	defer f.fakeClock.lock.Unlock()
-	// The timer has already fired or been stopped, unless it is found
-	// among the clock's waiters.
-	stopped := false
-	oldWaiters := f.fakeClock.waiters
-	newWaiters := make([]fakeClockWaiter, 0, len(oldWaiters))
-	seekChan := f.waiter.destChan
-	for i := range oldWaiters {
-		// Identify the timer's fakeClockWaiter by the identity of the
-		// destination channel, nothing else is necessarily unique and
-		// constant since the timer's creation.
-		if oldWaiters[i].destChan == seekChan {
-			stopped = true
-		} else {
-			newWaiters = append(newWaiters, oldWaiters[i])
-		}
-	}
-
-	f.fakeClock.waiters = newWaiters
-
-	return stopped
-}
-
-// Reset conditionally updates the firing time of the timer.  If the
-// timer has neither fired nor been stopped then this call resets the
-// timer to the fake clock's "now" + d and returns true, otherwise
-// it creates a new waiter, adds it to the clock, and returns true.
-//
-// It is not possible to return false, because a fake timer can be reset
-// from any state (waiting to fire, already fired, and stopped).
-//
-// See the GoDoc for time.Timer::Reset for more context on why
-// the return value of Reset() is not useful.
-func (f *fakeTimer) Reset(d time.Duration) bool {
-	f.fakeClock.lock.Lock()
-	defer f.fakeClock.lock.Unlock()
-	waiters := f.fakeClock.waiters
-	seekChan := f.waiter.destChan
-	for i := range waiters {
-		if waiters[i].destChan == seekChan {
-			waiters[i].targetTime = f.fakeClock.time.Add(d)
-			return true
-		}
-	}
-	// No existing waiter, timer has already fired or been reset.
-	// We should still enable Reset() to succeed by creating a
-	// new waiter and adding it to the clock's waiters.
-	newWaiter := fakeClockWaiter{
-		targetTime: f.fakeClock.time.Add(d),
-		destChan:   seekChan,
-	}
-	f.fakeClock.waiters = append(f.fakeClock.waiters, newWaiter)
-	return true
-}
-
-// Ticker defines the Ticker interface
-type Ticker interface {
-	C() <-chan time.Time
-	Stop()
-}
-
-type realTicker struct {
-	ticker *time.Ticker
-}
-
-func (t *realTicker) C() <-chan time.Time {
-	return t.ticker.C
-}
-
-func (t *realTicker) Stop() {
-	t.ticker.Stop()
-}
-
-type fakeTicker struct {
-	c <-chan time.Time
-}
-
-func (t *fakeTicker) C() <-chan time.Time {
-	return t.c
-}
-
-func (t *fakeTicker) Stop() {
-}

vendor/k8s.io/apimachinery/pkg/util/framer/framer.go

@@ -132,14 +132,14 @@ func (r *jsonFrameReader) Read(data []byte) (int, error) {
 	// Return whatever remaining data exists from an in progress frame
 	if n := len(r.remaining); n > 0 {
 		if n <= len(data) {
-			//lint:ignore SA4006,SA4010 underlying array of data is modified here.
+			//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
 			data = append(data[0:0], r.remaining...)
 			r.remaining = nil
 			return n, nil
 		}
 
 		n = len(data)
-		//lint:ignore SA4006,SA4010 underlying array of data is modified here.
+		//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
 		data = append(data[0:0], r.remaining[:n]...)
 		r.remaining = r.remaining[n:]
 		return n, io.ErrShortBuffer
@@ -157,7 +157,7 @@ func (r *jsonFrameReader) Read(data []byte) (int, error) {
 	// and set m to it, which means we need to copy the partial result back into data and preserve
 	// the remaining result for subsequent reads.
 	if len(m) > n {
-		//lint:ignore SA4006,SA4010 underlying array of data is modified here.
+		//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
 		data = append(data[0:0], m[:n]...)
 		r.remaining = m[n:]
 		return n, io.ErrShortBuffer

vendor/k8s.io/apimachinery/pkg/util/httpstream/spdy/roundtripper.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -32,6 +33,7 @@ import (
 	"strings"
 	"time"
 
+	"golang.org/x/net/proxy"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -65,12 +67,6 @@ type SpdyRoundTripper struct {
 	// Used primarily for mocking the proxy discovery in tests.
 	proxier func(req *http.Request) (*url.URL, error)
 
-	// followRedirects indicates if the round tripper should examine responses for redirects and
-	// follow them.
-	followRedirects bool
-	// requireSameHostRedirects restricts redirect following to only follow redirects to the same host
-	// as the original request.
-	requireSameHostRedirects bool
 	// pingPeriod is a period for sending Ping frames over established
 	// connections.
 	pingPeriod time.Duration
@@ -82,37 +78,31 @@ var _ utilnet.Dialer = &SpdyRoundTripper{}
 
 // NewRoundTripper creates a new SpdyRoundTripper that will use the specified
 // tlsConfig.
-func NewRoundTripper(tlsConfig *tls.Config, followRedirects, requireSameHostRedirects bool) *SpdyRoundTripper {
+func NewRoundTripper(tlsConfig *tls.Config) *SpdyRoundTripper {
 	return NewRoundTripperWithConfig(RoundTripperConfig{
-		TLS:                      tlsConfig,
-		FollowRedirects:          followRedirects,
-		RequireSameHostRedirects: requireSameHostRedirects,
+		TLS: tlsConfig,
 	})
 }
 
 // NewRoundTripperWithProxy creates a new SpdyRoundTripper that will use the
 // specified tlsConfig and proxy func.
-func NewRoundTripperWithProxy(tlsConfig *tls.Config, followRedirects, requireSameHostRedirects bool, proxier func(*http.Request) (*url.URL, error)) *SpdyRoundTripper {
+func NewRoundTripperWithProxy(tlsConfig *tls.Config, proxier func(*http.Request) (*url.URL, error)) *SpdyRoundTripper {
 	return NewRoundTripperWithConfig(RoundTripperConfig{
-		TLS:                      tlsConfig,
-		FollowRedirects:          followRedirects,
-		RequireSameHostRedirects: requireSameHostRedirects,
-		Proxier:                  proxier,
+		TLS:     tlsConfig,
+		Proxier: proxier,
 	})
 }
 
-// NewRoundTripperWithProxy creates a new SpdyRoundTripper with the specified
+// NewRoundTripperWithConfig creates a new SpdyRoundTripper with the specified
 // configuration.
 func NewRoundTripperWithConfig(cfg RoundTripperConfig) *SpdyRoundTripper {
 	if cfg.Proxier == nil {
 		cfg.Proxier = utilnet.NewProxierWithNoProxyCIDR(http.ProxyFromEnvironment)
 	}
 	return &SpdyRoundTripper{
-		tlsConfig:                cfg.TLS,
-		followRedirects:          cfg.FollowRedirects,
-		requireSameHostRedirects: cfg.RequireSameHostRedirects,
-		proxier:                  cfg.Proxier,
-		pingPeriod:               cfg.PingPeriod,
+		tlsConfig:  cfg.TLS,
+		proxier:    cfg.Proxier,
+		pingPeriod: cfg.PingPeriod,
 	}
 }
 
@@ -125,9 +115,6 @@ type RoundTripperConfig struct {
 	// PingPeriod is a period for sending SPDY Pings on the connection.
 	// Optional.
 	PingPeriod time.Duration
-
-	FollowRedirects          bool
-	RequireSameHostRedirects bool
 }
 
 // TLSClientConfig implements pkg/util/net.TLSClientConfigHolder for proper TLS checking during
@@ -163,6 +150,18 @@ func (s *SpdyRoundTripper) dial(req *http.Request) (net.Conn, error) {
 		return s.dialWithoutProxy(req.Context(), req.URL)
 	}
 
+	switch proxyURL.Scheme {
+	case "socks5":
+		return s.dialWithSocks5Proxy(req, proxyURL)
+	case "https", "http", "":
+		return s.dialWithHttpProxy(req, proxyURL)
+	}
+
+	return nil, fmt.Errorf("proxy URL scheme not supported: %s", proxyURL.Scheme)
+}
+
+// dialWithHttpProxy dials the host specified by url through an http or an https proxy.
+func (s *SpdyRoundTripper) dialWithHttpProxy(req *http.Request, proxyURL *url.URL) (net.Conn, error) {
 	// ensure we use a canonical host with proxyReq
 	targetHost := netutil.CanonicalAddr(req.URL)
 
@@ -173,20 +172,22 @@ func (s *SpdyRoundTripper) dial(req *http.Request) (net.Conn, error) {
 		Host:   targetHost,
 	}
 
+	proxyReq = *proxyReq.WithContext(req.Context())
+
 	if pa := s.proxyAuth(proxyURL); pa != "" {
 		proxyReq.Header = http.Header{}
 		proxyReq.Header.Set("Proxy-Authorization", pa)
 	}
 
-	proxyDialConn, err := s.dialWithoutProxy(req.Context(), proxyURL)
+	proxyDialConn, err := s.dialWithoutProxy(proxyReq.Context(), proxyURL)
 	if err != nil {
 		return nil, err
 	}
 
-	//lint:ignore SA1019 ignore deprecated httputil.NewProxyClientConn
+	//nolint:staticcheck // SA1019 ignore deprecated httputil.NewProxyClientConn
 	proxyClientConn := httputil.NewProxyClientConn(proxyDialConn, nil)
 	_, err = proxyClientConn.Do(&proxyReq)
-	//lint:ignore SA1019 ignore deprecated httputil.ErrPersistEOF: it might be
+	//nolint:staticcheck // SA1019 ignore deprecated httputil.ErrPersistEOF: it might be
 	// returned from the invocation of proxyClientConn.Do
 	if err != nil && err != httputil.ErrPersistEOF {
 		return nil, err
@@ -194,9 +195,58 @@ func (s *SpdyRoundTripper) dial(req *http.Request) (net.Conn, error) {
 
 	rwc, _ := proxyClientConn.Hijack()
 
-	if req.URL.Scheme != "https" {
-		return rwc, nil
+	if req.URL.Scheme == "https" {
+		return s.tlsConn(proxyReq.Context(), rwc, targetHost)
 	}
+	return rwc, nil
+}
+
+// dialWithSocks5Proxy dials the host specified by url through a socks5 proxy.
+func (s *SpdyRoundTripper) dialWithSocks5Proxy(req *http.Request, proxyURL *url.URL) (net.Conn, error) {
+	// ensure we use a canonical host with proxyReq
+	targetHost := netutil.CanonicalAddr(req.URL)
+	proxyDialAddr := netutil.CanonicalAddr(proxyURL)
+
+	var auth *proxy.Auth
+	if proxyURL.User != nil {
+		pass, _ := proxyURL.User.Password()
+		auth = &proxy.Auth{
+			User:     proxyURL.User.Username(),
+			Password: pass,
+		}
+	}
+
+	dialer := s.Dialer
+	if dialer == nil {
+		dialer = &net.Dialer{
+			Timeout: 30 * time.Second,
+		}
+	}
+
+	proxyDialer, err := proxy.SOCKS5("tcp", proxyDialAddr, auth, dialer)
+	if err != nil {
+		return nil, err
+	}
+
+	// According to the implementation of proxy.SOCKS5, the type assertion will always succeed
+	contextDialer, ok := proxyDialer.(proxy.ContextDialer)
+	if !ok {
+		return nil, errors.New("SOCKS5 Dialer must implement ContextDialer")
+	}
+
+	proxyDialConn, err := contextDialer.DialContext(req.Context(), "tcp", targetHost)
+	if err != nil {
+		return nil, err
+	}
+
+	if req.URL.Scheme == "https" {
+		return s.tlsConn(req.Context(), proxyDialConn, targetHost)
+	}
+	return proxyDialConn, nil
+}
+
+// tlsConn returns a TLS client side connection using rwc as the underlying transport.
+func (s *SpdyRoundTripper) tlsConn(ctx context.Context, rwc net.Conn, targetHost string) (net.Conn, error) {
 
 	host, _, err := net.SplitHostPort(targetHost)
 	if err != nil {
@@ -215,7 +265,7 @@ func (s *SpdyRoundTripper) dial(req *http.Request) (net.Conn, error) {
 	tlsConn := tls.Client(rwc, tlsConfig)
 
 	// need to manually call Handshake() so we can call VerifyHostname() below
-	if err := tlsConn.Handshake(); err != nil {
+	if err := tlsConn.HandshakeContext(ctx); err != nil {
 		return nil, err
 	}
 
@@ -300,13 +350,9 @@ func (s *SpdyRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 		err         error
 	)
 
-	if s.followRedirects {
-		conn, rawResponse, err = utilnet.ConnectWithRedirects(req.Method, req.URL, header, req.Body, s, s.requireSameHostRedirects)
-	} else {
-		clone := utilnet.CloneRequest(req)
-		clone.Header = header
-		conn, err = s.Dial(clone)
-	}
+	clone := utilnet.CloneRequest(req)
+	clone.Header = header
+	conn, err = s.Dial(clone)
 	if err != nil {
 		return nil, err
 	}

vendor/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go

@@ -78,25 +78,25 @@ func init() {
 
 var fileDescriptor_94e046ae3ce6121c = []byte{
 	// 292 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x4c, 0x8f, 0x31, 0x4b, 0x33, 0x31,
-	0x1c, 0xc6, 0x93, 0xb7, 0x7d, 0x8b, 0x9e, 0xe0, 0x50, 0x1c, 0x8a, 0x43, 0x7a, 0x28, 0xc8, 0x0d,
-	0x9a, 0xac, 0xe2, 0xd8, 0xad, 0x20, 0x08, 0x57, 0x71, 0x70, 0xbb, 0x6b, 0x63, 0x1a, 0xae, 0x4d,
-	0x42, 0xee, 0x7f, 0xc2, 0x6d, 0xfd, 0x08, 0xba, 0x39, 0xfa, 0x71, 0x6e, 0xec, 0xd8, 0x41, 0x8a,
-	0x17, 0xbf, 0x85, 0x93, 0x5c, 0xee, 0x40, 0xa7, 0xe4, 0x79, 0x9e, 0xdf, 0x2f, 0x90, 0xe0, 0x36,
-	0xbb, 0xce, 0xa9, 0xd4, 0x2c, 0x2b, 0x52, 0x6e, 0x15, 0x07, 0x9e, 0xb3, 0x67, 0xae, 0x16, 0xda,
-	0xb2, 0x6e, 0x48, 0x8c, 0x5c, 0x27, 0xf3, 0xa5, 0x54, 0xdc, 0x96, 0xcc, 0x64, 0x82, 0x15, 0x20,
-	0x57, 0x4c, 0x2a, 0xc8, 0xc1, 0x32, 0xc1, 0x15, 0xb7, 0x09, 0xf0, 0x05, 0x35, 0x56, 0x83, 0x1e,
-	0x9e, 0xb7, 0x12, 0xfd, 0x2b, 0x51, 0x93, 0x09, 0xda, 0x48, 0xb4, 0x95, 0x4e, 0xaf, 0x84, 0x84,
-	0x65, 0x91, 0xd2, 0xb9, 0x5e, 0x33, 0xa1, 0x85, 0x66, 0xde, 0x4d, 0x8b, 0x27, 0x9f, 0x7c, 0xf0,
-	0xb7, 0xf6, 0xcd, 0xb3, 0x57, 0x1c, 0x1c, 0x4d, 0x15, 0xdc, 0xd9, 0x19, 0x58, 0xa9, 0xc4, 0x30,
-	0x0a, 0xfa, 0x50, 0x1a, 0x3e, 0xc2, 0x21, 0x8e, 0x7a, 0x93, 0x93, 0x6a, 0x3f, 0x46, 0x6e, 0x3f,
-	0xee, 0xdf, 0x97, 0x86, 0x7f, 0x77, 0x67, 0xec, 0x89, 0xe1, 0x45, 0x30, 0x90, 0x0a, 0x1e, 0x92,
-	0xd5, 0xe8, 0x5f, 0x88, 0xa3, 0xff, 0x93, 0xe3, 0x8e, 0x1d, 0x4c, 0x7d, 0x1b, 0x77, 0x6b, 0xc3,
-	0xe5, 0x60, 0x1b, 0xae, 0x17, 0xe2, 0xe8, 0xf0, 0x97, 0x9b, 0xf9, 0x36, 0xee, 0xd6, 0x9b, 0x83,
-	0xb7, 0xf7, 0x31, 0xda, 0x7c, 0x84, 0x68, 0x72, 0x59, 0xd5, 0x04, 0x6d, 0x6b, 0x82, 0x76, 0x35,
-	0x41, 0x1b, 0x47, 0x70, 0xe5, 0x08, 0xde, 0x3a, 0x82, 0x77, 0x8e, 0xe0, 0x4f, 0x47, 0xf0, 0xcb,
-	0x17, 0x41, 0x8f, 0x83, 0xf6, 0xc3, 0x3f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x52, 0xa0, 0xb5, 0xc9,
-	0x64, 0x01, 0x00, 0x00,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x90, 0xb1, 0x4a, 0x03, 0x31,
+	0x1c, 0xc6, 0x13, 0x5b, 0x8b, 0x9e, 0xe0, 0x50, 0x1c, 0x8a, 0x43, 0x7a, 0x58, 0x90, 0x5b, 0x4c,
+	0x56, 0x71, 0xec, 0x56, 0x10, 0x84, 0x56, 0x1c, 0xdc, 0xee, 0xda, 0x98, 0x86, 0x6b, 0x93, 0x90,
+	0xfb, 0x9f, 0x70, 0x5b, 0x1f, 0x41, 0x37, 0x47, 0x1f, 0xe7, 0xc6, 0x8e, 0x1d, 0xa4, 0x78, 0xf1,
+	0x2d, 0x9c, 0xe4, 0x72, 0x07, 0x3a, 0x3a, 0x25, 0xdf, 0xf7, 0xfd, 0x7e, 0x19, 0x12, 0xdc, 0xa6,
+	0xd7, 0x19, 0x95, 0x9a, 0xa5, 0x79, 0xc2, 0xad, 0xe2, 0xc0, 0x33, 0xf6, 0xcc, 0xd5, 0x42, 0x5b,
+	0xd6, 0x0e, 0xb1, 0x91, 0xeb, 0x78, 0xbe, 0x94, 0x8a, 0xdb, 0x82, 0x99, 0x54, 0xb0, 0x1c, 0xe4,
+	0x8a, 0x49, 0x05, 0x19, 0x58, 0x26, 0xb8, 0xe2, 0x36, 0x06, 0xbe, 0xa0, 0xc6, 0x6a, 0xd0, 0xfd,
+	0x51, 0x23, 0xd1, 0xbf, 0x12, 0x35, 0xa9, 0xa0, 0xb5, 0x44, 0x1b, 0xe9, 0xfc, 0x4a, 0x48, 0x58,
+	0xe6, 0x09, 0x9d, 0xeb, 0x35, 0x13, 0x5a, 0x68, 0xe6, 0xdd, 0x24, 0x7f, 0xf2, 0xc9, 0x07, 0x7f,
+	0x6b, 0xde, 0xbc, 0x78, 0xc5, 0xc1, 0xc9, 0x44, 0xc1, 0x9d, 0x9d, 0x81, 0x95, 0x4a, 0xf4, 0xa3,
+	0xa0, 0x0b, 0x85, 0xe1, 0x03, 0x1c, 0xe2, 0xa8, 0x33, 0x3e, 0x2b, 0xf7, 0x43, 0xe4, 0xf6, 0xc3,
+	0xee, 0x7d, 0x61, 0xf8, 0x77, 0x7b, 0x4e, 0x3d, 0xd1, 0xbf, 0x0c, 0x7a, 0x52, 0xc1, 0x43, 0xbc,
+	0x1a, 0x1c, 0x84, 0x38, 0x3a, 0x1c, 0x9f, 0xb6, 0x6c, 0x6f, 0xe2, 0xdb, 0x69, 0xbb, 0xd6, 0x5c,
+	0x06, 0xb6, 0xe6, 0x3a, 0x21, 0x8e, 0x8e, 0x7f, 0xb9, 0x99, 0x6f, 0xa7, 0xed, 0x7a, 0x73, 0xf4,
+	0xf6, 0x3e, 0x44, 0x9b, 0x8f, 0x10, 0x8d, 0x27, 0x65, 0x45, 0xd0, 0xb6, 0x22, 0x68, 0x57, 0x11,
+	0xb4, 0x71, 0x04, 0x97, 0x8e, 0xe0, 0xad, 0x23, 0x78, 0xe7, 0x08, 0xfe, 0x74, 0x04, 0xbf, 0x7c,
+	0x11, 0xf4, 0x38, 0xfa, 0xc7, 0x17, 0xfe, 0x04, 0x00, 0x00, 0xff, 0xff, 0xdc, 0xc4, 0xf0, 0xa0,
+	0x81, 0x01, 0x00, 0x00,
 }
 
 func (m *IntOrString) Marshal() (dAtA []byte, err error) {

vendor/k8s.io/apimachinery/pkg/util/intstr/generated.proto

@@ -22,7 +22,7 @@ syntax = "proto2";
 package k8s.io.apimachinery.pkg.util.intstr;
 
 // Package-wide variables from generator "generated".
-option go_package = "intstr";
+option go_package = "k8s.io/apimachinery/pkg/util/intstr";
 
 // IntOrString is a type that can hold an int32 or a string.  When used in
 // JSON or YAML marshalling and unmarshalling, it produces or consumes the

vendor/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go

@@ -1,3 +1,4 @@
+//go:build !notest
 // +build !notest
 
 /*

vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go

@@ -131,6 +131,10 @@ func (IntOrString) OpenAPISchemaType() []string { return []string{"string"} }
 // the OpenAPI spec of this type.
 func (IntOrString) OpenAPISchemaFormat() string { return "int-or-string" }
 
+// OpenAPIV3OneOfTypes is used by the kube-openapi generator when constructing
+// the OpenAPI v3 spec of this type.
+func (IntOrString) OpenAPIV3OneOfTypes() []string { return []string{"integer", "string"} }
+
 func ValueOrDefault(intOrPercent *IntOrString, defaultValue IntOrString) *IntOrString {
 	if intOrPercent == nil {
 		return &defaultValue

vendor/k8s.io/apimachinery/pkg/util/json/json.go

@@ -17,10 +17,11 @@ limitations under the License.
 package json
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
+
+	kjson "sigs.k8s.io/json"
 )
 
 // NewEncoder delegates to json.NewEncoder
@@ -38,50 +39,11 @@ func Marshal(v interface{}) ([]byte, error) {
 // limit recursive depth to prevent stack overflow errors
 const maxDepth = 10000
 
-// Unmarshal unmarshals the given data
-// If v is a *map[string]interface{}, *[]interface{}, or *interface{} numbers
-// are converted to int64 or float64
+// Unmarshal unmarshals the given data.
+// Object keys are case-sensitive.
+// Numbers decoded into interface{} fields are converted to int64 or float64.
 func Unmarshal(data []byte, v interface{}) error {
-	switch v := v.(type) {
-	case *map[string]interface{}:
-		// Build a decoder from the given data
-		decoder := json.NewDecoder(bytes.NewBuffer(data))
-		// Preserve numbers, rather than casting to float64 automatically
-		decoder.UseNumber()
-		// Run the decode
-		if err := decoder.Decode(v); err != nil {
-			return err
-		}
-		// If the decode succeeds, post-process the map to convert json.Number objects to int64 or float64
-		return ConvertMapNumbers(*v, 0)
-
-	case *[]interface{}:
-		// Build a decoder from the given data
-		decoder := json.NewDecoder(bytes.NewBuffer(data))
-		// Preserve numbers, rather than casting to float64 automatically
-		decoder.UseNumber()
-		// Run the decode
-		if err := decoder.Decode(v); err != nil {
-			return err
-		}
-		// If the decode succeeds, post-process the map to convert json.Number objects to int64 or float64
-		return ConvertSliceNumbers(*v, 0)
-
-	case *interface{}:
-		// Build a decoder from the given data
-		decoder := json.NewDecoder(bytes.NewBuffer(data))
-		// Preserve numbers, rather than casting to float64 automatically
-		decoder.UseNumber()
-		// Run the decode
-		if err := decoder.Decode(v); err != nil {
-			return err
-		}
-		// If the decode succeeds, post-process the map to convert json.Number objects to int64 or float64
-		return ConvertInterfaceNumbers(v, 0)
-
-	default:
-		return json.Unmarshal(data, v)
-	}
+	return kjson.UnmarshalCaseSensitivePreserveInts(data, v)
 }
 
 // ConvertInterfaceNumbers converts any json.Number values to int64 or float64.

vendor/k8s.io/apimachinery/pkg/util/net/http.go

@@ -17,7 +17,6 @@ limitations under the License.
 package net
 
 import (
-	"bufio"
 	"bytes"
 	"context"
 	"crypto/tls"
@@ -39,6 +38,7 @@ import (
 
 	"golang.org/x/net/http2"
 	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
 )
 
 // JoinPreservingTrailingSlash does a path.Join of the specified elements,
@@ -237,6 +237,29 @@ func DialerFor(transport http.RoundTripper) (DialFunc, error) {
 	}
 }
 
+// CloseIdleConnectionsFor close idles connections for the Transport.
+// If the Transport is wrapped it iterates over the wrapped round trippers
+// until it finds one that implements the CloseIdleConnections method.
+// If the Transport does not have a CloseIdleConnections method
+// then this function does nothing.
+func CloseIdleConnectionsFor(transport http.RoundTripper) {
+	if transport == nil {
+		return
+	}
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+
+	switch transport := transport.(type) {
+	case closeIdler:
+		transport.CloseIdleConnections()
+	case RoundTripperWrapper:
+		CloseIdleConnectionsFor(transport.WrappedRoundTripper())
+	default:
+		klog.Warningf("unknown transport type: %T", transport)
+	}
+}
+
 type TLSClientConfigHolder interface {
 	TLSClientConfig() *tls.Config
 }
@@ -289,7 +312,7 @@ func SourceIPs(req *http.Request) []net.IP {
 		// Use the first valid one.
 		parts := strings.Split(hdrForwardedFor, ",")
 		for _, part := range parts {
-			ip := net.ParseIP(strings.TrimSpace(part))
+			ip := netutils.ParseIPSloppy(strings.TrimSpace(part))
 			if ip != nil {
 				srcIPs = append(srcIPs, ip)
 			}
@@ -299,7 +322,7 @@ func SourceIPs(req *http.Request) []net.IP {
 	// Try the X-Real-Ip header.
 	hdrRealIp := hdr.Get("X-Real-Ip")
 	if hdrRealIp != "" {
-		ip := net.ParseIP(hdrRealIp)
+		ip := netutils.ParseIPSloppy(hdrRealIp)
 		// Only append the X-Real-Ip if it's not already contained in the X-Forwarded-For chain.
 		if ip != nil && !containsIP(srcIPs, ip) {
 			srcIPs = append(srcIPs, ip)
@@ -311,11 +334,11 @@ func SourceIPs(req *http.Request) []net.IP {
 	// Remote Address in Go's HTTP server is in the form host:port so we need to split that first.
 	host, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err == nil {
-		remoteIP = net.ParseIP(host)
+		remoteIP = netutils.ParseIPSloppy(host)
 	}
 	// Fallback if Remote Address was just IP.
 	if remoteIP == nil {
-		remoteIP = net.ParseIP(req.RemoteAddr)
+		remoteIP = netutils.ParseIPSloppy(req.RemoteAddr)
 	}
 
 	// Don't duplicate remote IP if it's already the last address in the chain.
@@ -382,7 +405,7 @@ func NewProxierWithNoProxyCIDR(delegate func(req *http.Request) (*url.URL, error
 
 	cidrs := []*net.IPNet{}
 	for _, noProxyRule := range noProxyRules {
-		_, cidr, _ := net.ParseCIDR(noProxyRule)
+		_, cidr, _ := netutils.ParseCIDRSloppy(noProxyRule)
 		if cidr != nil {
 			cidrs = append(cidrs, cidr)
 		}
@@ -393,7 +416,7 @@ func NewProxierWithNoProxyCIDR(delegate func(req *http.Request) (*url.URL, error
 	}
 
 	return func(req *http.Request) (*url.URL, error) {
-		ip := net.ParseIP(req.URL.Hostname())
+		ip := netutils.ParseIPSloppy(req.URL.Hostname())
 		if ip == nil {
 			return delegate(req)
 		}
@@ -422,104 +445,6 @@ type Dialer interface {
 	Dial(req *http.Request) (net.Conn, error)
 }
 
-// ConnectWithRedirects uses dialer to send req, following up to 10 redirects (relative to
-// originalLocation). It returns the opened net.Conn and the raw response bytes.
-// If requireSameHostRedirects is true, only redirects to the same host are permitted.
-func ConnectWithRedirects(originalMethod string, originalLocation *url.URL, header http.Header, originalBody io.Reader, dialer Dialer, requireSameHostRedirects bool) (net.Conn, []byte, error) {
-	const (
-		maxRedirects    = 9     // Fail on the 10th redirect
-		maxResponseSize = 16384 // play it safe to allow the potential for lots of / large headers
-	)
-
-	var (
-		location         = originalLocation
-		method           = originalMethod
-		intermediateConn net.Conn
-		rawResponse      = bytes.NewBuffer(make([]byte, 0, 256))
-		body             = originalBody
-	)
-
-	defer func() {
-		if intermediateConn != nil {
-			intermediateConn.Close()
-		}
-	}()
-
-redirectLoop:
-	for redirects := 0; ; redirects++ {
-		if redirects > maxRedirects {
-			return nil, nil, fmt.Errorf("too many redirects (%d)", redirects)
-		}
-
-		req, err := http.NewRequest(method, location.String(), body)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		req.Header = header
-
-		intermediateConn, err = dialer.Dial(req)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		// Peek at the backend response.
-		rawResponse.Reset()
-		respReader := bufio.NewReader(io.TeeReader(
-			io.LimitReader(intermediateConn, maxResponseSize), // Don't read more than maxResponseSize bytes.
-			rawResponse)) // Save the raw response.
-		resp, err := http.ReadResponse(respReader, nil)
-		if err != nil {
-			// Unable to read the backend response; let the client handle it.
-			klog.Warningf("Error reading backend response: %v", err)
-			break redirectLoop
-		}
-
-		switch resp.StatusCode {
-		case http.StatusFound:
-			// Redirect, continue.
-		default:
-			// Don't redirect.
-			break redirectLoop
-		}
-
-		// Redirected requests switch to "GET" according to the HTTP spec:
-		// https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3
-		method = "GET"
-		// don't send a body when following redirects
-		body = nil
-
-		resp.Body.Close() // not used
-
-		// Prepare to follow the redirect.
-		redirectStr := resp.Header.Get("Location")
-		if redirectStr == "" {
-			return nil, nil, fmt.Errorf("%d response missing Location header", resp.StatusCode)
-		}
-		// We have to parse relative to the current location, NOT originalLocation. For example,
-		// if we request http://foo.com/a and get back "http://bar.com/b", the result should be
-		// http://bar.com/b. If we then make that request and get back a redirect to "/c", the result
-		// should be http://bar.com/c, not http://foo.com/c.
-		location, err = location.Parse(redirectStr)
-		if err != nil {
-			return nil, nil, fmt.Errorf("malformed Location header: %v", err)
-		}
-
-		// Only follow redirects to the same host. Otherwise, propagate the redirect response back.
-		if requireSameHostRedirects && location.Hostname() != originalLocation.Hostname() {
-			return nil, nil, fmt.Errorf("hostname mismatch: expected %s, found %s", originalLocation.Hostname(), location.Hostname())
-		}
-
-		// Reset the connection.
-		intermediateConn.Close()
-		intermediateConn = nil
-	}
-
-	connToReturn := intermediateConn
-	intermediateConn = nil // Don't close the connection when we return it.
-	return connToReturn, rawResponse.Bytes(), nil
-}
-
 // CloneRequest creates a shallow copy of the request along with a deep copy of the Headers.
 func CloneRequest(req *http.Request) *http.Request {
 	r := new(http.Request)

vendor/k8s.io/apimachinery/pkg/util/net/interface.go

@@ -27,6 +27,7 @@ import (
 	"strings"
 
 	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
 )
 
 type AddressFamily uint
@@ -221,7 +222,7 @@ func getMatchingGlobalIP(addrs []net.Addr, family AddressFamily) (net.IP, error)
 	if len(addrs) > 0 {
 		for i := range addrs {
 			klog.V(4).Infof("Checking addr  %s.", addrs[i].String())
-			ip, _, err := net.ParseCIDR(addrs[i].String())
+			ip, _, err := netutils.ParseCIDRSloppy(addrs[i].String())
 			if err != nil {
 				return nil, err
 			}
@@ -336,7 +337,7 @@ func chooseIPFromHostInterfaces(nw networkInterfacer, addressFamilies AddressFam
 				continue
 			}
 			for _, addr := range addrs {
-				ip, _, err := net.ParseCIDR(addr.String())
+				ip, _, err := netutils.ParseCIDRSloppy(addr.String())
 				if err != nil {
 					return nil, fmt.Errorf("Unable to parse CIDR for interface %q: %s", intf.Name, err)
 				}

vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go

@@ -27,9 +27,10 @@ import (
 )
 
 var (
-	// ReallyCrash controls the behavior of HandleCrash and now defaults
-	// true. It's still exposed so components can optionally set to false
-	// to restore prior behavior.
+	// ReallyCrash controls the behavior of HandleCrash and defaults to
+	// true. It's exposed so components can optionally set to false
+	// to restore prior behavior. This flag is mostly used for tests to validate
+	// crash conditions.
 	ReallyCrash = true
 )
 

vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go

@@ -42,12 +42,24 @@ func (v *Error) Error() string {
 	return fmt.Sprintf("%s: %s", v.Field, v.ErrorBody())
 }
 
+type omitValueType struct{}
+
+var omitValue = omitValueType{}
+
 // ErrorBody returns the error message without the field name.  This is useful
 // for building nice-looking higher-level error reporting.
 func (v *Error) ErrorBody() string {
 	var s string
-	switch v.Type {
-	case ErrorTypeRequired, ErrorTypeForbidden, ErrorTypeTooLong, ErrorTypeInternal:
+	switch {
+	case v.Type == ErrorTypeRequired:
+		s = v.Type.String()
+	case v.Type == ErrorTypeForbidden:
+		s = v.Type.String()
+	case v.Type == ErrorTypeTooLong:
+		s = v.Type.String()
+	case v.Type == ErrorTypeInternal:
+		s = v.Type.String()
+	case v.BadValue == omitValue:
 		s = v.Type.String()
 	default:
 		value := v.BadValue
@@ -123,6 +135,8 @@ const (
 	// ErrorTypeInternal is used to report other errors that are not related
 	// to user input.  See InternalError().
 	ErrorTypeInternal ErrorType = "InternalError"
+	// ErrorTypeTypeInvalid is for the value did not match the schema type for that field
+	ErrorTypeTypeInvalid ErrorType = "FieldValueTypeInvalid"
 )
 
 // String converts a ErrorType into its corresponding canonical error message.
@@ -146,11 +160,18 @@ func (t ErrorType) String() string {
 		return "Too many"
 	case ErrorTypeInternal:
 		return "Internal error"
+	case ErrorTypeTypeInvalid:
+		return "Invalid value"
 	default:
 		panic(fmt.Sprintf("unrecognized validation error: %q", string(t)))
 	}
 }
 
+// TypeInvalid returns a *Error indicating "type is invalid"
+func TypeInvalid(field *Path, value interface{}, detail string) *Error {
+	return &Error{ErrorTypeTypeInvalid, field.String(), value, detail}
+}
+
 // NotFound returns a *Error indicating "value not found".  This is
 // used to report failure to find a requested value (e.g. looking up an ID).
 func NotFound(field *Path, value interface{}) *Error {
@@ -207,11 +228,40 @@ func TooLong(field *Path, value interface{}, maxLength int) *Error {
 	return &Error{ErrorTypeTooLong, field.String(), value, fmt.Sprintf("must have at most %d bytes", maxLength)}
 }
 
+// TooLongMaxLength returns a *Error indicating "too long".  This is used to
+// report that the given value is too long.  This is similar to
+// Invalid, but the returned error will not include the too-long
+// value. If maxLength is negative, no max length will be included in the message.
+func TooLongMaxLength(field *Path, value interface{}, maxLength int) *Error {
+	var msg string
+	if maxLength >= 0 {
+		msg = fmt.Sprintf("may not be longer than %d", maxLength)
+	} else {
+		msg = "value is too long"
+	}
+	return &Error{ErrorTypeTooLong, field.String(), value, msg}
+}
+
 // TooMany returns a *Error indicating "too many". This is used to
 // report that a given list has too many items. This is similar to TooLong,
 // but the returned error indicates quantity instead of length.
 func TooMany(field *Path, actualQuantity, maxQuantity int) *Error {
-	return &Error{ErrorTypeTooMany, field.String(), actualQuantity, fmt.Sprintf("must have at most %d items", maxQuantity)}
+	var msg string
+
+	if maxQuantity >= 0 {
+		msg = fmt.Sprintf("must have at most %d items", maxQuantity)
+	} else {
+		msg = "has too many items"
+	}
+
+	var actual interface{}
+	if actualQuantity >= 0 {
+		actual = actualQuantity
+	} else {
+		actual = omitValue
+	}
+
+	return &Error{ErrorTypeTooMany, field.String(), actual, msg}
 }
 
 // InternalError returns a *Error indicating "internal error".  This is used
@@ -239,6 +289,9 @@ func NewErrorTypeMatcher(t ErrorType) utilerrors.Matcher {
 
 // ToAggregate converts the ErrorList into an errors.Aggregate.
 func (list ErrorList) ToAggregate() utilerrors.Aggregate {
+	if len(list) == 0 {
+		return nil
+	}
 	errs := make([]error, 0, len(list))
 	errorMsgs := sets.NewString()
 	for _, err := range list {

vendor/k8s.io/apimachinery/pkg/util/validation/validation.go

@@ -25,6 +25,7 @@ import (
 	"strings"
 
 	"k8s.io/apimachinery/pkg/util/validation/field"
+	netutils "k8s.io/utils/net"
 )
 
 const qnameCharFmt string = "[A-Za-z0-9]"
@@ -346,7 +347,7 @@ func IsValidPortName(port string) []string {
 
 // IsValidIP tests that the argument is a valid IP address.
 func IsValidIP(value string) []string {
-	if net.ParseIP(value) == nil {
+	if netutils.ParseIPSloppy(value) == nil {
 		return []string{"must be a valid IP address, (e.g. 10.9.8.7 or 2001:db8::ffff)"}
 	}
 	return nil
@@ -355,7 +356,7 @@ func IsValidIP(value string) []string {
 // IsValidIPv4Address tests that the argument is a valid IPv4 address.
 func IsValidIPv4Address(fldPath *field.Path, value string) field.ErrorList {
 	var allErrors field.ErrorList
-	ip := net.ParseIP(value)
+	ip := netutils.ParseIPSloppy(value)
 	if ip == nil || ip.To4() == nil {
 		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid IPv4 address"))
 	}
@@ -365,7 +366,7 @@ func IsValidIPv4Address(fldPath *field.Path, value string) field.ErrorList {
 // IsValidIPv6Address tests that the argument is a valid IPv6 address.
 func IsValidIPv6Address(fldPath *field.Path, value string) field.ErrorList {
 	var allErrors field.ErrorList
-	ip := net.ParseIP(value)
+	ip := netutils.ParseIPSloppy(value)
 	if ip == nil || ip.To4() != nil {
 		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid IPv6 address"))
 	}

vendor/k8s.io/apimachinery/pkg/util/wait/wait.go

@@ -24,8 +24,8 @@ import (
 	"sync"
 	"time"
 
-	"k8s.io/apimachinery/pkg/util/clock"
 	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/utils/clock"
 )
 
 // For any test of the style:
@@ -166,6 +166,9 @@ func BackoffUntil(f func(), backoff BackoffManager, sliding bool, stopCh <-chan
 		// of every loop to prevent extra executions of f().
 		select {
 		case <-stopCh:
+			if !t.Stop() {
+				<-t.C()
+			}
 			return
 		case <-t.C():
 		}

vendor/k8s.io/apimachinery/pkg/util/yaml/decoder.go

@@ -59,6 +59,34 @@ func Unmarshal(data []byte, v interface{}) error {
 	}
 }
 
+// UnmarshalStrict unmarshals the given data
+// strictly (erroring when there are duplicate fields).
+func UnmarshalStrict(data []byte, v interface{}) error {
+	preserveIntFloat := func(d *json.Decoder) *json.Decoder {
+		d.UseNumber()
+		return d
+	}
+	switch v := v.(type) {
+	case *map[string]interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertMapNumbers(*v, 0)
+	case *[]interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertSliceNumbers(*v, 0)
+	case *interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertInterfaceNumbers(v, 0)
+	default:
+		return yaml.UnmarshalStrict(data, v)
+	}
+}
+
 // ToJSON converts a single YAML document into a JSON document
 // or returns an error. If the document appears to be JSON the
 // YAML decoding path is not used (so that error messages are

vendor/k8s.io/apimachinery/pkg/watch/watch.go

@@ -27,11 +27,11 @@ import (
 
 // Interface can be implemented by anything that knows how to watch and report changes.
 type Interface interface {
-	// Stops watching. Will close the channel returned by ResultChan(). Releases
+	// Stop stops watching. Will close the channel returned by ResultChan(). Releases
 	// any resources used by the watch.
 	Stop()
 
-	// Returns a chan which will receive all the events. If an error occurs
+	// ResultChan returns a chan which will receive all the events. If an error occurs
 	// or Stop() is called, the implementation will close this channel and
 	// release any resources used by the watch.
 	ResultChan() <-chan Event

vendor/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go

@@ -12,8 +12,9 @@ func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastInd
 
 // FROM: http://golang.org/src/net/http/transport.go
 var portMap = map[string]string{
-	"http":  "80",
-	"https": "443",
+	"http":   "80",
+	"https":  "443",
+	"socks5": "1080",
 }
 
 // FROM: http://golang.org/src/net/http/transport.go

vendor/k8s.io/apiserver/pkg/apis/audit/OWNERS

@@ -2,8 +2,7 @@
 
 # approval on api packages bubbles to api-approvers
 reviewers:
-- sig-auth-audit-approvers
-- sig-auth-audit-reviewers
+  - sig-auth-audit-approvers
+  - sig-auth-audit-reviewers
 labels:
-- sig/auth
-
+  - sig/auth

vendor/k8s.io/apiserver/pkg/apis/audit/types.go

@@ -98,6 +98,12 @@ type Event struct {
 	// +optional
 	ImpersonatedUser *authnv1.UserInfo
 	// Source IPs, from where the request originated and intermediate proxies.
+	// The source IPs are listed from (in order):
+	// 1. X-Forwarded-For request header IPs
+	// 2. X-Real-Ip header, if not present in the X-Forwarded-For list
+	// 3. The remote address for the connection, if it doesn't match the last
+	//    IP in the list up to here (X-Forwarded-For or X-Real-Ip).
+	// Note: All but the last IP can be arbitrarily set by the client.
 	// +optional
 	SourceIPs []string
 	// UserAgent records the user agent string reported by the client.
@@ -172,6 +178,15 @@ type Policy struct {
 	// be specified per rule in which case the union of both are omitted.
 	// +optional
 	OmitStages []Stage
+
+	// OmitManagedFields indicates whether to omit the managed fields of the request
+	// and response bodies from being written to the API audit log.
+	// This is used as a global default - a value of 'true' will omit the managed fileds,
+	// otherwise the managed fields will be included in the API audit log.
+	// Note that this can also be specified per rule in which case the value specified
+	// in a rule will override the global default.
+	// +optional
+	OmitManagedFields bool
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -232,6 +247,17 @@ type PolicyRule struct {
 	// An empty list means no restrictions will apply.
 	// +optional
 	OmitStages []Stage
+
+	// OmitManagedFields indicates whether to omit the managed fields of the request
+	// and response bodies from being written to the API audit log.
+	// - a value of 'true' will drop the managed fields from the API audit log
+	// - a value of 'false' indicates that the managed fileds should be included
+	//   in the API audit log
+	// Note that the value, if specified, in this rule will override the global default
+	// If a value is not specified then the global default specified in
+	// Policy.OmitManagedFields will stand.
+	// +optional
+	OmitManagedFields *bool
 }
 
 // GroupResources represents resource kinds in an API group.

vendor/k8s.io/apiserver/pkg/apis/audit/v1/generated.pb.go

@@ -261,85 +261,88 @@ func init() {
 }
 
 var fileDescriptor_4982ac40a460d730 = []byte{
-	// 1243 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0xcd, 0x8e, 0x1b, 0x45,
-	0x10, 0xde, 0x59, 0xaf, 0xb3, 0x76, 0x3b, 0xeb, 0x75, 0x3a, 0x11, 0x19, 0xed, 0xc1, 0x36, 0x46,
-	0x42, 0x06, 0x96, 0x99, 0xec, 0x12, 0x48, 0x14, 0x09, 0x24, 0x5b, 0x89, 0xc0, 0x22, 0xd9, 0xac,
-	0xda, 0x38, 0x07, 0xc4, 0x21, 0xe3, 0x71, 0xc5, 0x1e, 0x6c, 0xcf, 0x4c, 0xba, 0x7b, 0x8c, 0xf6,
-	0xc6, 0x0b, 0x20, 0x71, 0xe7, 0x2d, 0xb8, 0x45, 0xbc, 0x40, 0x8e, 0x39, 0xe6, 0x64, 0x11, 0xc3,
-	0x43, 0xa0, 0x9c, 0x50, 0xff, 0xcc, 0x8f, 0xbd, 0x6b, 0xc5, 0xcb, 0x81, 0xdb, 0x74, 0xd5, 0xf7,
-	0x7d, 0x55, 0x5d, 0xd3, 0x55, 0xdd, 0xe8, 0xdb, 0xf1, 0x5d, 0x66, 0x79, 0x81, 0x3d, 0x8e, 0xfa,
-	0x40, 0x7d, 0xe0, 0xc0, 0xec, 0x19, 0xf8, 0x83, 0x80, 0xda, 0xda, 0xe1, 0x84, 0x1e, 0x03, 0x3a,
-	0x03, 0x6a, 0x87, 0xe3, 0xa1, 0x5c, 0xd9, 0x4e, 0x34, 0xf0, 0xb8, 0x3d, 0x3b, 0xb2, 0x87, 0xe0,
-	0x03, 0x75, 0x38, 0x0c, 0xac, 0x90, 0x06, 0x3c, 0xc0, 0x0d, 0xc5, 0xb1, 0x12, 0x8e, 0x15, 0x8e,
-	0x87, 0x72, 0x65, 0x49, 0x8e, 0x35, 0x3b, 0x3a, 0xf8, 0x74, 0xe8, 0xf1, 0x51, 0xd4, 0xb7, 0xdc,
-	0x60, 0x6a, 0x0f, 0x83, 0x61, 0x60, 0x4b, 0x6a, 0x3f, 0x7a, 0x26, 0x57, 0x72, 0x21, 0xbf, 0x94,
-	0xe4, 0xc1, 0x61, 0x9a, 0x86, 0xed, 0x44, 0x7c, 0x04, 0x3e, 0xf7, 0x5c, 0x87, 0x7b, 0x81, 0x7f,
-	0x41, 0x02, 0x07, 0xb7, 0x53, 0xf4, 0xd4, 0x71, 0x47, 0x9e, 0x0f, 0xf4, 0x2c, 0xcd, 0x7b, 0x0a,
-	0xdc, 0xb9, 0x88, 0x65, 0xaf, 0x63, 0xd1, 0xc8, 0xe7, 0xde, 0x14, 0xce, 0x11, 0xbe, 0x78, 0x17,
-	0x81, 0xb9, 0x23, 0x98, 0x3a, 0xab, 0xbc, 0xc6, 0xdf, 0x08, 0xe5, 0x1f, 0xcc, 0xc0, 0xe7, 0xf8,
-	0x10, 0xe5, 0x27, 0x30, 0x83, 0x89, 0x69, 0xd4, 0x8d, 0x66, 0xb1, 0xfd, 0xde, 0xcb, 0x79, 0x6d,
-	0x6b, 0x31, 0xaf, 0xe5, 0x1f, 0x0a, 0xe3, 0xdb, 0xf8, 0x83, 0x28, 0x10, 0x3e, 0x41, 0xbb, 0xb2,
-	0x7e, 0x9d, 0xfb, 0xe6, 0xb6, 0xc4, 0xdf, 0xd6, 0xf8, 0xdd, 0x96, 0x32, 0xbf, 0x9d, 0xd7, 0xde,
-	0x5f, 0x97, 0x13, 0x3f, 0x0b, 0x81, 0x59, 0xbd, 0xce, 0x7d, 0x12, 0x8b, 0x88, 0xe8, 0x8c, 0x3b,
-	0x43, 0x30, 0x73, 0xcb, 0xd1, 0xbb, 0xc2, 0xf8, 0x36, 0xfe, 0x20, 0x0a, 0x84, 0x8f, 0x11, 0xa2,
-	0xf0, 0x3c, 0x02, 0xc6, 0x7b, 0xa4, 0x63, 0xee, 0x48, 0x0a, 0xd6, 0x14, 0x44, 0x12, 0x0f, 0xc9,
-	0xa0, 0x70, 0x1d, 0xed, 0xcc, 0x80, 0xf6, 0xcd, 0xbc, 0x44, 0x5f, 0xd5, 0xe8, 0x9d, 0x27, 0x40,
-	0xfb, 0x44, 0x7a, 0xf0, 0x37, 0x68, 0x27, 0x62, 0x40, 0xcd, 0x2b, 0x75, 0xa3, 0x59, 0x3a, 0xfe,
-	0xd0, 0x4a, 0x8f, 0x8e, 0xb5, 0xfc, 0x9f, 0xad, 0xd9, 0x91, 0xd5, 0x63, 0x40, 0x3b, 0xfe, 0xb3,
-	0x20, 0x55, 0x12, 0x16, 0x22, 0x15, 0xf0, 0x08, 0x55, 0xbc, 0x69, 0x08, 0x94, 0x05, 0xbe, 0xa8,
-	0xb5, 0xf0, 0x98, 0xbb, 0x97, 0x52, 0xbd, 0xb1, 0x98, 0xd7, 0x2a, 0x9d, 0x15, 0x0d, 0x72, 0x4e,
-	0x15, 0x7f, 0x82, 0x8a, 0x2c, 0x88, 0xa8, 0x0b, 0x9d, 0x53, 0x66, 0x16, 0xea, 0xb9, 0x66, 0xb1,
-	0xbd, 0xb7, 0x98, 0xd7, 0x8a, 0xdd, 0xd8, 0x48, 0x52, 0x3f, 0xb6, 0x51, 0x51, 0xa4, 0xd7, 0x1a,
-	0x82, 0xcf, 0xcd, 0x8a, 0xac, 0xc3, 0x35, 0x9d, 0x7d, 0xb1, 0x17, 0x3b, 0x48, 0x8a, 0xc1, 0x4f,
-	0x51, 0x31, 0xe8, 0xff, 0x08, 0x2e, 0x27, 0xf0, 0xcc, 0x2c, 0xca, 0x0d, 0x7c, 0x66, 0xbd, 0xbb,
-	0xa3, 0xac, 0xc7, 0x31, 0x09, 0x28, 0xf8, 0x2e, 0xa8, 0x94, 0x12, 0x23, 0x49, 0x45, 0xf1, 0x08,
-	0x95, 0x29, 0xb0, 0x30, 0xf0, 0x19, 0x74, 0xb9, 0xc3, 0x23, 0x66, 0x22, 0x19, 0xe6, 0x30, 0x13,
-	0x26, 0x39, 0x3c, 0x69, 0x24, 0xd1, 0x37, 0x22, 0x90, 0xe2, 0xb4, 0xf1, 0x62, 0x5e, 0x2b, 0x93,
-	0x25, 0x1d, 0xb2, 0xa2, 0x8b, 0x1d, 0xb4, 0xa7, 0x4f, 0x83, 0x4a, 0xc4, 0x2c, 0xc9, 0x40, 0xcd,
-	0xb5, 0x81, 0x74, 0xe7, 0x58, 0x3d, 0x7f, 0xec, 0x07, 0x3f, 0xf9, 0xed, 0x6b, 0x8b, 0x79, 0x6d,
-	0x8f, 0x64, 0x25, 0xc8, 0xb2, 0x22, 0x1e, 0xa4, 0x9b, 0xd1, 0x31, 0xae, 0x5e, 0x32, 0xc6, 0xd2,
-	0x46, 0x74, 0x90, 0x15, 0x4d, 0xfc, 0x8b, 0x81, 0x4c, 0x1d, 0x97, 0x80, 0x0b, 0xde, 0x0c, 0x06,
-	0xdf, 0x79, 0x53, 0x60, 0xdc, 0x99, 0x86, 0xe6, 0x9e, 0x0c, 0x68, 0x6f, 0x56, 0xbd, 0x47, 0x9e,
-	0x4b, 0x03, 0xc1, 0x6d, 0xd7, 0xf5, 0x31, 0x30, 0xc9, 0x1a, 0x61, 0xb2, 0x36, 0x24, 0x0e, 0x50,
-	0x59, 0x76, 0x65, 0x9a, 0x44, 0xf9, 0xbf, 0x25, 0x11, 0x37, 0x7d, 0xb9, 0xbb, 0x24, 0x47, 0x56,
-	0xe4, 0xf1, 0x73, 0x54, 0x72, 0x7c, 0x3f, 0xe0, 0xb2, 0x6b, 0x98, 0xb9, 0x5f, 0xcf, 0x35, 0x4b,
-	0xc7, 0xf7, 0x36, 0x39, 0x97, 0x72, 0xd2, 0x59, 0xad, 0x94, 0xfc, 0xc0, 0xe7, 0xf4, 0xac, 0x7d,
-	0x5d, 0x07, 0x2e, 0x65, 0x3c, 0x24, 0x1b, 0xe3, 0xe0, 0x2b, 0x54, 0x59, 0x65, 0xe1, 0x0a, 0xca,
-	0x8d, 0xe1, 0x4c, 0x8d, 0x4b, 0x22, 0x3e, 0xf1, 0x0d, 0x94, 0x9f, 0x39, 0x93, 0x08, 0xd4, 0x48,
-	0x24, 0x6a, 0x71, 0x6f, 0xfb, 0xae, 0xd1, 0x78, 0x61, 0xa0, 0xa2, 0x0c, 0xfe, 0xd0, 0x63, 0x1c,
-	0xff, 0x80, 0x0a, 0x62, 0xf7, 0x03, 0x87, 0x3b, 0x92, 0x5e, 0x3a, 0xb6, 0x36, 0xab, 0x95, 0x60,
-	0x3f, 0x02, 0xee, 0xb4, 0x2b, 0x3a, 0xe3, 0x42, 0x6c, 0x21, 0x89, 0x22, 0x3e, 0x41, 0x79, 0x8f,
-	0xc3, 0x94, 0x99, 0xdb, 0xb2, 0x30, 0x1f, 0x6d, 0x5c, 0x98, 0xf6, 0x5e, 0x3c, 0x75, 0x3b, 0x82,
-	0x4f, 0x94, 0x4c, 0xe3, 0x37, 0x03, 0x95, 0xbf, 0xa6, 0x41, 0x14, 0x12, 0x50, 0xa3, 0x84, 0xe1,
-	0x0f, 0x50, 0x7e, 0x28, 0x2c, 0xfa, 0xae, 0x48, 0x78, 0x0a, 0xa6, 0x7c, 0x62, 0x34, 0xd1, 0x98,
-	0x21, 0x73, 0xd1, 0xa3, 0x29, 0x91, 0x21, 0xa9, 0x1f, 0xdf, 0x11, 0xdd, 0xa9, 0x16, 0x27, 0xce,
-	0x14, 0x98, 0x99, 0x93, 0x04, 0xdd, 0x73, 0x19, 0x07, 0x59, 0xc6, 0x35, 0x7e, 0xcf, 0xa1, 0xfd,
-	0x95, 0x71, 0x83, 0x0f, 0x51, 0x21, 0x06, 0xe9, 0x0c, 0x93, 0x7a, 0xc5, 0x5a, 0x24, 0x41, 0x88,
-	0xa9, 0xe8, 0x0b, 0xa9, 0xd0, 0x71, 0xf5, 0x9f, 0x4b, 0xa7, 0xe2, 0x49, 0xec, 0x20, 0x29, 0x46,
-	0xdc, 0x24, 0x62, 0xa1, 0xaf, 0xaa, 0x64, 0xfe, 0x0b, 0x2c, 0x91, 0x1e, 0xdc, 0x46, 0xb9, 0xc8,
-	0x1b, 0xe8, 0x8b, 0xe9, 0x96, 0x06, 0xe4, 0x7a, 0x9b, 0xde, 0x8a, 0x82, 0x2c, 0x36, 0xe1, 0x84,
-	0x9e, 0xac, 0xa8, 0xbe, 0xb3, 0x92, 0x4d, 0xb4, 0x4e, 0x3b, 0xaa, 0xd2, 0x09, 0x42, 0xdc, 0x88,
-	0x4e, 0xe8, 0x3d, 0x01, 0xca, 0xbc, 0xc0, 0x97, 0x37, 0x58, 0xe6, 0x46, 0x6c, 0x9d, 0x76, 0xb4,
-	0x87, 0x64, 0x50, 0xb8, 0x85, 0xf6, 0xe3, 0x22, 0xc4, 0xc4, 0x5d, 0x49, 0xbc, 0xa9, 0x89, 0xfb,
-	0x64, 0xd9, 0x4d, 0x56, 0xf1, 0xf8, 0x73, 0x54, 0x62, 0x51, 0x3f, 0x29, 0x76, 0x41, 0xd2, 0x93,
-	0x76, 0xea, 0xa6, 0x2e, 0x92, 0xc5, 0x35, 0xfe, 0x31, 0xd0, 0x95, 0xd3, 0x60, 0xe2, 0xb9, 0x67,
-	0xf8, 0xe9, 0xb9, 0x5e, 0xb8, 0xb5, 0x59, 0x2f, 0xa8, 0x9f, 0x2e, 0xbb, 0x21, 0xd9, 0x68, 0x6a,
-	0xcb, 0xf4, 0x43, 0x17, 0xe5, 0x69, 0x34, 0x81, 0xb8, 0x1f, 0xac, 0x4d, 0xfa, 0x41, 0x25, 0x47,
-	0xa2, 0x09, 0xa4, 0x87, 0x5b, 0xac, 0x18, 0x51, 0x5a, 0xf8, 0x0e, 0x42, 0xc1, 0xd4, 0xe3, 0x72,
-	0x52, 0xc5, 0x87, 0xf5, 0xa6, 0x4c, 0x21, 0xb1, 0xa6, 0xaf, 0x96, 0x0c, 0xb4, 0xf1, 0x87, 0x81,
-	0x90, 0x52, 0xff, 0x1f, 0x46, 0xc1, 0xe3, 0xe5, 0x51, 0xf0, 0xf1, 0xe6, 0x5b, 0x5f, 0x33, 0x0b,
-	0x5e, 0xe4, 0xe2, 0xec, 0x45, 0x35, 0x2e, 0xf9, 0x66, 0xac, 0xa1, 0xbc, 0x78, 0x5a, 0xc4, 0xc3,
-	0xa0, 0x28, 0x90, 0xe2, 0xd9, 0xc1, 0x88, 0xb2, 0x63, 0x0b, 0x21, 0xf1, 0x21, 0x4f, 0x74, 0x5c,
-	0xd4, 0xb2, 0x28, 0x6a, 0x2f, 0xb1, 0x92, 0x0c, 0x42, 0x08, 0x8a, 0x87, 0x1b, 0x33, 0x77, 0x52,
-	0x41, 0xf1, 0x9e, 0x63, 0x44, 0xd9, 0xb1, 0x9b, 0x1d, 0x41, 0x79, 0x59, 0x83, 0xe3, 0x4d, 0x6a,
-	0xb0, 0x3c, 0xee, 0xd2, 0x71, 0x70, 0xe1, 0xe8, 0xb2, 0x10, 0x4a, 0x66, 0x03, 0x33, 0xaf, 0xa4,
-	0x59, 0x27, 0xc3, 0x83, 0x91, 0x0c, 0x02, 0x7f, 0x89, 0xf6, 0xfd, 0xc0, 0x8f, 0xa5, 0x7a, 0xe4,
-	0x21, 0x33, 0x77, 0x25, 0xe9, 0xba, 0x68, 0xb9, 0x93, 0x65, 0x17, 0x59, 0xc5, 0xae, 0x9c, 0xbc,
-	0xc2, 0xc6, 0x27, 0xaf, 0xdd, 0x7c, 0xf9, 0xa6, 0xba, 0xf5, 0xea, 0x4d, 0x75, 0xeb, 0xf5, 0x9b,
-	0xea, 0xd6, 0xcf, 0x8b, 0xaa, 0xf1, 0x72, 0x51, 0x35, 0x5e, 0x2d, 0xaa, 0xc6, 0xeb, 0x45, 0xd5,
-	0xf8, 0x73, 0x51, 0x35, 0x7e, 0xfd, 0xab, 0xba, 0xf5, 0xfd, 0xf6, 0xec, 0xe8, 0xdf, 0x00, 0x00,
-	0x00, 0xff, 0xff, 0x33, 0x6e, 0xcf, 0xc7, 0x82, 0x0d, 0x00, 0x00,
+	// 1288 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x57, 0x4f, 0x6f, 0x1b, 0x45,
+	0x14, 0xcf, 0xc6, 0x71, 0x63, 0x8f, 0x1b, 0xc7, 0x99, 0x16, 0xba, 0xe4, 0x60, 0x1b, 0x23, 0xa1,
+	0x00, 0x61, 0xb7, 0x0d, 0x85, 0x56, 0x95, 0x40, 0xb2, 0x69, 0x69, 0x2d, 0x9a, 0x3f, 0x1a, 0xe3,
+	0x1e, 0x10, 0x87, 0xae, 0xd7, 0x2f, 0xf6, 0x62, 0x7b, 0x76, 0xbb, 0x33, 0x6b, 0x94, 0x1b, 0x5f,
+	0x00, 0x89, 0x3b, 0xdf, 0x82, 0x1b, 0xe2, 0xc4, 0x2d, 0xc7, 0x1e, 0x7b, 0xb2, 0x88, 0xe1, 0x53,
+	0xe4, 0x80, 0xd0, 0xcc, 0xce, 0xfe, 0xb1, 0x13, 0x2b, 0x0e, 0x07, 0x6e, 0x9e, 0xf7, 0x7e, 0xbf,
+	0xdf, 0x7b, 0xfb, 0xf6, 0xbd, 0x37, 0x6b, 0xf4, 0xf5, 0xe0, 0x21, 0x33, 0x1c, 0xd7, 0x1c, 0x04,
+	0x1d, 0xf0, 0x29, 0x70, 0x60, 0xe6, 0x18, 0x68, 0xd7, 0xf5, 0x4d, 0xe5, 0xb0, 0x3c, 0x87, 0x81,
+	0x3f, 0x06, 0xdf, 0xf4, 0x06, 0x3d, 0x79, 0x32, 0xad, 0xa0, 0xeb, 0x70, 0x73, 0x7c, 0xcf, 0xec,
+	0x01, 0x05, 0xdf, 0xe2, 0xd0, 0x35, 0x3c, 0xdf, 0xe5, 0x2e, 0xae, 0x85, 0x1c, 0x23, 0xe6, 0x18,
+	0xde, 0xa0, 0x27, 0x4f, 0x86, 0xe4, 0x18, 0xe3, 0x7b, 0xdb, 0x1f, 0xf7, 0x1c, 0xde, 0x0f, 0x3a,
+	0x86, 0xed, 0x8e, 0xcc, 0x9e, 0xdb, 0x73, 0x4d, 0x49, 0xed, 0x04, 0xc7, 0xf2, 0x24, 0x0f, 0xf2,
+	0x57, 0x28, 0xb9, 0xbd, 0x9b, 0xa4, 0x61, 0x5a, 0x01, 0xef, 0x03, 0xe5, 0x8e, 0x6d, 0x71, 0xc7,
+	0xa5, 0x97, 0x24, 0xb0, 0x7d, 0x3f, 0x41, 0x8f, 0x2c, 0xbb, 0xef, 0x50, 0xf0, 0x4f, 0x92, 0xbc,
+	0x47, 0xc0, 0xad, 0xcb, 0x58, 0xe6, 0x22, 0x96, 0x1f, 0x50, 0xee, 0x8c, 0xe0, 0x02, 0xe1, 0xb3,
+	0xab, 0x08, 0xcc, 0xee, 0xc3, 0xc8, 0x9a, 0xe7, 0xd5, 0xfe, 0x46, 0x28, 0xfb, 0x64, 0x0c, 0x94,
+	0xe3, 0x5d, 0x94, 0x1d, 0xc2, 0x18, 0x86, 0xba, 0x56, 0xd5, 0x76, 0xf2, 0x8d, 0xb7, 0x4f, 0x27,
+	0x95, 0x95, 0xe9, 0xa4, 0x92, 0x7d, 0x2e, 0x8c, 0xe7, 0xd1, 0x0f, 0x12, 0x82, 0xf0, 0x01, 0x5a,
+	0x97, 0xf5, 0x6b, 0x3e, 0xd6, 0x57, 0x25, 0xfe, 0xbe, 0xc2, 0xaf, 0xd7, 0x43, 0xf3, 0xf9, 0xa4,
+	0xf2, 0xee, 0xa2, 0x9c, 0xf8, 0x89, 0x07, 0xcc, 0x68, 0x37, 0x1f, 0x93, 0x48, 0x44, 0x44, 0x67,
+	0xdc, 0xea, 0x81, 0x9e, 0x99, 0x8d, 0xde, 0x12, 0xc6, 0xf3, 0xe8, 0x07, 0x09, 0x41, 0x78, 0x0f,
+	0x21, 0x1f, 0x5e, 0x05, 0xc0, 0x78, 0x9b, 0x34, 0xf5, 0x35, 0x49, 0xc1, 0x8a, 0x82, 0x48, 0xec,
+	0x21, 0x29, 0x14, 0xae, 0xa2, 0xb5, 0x31, 0xf8, 0x1d, 0x3d, 0x2b, 0xd1, 0x37, 0x15, 0x7a, 0xed,
+	0x05, 0xf8, 0x1d, 0x22, 0x3d, 0xf8, 0x19, 0x5a, 0x0b, 0x18, 0xf8, 0xfa, 0x8d, 0xaa, 0xb6, 0x53,
+	0xd8, 0x7b, 0xdf, 0x48, 0x5a, 0xc7, 0x98, 0x7d, 0xcf, 0xc6, 0xf8, 0x9e, 0xd1, 0x66, 0xe0, 0x37,
+	0xe9, 0xb1, 0x9b, 0x28, 0x09, 0x0b, 0x91, 0x0a, 0xb8, 0x8f, 0x4a, 0xce, 0xc8, 0x03, 0x9f, 0xb9,
+	0x54, 0xd4, 0x5a, 0x78, 0xf4, 0xf5, 0x6b, 0xa9, 0xde, 0x9e, 0x4e, 0x2a, 0xa5, 0xe6, 0x9c, 0x06,
+	0xb9, 0xa0, 0x8a, 0x3f, 0x42, 0x79, 0xe6, 0x06, 0xbe, 0x0d, 0xcd, 0x23, 0xa6, 0xe7, 0xaa, 0x99,
+	0x9d, 0x7c, 0x63, 0x63, 0x3a, 0xa9, 0xe4, 0x5b, 0x91, 0x91, 0x24, 0x7e, 0x6c, 0xa2, 0xbc, 0x48,
+	0xaf, 0xde, 0x03, 0xca, 0xf5, 0x92, 0xac, 0xc3, 0x96, 0xca, 0x3e, 0xdf, 0x8e, 0x1c, 0x24, 0xc1,
+	0xe0, 0x97, 0x28, 0xef, 0x76, 0xbe, 0x07, 0x9b, 0x13, 0x38, 0xd6, 0xf3, 0xf2, 0x01, 0x3e, 0x31,
+	0xae, 0x9e, 0x28, 0xe3, 0x30, 0x22, 0x81, 0x0f, 0xd4, 0x86, 0x30, 0xa5, 0xd8, 0x48, 0x12, 0x51,
+	0xdc, 0x47, 0x45, 0x1f, 0x98, 0xe7, 0x52, 0x06, 0x2d, 0x6e, 0xf1, 0x80, 0xe9, 0x48, 0x86, 0xd9,
+	0x4d, 0x85, 0x89, 0x9b, 0x27, 0x89, 0x24, 0xe6, 0x46, 0x04, 0x0a, 0x39, 0x0d, 0x3c, 0x9d, 0x54,
+	0x8a, 0x64, 0x46, 0x87, 0xcc, 0xe9, 0x62, 0x0b, 0x6d, 0xa8, 0x6e, 0x08, 0x13, 0xd1, 0x0b, 0x32,
+	0xd0, 0xce, 0xc2, 0x40, 0x6a, 0x72, 0x8c, 0x36, 0x1d, 0x50, 0xf7, 0x07, 0xda, 0xd8, 0x9a, 0x4e,
+	0x2a, 0x1b, 0x24, 0x2d, 0x41, 0x66, 0x15, 0x71, 0x37, 0x79, 0x18, 0x15, 0xe3, 0xe6, 0x35, 0x63,
+	0xcc, 0x3c, 0x88, 0x0a, 0x32, 0xa7, 0x89, 0x7f, 0xd2, 0x90, 0xae, 0xe2, 0x12, 0xb0, 0xc1, 0x19,
+	0x43, 0xf7, 0x1b, 0x67, 0x04, 0x8c, 0x5b, 0x23, 0x4f, 0xdf, 0x90, 0x01, 0xcd, 0xe5, 0xaa, 0xb7,
+	0xef, 0xd8, 0xbe, 0x2b, 0xb8, 0x8d, 0xaa, 0x6a, 0x03, 0x9d, 0x2c, 0x10, 0x26, 0x0b, 0x43, 0x62,
+	0x17, 0x15, 0xe5, 0x54, 0x26, 0x49, 0x14, 0xff, 0x5b, 0x12, 0xd1, 0xd0, 0x17, 0x5b, 0x33, 0x72,
+	0x64, 0x4e, 0x1e, 0xbf, 0x42, 0x05, 0x8b, 0x52, 0x97, 0xcb, 0xa9, 0x61, 0xfa, 0x66, 0x35, 0xb3,
+	0x53, 0xd8, 0x7b, 0xb4, 0x4c, 0x5f, 0xca, 0x4d, 0x67, 0xd4, 0x13, 0xf2, 0x13, 0xca, 0xfd, 0x93,
+	0xc6, 0x2d, 0x15, 0xb8, 0x90, 0xf2, 0x90, 0x74, 0x8c, 0xed, 0x2f, 0x50, 0x69, 0x9e, 0x85, 0x4b,
+	0x28, 0x33, 0x80, 0x93, 0x70, 0x5d, 0x12, 0xf1, 0x13, 0xdf, 0x46, 0xd9, 0xb1, 0x35, 0x0c, 0x20,
+	0x5c, 0x89, 0x24, 0x3c, 0x3c, 0x5a, 0x7d, 0xa8, 0xd5, 0x7e, 0xd3, 0x50, 0x5e, 0x06, 0x7f, 0xee,
+	0x30, 0x8e, 0xbf, 0x43, 0x39, 0xf1, 0xf4, 0x5d, 0x8b, 0x5b, 0x92, 0x5e, 0xd8, 0x33, 0x96, 0xab,
+	0x95, 0x60, 0xef, 0x03, 0xb7, 0x1a, 0x25, 0x95, 0x71, 0x2e, 0xb2, 0x90, 0x58, 0x11, 0x1f, 0xa0,
+	0xac, 0xc3, 0x61, 0xc4, 0xf4, 0x55, 0x59, 0x98, 0x0f, 0x96, 0x2e, 0x4c, 0x63, 0x23, 0xda, 0xba,
+	0x4d, 0xc1, 0x27, 0xa1, 0x4c, 0xed, 0x17, 0x0d, 0x15, 0x9f, 0xfa, 0x6e, 0xe0, 0x11, 0x08, 0x57,
+	0x09, 0xc3, 0xef, 0xa1, 0x6c, 0x4f, 0x58, 0xd4, 0x5d, 0x11, 0xf3, 0x42, 0x58, 0xe8, 0x13, 0xab,
+	0xc9, 0x8f, 0x18, 0x32, 0x17, 0xb5, 0x9a, 0x62, 0x19, 0x92, 0xf8, 0xf1, 0x03, 0x31, 0x9d, 0xe1,
+	0xe1, 0xc0, 0x1a, 0x01, 0xd3, 0x33, 0x92, 0xa0, 0x66, 0x2e, 0xe5, 0x20, 0xb3, 0xb8, 0xda, 0xaf,
+	0x19, 0xb4, 0x39, 0xb7, 0x6e, 0xf0, 0x2e, 0xca, 0x45, 0x20, 0x95, 0x61, 0x5c, 0xaf, 0x48, 0x8b,
+	0xc4, 0x08, 0xb1, 0x15, 0xa9, 0x90, 0xf2, 0x2c, 0x5b, 0xbd, 0xb9, 0x64, 0x2b, 0x1e, 0x44, 0x0e,
+	0x92, 0x60, 0xc4, 0x4d, 0x22, 0x0e, 0xea, 0xaa, 0x8a, 0xf7, 0xbf, 0xc0, 0x12, 0xe9, 0xc1, 0x0d,
+	0x94, 0x09, 0x9c, 0xae, 0xba, 0x98, 0xee, 0x2a, 0x40, 0xa6, 0xbd, 0xec, 0xad, 0x28, 0xc8, 0xe2,
+	0x21, 0x2c, 0xcf, 0x91, 0x15, 0x55, 0x77, 0x56, 0xfc, 0x10, 0xf5, 0xa3, 0x66, 0x58, 0xe9, 0x18,
+	0x21, 0x6e, 0x44, 0xcb, 0x73, 0x5e, 0x80, 0xcf, 0x1c, 0x97, 0xca, 0x1b, 0x2c, 0x75, 0x23, 0xd6,
+	0x8f, 0x9a, 0xca, 0x43, 0x52, 0x28, 0x5c, 0x47, 0x9b, 0x51, 0x11, 0x22, 0xe2, 0xba, 0x24, 0xde,
+	0x51, 0xc4, 0x4d, 0x32, 0xeb, 0x26, 0xf3, 0x78, 0xfc, 0x29, 0x2a, 0xb0, 0xa0, 0x13, 0x17, 0x3b,
+	0x27, 0xe9, 0xf1, 0x38, 0xb5, 0x12, 0x17, 0x49, 0xe3, 0x6a, 0x7f, 0xac, 0xa2, 0x1b, 0x47, 0xee,
+	0xd0, 0xb1, 0x4f, 0xf0, 0xcb, 0x0b, 0xb3, 0x70, 0x77, 0xb9, 0x59, 0x08, 0x5f, 0xba, 0x9c, 0x86,
+	0xf8, 0x41, 0x13, 0x5b, 0x6a, 0x1e, 0x5a, 0x28, 0xeb, 0x07, 0x43, 0x88, 0xe6, 0xc1, 0x58, 0x66,
+	0x1e, 0xc2, 0xe4, 0x48, 0x30, 0x84, 0xa4, 0xb9, 0xc5, 0x89, 0x91, 0x50, 0x0b, 0x3f, 0x40, 0xc8,
+	0x1d, 0x39, 0x5c, 0x6e, 0xaa, 0xa8, 0x59, 0xef, 0xc8, 0x14, 0x62, 0x6b, 0xf2, 0xd5, 0x92, 0x82,
+	0xe2, 0xa7, 0x68, 0x4b, 0x9c, 0xf6, 0x2d, 0x6a, 0xf5, 0xa0, 0xfb, 0x95, 0x03, 0xc3, 0x2e, 0x93,
+	0x8d, 0x92, 0x6b, 0xbc, 0xa3, 0x22, 0x6d, 0x1d, 0xce, 0x03, 0xc8, 0x45, 0x4e, 0xed, 0x77, 0x0d,
+	0xa1, 0x30, 0xcd, 0xff, 0x61, 0xa7, 0x1c, 0xce, 0xee, 0x94, 0x0f, 0x97, 0xaf, 0xe1, 0x82, 0xa5,
+	0xf2, 0x4f, 0x26, 0xca, 0x5e, 0x94, 0xf5, 0x9a, 0x1f, 0x9f, 0x15, 0x94, 0x15, 0xdf, 0x28, 0xd1,
+	0x56, 0xc9, 0x0b, 0xa4, 0xf8, 0x7e, 0x61, 0x24, 0xb4, 0x63, 0x03, 0x21, 0xf1, 0x43, 0x8e, 0x46,
+	0xf4, 0x76, 0x8a, 0xe2, 0xed, 0xb4, 0x63, 0x2b, 0x49, 0x21, 0x84, 0xa0, 0xf8, 0x02, 0x14, 0x2f,
+	0x22, 0x16, 0x14, 0x1f, 0x86, 0x8c, 0x84, 0x76, 0x6c, 0xa7, 0x77, 0x59, 0x56, 0xd6, 0x60, 0x6f,
+	0x99, 0x1a, 0xcc, 0xee, 0xcd, 0x64, 0xaf, 0x5c, 0xba, 0x03, 0x0d, 0x84, 0xe2, 0x25, 0xc3, 0xf4,
+	0x1b, 0x49, 0xd6, 0xf1, 0x16, 0x62, 0x24, 0x85, 0xc0, 0x9f, 0xa3, 0x4d, 0xea, 0xd2, 0x48, 0xaa,
+	0x4d, 0x9e, 0x33, 0x7d, 0x5d, 0x92, 0x6e, 0x89, 0xd9, 0x3d, 0x98, 0x75, 0x91, 0x79, 0xec, 0x5c,
+	0x0b, 0xe7, 0x96, 0x6f, 0xe1, 0x2f, 0x2f, 0x6b, 0xe1, 0xbc, 0x6c, 0xe1, 0xb7, 0x96, 0x6d, 0xdf,
+	0xc6, 0xb3, 0xd3, 0xb3, 0xf2, 0xca, 0xeb, 0xb3, 0xf2, 0xca, 0x9b, 0xb3, 0xf2, 0xca, 0x8f, 0xd3,
+	0xb2, 0x76, 0x3a, 0x2d, 0x6b, 0xaf, 0xa7, 0x65, 0xed, 0xcd, 0xb4, 0xac, 0xfd, 0x39, 0x2d, 0x6b,
+	0x3f, 0xff, 0x55, 0x5e, 0xf9, 0xb6, 0x76, 0xf5, 0x5f, 0xbe, 0x7f, 0x03, 0x00, 0x00, 0xff, 0xff,
+	0xef, 0x9b, 0x7d, 0x75, 0x30, 0x0e, 0x00, 0x00,
 }
 
 func (m *Event) Marshal() (dAtA []byte, err error) {
@@ -696,6 +699,14 @@ func (m *Policy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	i--
+	if m.OmitManagedFields {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x20
 	if len(m.OmitStages) > 0 {
 		for iNdEx := len(m.OmitStages) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.OmitStages[iNdEx])
@@ -799,6 +810,16 @@ func (m *PolicyRule) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.OmitManagedFields != nil {
+		i--
+		if *m.OmitManagedFields {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x48
+	}
 	if len(m.OmitStages) > 0 {
 		for iNdEx := len(m.OmitStages) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.OmitStages[iNdEx])
@@ -1032,6 +1053,7 @@ func (m *Policy) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	n += 2
 	return n
 }
 
@@ -1102,6 +1124,9 @@ func (m *PolicyRule) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.OmitManagedFields != nil {
+		n += 2
+	}
 	return n
 }
 
@@ -1204,6 +1229,7 @@ func (this *Policy) String() string {
 		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v11.ObjectMeta", 1), `&`, ``, 1) + `,`,
 		`Rules:` + repeatedStringForRules + `,`,
 		`OmitStages:` + fmt.Sprintf("%v", this.OmitStages) + `,`,
+		`OmitManagedFields:` + fmt.Sprintf("%v", this.OmitManagedFields) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -1242,6 +1268,7 @@ func (this *PolicyRule) String() string {
 		`Namespaces:` + fmt.Sprintf("%v", this.Namespaces) + `,`,
 		`NonResourceURLs:` + fmt.Sprintf("%v", this.NonResourceURLs) + `,`,
 		`OmitStages:` + fmt.Sprintf("%v", this.OmitStages) + `,`,
+		`OmitManagedFields:` + valueToStringGenerated(this.OmitManagedFields) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -2631,6 +2658,26 @@ func (m *Policy) Unmarshal(dAtA []byte) error {
 			}
 			m.OmitStages = append(m.OmitStages, Stage(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OmitManagedFields", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.OmitManagedFields = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -3056,6 +3103,27 @@ func (m *PolicyRule) Unmarshal(dAtA []byte) error {
 			}
 			m.OmitStages = append(m.OmitStages, Stage(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OmitManagedFields", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.OmitManagedFields = &b
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])

vendor/k8s.io/apiserver/pkg/apis/audit/v1/generated.proto

@@ -27,7 +27,7 @@ import "k8s.io/apimachinery/pkg/runtime/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 
 // Package-wide variables from generator "generated".
-option go_package = "v1";
+option go_package = "k8s.io/apiserver/pkg/apis/audit/v1";
 
 // Event captures all the information that can be included in an API audit log.
 message Event {
@@ -55,6 +55,12 @@ message Event {
   optional k8s.io.api.authentication.v1.UserInfo impersonatedUser = 7;
 
   // Source IPs, from where the request originated and intermediate proxies.
+  // The source IPs are listed from (in order):
+  // 1. X-Forwarded-For request header IPs
+  // 2. X-Real-Ip header, if not present in the X-Forwarded-For list
+  // 3. The remote address for the connection, if it doesn't match the last
+  //    IP in the list up to here (X-Forwarded-For or X-Real-Ip).
+  // Note: All but the last IP can be arbitrarily set by the client.
   // +optional
   repeated string sourceIPs = 8;
 
@@ -190,6 +196,15 @@ message Policy {
   // be specified per rule in which case the union of both are omitted.
   // +optional
   repeated string omitStages = 3;
+
+  // OmitManagedFields indicates whether to omit the managed fields of the request
+  // and response bodies from being written to the API audit log.
+  // This is used as a global default - a value of 'true' will omit the managed fileds,
+  // otherwise the managed fields will be included in the API audit log.
+  // Note that this can also be specified per rule in which case the value specified
+  // in a rule will override the global default.
+  // +optional
+  optional bool omitManagedFields = 4;
 }
 
 // PolicyList is a list of audit Policies.
@@ -245,5 +260,16 @@ message PolicyRule {
   // An empty list means no restrictions will apply.
   // +optional
   repeated string omitStages = 8;
+
+  // OmitManagedFields indicates whether to omit the managed fields of the request
+  // and response bodies from being written to the API audit log.
+  // - a value of 'true' will drop the managed fields from the API audit log
+  // - a value of 'false' indicates that the managed fileds should be included
+  //   in the API audit log
+  // Note that the value, if specified, in this rule will override the global default
+  // If a value is not specified then the global default specified in
+  // Policy.OmitManagedFields will stand.
+  // +optional
+  optional bool omitManagedFields = 9;
 }
 

vendor/k8s.io/apiserver/pkg/apis/audit/v1/types.go

@@ -91,6 +91,12 @@ type Event struct {
 	// +optional
 	ImpersonatedUser *authnv1.UserInfo `json:"impersonatedUser,omitempty" protobuf:"bytes,7,opt,name=impersonatedUser"`
 	// Source IPs, from where the request originated and intermediate proxies.
+	// The source IPs are listed from (in order):
+	// 1. X-Forwarded-For request header IPs
+	// 2. X-Real-Ip header, if not present in the X-Forwarded-For list
+	// 3. The remote address for the connection, if it doesn't match the last
+	//    IP in the list up to here (X-Forwarded-For or X-Real-Ip).
+	// Note: All but the last IP can be arbitrarily set by the client.
 	// +optional
 	SourceIPs []string `json:"sourceIPs,omitempty" protobuf:"bytes,8,rep,name=sourceIPs"`
 	// UserAgent records the user agent string reported by the client.
@@ -166,6 +172,15 @@ type Policy struct {
 	// be specified per rule in which case the union of both are omitted.
 	// +optional
 	OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,3,rep,name=omitStages"`
+
+	// OmitManagedFields indicates whether to omit the managed fields of the request
+	// and response bodies from being written to the API audit log.
+	// This is used as a global default - a value of 'true' will omit the managed fileds,
+	// otherwise the managed fields will be included in the API audit log.
+	// Note that this can also be specified per rule in which case the value specified
+	// in a rule will override the global default.
+	// +optional
+	OmitManagedFields bool `json:"omitManagedFields,omitempty" protobuf:"varint,4,opt,name=omitManagedFields"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -226,6 +241,17 @@ type PolicyRule struct {
 	// An empty list means no restrictions will apply.
 	// +optional
 	OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,8,rep,name=omitStages"`
+
+	// OmitManagedFields indicates whether to omit the managed fields of the request
+	// and response bodies from being written to the API audit log.
+	// - a value of 'true' will drop the managed fields from the API audit log
+	// - a value of 'false' indicates that the managed fileds should be included
+	//   in the API audit log
+	// Note that the value, if specified, in this rule will override the global default
+	// If a value is not specified then the global default specified in
+	// Policy.OmitManagedFields will stand.
+	// +optional
+	OmitManagedFields *bool `json:"omitManagedFields,omitempty" protobuf:"varint,9,opt,name=omitManagedFields"`
 }
 
 // GroupResources represents resource kinds in an API group.

vendor/k8s.io/apiserver/pkg/apis/audit/v1/zz_generated.conversion.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*
@@ -245,6 +246,7 @@ func autoConvert_v1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conv
 	out.ObjectMeta = in.ObjectMeta
 	out.Rules = *(*[]audit.PolicyRule)(unsafe.Pointer(&in.Rules))
 	out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
+	out.OmitManagedFields = in.OmitManagedFields
 	return nil
 }
 
@@ -257,6 +259,7 @@ func autoConvert_audit_Policy_To_v1_Policy(in *audit.Policy, out *Policy, s conv
 	out.ObjectMeta = in.ObjectMeta
 	out.Rules = *(*[]PolicyRule)(unsafe.Pointer(&in.Rules))
 	out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
+	out.OmitManagedFields = in.OmitManagedFields
 	return nil
 }
 
@@ -296,6 +299,7 @@ func autoConvert_v1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.Po
 	out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
 	out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
 	out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
+	out.OmitManagedFields = (*bool)(unsafe.Pointer(in.OmitManagedFields))
 	return nil
 }
 
@@ -313,6 +317,7 @@ func autoConvert_audit_PolicyRule_To_v1_PolicyRule(in *audit.PolicyRule, out *Po
 	out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
 	out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
 	out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
+	out.OmitManagedFields = (*bool)(unsafe.Pointer(in.OmitManagedFields))
 	return nil
 }
 

vendor/k8s.io/apiserver/pkg/apis/audit/v1/zz_generated.deepcopy.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*
@@ -277,6 +278,11 @@ func (in *PolicyRule) DeepCopyInto(out *PolicyRule) {
 		*out = make([]Stage, len(*in))
 		copy(*out, *in)
 	}
+	if in.OmitManagedFields != nil {
+		in, out := &in.OmitManagedFields, &out.OmitManagedFields
+		*out = new(bool)
+		**out = **in
+	}
 	return
 }
 

vendor/k8s.io/apiserver/pkg/apis/audit/v1/zz_generated.defaults.go

@@ -1,3 +1,4 @@
+//go:build !ignore_autogenerated
 // +build !ignore_autogenerated
 
 /*

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/conversion.go

@@ -1,78 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	"strings"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/conversion"
-	"k8s.io/apiserver/pkg/apis/audit"
-)
-
-func Convert_audit_ObjectReference_To_v1alpha1_ObjectReference(in *audit.ObjectReference, out *ObjectReference, s conversion.Scope) error {
-	// Begin by copying all fields
-	if err := autoConvert_audit_ObjectReference_To_v1alpha1_ObjectReference(in, out, s); err != nil {
-		return err
-	}
-	// empty string means the core api group
-	if in.APIGroup == "" {
-		out.APIVersion = in.APIVersion
-	} else {
-		out.APIVersion = in.APIGroup + "/" + in.APIVersion
-	}
-	return nil
-}
-
-func Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(in *ObjectReference, out *audit.ObjectReference, s conversion.Scope) error {
-	// Begin by copying all fields
-	if err := autoConvert_v1alpha1_ObjectReference_To_audit_ObjectReference(in, out, s); err != nil {
-		return err
-	}
-	i := strings.LastIndex(in.APIVersion, "/")
-	if i == -1 {
-		// In fact it should always contain a "/"
-		out.APIVersion = in.APIVersion
-	} else {
-		out.APIGroup = in.APIVersion[:i]
-		out.APIVersion = in.APIVersion[i+1:]
-	}
-	return nil
-}
-
-func Convert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
-	if err := autoConvert_v1alpha1_Event_To_audit_Event(in, out, s); err != nil {
-		return err
-	}
-	if out.StageTimestamp.IsZero() {
-		out.StageTimestamp = metav1.NewMicroTime(in.CreationTimestamp.Time)
-	}
-	if out.RequestReceivedTimestamp.IsZero() {
-		out.RequestReceivedTimestamp = metav1.NewMicroTime(in.Timestamp.Time)
-	}
-	return nil
-}
-
-func Convert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
-	if err := autoConvert_audit_Event_To_v1alpha1_Event(in, out, s); err != nil {
-		return err
-	}
-	out.CreationTimestamp = metav1.NewTime(in.StageTimestamp.Time)
-	out.Timestamp = metav1.NewTime(in.RequestReceivedTimestamp.Time)
-	return nil
-
-}

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/doc.go

@@ -1,26 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// +k8s:deepcopy-gen=package
-// +k8s:protobuf-gen=package
-// +k8s:conversion-gen=k8s.io/apiserver/pkg/apis/audit
-// +k8s:openapi-gen=true
-// +k8s:prerelease-lifecycle-gen=true
-// +k8s:defaulter-gen=TypeMeta
-
-// +groupName=audit.k8s.io
-
-package v1alpha1 // import "k8s.io/apiserver/pkg/apis/audit/v1alpha1"

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/generated.proto

@@ -1,254 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-
-// This file was autogenerated by go-to-protobuf. Do not edit it manually!
-
-syntax = "proto2";
-
-package k8s.io.apiserver.pkg.apis.audit.v1alpha1;
-
-import "k8s.io/api/authentication/v1/generated.proto";
-import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
-import "k8s.io/apimachinery/pkg/runtime/generated.proto";
-import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
-
-// Package-wide variables from generator "generated".
-option go_package = "v1alpha1";
-
-// DEPRECATED - This group version of Event is deprecated by audit.k8s.io/v1/Event. See the release notes for
-// more information.
-// Event captures all the information that can be included in an API audit log.
-message Event {
-  // ObjectMeta is included for interoperability with API infrastructure.
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
-
-  // AuditLevel at which event was generated
-  optional string level = 2;
-
-  // Time the request reached the apiserver.
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time timestamp = 3;
-
-  // Unique audit ID, generated for each request.
-  optional string auditID = 4;
-
-  // Stage of the request handling when this event instance was generated.
-  optional string stage = 5;
-
-  // RequestURI is the request URI as sent by the client to a server.
-  optional string requestURI = 6;
-
-  // Verb is the kubernetes verb associated with the request.
-  // For non-resource requests, this is the lower-cased HTTP method.
-  optional string verb = 7;
-
-  // Authenticated user information.
-  optional k8s.io.api.authentication.v1.UserInfo user = 8;
-
-  // Impersonated user information.
-  // +optional
-  optional k8s.io.api.authentication.v1.UserInfo impersonatedUser = 9;
-
-  // Source IPs, from where the request originated and intermediate proxies.
-  // +optional
-  repeated string sourceIPs = 10;
-
-  // UserAgent records the user agent string reported by the client.
-  // Note that the UserAgent is provided by the client, and must not be trusted.
-  // +optional
-  optional string userAgent = 18;
-
-  // Object reference this request is targeted at.
-  // Does not apply for List-type requests, or non-resource requests.
-  // +optional
-  optional ObjectReference objectRef = 11;
-
-  // The response status, populated even when the ResponseObject is not a Status type.
-  // For successful responses, this will only include the Code and StatusSuccess.
-  // For non-status type error responses, this will be auto-populated with the error Message.
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status responseStatus = 12;
-
-  // API object from the request, in JSON format. The RequestObject is recorded as-is in the request
-  // (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
-  // merging. It is an external versioned object type, and may not be a valid object on its own.
-  // Omitted for non-resource requests.  Only logged at Request Level and higher.
-  // +optional
-  optional k8s.io.apimachinery.pkg.runtime.Unknown requestObject = 13;
-
-  // API object returned in the response, in JSON. The ResponseObject is recorded after conversion
-  // to the external type, and serialized as JSON.  Omitted for non-resource requests.  Only logged
-  // at Response Level.
-  // +optional
-  optional k8s.io.apimachinery.pkg.runtime.Unknown responseObject = 14;
-
-  // Time the request reached the apiserver.
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime requestReceivedTimestamp = 15;
-
-  // Time the request reached current audit stage.
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime stageTimestamp = 16;
-
-  // Annotations is an unstructured key value map stored with an audit event that may be set by
-  // plugins invoked in the request serving chain, including authentication, authorization and
-  // admission plugins. Note that these annotations are for the audit event, and do not correspond
-  // to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
-  // component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
-  // should be short. Annotations are included in the Metadata level.
-  // +optional
-  map<string, string> annotations = 17;
-}
-
-// EventList is a list of audit Events.
-message EventList {
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
-
-  repeated Event items = 2;
-}
-
-// GroupResources represents resource kinds in an API group.
-message GroupResources {
-  // Group is the name of the API group that contains the resources.
-  // The empty string represents the core API group.
-  // +optional
-  optional string group = 1;
-
-  // Resources is a list of resources this rule applies to.
-  //
-  // For example:
-  // 'pods' matches pods.
-  // 'pods/log' matches the log subresource of pods.
-  // '*' matches all resources and their subresources.
-  // 'pods/*' matches all subresources of pods.
-  // '*/scale' matches all scale subresources.
-  //
-  // If wildcard is present, the validation rule will ensure resources do not
-  // overlap with each other.
-  //
-  // An empty list implies all resources and subresources in this API groups apply.
-  // +optional
-  repeated string resources = 2;
-
-  // ResourceNames is a list of resource instance names that the policy matches.
-  // Using this field requires Resources to be specified.
-  // An empty list implies that every instance of the resource is matched.
-  // +optional
-  repeated string resourceNames = 3;
-}
-
-// ObjectReference contains enough information to let you inspect or modify the referred object.
-message ObjectReference {
-  // +optional
-  optional string resource = 1;
-
-  // +optional
-  optional string namespace = 2;
-
-  // +optional
-  optional string name = 3;
-
-  // +optional
-  optional string uid = 4;
-
-  // +optional
-  optional string apiVersion = 5;
-
-  // +optional
-  optional string resourceVersion = 6;
-
-  // +optional
-  optional string subresource = 7;
-}
-
-// DEPRECATED - This group version of Policy is deprecated by audit.k8s.io/v1/Policy. See the release notes for
-// more information.
-// Policy defines the configuration of audit logging, and the rules for how different request
-// categories are logged.
-message Policy {
-  // ObjectMeta is included for interoperability with API infrastructure.
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
-
-  // Rules specify the audit Level a request should be recorded at.
-  // A request may match multiple rules, in which case the FIRST matching rule is used.
-  // The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
-  // PolicyRules are strictly ordered.
-  repeated PolicyRule rules = 2;
-
-  // OmitStages is a list of stages for which no events are created. Note that this can also
-  // be specified per rule in which case the union of both are omitted.
-  // +optional
-  repeated string omitStages = 3;
-}
-
-// PolicyList is a list of audit Policies.
-message PolicyList {
-  // +optional
-  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
-
-  repeated Policy items = 2;
-}
-
-// PolicyRule maps requests based off metadata to an audit Level.
-// Requests must match the rules of every field (an intersection of rules).
-message PolicyRule {
-  // The Level that requests matching this rule are recorded at.
-  optional string level = 1;
-
-  // The users (by authenticated user name) this rule applies to.
-  // An empty list implies every user.
-  // +optional
-  repeated string users = 2;
-
-  // The user groups this rule applies to. A user is considered matching
-  // if it is a member of any of the UserGroups.
-  // An empty list implies every user group.
-  // +optional
-  repeated string userGroups = 3;
-
-  // The verbs that match this rule.
-  // An empty list implies every verb.
-  // +optional
-  repeated string verbs = 4;
-
-  // Resources that this rule matches. An empty list implies all kinds in all API groups.
-  // +optional
-  repeated GroupResources resources = 5;
-
-  // Namespaces that this rule matches.
-  // The empty string "" matches non-namespaced resources.
-  // An empty list implies every namespace.
-  // +optional
-  repeated string namespaces = 6;
-
-  // NonResourceURLs is a set of URL paths that should be audited.
-  // *s are allowed, but only as the full, final step in the path.
-  // Examples:
-  //  "/metrics" - Log requests for apiserver metrics
-  //  "/healthz*" - Log all health checks
-  // +optional
-  repeated string nonResourceURLs = 7;
-
-  // OmitStages is a list of stages for which no events are created. Note that this can also
-  // be specified policy wide in which case the union of both are omitted.
-  // An empty list means no restrictions will apply.
-  // +optional
-  repeated string omitStages = 8;
-}
-

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/register.go

@@ -1,58 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-// GroupName is the group name use in this package
-const GroupName = "audit.k8s.io"
-
-// SchemeGroupVersion is group version used to register these objects
-var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
-
-// Resource takes an unqualified resource and returns a Group qualified GroupResource
-func Resource(resource string) schema.GroupResource {
-	return SchemeGroupVersion.WithResource(resource).GroupResource()
-}
-
-var (
-	SchemeBuilder      runtime.SchemeBuilder
-	localSchemeBuilder = &SchemeBuilder
-	AddToScheme        = localSchemeBuilder.AddToScheme
-)
-
-func init() {
-	// We only register manually written functions here. The registration of the
-	// generated functions takes place in the generated files. The separation
-	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes)
-}
-
-func addKnownTypes(scheme *runtime.Scheme) error {
-	scheme.AddKnownTypes(SchemeGroupVersion,
-		&Event{},
-		&EventList{},
-		&Policy{},
-		&PolicyList{},
-	)
-	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
-	return nil
-}

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/types.go

@@ -1,303 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	authnv1 "k8s.io/api/authentication/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-)
-
-// Header keys used by the audit system.
-const (
-	// Header to hold the audit ID as the request is propagated through the serving hierarchy. The
-	// Audit-ID header should be set by the first server to receive the request (e.g. the federation
-	// server or kube-aggregator).
-	//
-	// Audit ID is also returned to client by http response header.
-	// It's not guaranteed Audit-Id http header is sent for all requests. When kube-apiserver didn't
-	// audit the events according to the audit policy, no Audit-ID is returned. Also, for request to
-	// pods/exec, pods/attach, pods/proxy, kube-apiserver works like a proxy and redirect the request
-	// to kubelet node, users will only get http headers sent from kubelet node, so no Audit-ID is
-	// sent when users run command like "kubectl exec" or "kubectl attach".
-	HeaderAuditID = "Audit-ID"
-)
-
-// Level defines the amount of information logged during auditing
-type Level string
-
-// Valid audit levels
-const (
-	// LevelNone disables auditing
-	LevelNone Level = "None"
-	// LevelMetadata provides the basic level of auditing.
-	LevelMetadata Level = "Metadata"
-	// LevelRequest provides Metadata level of auditing, and additionally
-	// logs the request object (does not apply for non-resource requests).
-	LevelRequest Level = "Request"
-	// LevelRequestResponse provides Request level of auditing, and additionally
-	// logs the response object (does not apply for non-resource requests).
-	LevelRequestResponse Level = "RequestResponse"
-)
-
-// Stage defines the stages in request handling that audit events may be generated.
-type Stage string
-
-// Valid audit stages.
-const (
-	// The stage for events generated as soon as the audit handler receives the request, and before it
-	// is delegated down the handler chain.
-	StageRequestReceived Stage = "RequestReceived"
-	// The stage for events generated once the response headers are sent, but before the response body
-	// is sent. This stage is only generated for long-running requests (e.g. watch).
-	StageResponseStarted Stage = "ResponseStarted"
-	// The stage for events generated once the response body has been completed, and no more bytes
-	// will be sent.
-	StageResponseComplete Stage = "ResponseComplete"
-	// The stage for events generated when a panic occurred.
-	StagePanic Stage = "Panic"
-)
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.7
-// +k8s:prerelease-lifecycle-gen:deprecated=1.21
-// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,Event
-
-// DEPRECATED - This group version of Event is deprecated by audit.k8s.io/v1/Event. See the release notes for
-// more information.
-// Event captures all the information that can be included in an API audit log.
-type Event struct {
-	metav1.TypeMeta `json:",inline"`
-	// ObjectMeta is included for interoperability with API infrastructure.
-	// +optional
-	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	// AuditLevel at which event was generated
-	Level Level `json:"level" protobuf:"bytes,2,opt,name=level,casttype=Level"`
-
-	// Time the request reached the apiserver.
-	Timestamp metav1.Time `json:"timestamp" protobuf:"bytes,3,opt,name=timestamp"`
-	// Unique audit ID, generated for each request.
-	AuditID types.UID `json:"auditID" protobuf:"bytes,4,opt,name=auditID,casttype=k8s.io/apimachinery/pkg/types.UID"`
-	// Stage of the request handling when this event instance was generated.
-	Stage Stage `json:"stage" protobuf:"bytes,5,opt,name=stage,casttype=Stage"`
-
-	// RequestURI is the request URI as sent by the client to a server.
-	RequestURI string `json:"requestURI" protobuf:"bytes,6,opt,name=requestURI"`
-	// Verb is the kubernetes verb associated with the request.
-	// For non-resource requests, this is the lower-cased HTTP method.
-	Verb string `json:"verb" protobuf:"bytes,7,opt,name=verb"`
-	// Authenticated user information.
-	User authnv1.UserInfo `json:"user" protobuf:"bytes,8,opt,name=user"`
-	// Impersonated user information.
-	// +optional
-	ImpersonatedUser *authnv1.UserInfo `json:"impersonatedUser,omitempty" protobuf:"bytes,9,opt,name=impersonatedUser"`
-	// Source IPs, from where the request originated and intermediate proxies.
-	// +optional
-	SourceIPs []string `json:"sourceIPs,omitempty" protobuf:"bytes,10,rep,name=sourceIPs"`
-	// UserAgent records the user agent string reported by the client.
-	// Note that the UserAgent is provided by the client, and must not be trusted.
-	// +optional
-	UserAgent string `json:"userAgent,omitempty" protobuf:"bytes,18,opt,name=userAgent"`
-	// Object reference this request is targeted at.
-	// Does not apply for List-type requests, or non-resource requests.
-	// +optional
-	ObjectRef *ObjectReference `json:"objectRef,omitempty" protobuf:"bytes,11,opt,name=objectRef"`
-	// The response status, populated even when the ResponseObject is not a Status type.
-	// For successful responses, this will only include the Code and StatusSuccess.
-	// For non-status type error responses, this will be auto-populated with the error Message.
-	// +optional
-	ResponseStatus *metav1.Status `json:"responseStatus,omitempty" protobuf:"bytes,12,opt,name=responseStatus"`
-
-	// API object from the request, in JSON format. The RequestObject is recorded as-is in the request
-	// (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
-	// merging. It is an external versioned object type, and may not be a valid object on its own.
-	// Omitted for non-resource requests.  Only logged at Request Level and higher.
-	// +optional
-	RequestObject *runtime.Unknown `json:"requestObject,omitempty" protobuf:"bytes,13,opt,name=requestObject"`
-	// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
-	// to the external type, and serialized as JSON.  Omitted for non-resource requests.  Only logged
-	// at Response Level.
-	// +optional
-	ResponseObject *runtime.Unknown `json:"responseObject,omitempty" protobuf:"bytes,14,opt,name=responseObject"`
-	// Time the request reached the apiserver.
-	// +optional
-	RequestReceivedTimestamp metav1.MicroTime `json:"requestReceivedTimestamp" protobuf:"bytes,15,opt,name=requestReceivedTimestamp"`
-	// Time the request reached current audit stage.
-	// +optional
-	StageTimestamp metav1.MicroTime `json:"stageTimestamp" protobuf:"bytes,16,opt,name=stageTimestamp"`
-
-	// Annotations is an unstructured key value map stored with an audit event that may be set by
-	// plugins invoked in the request serving chain, including authentication, authorization and
-	// admission plugins. Note that these annotations are for the audit event, and do not correspond
-	// to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
-	// component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
-	// should be short. Annotations are included in the Metadata level.
-	// +optional
-	Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,17,rep,name=annotations"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.7
-// +k8s:prerelease-lifecycle-gen:deprecated=1.21
-// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,EventList
-
-// EventList is a list of audit Events.
-type EventList struct {
-	metav1.TypeMeta `json:",inline"`
-	// +optional
-	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	Items []Event `json:"items" protobuf:"bytes,2,rep,name=items"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.7
-// +k8s:prerelease-lifecycle-gen:deprecated=1.21
-// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,Policy
-
-// DEPRECATED - This group version of Policy is deprecated by audit.k8s.io/v1/Policy. See the release notes for
-// more information.
-// Policy defines the configuration of audit logging, and the rules for how different request
-// categories are logged.
-type Policy struct {
-	metav1.TypeMeta `json:",inline"`
-	// ObjectMeta is included for interoperability with API infrastructure.
-	// +optional
-	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	// Rules specify the audit Level a request should be recorded at.
-	// A request may match multiple rules, in which case the FIRST matching rule is used.
-	// The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
-	// PolicyRules are strictly ordered.
-	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
-
-	// OmitStages is a list of stages for which no events are created. Note that this can also
-	// be specified per rule in which case the union of both are omitted.
-	// +optional
-	OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,3,rep,name=omitStages"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.7
-// +k8s:prerelease-lifecycle-gen:deprecated=1.21
-// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,PolicyList
-
-// PolicyList is a list of audit Policies.
-type PolicyList struct {
-	metav1.TypeMeta `json:",inline"`
-	// +optional
-	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	Items []Policy `json:"items" protobuf:"bytes,2,rep,name=items"`
-}
-
-// PolicyRule maps requests based off metadata to an audit Level.
-// Requests must match the rules of every field (an intersection of rules).
-type PolicyRule struct {
-	// The Level that requests matching this rule are recorded at.
-	Level Level `json:"level" protobuf:"bytes,1,opt,name=level,casttype=Level"`
-
-	// The users (by authenticated user name) this rule applies to.
-	// An empty list implies every user.
-	// +optional
-	Users []string `json:"users,omitempty" protobuf:"bytes,2,rep,name=users"`
-	// The user groups this rule applies to. A user is considered matching
-	// if it is a member of any of the UserGroups.
-	// An empty list implies every user group.
-	// +optional
-	UserGroups []string `json:"userGroups,omitempty" protobuf:"bytes,3,rep,name=userGroups"`
-
-	// The verbs that match this rule.
-	// An empty list implies every verb.
-	// +optional
-	Verbs []string `json:"verbs,omitempty" protobuf:"bytes,4,rep,name=verbs"`
-
-	// Rules can apply to API resources (such as "pods" or "secrets"),
-	// non-resource URL paths (such as "/api"), or neither, but not both.
-	// If neither is specified, the rule is treated as a default for all URLs.
-
-	// Resources that this rule matches. An empty list implies all kinds in all API groups.
-	// +optional
-	Resources []GroupResources `json:"resources,omitempty" protobuf:"bytes,5,rep,name=resources"`
-	// Namespaces that this rule matches.
-	// The empty string "" matches non-namespaced resources.
-	// An empty list implies every namespace.
-	// +optional
-	Namespaces []string `json:"namespaces,omitempty" protobuf:"bytes,6,rep,name=namespaces"`
-
-	// NonResourceURLs is a set of URL paths that should be audited.
-	// *s are allowed, but only as the full, final step in the path.
-	// Examples:
-	//  "/metrics" - Log requests for apiserver metrics
-	//  "/healthz*" - Log all health checks
-	// +optional
-	NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,7,rep,name=nonResourceURLs"`
-
-	// OmitStages is a list of stages for which no events are created. Note that this can also
-	// be specified policy wide in which case the union of both are omitted.
-	// An empty list means no restrictions will apply.
-	// +optional
-	OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,8,rep,name=omitStages"`
-}
-
-// GroupResources represents resource kinds in an API group.
-type GroupResources struct {
-	// Group is the name of the API group that contains the resources.
-	// The empty string represents the core API group.
-	// +optional
-	Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
-	// Resources is a list of resources this rule applies to.
-	//
-	// For example:
-	// 'pods' matches pods.
-	// 'pods/log' matches the log subresource of pods.
-	// '*' matches all resources and their subresources.
-	// 'pods/*' matches all subresources of pods.
-	// '*/scale' matches all scale subresources.
-	//
-	// If wildcard is present, the validation rule will ensure resources do not
-	// overlap with each other.
-	//
-	// An empty list implies all resources and subresources in this API groups apply.
-	// +optional
-	Resources []string `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
-	// ResourceNames is a list of resource instance names that the policy matches.
-	// Using this field requires Resources to be specified.
-	// An empty list implies that every instance of the resource is matched.
-	// +optional
-	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,3,rep,name=resourceNames"`
-}
-
-// ObjectReference contains enough information to let you inspect or modify the referred object.
-type ObjectReference struct {
-	// +optional
-	Resource string `json:"resource,omitempty" protobuf:"bytes,1,opt,name=resource"`
-	// +optional
-	Namespace string `json:"namespace,omitempty" protobuf:"bytes,2,opt,name=namespace"`
-	// +optional
-	Name string `json:"name,omitempty" protobuf:"bytes,3,opt,name=name"`
-	// +optional
-	UID types.UID `json:"uid,omitempty" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
-	// +optional
-	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,5,opt,name=apiVersion"`
-	// +optional
-	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,6,opt,name=resourceVersion"`
-	// +optional
-	Subresource string `json:"subresource,omitempty" protobuf:"bytes,7,opt,name=subresource"`
-}

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/zz_generated.conversion.go

@@ -1,339 +0,0 @@
-// +build !ignore_autogenerated
-
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by conversion-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	unsafe "unsafe"
-
-	v1 "k8s.io/api/authentication/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	conversion "k8s.io/apimachinery/pkg/conversion"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	types "k8s.io/apimachinery/pkg/types"
-	audit "k8s.io/apiserver/pkg/apis/audit"
-)
-
-func init() {
-	localSchemeBuilder.Register(RegisterConversions)
-}
-
-// RegisterConversions adds conversion functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterConversions(s *runtime.Scheme) error {
-	if err := s.AddGeneratedConversionFunc((*EventList)(nil), (*audit.EventList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_EventList_To_audit_EventList(a.(*EventList), b.(*audit.EventList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*audit.EventList)(nil), (*EventList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_EventList_To_v1alpha1_EventList(a.(*audit.EventList), b.(*EventList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*GroupResources)(nil), (*audit.GroupResources)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_GroupResources_To_audit_GroupResources(a.(*GroupResources), b.(*audit.GroupResources), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*audit.GroupResources)(nil), (*GroupResources)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_GroupResources_To_v1alpha1_GroupResources(a.(*audit.GroupResources), b.(*GroupResources), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*Policy)(nil), (*audit.Policy)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_Policy_To_audit_Policy(a.(*Policy), b.(*audit.Policy), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*audit.Policy)(nil), (*Policy)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_Policy_To_v1alpha1_Policy(a.(*audit.Policy), b.(*Policy), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*PolicyList)(nil), (*audit.PolicyList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_PolicyList_To_audit_PolicyList(a.(*PolicyList), b.(*audit.PolicyList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*audit.PolicyList)(nil), (*PolicyList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_PolicyList_To_v1alpha1_PolicyList(a.(*audit.PolicyList), b.(*PolicyList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*PolicyRule)(nil), (*audit.PolicyRule)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_PolicyRule_To_audit_PolicyRule(a.(*PolicyRule), b.(*audit.PolicyRule), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*audit.PolicyRule)(nil), (*PolicyRule)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_PolicyRule_To_v1alpha1_PolicyRule(a.(*audit.PolicyRule), b.(*PolicyRule), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddConversionFunc((*audit.Event)(nil), (*Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_Event_To_v1alpha1_Event(a.(*audit.Event), b.(*Event), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddConversionFunc((*audit.ObjectReference)(nil), (*ObjectReference)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_audit_ObjectReference_To_v1alpha1_ObjectReference(a.(*audit.ObjectReference), b.(*ObjectReference), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddConversionFunc((*Event)(nil), (*audit.Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_Event_To_audit_Event(a.(*Event), b.(*audit.Event), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddConversionFunc((*ObjectReference)(nil), (*audit.ObjectReference)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(a.(*ObjectReference), b.(*audit.ObjectReference), scope)
-	}); err != nil {
-		return err
-	}
-	return nil
-}
-
-func autoConvert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
-	// WARNING: in.ObjectMeta requires manual conversion: does not exist in peer-type
-	out.Level = audit.Level(in.Level)
-	// WARNING: in.Timestamp requires manual conversion: does not exist in peer-type
-	out.AuditID = types.UID(in.AuditID)
-	out.Stage = audit.Stage(in.Stage)
-	out.RequestURI = in.RequestURI
-	out.Verb = in.Verb
-	out.User = in.User
-	out.ImpersonatedUser = (*v1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
-	out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
-	out.UserAgent = in.UserAgent
-	if in.ObjectRef != nil {
-		in, out := &in.ObjectRef, &out.ObjectRef
-		*out = new(audit.ObjectReference)
-		if err := Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(*in, *out, s); err != nil {
-			return err
-		}
-	} else {
-		out.ObjectRef = nil
-	}
-	out.ResponseStatus = (*metav1.Status)(unsafe.Pointer(in.ResponseStatus))
-	out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
-	out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
-	out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
-	out.StageTimestamp = in.StageTimestamp
-	out.Annotations = *(*map[string]string)(unsafe.Pointer(&in.Annotations))
-	return nil
-}
-
-func autoConvert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
-	out.Level = Level(in.Level)
-	out.AuditID = types.UID(in.AuditID)
-	out.Stage = Stage(in.Stage)
-	out.RequestURI = in.RequestURI
-	out.Verb = in.Verb
-	out.User = in.User
-	out.ImpersonatedUser = (*v1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
-	out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
-	out.UserAgent = in.UserAgent
-	if in.ObjectRef != nil {
-		in, out := &in.ObjectRef, &out.ObjectRef
-		*out = new(ObjectReference)
-		if err := Convert_audit_ObjectReference_To_v1alpha1_ObjectReference(*in, *out, s); err != nil {
-			return err
-		}
-	} else {
-		out.ObjectRef = nil
-	}
-	out.ResponseStatus = (*metav1.Status)(unsafe.Pointer(in.ResponseStatus))
-	out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
-	out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
-	out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
-	out.StageTimestamp = in.StageTimestamp
-	out.Annotations = *(*map[string]string)(unsafe.Pointer(&in.Annotations))
-	return nil
-}
-
-func autoConvert_v1alpha1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]audit.Event, len(*in))
-		for i := range *in {
-			if err := Convert_v1alpha1_Event_To_audit_Event(&(*in)[i], &(*out)[i], s); err != nil {
-				return err
-			}
-		}
-	} else {
-		out.Items = nil
-	}
-	return nil
-}
-
-// Convert_v1alpha1_EventList_To_audit_EventList is an autogenerated conversion function.
-func Convert_v1alpha1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
-	return autoConvert_v1alpha1_EventList_To_audit_EventList(in, out, s)
-}
-
-func autoConvert_audit_EventList_To_v1alpha1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Event, len(*in))
-		for i := range *in {
-			if err := Convert_audit_Event_To_v1alpha1_Event(&(*in)[i], &(*out)[i], s); err != nil {
-				return err
-			}
-		}
-	} else {
-		out.Items = nil
-	}
-	return nil
-}
-
-// Convert_audit_EventList_To_v1alpha1_EventList is an autogenerated conversion function.
-func Convert_audit_EventList_To_v1alpha1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
-	return autoConvert_audit_EventList_To_v1alpha1_EventList(in, out, s)
-}
-
-func autoConvert_v1alpha1_GroupResources_To_audit_GroupResources(in *GroupResources, out *audit.GroupResources, s conversion.Scope) error {
-	out.Group = in.Group
-	out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
-	out.ResourceNames = *(*[]string)(unsafe.Pointer(&in.ResourceNames))
-	return nil
-}
-
-// Convert_v1alpha1_GroupResources_To_audit_GroupResources is an autogenerated conversion function.
-func Convert_v1alpha1_GroupResources_To_audit_GroupResources(in *GroupResources, out *audit.GroupResources, s conversion.Scope) error {
-	return autoConvert_v1alpha1_GroupResources_To_audit_GroupResources(in, out, s)
-}
-
-func autoConvert_audit_GroupResources_To_v1alpha1_GroupResources(in *audit.GroupResources, out *GroupResources, s conversion.Scope) error {
-	out.Group = in.Group
-	out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
-	out.ResourceNames = *(*[]string)(unsafe.Pointer(&in.ResourceNames))
-	return nil
-}
-
-// Convert_audit_GroupResources_To_v1alpha1_GroupResources is an autogenerated conversion function.
-func Convert_audit_GroupResources_To_v1alpha1_GroupResources(in *audit.GroupResources, out *GroupResources, s conversion.Scope) error {
-	return autoConvert_audit_GroupResources_To_v1alpha1_GroupResources(in, out, s)
-}
-
-func autoConvert_v1alpha1_ObjectReference_To_audit_ObjectReference(in *ObjectReference, out *audit.ObjectReference, s conversion.Scope) error {
-	out.Resource = in.Resource
-	out.Namespace = in.Namespace
-	out.Name = in.Name
-	out.UID = types.UID(in.UID)
-	out.APIVersion = in.APIVersion
-	out.ResourceVersion = in.ResourceVersion
-	out.Subresource = in.Subresource
-	return nil
-}
-
-func autoConvert_audit_ObjectReference_To_v1alpha1_ObjectReference(in *audit.ObjectReference, out *ObjectReference, s conversion.Scope) error {
-	out.Resource = in.Resource
-	out.Namespace = in.Namespace
-	out.Name = in.Name
-	out.UID = types.UID(in.UID)
-	// WARNING: in.APIGroup requires manual conversion: does not exist in peer-type
-	out.APIVersion = in.APIVersion
-	out.ResourceVersion = in.ResourceVersion
-	out.Subresource = in.Subresource
-	return nil
-}
-
-func autoConvert_v1alpha1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
-	out.Rules = *(*[]audit.PolicyRule)(unsafe.Pointer(&in.Rules))
-	out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
-	return nil
-}
-
-// Convert_v1alpha1_Policy_To_audit_Policy is an autogenerated conversion function.
-func Convert_v1alpha1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conversion.Scope) error {
-	return autoConvert_v1alpha1_Policy_To_audit_Policy(in, out, s)
-}
-
-func autoConvert_audit_Policy_To_v1alpha1_Policy(in *audit.Policy, out *Policy, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
-	out.Rules = *(*[]PolicyRule)(unsafe.Pointer(&in.Rules))
-	out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
-	return nil
-}
-
-// Convert_audit_Policy_To_v1alpha1_Policy is an autogenerated conversion function.
-func Convert_audit_Policy_To_v1alpha1_Policy(in *audit.Policy, out *Policy, s conversion.Scope) error {
-	return autoConvert_audit_Policy_To_v1alpha1_Policy(in, out, s)
-}
-
-func autoConvert_v1alpha1_PolicyList_To_audit_PolicyList(in *PolicyList, out *audit.PolicyList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	out.Items = *(*[]audit.Policy)(unsafe.Pointer(&in.Items))
-	return nil
-}
-
-// Convert_v1alpha1_PolicyList_To_audit_PolicyList is an autogenerated conversion function.
-func Convert_v1alpha1_PolicyList_To_audit_PolicyList(in *PolicyList, out *audit.PolicyList, s conversion.Scope) error {
-	return autoConvert_v1alpha1_PolicyList_To_audit_PolicyList(in, out, s)
-}
-
-func autoConvert_audit_PolicyList_To_v1alpha1_PolicyList(in *audit.PolicyList, out *PolicyList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	out.Items = *(*[]Policy)(unsafe.Pointer(&in.Items))
-	return nil
-}
-
-// Convert_audit_PolicyList_To_v1alpha1_PolicyList is an autogenerated conversion function.
-func Convert_audit_PolicyList_To_v1alpha1_PolicyList(in *audit.PolicyList, out *PolicyList, s conversion.Scope) error {
-	return autoConvert_audit_PolicyList_To_v1alpha1_PolicyList(in, out, s)
-}
-
-func autoConvert_v1alpha1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.PolicyRule, s conversion.Scope) error {
-	out.Level = audit.Level(in.Level)
-	out.Users = *(*[]string)(unsafe.Pointer(&in.Users))
-	out.UserGroups = *(*[]string)(unsafe.Pointer(&in.UserGroups))
-	out.Verbs = *(*[]string)(unsafe.Pointer(&in.Verbs))
-	out.Resources = *(*[]audit.GroupResources)(unsafe.Pointer(&in.Resources))
-	out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
-	out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
-	out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
-	return nil
-}
-
-// Convert_v1alpha1_PolicyRule_To_audit_PolicyRule is an autogenerated conversion function.
-func Convert_v1alpha1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.PolicyRule, s conversion.Scope) error {
-	return autoConvert_v1alpha1_PolicyRule_To_audit_PolicyRule(in, out, s)
-}
-
-func autoConvert_audit_PolicyRule_To_v1alpha1_PolicyRule(in *audit.PolicyRule, out *PolicyRule, s conversion.Scope) error {
-	out.Level = Level(in.Level)
-	out.Users = *(*[]string)(unsafe.Pointer(&in.Users))
-	out.UserGroups = *(*[]string)(unsafe.Pointer(&in.UserGroups))
-	out.Verbs = *(*[]string)(unsafe.Pointer(&in.Verbs))
-	out.Resources = *(*[]GroupResources)(unsafe.Pointer(&in.Resources))
-	out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
-	out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
-	out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
-	return nil
-}
-
-// Convert_audit_PolicyRule_To_v1alpha1_PolicyRule is an autogenerated conversion function.
-func Convert_audit_PolicyRule_To_v1alpha1_PolicyRule(in *audit.PolicyRule, out *PolicyRule, s conversion.Scope) error {
-	return autoConvert_audit_PolicyRule_To_v1alpha1_PolicyRule(in, out, s)
-}

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/zz_generated.deepcopy.go

@@ -1,293 +0,0 @@
-// +build !ignore_autogenerated
-
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by deepcopy-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1 "k8s.io/api/authentication/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Event) DeepCopyInto(out *Event) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Timestamp.DeepCopyInto(&out.Timestamp)
-	in.User.DeepCopyInto(&out.User)
-	if in.ImpersonatedUser != nil {
-		in, out := &in.ImpersonatedUser, &out.ImpersonatedUser
-		*out = new(v1.UserInfo)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.SourceIPs != nil {
-		in, out := &in.SourceIPs, &out.SourceIPs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.ObjectRef != nil {
-		in, out := &in.ObjectRef, &out.ObjectRef
-		*out = new(ObjectReference)
-		**out = **in
-	}
-	if in.ResponseStatus != nil {
-		in, out := &in.ResponseStatus, &out.ResponseStatus
-		*out = new(metav1.Status)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.RequestObject != nil {
-		in, out := &in.RequestObject, &out.RequestObject
-		*out = new(runtime.Unknown)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ResponseObject != nil {
-		in, out := &in.ResponseObject, &out.ResponseObject
-		*out = new(runtime.Unknown)
-		(*in).DeepCopyInto(*out)
-	}
-	in.RequestReceivedTimestamp.DeepCopyInto(&out.RequestReceivedTimestamp)
-	in.StageTimestamp.DeepCopyInto(&out.StageTimestamp)
-	if in.Annotations != nil {
-		in, out := &in.Annotations, &out.Annotations
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Event.
-func (in *Event) DeepCopy() *Event {
-	if in == nil {
-		return nil
-	}
-	out := new(Event)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Event) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *EventList) DeepCopyInto(out *EventList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Event, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EventList.
-func (in *EventList) DeepCopy() *EventList {
-	if in == nil {
-		return nil
-	}
-	out := new(EventList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *EventList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GroupResources) DeepCopyInto(out *GroupResources) {
-	*out = *in
-	if in.Resources != nil {
-		in, out := &in.Resources, &out.Resources
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.ResourceNames != nil {
-		in, out := &in.ResourceNames, &out.ResourceNames
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupResources.
-func (in *GroupResources) DeepCopy() *GroupResources {
-	if in == nil {
-		return nil
-	}
-	out := new(GroupResources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ObjectReference) DeepCopyInto(out *ObjectReference) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectReference.
-func (in *ObjectReference) DeepCopy() *ObjectReference {
-	if in == nil {
-		return nil
-	}
-	out := new(ObjectReference)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Policy) DeepCopyInto(out *Policy) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	if in.Rules != nil {
-		in, out := &in.Rules, &out.Rules
-		*out = make([]PolicyRule, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.OmitStages != nil {
-		in, out := &in.OmitStages, &out.OmitStages
-		*out = make([]Stage, len(*in))
-		copy(*out, *in)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Policy.
-func (in *Policy) DeepCopy() *Policy {
-	if in == nil {
-		return nil
-	}
-	out := new(Policy)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Policy) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PolicyList) DeepCopyInto(out *PolicyList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Policy, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyList.
-func (in *PolicyList) DeepCopy() *PolicyList {
-	if in == nil {
-		return nil
-	}
-	out := new(PolicyList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PolicyList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PolicyRule) DeepCopyInto(out *PolicyRule) {
-	*out = *in
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.UserGroups != nil {
-		in, out := &in.UserGroups, &out.UserGroups
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Verbs != nil {
-		in, out := &in.Verbs, &out.Verbs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Resources != nil {
-		in, out := &in.Resources, &out.Resources
-		*out = make([]GroupResources, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.Namespaces != nil {
-		in, out := &in.Namespaces, &out.Namespaces
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.NonResourceURLs != nil {
-		in, out := &in.NonResourceURLs, &out.NonResourceURLs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.OmitStages != nil {
-		in, out := &in.OmitStages, &out.OmitStages
-		*out = make([]Stage, len(*in))
-		copy(*out, *in)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRule.
-func (in *PolicyRule) DeepCopy() *PolicyRule {
-	if in == nil {
-		return nil
-	}
-	out := new(PolicyRule)
-	in.DeepCopyInto(out)
-	return out
-}