@@ -97,7 +97,7 @@ func secretReferencesToGRPC(sr []*types.SecretReference) []*swarmapi.SecretRefer

 		}

 		if s.File != nil {

 			ref.Target = &swarmapi.SecretReference_File{

-				File: &swarmapi.SecretReference_FileTarget{

+				File: &swarmapi.FileTarget{

 					Name: s.File.Name,

 					UID:  s.File.UID,

 					GID:  s.File.GID,

@@ -105,7 +105,7 @@ github.com/docker/containerd 9048e5e50717ea4497b757314bad98ea3763c145

 github.com/tonistiigi/fifo 1405643975692217d6720f8b54aeee1bf2cd5cf4

 # cluster

-github.com/docker/swarmkit b74ec2b81bb1d4a998f461bb2dc59b9408b7790f

+github.com/docker/swarmkit d2e48a332063ccd4ea26b6262ee717de997de560

 github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9

 github.com/gogo/protobuf 8d70fb3182befc465c4a1eac8ad4d38ff49778e2

 github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a

@@ -1,6 +1,7 @@

 package agent

 import (

+	"bytes"

 	"fmt"

 	"math/rand"

 	"reflect"

@@ -44,6 +45,8 @@ type Agent struct {

 	stopOnce  sync.Once     // only allow stop to be called once

 	closed    chan struct{} // only closed in run

 	err       error         // read only after closed is closed

+

+	nodeUpdatePeriod time.Duration

 }

 // New returns a new agent, ready for task dispatch.

@@ -53,14 +56,15 @@ func New(config *Config) (*Agent, error) {

 	}

 	a := &Agent{

-		config:   config,

-		sessionq: make(chan sessionOperation),

-		started:  make(chan struct{}),

-		leaving:  make(chan struct{}),

-		left:     make(chan struct{}),

-		stopped:  make(chan struct{}),

-		closed:   make(chan struct{}),

-		ready:    make(chan struct{}),

+		config:           config,

+		sessionq:         make(chan sessionOperation),

+		started:          make(chan struct{}),

+		leaving:          make(chan struct{}),

+		left:             make(chan struct{}),

+		stopped:          make(chan struct{}),

+		closed:           make(chan struct{}),

+		ready:            make(chan struct{}),

+		nodeUpdatePeriod: nodeUpdatePeriod,

 	}

 	a.worker = newWorker(config.DB, config.Executor, a)

@@ -182,13 +186,15 @@ func (a *Agent) run(ctx context.Context) {

 	log.G(ctx).Debug("(*Agent).run")

 	defer log.G(ctx).Debug("(*Agent).run exited")

+	nodeTLSInfo := a.config.NodeTLSInfo

+

 	// get the node description

-	nodeDescription, err := a.nodeDescriptionWithHostname(ctx)

+	nodeDescription, err := a.nodeDescriptionWithHostname(ctx, nodeTLSInfo)

 	if err != nil {

 		log.G(ctx).WithError(err).WithField("agent", a.config.Executor).Error("agent: node description unavailable")

 	}

 	// nodeUpdateTicker is used to periodically check for updates to node description

-	nodeUpdateTicker := time.NewTicker(nodeUpdatePeriod)

+	nodeUpdateTicker := time.NewTicker(a.nodeUpdatePeriod)

 	defer nodeUpdateTicker.Stop()

 	var (

@@ -214,6 +220,35 @@ func (a *Agent) run(ctx context.Context) {

 	a.worker.Listen(ctx, reporter)

+	updateNode := func() {

+		// skip updating if the registration isn't finished

+		if registered != nil {

+			return

+		}

+		// get the current node description

+		newNodeDescription, err := a.nodeDescriptionWithHostname(ctx, nodeTLSInfo)

+		if err != nil {

+			log.G(ctx).WithError(err).WithField("agent", a.config.Executor).Error("agent: updated node description unavailable")

+		}

+

+		// if newNodeDescription is nil, it will cause a panic when

+		// trying to create a session. Typically this can happen

+		// if the engine goes down

+		if newNodeDescription == nil {

+			return

+		}

+

+		// if the node description has changed, update it to the new one

+		// and close the session. The old session will be stopped and a

+		// new one will be created with the updated description

+		if !reflect.DeepEqual(nodeDescription, newNodeDescription) {

+			nodeDescription = newNodeDescription

+			// close the session

+			log.G(ctx).Info("agent: found node update")

+			session.sendError(nil)

+		}

+	}

+

 	for {

 		select {

 		case operation := <-sessionq:

@@ -237,7 +272,8 @@ func (a *Agent) run(ctx context.Context) {

 			switch msg.Type {

 			case api.AssignmentsMessage_COMPLETE:

-				// Need to assign secrets before tasks, because tasks might depend on new secrets

+				// Need to assign secrets and configs before tasks,

+				// because tasks might depend on new secrets or configs

 				if err := a.worker.Assign(ctx, msg.Changes); err != nil {

 					log.G(ctx).WithError(err).Error("failed to synchronize worker assignments")

 				}

@@ -247,7 +283,7 @@ func (a *Agent) run(ctx context.Context) {

 				}

 			}

 		case msg := <-session.messages:

-			if err := a.handleSessionMessage(ctx, msg); err != nil {

+			if err := a.handleSessionMessage(ctx, msg, nodeTLSInfo); err != nil {

 				log.G(ctx).WithError(err).Error("session message handler failed")

 			}

 		case sub := <-session.subscriptions:

@@ -305,33 +341,17 @@ func (a *Agent) run(ctx context.Context) {

 			}

 			session = newSession(ctx, a, delay, session.sessionID, nodeDescription)

 			registered = session.registered

-		case <-nodeUpdateTicker.C:

-			// skip this case if the registration isn't finished

-			if registered != nil {

-				continue

-			}

-			// get the current node description

-			newNodeDescription, err := a.nodeDescriptionWithHostname(ctx)

-			if err != nil {

-				log.G(ctx).WithError(err).WithField("agent", a.config.Executor).Error("agent: updated node description unavailable")

-			}

-

-			// if newNodeDescription is nil, it will cause a panic when

-			// trying to create a session. Typically this can happen

-			// if the engine goes down

-			if newNodeDescription == nil {

-				continue

-			}

-

-			// if the node description has changed, update it to the new one

-			// and close the session. The old session will be stopped and a

-			// new one will be created with the updated description

-			if !reflect.DeepEqual(nodeDescription, newNodeDescription) {

-				nodeDescription = newNodeDescription

-				// close the session

-				log.G(ctx).Info("agent: found node update")

-				session.sendError(nil)

+		case ev := <-a.config.NotifyTLSChange:

+			// the TLS info has changed, so force a check to see if we need to restart the session

+			if tlsInfo, ok := ev.(*api.NodeTLSInfo); ok {

+				nodeTLSInfo = tlsInfo

+				updateNode()

+				nodeUpdateTicker.Stop()

+				nodeUpdateTicker = time.NewTicker(a.nodeUpdatePeriod)

 			}

+		case <-nodeUpdateTicker.C:

+			// periodically check to see whether the node information has changed, and if so, restart the session

+			updateNode()

 		case <-a.stopped:

 			// TODO(stevvooe): Wait on shutdown and cleanup. May need to pump

 			// this loop a few times.

@@ -347,7 +367,7 @@ func (a *Agent) run(ctx context.Context) {

 	}

 }

-func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMessage) error {

+func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMessage, nti *api.NodeTLSInfo) error {

 	seen := map[api.Peer]struct{}{}

 	for _, manager := range message.Managers {

 		if manager.Peer.Addr == "" {

@@ -358,18 +378,28 @@ func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMe

 		seen[*manager.Peer] = struct{}{}

 	}

-	if message.Node != nil {

-		if a.node == nil || !nodesEqual(a.node, message.Node) {

-			if a.config.NotifyNodeChange != nil {

-				a.config.NotifyNodeChange <- message.Node.Copy()

-			}

-			a.node = message.Node.Copy()

-			if err := a.config.Executor.Configure(ctx, a.node); err != nil {

-				log.G(ctx).WithError(err).Error("node configure failed")

-			}

+	var changes *NodeChanges

+	if message.Node != nil && (a.node == nil || !nodesEqual(a.node, message.Node)) {

+		if a.config.NotifyNodeChange != nil {

+			changes = &NodeChanges{Node: message.Node.Copy()}

+		}

+		a.node = message.Node.Copy()

+		if err := a.config.Executor.Configure(ctx, a.node); err != nil {

+			log.G(ctx).WithError(err).Error("node configure failed")

+		}

+	}

+	if len(message.RootCA) > 0 && !bytes.Equal(message.RootCA, nti.TrustRoot) {

+		if changes == nil {

+			changes = &NodeChanges{RootCert: message.RootCA}

+		} else {

+			changes.RootCert = message.RootCA

 		}

 	}

+	if changes != nil {

+		a.config.NotifyNodeChange <- changes

+	}

+

 	// prune managers not in list.

 	for peer := range a.config.ConnBroker.Remotes().Weights() {

 		if _, ok := seen[peer]; !ok {

@@ -517,12 +547,15 @@ func (a *Agent) Publisher(ctx context.Context, subscriptionID string) (exec.LogP

 }

 // nodeDescriptionWithHostname retrieves node description, and overrides hostname if available

-func (a *Agent) nodeDescriptionWithHostname(ctx context.Context) (*api.NodeDescription, error) {

+func (a *Agent) nodeDescriptionWithHostname(ctx context.Context, tlsInfo *api.NodeTLSInfo) (*api.NodeDescription, error) {

 	desc, err := a.config.Executor.Describe(ctx)

-	// Override hostname

-	if a.config.Hostname != "" && desc != nil {

-		desc.Hostname = a.config.Hostname

+	// Override hostname and TLS info

+	if desc != nil {

+		if a.config.Hostname != "" && desc != nil {

+			desc.Hostname = a.config.Hostname

+		}

+		desc.TLSInfo = tlsInfo

 	}

 	return desc, err

 }

@@ -2,6 +2,7 @@ package agent

 import (

 	"github.com/boltdb/bolt"

+	"github.com/docker/go-events"

 	"github.com/docker/swarmkit/agent/exec"

 	"github.com/docker/swarmkit/api"

 	"github.com/docker/swarmkit/connectionbroker"

@@ -9,6 +10,13 @@ import (

 	"google.golang.org/grpc/credentials"

 )

+// NodeChanges encapsulates changes that should be made to the node as per session messages

+// from the dispatcher

+type NodeChanges struct {

+	Node     *api.Node

+	RootCert []byte

+}

+

 // Config provides values for an Agent.

 type Config struct {

 	// Hostname the name of host for agent instance.

@@ -25,10 +33,16 @@ type Config struct {

 	DB *bolt.DB

 	// NotifyNodeChange channel receives new node changes from session messages.

-	NotifyNodeChange chan<- *api.Node

+	NotifyNodeChange chan<- *NodeChanges

+

+	// NotifyTLSChange channel sends new TLS information changes, which can cause a session to restart

+	NotifyTLSChange <-chan events.Event

 	// Credentials is credentials for grpc connection to manager.

 	Credentials credentials.TransportCredentials

+

+	// NodeTLSInfo contains the starting node TLS info to bootstrap into the agent

+	NodeTLSInfo *api.NodeTLSInfo

 }

 func (c *Config) validate() error {

@@ -44,5 +58,9 @@ func (c *Config) validate() error {

 		return errors.New("agent: database required")

 	}

+	if c.NodeTLSInfo == nil {

+		return errors.New("agent: Node TLS info is required")

+	}

+

 	return nil

 }

new file mode 100644

@@ -0,0 +1,87 @@

+package configs

+

+import (

+	"sync"

+

+	"github.com/docker/swarmkit/agent/exec"

+	"github.com/docker/swarmkit/api"

+)

+

+// configs is a map that keeps all the currently available configs to the agent

+// mapped by config ID.

+type configs struct {

+	mu sync.RWMutex

+	m  map[string]*api.Config

+}

+

+// NewManager returns a place to store configs.

+func NewManager() exec.ConfigsManager {

+	return &configs{

+		m: make(map[string]*api.Config),

+	}

+}

+

+// Get returns a config by ID.  If the config doesn't exist, returns nil.

+func (r *configs) Get(configID string) *api.Config {

+	r.mu.RLock()

+	defer r.mu.RUnlock()

+	if r, ok := r.m[configID]; ok {

+		return r

+	}

+	return nil

+}

+

+// Add adds one or more configs to the config map.

+func (r *configs) Add(configs ...api.Config) {

+	r.mu.Lock()

+	defer r.mu.Unlock()

+	for _, config := range configs {

+		r.m[config.ID] = config.Copy()

+	}

+}

+

+// Remove removes one or more configs by ID from the config map. Succeeds

+// whether or not the given IDs are in the map.

+func (r *configs) Remove(configs []string) {

+	r.mu.Lock()

+	defer r.mu.Unlock()

+	for _, config := range configs {

+		delete(r.m, config)

+	}

+}

+

+// Reset removes all the configs.

+func (r *configs) Reset() {

+	r.mu.Lock()

+	defer r.mu.Unlock()

+	r.m = make(map[string]*api.Config)

+}

+

+// taskRestrictedConfigsProvider restricts the ids to the task.

+type taskRestrictedConfigsProvider struct {

+	configs   exec.ConfigGetter

+	configIDs map[string]struct{} // allow list of config ids

+}

+

+func (sp *taskRestrictedConfigsProvider) Get(configID string) *api.Config {

+	if _, ok := sp.configIDs[configID]; !ok {

+		return nil

+	}

+

+	return sp.configs.Get(configID)

+}

+

+// Restrict provides a getter that only allows access to the configs

+// referenced by the task.

+func Restrict(configs exec.ConfigGetter, t *api.Task) exec.ConfigGetter {

+	cids := map[string]struct{}{}

+

+	container := t.Spec.GetContainer()

+	if container != nil {

+		for _, configRef := range container.Configs {

+			cids[configRef.ConfigID] = struct{}{}

+		}

+	}

+

+	return &taskRestrictedConfigsProvider{configs: configs, configIDs: cids}

+}

new file mode 100644

@@ -0,0 +1,52 @@

+package agent

+

+import (

+	"github.com/docker/swarmkit/agent/configs"

+	"github.com/docker/swarmkit/agent/exec"

+	"github.com/docker/swarmkit/agent/secrets"

+	"github.com/docker/swarmkit/api"

+)

+

+type dependencyManager struct {

+	secrets exec.SecretsManager

+	configs exec.ConfigsManager

+}

+

+// NewDependencyManager creates a dependency manager object that wraps

+// objects which provide access to various dependency types.

+func NewDependencyManager() exec.DependencyManager {

+	return &dependencyManager{

+		secrets: secrets.NewManager(),

+		configs: configs.NewManager(),

+	}

+}

+

+func (d *dependencyManager) Secrets() exec.SecretsManager {

+	return d.secrets

+}

+

+func (d *dependencyManager) Configs() exec.ConfigsManager {

+	return d.configs

+}

+

+type dependencyGetter struct {

+	secrets exec.SecretGetter

+	configs exec.ConfigGetter

+}

+

+func (d *dependencyGetter) Secrets() exec.SecretGetter {

+	return d.secrets

+}

+

+func (d *dependencyGetter) Configs() exec.ConfigGetter {

+	return d.configs

+}

+

+// Restrict provides getters that only allows access to the dependencies

+// referenced by the task.

+func Restrict(dependencies exec.DependencyManager, t *api.Task) exec.DependencyGetter {

+	return &dependencyGetter{

+		secrets: secrets.Restrict(dependencies.Secrets(), t),

+		configs: configs.Restrict(dependencies.Configs(), t),

+	}

+}

@@ -28,6 +28,26 @@ type SecretsProvider interface {

 	Secrets() SecretsManager

 }

+// ConfigsProvider is implemented by objects that can store configs,

+// typically an executor.

+type ConfigsProvider interface {

+	Configs() ConfigsManager

+}

+

+// DependencyManager is a meta-object that can keep track of typed objects

+// such as secrets and configs.

+type DependencyManager interface {

+	SecretsProvider

+	ConfigsProvider

+}

+

+// DependencyGetter is a meta-object that can provide access to typed objects

+// such as secrets and configs.

+type DependencyGetter interface {

+	Secrets() SecretGetter

+	Configs() ConfigGetter

+}

+

 // SecretGetter contains secret data necessary for the Controller.

 type SecretGetter interface {

 	// Get returns the the secret with a specific secret ID, if available.

@@ -43,3 +63,19 @@ type SecretsManager interface {

 	Remove(secrets []string)   // remove the secrets by ID

 	Reset()                    // remove all secrets

 }

+

+// ConfigGetter contains config data necessary for the Controller.

+type ConfigGetter interface {

+	// Get returns the the config with a specific config ID, if available.

+	// When the config is not available, the return will be nil.

+	Get(configID string) *api.Config

+}

+

+// ConfigsManager is the interface for config storage and updates.

+type ConfigsManager interface {

+	ConfigGetter

+

+	Add(configs ...api.Config) // add one or more configs

+	Remove(configs []string)   // remove the configs by ID

+	Reset()                    // remove all configs

+}

@@ -23,12 +23,13 @@ type Worker interface {

 	// It is not safe to call any worker function after that.

 	Close()

-	// Assign assigns a complete set of tasks and secrets to a worker. Any task or secrets not included in

-	// this set will be removed.

+	// Assign assigns a complete set of tasks and configs/secrets to a

+	// worker. Any items not included in this set will be removed.

 	Assign(ctx context.Context, assignments []*api.AssignmentChange) error

-	// Updates updates an incremental set of tasks or secrets of the worker. Any task/secret not included

-	// either in added or removed will remain untouched.

+	// Updates updates an incremental set of tasks or configs/secrets of

+	// the worker. Any items not included either in added or removed will

+	// remain untouched.

 	Update(ctx context.Context, assignments []*api.AssignmentChange) error

 	// Listen to updates about tasks controlled by the worker. When first

@@ -119,11 +120,11 @@ func (w *worker) Close() {

 	w.taskevents.Close()

 }

-// Assign assigns a full set of tasks and secrets to the worker.

+// Assign assigns a full set of tasks, configs, and secrets to the worker.

 // Any tasks not previously known will be started. Any tasks that are in the task set

 // and already running will be updated, if possible. Any tasks currently running on

 // the worker outside the task set will be terminated.

-// Any secrets not in the set of assignments will be removed.

+// Anything not in the set of assignments will be removed.

 func (w *worker) Assign(ctx context.Context, assignments []*api.AssignmentChange) error {

 	w.mu.Lock()

 	defer w.mu.Unlock()

@@ -136,20 +137,28 @@ func (w *worker) Assign(ctx context.Context, assignments []*api.AssignmentChange

 		"len(assignments)": len(assignments),

 	}).Debug("(*worker).Assign")

-	// Need to update secrets before tasks, because tasks might depend on new secrets

+	// Need to update dependencies before tasks

+

 	err := reconcileSecrets(ctx, w, assignments, true)

 	if err != nil {

 		return err

 	}

+	err = reconcileConfigs(ctx, w, assignments, true)

+	if err != nil {

+		return err

+	}

+

 	return reconcileTaskState(ctx, w, assignments, true)

 }

-// Update updates the set of tasks and secret for the worker.

+// Update updates the set of tasks, configs, and secrets for the worker.

 // Tasks in the added set will be added to the worker, and tasks in the removed set

 // will be removed from the worker

 // Secrets in the added set will be added to the worker, and secrets in the removed set

 // will be removed from the worker.

+// Configs in the added set will be added to the worker, and configs in the removed set

+// will be removed from the worker.

 func (w *worker) Update(ctx context.Context, assignments []*api.AssignmentChange) error {

 	w.mu.Lock()

 	defer w.mu.Unlock()

@@ -167,6 +176,11 @@ func (w *worker) Update(ctx context.Context, assignments []*api.AssignmentChange

 		return err

 	}

+	err = reconcileConfigs(ctx, w, assignments, false)

+	if err != nil {

+		return err

+	}

+

 	return reconcileTaskState(ctx, w, assignments, false)

 }

@@ -318,7 +332,7 @@ func reconcileSecrets(ctx context.Context, w *worker, assignments []*api.Assignm

 		}

 	}

-	provider, ok := w.executor.(exec.SecretsProvider)

+	secretsProvider, ok := w.executor.(exec.SecretsProvider)

 	if !ok {

 		if len(updatedSecrets) != 0 || len(removedSecrets) != 0 {

 			log.G(ctx).Warn("secrets update ignored; executor does not support secrets")

@@ -326,7 +340,7 @@ func reconcileSecrets(ctx context.Context, w *worker, assignments []*api.Assignm

 		return nil

 	}

-	secrets := provider.Secrets()

+	secrets := secretsProvider.Secrets()

 	log.G(ctx).WithFields(logrus.Fields{

 		"len(updatedSecrets)": len(updatedSecrets),

@@ -344,6 +358,49 @@ func reconcileSecrets(ctx context.Context, w *worker, assignments []*api.Assignm

 	return nil

 }

+func reconcileConfigs(ctx context.Context, w *worker, assignments []*api.AssignmentChange, fullSnapshot bool) error {

+	var (

+		updatedConfigs []api.Config

+		removedConfigs []string

+	)

+	for _, a := range assignments {

+		if r := a.Assignment.GetConfig(); r != nil {

+			switch a.Action {

+			case api.AssignmentChange_AssignmentActionUpdate:

+				updatedConfigs = append(updatedConfigs, *r)

+			case api.AssignmentChange_AssignmentActionRemove:

+				removedConfigs = append(removedConfigs, r.ID)

+			}

+

+		}

+	}

+

+	configsProvider, ok := w.executor.(exec.ConfigsProvider)

+	if !ok {

+		if len(updatedConfigs) != 0 || len(removedConfigs) != 0 {

+			log.G(ctx).Warn("configs update ignored; executor does not support configs")

+		}

+		return nil

+	}

+

+	configs := configsProvider.Configs()

+

+	log.G(ctx).WithFields(logrus.Fields{

+		"len(updatedConfigs)": len(updatedConfigs),

+		"len(removedConfigs)": len(removedConfigs),

+	}).Debug("(*worker).reconcileConfigs")

+

+	// If this was a complete set of configs, we're going to clear the configs map and add all of them

+	if fullSnapshot {

+		configs.Reset()

+	} else {

+		configs.Remove(removedConfigs)

+	}

+	configs.Add(updatedConfigs...)

+

+	return nil

+}

+

 func (w *worker) Listen(ctx context.Context, reporter StatusReporter) {

 	w.mu.Lock()

 	defer w.mu.Unlock()

@@ -567,7 +567,7 @@ func (m *CreateSecretRequest) Reset()                    { *m = CreateSecretRequ

 func (*CreateSecretRequest) ProtoMessage()               {}

 func (*CreateSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{45} }

-// CreateSecretResponse contains the newly created `Secret`` corresponding to the

+// CreateSecretResponse contains the newly created `Secret` corresponding to the

 // name in `CreateSecretRequest`.  The `Secret.Spec.Data` field should be nil instead

 // of actually containing the secret bytes.

 type CreateSecretResponse struct {

@@ -597,6 +597,119 @@ func (m *RemoveSecretResponse) Reset()                    { *m = RemoveSecretRes

 func (*RemoveSecretResponse) ProtoMessage()               {}

 func (*RemoveSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{48} }

+// GetConfigRequest is the request to get a `Config` object given a config id.

+type GetConfigRequest struct {

+	ConfigID string `protobuf:"bytes,1,opt,name=config_id,json=configId,proto3" json:"config_id,omitempty"`

+}

+

+func (m *GetConfigRequest) Reset()                    { *m = GetConfigRequest{} }

+func (*GetConfigRequest) ProtoMessage()               {}

+func (*GetConfigRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{49} }

+

+// GetConfigResponse contains the Config corresponding to the id in

+// `GetConfigRequest`.

+type GetConfigResponse struct {

+	Config *Config `protobuf:"bytes,1,opt,name=config" json:"config,omitempty"`

+}

+

+func (m *GetConfigResponse) Reset()                    { *m = GetConfigResponse{} }

+func (*GetConfigResponse) ProtoMessage()               {}

+func (*GetConfigResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{50} }

+

+type UpdateConfigRequest struct {

+	// ConfigID is the config ID to update.

+	ConfigID string `protobuf:"bytes,1,opt,name=config_id,json=configId,proto3" json:"config_id,omitempty"`

+	// ConfigVersion is the version of the config being updated.

+	ConfigVersion *Version `protobuf:"bytes,2,opt,name=config_version,json=configVersion" json:"config_version,omitempty"`

+	// Spec is the new spec to apply to the Config

+	// Only some fields are allowed to be updated.

+	Spec *ConfigSpec `protobuf:"bytes,3,opt,name=spec" json:"spec,omitempty"`

+}

+

+func (m *UpdateConfigRequest) Reset()                    { *m = UpdateConfigRequest{} }

+func (*UpdateConfigRequest) ProtoMessage()               {}

+func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{51} }

+

+type UpdateConfigResponse struct {

+	Config *Config `protobuf:"bytes,1,opt,name=config" json:"config,omitempty"`

+}

+

+func (m *UpdateConfigResponse) Reset()                    { *m = UpdateConfigResponse{} }

+func (*UpdateConfigResponse) ProtoMessage()               {}

+func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{52} }

+

+// ListConfigRequest is the request to list all configs in the config store,

+// or all configs filtered by (name or name prefix or id prefix) and labels.

+type ListConfigsRequest struct {

+	Filters *ListConfigsRequest_Filters `protobuf:"bytes,1,opt,name=filters" json:"filters,omitempty"`

+}

+

+func (m *ListConfigsRequest) Reset()                    { *m = ListConfigsRequest{} }

+func (*ListConfigsRequest) ProtoMessage()               {}

+func (*ListConfigsRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{53} }

+

+type ListConfigsRequest_Filters struct {

+	Names        []string          `protobuf:"bytes,1,rep,name=names" json:"names,omitempty"`

+	IDPrefixes   []string          `protobuf:"bytes,2,rep,name=id_prefixes,json=idPrefixes" json:"id_prefixes,omitempty"`

+	Labels       map[string]string `protobuf:"bytes,3,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`

+	NamePrefixes []string          `protobuf:"bytes,4,rep,name=name_prefixes,json=namePrefixes" json:"name_prefixes,omitempty"`

+}

+

+func (m *ListConfigsRequest_Filters) Reset()      { *m = ListConfigsRequest_Filters{} }

+func (*ListConfigsRequest_Filters) ProtoMessage() {}

+func (*ListConfigsRequest_Filters) Descriptor() ([]byte, []int) {

+	return fileDescriptorControl, []int{53, 0}

+}

+

+// ListConfigResponse contains a list of all the configs that match the name or

+// name prefix filters provided in `ListConfigRequest`.

+type ListConfigsResponse struct {

+	Configs []*Config `protobuf:"bytes,1,rep,name=configs" json:"configs,omitempty"`

+}

+

+func (m *ListConfigsResponse) Reset()                    { *m = ListConfigsResponse{} }

+func (*ListConfigsResponse) ProtoMessage()               {}

+func (*ListConfigsResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{54} }

+

+// CreateConfigRequest specifies a new config (it will not update an existing

+// config) to create.

+type CreateConfigRequest struct {

+	Spec *ConfigSpec `protobuf:"bytes,1,opt,name=spec" json:"spec,omitempty"`

+}

+

+func (m *CreateConfigRequest) Reset()                    { *m = CreateConfigRequest{} }

+func (*CreateConfigRequest) ProtoMessage()               {}

+func (*CreateConfigRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{55} }

+

+// CreateConfigResponse contains the newly created `Config` corresponding to the

+// name in `CreateConfigRequest`.

+type CreateConfigResponse struct {

+	Config *Config `protobuf:"bytes,1,opt,name=config" json:"config,omitempty"`

+}

+

+func (m *CreateConfigResponse) Reset()                    { *m = CreateConfigResponse{} }

+func (*CreateConfigResponse) ProtoMessage()               {}

+func (*CreateConfigResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{56} }

+

+// RemoveConfigRequest contains the ID of the config that should be removed.  This

+// removes all versions of the config.

+type RemoveConfigRequest struct {

+	ConfigID string `protobuf:"bytes,1,opt,name=config_id,json=configId,proto3" json:"config_id,omitempty"`

+}

+

+func (m *RemoveConfigRequest) Reset()                    { *m = RemoveConfigRequest{} }

+func (*RemoveConfigRequest) ProtoMessage()               {}

+func (*RemoveConfigRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{57} }

+

+// RemoveConfigResponse is an empty object indicating the successful removal of

+// a config.

+type RemoveConfigResponse struct {

+}

+

+func (m *RemoveConfigResponse) Reset()                    { *m = RemoveConfigResponse{} }

+func (*RemoveConfigResponse) ProtoMessage()               {}

+func (*RemoveConfigResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{58} }

+

 func init() {

 	proto.RegisterType((*GetNodeRequest)(nil), "docker.swarmkit.v1.GetNodeRequest")

 	proto.RegisterType((*GetNodeResponse)(nil), "docker.swarmkit.v1.GetNodeResponse")

@@ -653,6 +766,17 @@ func init() {

 	proto.RegisterType((*CreateSecretResponse)(nil), "docker.swarmkit.v1.CreateSecretResponse")

 	proto.RegisterType((*RemoveSecretRequest)(nil), "docker.swarmkit.v1.RemoveSecretRequest")

 	proto.RegisterType((*RemoveSecretResponse)(nil), "docker.swarmkit.v1.RemoveSecretResponse")

+	proto.RegisterType((*GetConfigRequest)(nil), "docker.swarmkit.v1.GetConfigRequest")

+	proto.RegisterType((*GetConfigResponse)(nil), "docker.swarmkit.v1.GetConfigResponse")

+	proto.RegisterType((*UpdateConfigRequest)(nil), "docker.swarmkit.v1.UpdateConfigRequest")

+	proto.RegisterType((*UpdateConfigResponse)(nil), "docker.swarmkit.v1.UpdateConfigResponse")

+	proto.RegisterType((*ListConfigsRequest)(nil), "docker.swarmkit.v1.ListConfigsRequest")

+	proto.RegisterType((*ListConfigsRequest_Filters)(nil), "docker.swarmkit.v1.ListConfigsRequest.Filters")

+	proto.RegisterType((*ListConfigsResponse)(nil), "docker.swarmkit.v1.ListConfigsResponse")

+	proto.RegisterType((*CreateConfigRequest)(nil), "docker.swarmkit.v1.CreateConfigRequest")

+	proto.RegisterType((*CreateConfigResponse)(nil), "docker.swarmkit.v1.CreateConfigResponse")

+	proto.RegisterType((*RemoveConfigRequest)(nil), "docker.swarmkit.v1.RemoveConfigRequest")

+	proto.RegisterType((*RemoveConfigResponse)(nil), "docker.swarmkit.v1.RemoveConfigResponse")

 	proto.RegisterEnum("docker.swarmkit.v1.UpdateServiceRequest_Rollback", UpdateServiceRequest_Rollback_name, UpdateServiceRequest_Rollback_value)

 }

@@ -860,6 +984,46 @@ func (p *authenticatedWrapperControlServer) RemoveSecret(ctx context.Context, r

 	return p.local.RemoveSecret(ctx, r)

 }

+func (p *authenticatedWrapperControlServer) GetConfig(ctx context.Context, r *GetConfigRequest) (*GetConfigResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.GetConfig(ctx, r)

+}

+

+func (p *authenticatedWrapperControlServer) UpdateConfig(ctx context.Context, r *UpdateConfigRequest) (*UpdateConfigResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.UpdateConfig(ctx, r)

+}

+

+func (p *authenticatedWrapperControlServer) ListConfigs(ctx context.Context, r *ListConfigsRequest) (*ListConfigsResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.ListConfigs(ctx, r)

+}

+

+func (p *authenticatedWrapperControlServer) CreateConfig(ctx context.Context, r *CreateConfigRequest) (*CreateConfigResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.CreateConfig(ctx, r)

+}

+

+func (p *authenticatedWrapperControlServer) RemoveConfig(ctx context.Context, r *RemoveConfigRequest) (*RemoveConfigResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.RemoveConfig(ctx, r)

+}

+

 func (m *GetNodeRequest) Copy() *GetNodeRequest {

 	if m == nil {

 		return nil

@@ -1996,6 +2160,224 @@ func (m *RemoveSecretResponse) Copy() *RemoveSecretResponse {

 }

 func (m *RemoveSecretResponse) CopyFrom(src interface{}) {}

+func (m *GetConfigRequest) Copy() *GetConfigRequest {

+	if m == nil {

+		return nil

+	}

+	o := &GetConfigRequest{}

+	o.CopyFrom(m)

+	return o

+}

+

+func (m *GetConfigRequest) CopyFrom(src interface{}) {

+

+	o := src.(*GetConfigRequest)

+	*m = *o

+}

+

+func (m *GetConfigResponse) Copy() *GetConfigResponse {

+	if m == nil {

+		return nil

+	}

+	o := &GetConfigResponse{}

+	o.CopyFrom(m)

+	return o

+}

+

+func (m *GetConfigResponse) CopyFrom(src interface{}) {

+

+	o := src.(*GetConfigResponse)

+	*m = *o

+	if o.Config != nil {

+		m.Config = &Config{}

+		github_com_docker_swarmkit_api_deepcopy.Copy(m.Config, o.Config)

+	}

+}

+

+func (m *UpdateConfigRequest) Copy() *UpdateConfigRequest {

+	if m == nil {

+		return nil

+	}

+	o := &UpdateConfigRequest{}

+	o.CopyFrom(m)

+	return o

+}