@@ -139,7 +139,7 @@ clone git github.com/docker/docker-credential-helpers v0.3.0

 clone git github.com/docker/containerd 0ac3cd1be170d180b2baed755e8f0da547ceb267

 # cluster

-clone git github.com/docker/swarmkit 9ee5fc3b8db5de8c8593a57bc45fc178f74ceee1

+clone git github.com/docker/swarmkit 38857c06dafcf939a56d2650d8e0011b5aace384

 clone git github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9

 clone git github.com/gogo/protobuf 43a2e0b1c32252bfbbdf81f7faa7a88fb3fa4028

 clone git github.com/cloudflare/cfssl b895b0549c0ff676f92cf09ba971ae02bb41367b

@@ -43,11 +43,8 @@ type NodeConfig struct {

 	// remote managers and certificates.

 	StateDir string

-	// CAHash to be used on the first certificate request.

-	CAHash string

-

-	// Secret to be used on the first certificate request.

-	Secret string

+	// JoinToken is the token to be used on the first certificate request.

+	JoinToken string

 	// ExternalCAs is a list of CAs to which a manager node

 	// will make certificate signing requests for node certificates.

@@ -73,9 +70,6 @@ type NodeConfig struct {

 	// HeartbeatTick defines the amount of ticks between each

 	// heartbeat sent to other members for health-check purposes

 	HeartbeatTick uint32

-

-	// todo: temporary to bypass promotion not working yet

-	IsManager bool

 }

 // Node implements the primary node functionality for a member of a swarm

@@ -193,11 +187,6 @@ func (n *Node) run(ctx context.Context) (err error) {

 		}

 	}

-	csrRole := n.role

-	if n.config.IsManager { // todo: temporary

-		csrRole = ca.ManagerRole

-	}

-

 	// Obtain new certs and setup TLS certificates renewal for this node:

 	// - We call LoadOrCreateSecurityConfig which blocks until a valid certificate has been issued

 	// - We retrieve the nodeID from LoadOrCreateSecurityConfig through the info channel. This allows

@@ -220,7 +209,7 @@ func (n *Node) run(ctx context.Context) (err error) {

 	}()

 	certDir := filepath.Join(n.config.StateDir, "certificates")

-	securityConfig, err := ca.LoadOrCreateSecurityConfig(ctx, certDir, n.config.CAHash, n.config.Secret, csrRole, picker.NewPicker(n.remotes), issueResponseChan)

+	securityConfig, err := ca.LoadOrCreateSecurityConfig(ctx, certDir, n.config.JoinToken, ca.ManagerRole, picker.NewPicker(n.remotes), issueResponseChan)

 	if err != nil {

 		return err

 	}

@@ -93,7 +93,7 @@ func (tm *taskManager) run(ctx context.Context) {

 		case <-run:

 			// always check for shutdown before running.

 			select {

-			case <-shutdown:

+			case <-tm.shutdown:

 				continue // ignore run request and handle shutdown

 			case <-tm.closed:

 				continue

@@ -142,6 +142,13 @@ func (tm *taskManager) run(ctx context.Context) {

 			// goal is to decide whether or not we re-dispatch the operation.

 			cancel = nil

+			select {

+			case <-tm.shutdown:

+				shutdown = tm.shutdown // re-enable the shutdown branch

+				continue               // no dispatch if we are in shutdown.

+			default:

+			}

+

 			switch err {

 			case exec.ErrTaskNoop:

 				if !updated {

@@ -203,6 +210,12 @@ func (tm *taskManager) run(ctx context.Context) {

 			if cancel != nil {

 				// cancel outstanding operation.

 				cancel()

+

+				// subtle: after a cancellation, we want to avoid busy wait

+				// here. this gets renabled in the errs branch and we'll come

+				// back around and try shutdown again.

+				shutdown = nil // turn off this branch until op proceeds

+				continue       // wait until operation actually exits.

 			}

 			// TODO(stevvooe): This should be left for the repear.

@@ -51,11 +51,13 @@ func (*NodeCertificateStatusResponse) ProtoMessage()               {}

 func (*NodeCertificateStatusResponse) Descriptor() ([]byte, []int) { return fileDescriptorCa, []int{1} }

 type IssueNodeCertificateRequest struct {

+	// DEPRECATED: Role is now selected based on which secret is matched.

 	Role NodeRole `protobuf:"varint,1,opt,name=role,proto3,enum=docker.swarmkit.v1.NodeRole" json:"role,omitempty"`

-	CSR  []byte   `protobuf:"bytes,2,opt,name=csr,proto3" json:"csr,omitempty"`

-	// Secret represents a user-provided string that is necessary for new

+	// CSR is the certificate signing request.

+	CSR []byte `protobuf:"bytes,2,opt,name=csr,proto3" json:"csr,omitempty"`

+	// Token represents a user-provided string that is necessary for new

 	// nodes to join the cluster

-	Secret string `protobuf:"bytes,3,opt,name=secret,proto3" json:"secret,omitempty"`

+	Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`

 }

 func (m *IssueNodeCertificateRequest) Reset()                    { *m = IssueNodeCertificateRequest{} }

@@ -165,9 +167,9 @@ func (m *IssueNodeCertificateRequest) Copy() *IssueNodeCertificateRequest {

 	}

 	o := &IssueNodeCertificateRequest{

-		Role:   m.Role,

-		CSR:    m.CSR,

-		Secret: m.Secret,

+		Role:  m.Role,

+		CSR:   m.CSR,

+		Token: m.Token,

 	}

 	return o

@@ -241,7 +243,7 @@ func (this *IssueNodeCertificateRequest) GoString() string {

 	s = append(s, "&api.IssueNodeCertificateRequest{")

 	s = append(s, "Role: "+fmt.Sprintf("%#v", this.Role)+",\n")

 	s = append(s, "CSR: "+fmt.Sprintf("%#v", this.CSR)+",\n")

-	s = append(s, "Secret: "+fmt.Sprintf("%#v", this.Secret)+",\n")

+	s = append(s, "Token: "+fmt.Sprintf("%#v", this.Token)+",\n")

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

@@ -556,11 +558,11 @@ func (m *IssueNodeCertificateRequest) MarshalTo(data []byte) (int, error) {

 		i = encodeVarintCa(data, i, uint64(len(m.CSR)))

 		i += copy(data[i:], m.CSR)

 	}

-	if len(m.Secret) > 0 {

+	if len(m.Token) > 0 {

 		data[i] = 0x1a

 		i++

-		i = encodeVarintCa(data, i, uint64(len(m.Secret)))

-		i += copy(data[i:], m.Secret)

+		i = encodeVarintCa(data, i, uint64(len(m.Token)))

+		i += copy(data[i:], m.Token)

 	}

 	return i, nil

 }

@@ -836,7 +838,7 @@ func (m *IssueNodeCertificateRequest) Size() (n int) {

 	if l > 0 {

 		n += 1 + l + sovCa(uint64(l))

 	}

-	l = len(m.Secret)

+	l = len(m.Token)

 	if l > 0 {

 		n += 1 + l + sovCa(uint64(l))

 	}

@@ -913,7 +915,7 @@ func (this *IssueNodeCertificateRequest) String() string {

 	s := strings.Join([]string{`&IssueNodeCertificateRequest{`,

 		`Role:` + fmt.Sprintf("%v", this.Role) + `,`,

 		`CSR:` + fmt.Sprintf("%v", this.CSR) + `,`,

-		`Secret:` + fmt.Sprintf("%v", this.Secret) + `,`,

+		`Token:` + fmt.Sprintf("%v", this.Token) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -1232,7 +1234,7 @@ func (m *IssueNodeCertificateRequest) Unmarshal(data []byte) error {

 			iNdEx = postIndex

 		case 3:

 			if wireType != 2 {

-				return fmt.Errorf("proto: wrong wireType = %d for field Secret", wireType)

+				return fmt.Errorf("proto: wrong wireType = %d for field Token", wireType)

 			}

 			var stringLen uint64

 			for shift := uint(0); ; shift += 7 {

@@ -1257,7 +1259,7 @@ func (m *IssueNodeCertificateRequest) Unmarshal(data []byte) error {

 			if postIndex > l {

 				return io.ErrUnexpectedEOF

 			}

-			m.Secret = string(data[iNdEx:postIndex])

+			m.Token = string(data[iNdEx:postIndex])

 			iNdEx = postIndex

 		default:

 			iNdEx = preIndex

@@ -1615,36 +1617,36 @@ var (

 )

 var fileDescriptorCa = []byte{

-	// 487 bytes of a gzipped FileDescriptorProto

-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x94, 0xcf, 0x6e, 0xd3, 0x40,

-	0x10, 0xc6, 0x59, 0x07, 0xa5, 0x65, 0x52, 0x05, 0xb4, 0x14, 0x14, 0x52, 0x37, 0xad, 0xcc, 0x01,

-	0x4e, 0x4e, 0x6a, 0x6e, 0x9c, 0x48, 0x8c, 0x84, 0x72, 0x00, 0xa1, 0xcd, 0x03, 0x20, 0xd7, 0x19,

-	0x82, 0xd5, 0x26, 0x6b, 0x76, 0x37, 0x20, 0x6e, 0x08, 0x24, 0x0e, 0xdc, 0x11, 0x9c, 0x78, 0x04,

-	0x9e, 0xa3, 0xe2, 0xc4, 0x91, 0x13, 0xa2, 0x7d, 0x00, 0xc4, 0x23, 0xb0, 0xbb, 0x71, 0x48, 0xff,

-	0xac, 0xa3, 0xf6, 0x30, 0x8a, 0x77, 0x76, 0xbe, 0x2f, 0xbf, 0x9d, 0xf1, 0x1a, 0x56, 0xd3, 0x24,

-	0xcc, 0x05, 0x57, 0x9c, 0xd2, 0x21, 0x4f, 0xf7, 0x50, 0x84, 0xf2, 0x75, 0x22, 0xc6, 0x7b, 0x99,

-	0x0a, 0x5f, 0xed, 0x34, 0x6b, 0xea, 0x4d, 0x8e, 0x72, 0x56, 0xd0, 0xac, 0xc9, 0x1c, 0xd3, 0xf9,

-	0x62, 0x7d, 0xc4, 0x47, 0xdc, 0x3e, 0xb6, 0xcd, 0x53, 0x91, 0xbd, 0x9e, 0xef, 0x4f, 0x47, 0xd9,

-	0xa4, 0x3d, 0xfb, 0x99, 0x25, 0x83, 0x18, 0xfc, 0x27, 0x7c, 0x88, 0x31, 0x0a, 0x95, 0x3d, 0xcf,

-	0xd2, 0x44, 0xe1, 0x40, 0x25, 0x6a, 0x2a, 0x19, 0xbe, 0x9c, 0xa2, 0x54, 0xf4, 0x36, 0xac, 0x4c,

-	0xf4, 0xfe, 0xb3, 0x6c, 0xd8, 0x20, 0xdb, 0xe4, 0xee, 0x95, 0x1e, 0x1c, 0xfd, 0xda, 0xaa, 0x1a,

-	0x49, 0xff, 0x21, 0xab, 0x9a, 0xad, 0xfe, 0x30, 0xf8, 0x4a, 0x60, 0xb3, 0xc4, 0x45, 0xe6, 0x7c,

-	0x22, 0x91, 0xde, 0x87, 0xaa, 0xb4, 0x19, 0xeb, 0x52, 0x8b, 0x82, 0xf0, 0xec, 0x81, 0xc2, 0xbe,

-	0x94, 0xd3, 0x64, 0x92, 0xce, 0xb5, 0x85, 0x82, 0x76, 0xa1, 0x96, 0x2e, 0x8c, 0x1b, 0x9e, 0x35,

-	0xd8, 0x72, 0x19, 0x1c, 0xfb, 0x7f, 0x76, 0x5c, 0x13, 0xbc, 0x23, 0xb0, 0x61, 0xdc, 0xf1, 0x14,

-	0xe5, 0xfc, 0x94, 0x1d, 0xb8, 0x2c, 0xf8, 0x3e, 0x5a, 0xb8, 0x7a, 0xe4, 0xbb, 0xbc, 0x8d, 0x92,

-	0xe9, 0x1a, 0x66, 0x2b, 0xe9, 0x2d, 0xa8, 0xa4, 0x52, 0x58, 0x98, 0xb5, 0xde, 0x8a, 0xee, 0x49,

-	0x25, 0x1e, 0x30, 0x66, 0x72, 0xf4, 0xa6, 0x3e, 0x2b, 0xa6, 0x02, 0x55, 0xa3, 0x62, 0x3a, 0xc6,

-	0x8a, 0x55, 0xf0, 0x89, 0x80, 0xef, 0x86, 0x28, 0x9a, 0x74, 0x9e, 0x5e, 0xd3, 0xa7, 0x70, 0xd5,

-	0x16, 0x8d, 0x71, 0xbc, 0x8b, 0x42, 0xbe, 0xc8, 0x72, 0x0b, 0x51, 0x8f, 0xee, 0x94, 0x51, 0x0f,

-	0xf4, 0x9b, 0x11, 0x3e, 0xfe, 0x5f, 0xce, 0xea, 0x46, 0xbf, 0x58, 0x07, 0x9b, 0xb0, 0xf1, 0x08,

-	0x15, 0xe3, 0x5c, 0xc5, 0xdd, 0xb3, 0xbd, 0x09, 0x1e, 0x80, 0xef, 0xde, 0x2e, 0xa8, 0xb7, 0x4f,

-	0x8e, 0xc7, 0x90, 0xaf, 0x9d, 0xe8, 0x7e, 0xf4, 0x91, 0x80, 0x17, 0x77, 0xe9, 0x7b, 0x02, 0xeb,

-	0x2e, 0x27, 0xda, 0x76, 0x91, 0x2f, 0x41, 0x6a, 0x76, 0xce, 0x2f, 0x98, 0x41, 0x06, 0xab, 0xdf,

-	0xbf, 0xfd, 0xf9, 0xe2, 0x79, 0xd7, 0x48, 0xf4, 0xd9, 0x03, 0xdb, 0xd2, 0x02, 0xc8, 0x35, 0x10,

-	0x37, 0xd0, 0x92, 0xf7, 0xc7, 0x0d, 0xb4, 0x6c, 0xd6, 0x0b, 0x20, 0xfa, 0x81, 0xc0, 0x0d, 0xe7,

-	0xe5, 0xa1, 0x9d, 0xb2, 0x89, 0x96, 0xdd, 0xd6, 0xe6, 0xce, 0x05, 0x14, 0xa7, 0x41, 0x7a, 0xfe,

-	0xc1, 0x61, 0xeb, 0xd2, 0x4f, 0x1d, 0x7f, 0x0f, 0x5b, 0xe4, 0xed, 0x51, 0x8b, 0x1c, 0xe8, 0xf8,

-	0xa1, 0xe3, 0xb7, 0x8e, 0xdd, 0xaa, 0xfd, 0x5e, 0xdc, 0xfb, 0x17, 0x00, 0x00, 0xff, 0xff, 0x72,

-	0xd0, 0xad, 0xdf, 0x94, 0x04, 0x00, 0x00,

+	// 490 bytes of a gzipped FileDescriptorProto

+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x94, 0xcf, 0x8e, 0xd3, 0x30,

+	0x10, 0xc6, 0x71, 0x0a, 0xdd, 0x65, 0xba, 0x2a, 0xc8, 0x14, 0xa9, 0x74, 0xb3, 0xdd, 0x95, 0x39,

+	0xc0, 0x29, 0xdd, 0x0d, 0x9c, 0x38, 0xd1, 0x06, 0x09, 0xf5, 0x00, 0x42, 0xee, 0x03, 0xa0, 0x6c,

+	0x6a, 0x4a, 0xd4, 0x6d, 0x1c, 0x62, 0x07, 0xc4, 0x0d, 0x09, 0xc4, 0x81, 0x3b, 0x82, 0x13, 0x8f,

+	0xc0, 0x73, 0xac, 0x38, 0x71, 0xe4, 0x84, 0xd8, 0x7d, 0x00, 0xc4, 0x23, 0x60, 0x3b, 0x29, 0xdd,

+	0x3f, 0x4e, 0x55, 0x0e, 0xa3, 0xc6, 0xe3, 0xf9, 0xbe, 0xfe, 0x32, 0x63, 0x07, 0xd6, 0xa3, 0xd0,

+	0x4b, 0x33, 0x2e, 0x39, 0xc6, 0x63, 0x1e, 0x4d, 0x59, 0xe6, 0x89, 0x57, 0x61, 0x36, 0x9b, 0xc6,

+	0xd2, 0x7b, 0xb9, 0xd7, 0x69, 0xc8, 0xd7, 0x29, 0x13, 0x45, 0x41, 0xa7, 0x21, 0x52, 0x16, 0xcd,

+	0x17, 0xad, 0x09, 0x9f, 0x70, 0xf3, 0xd8, 0xd3, 0x4f, 0x65, 0xf6, 0x5a, 0x7a, 0x90, 0x4f, 0xe2,

+	0xa4, 0x57, 0xfc, 0x14, 0x49, 0x12, 0x80, 0xfb, 0x98, 0x8f, 0x59, 0xc0, 0x32, 0x19, 0x3f, 0x8b,

+	0xa3, 0x50, 0xb2, 0x91, 0x0c, 0x65, 0x2e, 0x28, 0x7b, 0x91, 0x33, 0x21, 0xf1, 0x4d, 0x58, 0x4b,

+	0xd4, 0xfe, 0xd3, 0x78, 0xdc, 0x46, 0x3b, 0xe8, 0xf6, 0xe5, 0x01, 0x1c, 0xff, 0xdc, 0xae, 0x6b,

+	0xc9, 0xf0, 0x01, 0xad, 0xeb, 0xad, 0xe1, 0x98, 0x7c, 0x41, 0xb0, 0x55, 0xe1, 0x22, 0x52, 0x9e,

+	0x08, 0x86, 0xef, 0x41, 0x5d, 0x98, 0x8c, 0x71, 0x69, 0xf8, 0xc4, 0x3b, 0xff, 0x42, 0xde, 0x50,

+	0x88, 0x3c, 0x4c, 0xa2, 0xb9, 0xb6, 0x54, 0xe0, 0x3e, 0x34, 0xa2, 0x85, 0x71, 0xdb, 0x31, 0x06,

+	0xdb, 0x36, 0x83, 0x13, 0xff, 0x4f, 0x4f, 0x6a, 0xc8, 0x3b, 0x04, 0x9b, 0xda, 0x9d, 0x9d, 0xa1,

+	0x9c, 0xbf, 0xe5, 0x5d, 0xb8, 0x98, 0xf1, 0x03, 0x66, 0xe0, 0x9a, 0xbe, 0x6b, 0xf3, 0xd6, 0x4a,

+	0xaa, 0x6a, 0x06, 0x4e, 0x1b, 0x51, 0x53, 0x8d, 0x6f, 0x40, 0x2d, 0x12, 0x99, 0x01, 0xda, 0x18,

+	0xac, 0xa9, 0xbe, 0xd4, 0x82, 0x11, 0xa5, 0x3a, 0x87, 0x5b, 0x70, 0x49, 0xf2, 0x29, 0x4b, 0xda,

+	0x35, 0xdd, 0x34, 0x5a, 0x2c, 0xc8, 0x47, 0x04, 0xae, 0x1d, 0xa3, 0x6c, 0xd3, 0x2a, 0xdd, 0xc6,

+	0x4f, 0xe0, 0x8a, 0x29, 0x9a, 0xb1, 0xd9, 0x3e, 0xcb, 0xc4, 0xf3, 0x38, 0x35, 0x08, 0x4d, 0xff,

+	0x56, 0x15, 0xf7, 0x48, 0x9d, 0x0d, 0xef, 0xd1, 0xbf, 0x72, 0xda, 0xd4, 0xfa, 0xc5, 0x9a, 0x6c,

+	0xc1, 0xe6, 0x43, 0x26, 0x29, 0xe7, 0x32, 0xe8, 0x9f, 0xef, 0x0e, 0xb9, 0x0f, 0xae, 0x7d, 0xbb,

+	0xa4, 0xde, 0x39, 0x3d, 0x20, 0x4d, 0xbe, 0x71, 0xaa, 0xff, 0xfe, 0x07, 0x04, 0x4e, 0xd0, 0xc7,

+	0x6f, 0x11, 0xb4, 0x6c, 0x4e, 0xb8, 0x67, 0x23, 0x5f, 0x82, 0xd4, 0xd9, 0x5d, 0x5d, 0x50, 0x40,

+	0x92, 0xf5, 0x6f, 0x5f, 0x7f, 0x7f, 0x76, 0x9c, 0xab, 0xc8, 0xff, 0xe4, 0x80, 0x69, 0x69, 0x09,

+	0x64, 0x1b, 0x88, 0x1d, 0x68, 0xc9, 0x09, 0xb2, 0x03, 0x2d, 0x9b, 0xf5, 0x02, 0x08, 0xbf, 0x47,

+	0x70, 0xdd, 0x7a, 0x7d, 0xf0, 0x6e, 0xd5, 0x44, 0xab, 0xee, 0x6b, 0x67, 0xef, 0x3f, 0x14, 0x67,

+	0x41, 0x06, 0xee, 0xe1, 0x51, 0xf7, 0xc2, 0x0f, 0x15, 0x7f, 0x8e, 0xba, 0xe8, 0xcd, 0x71, 0x17,

+	0x1d, 0xaa, 0xf8, 0xae, 0xe2, 0x97, 0x8a, 0xfd, 0xba, 0xf9, 0x62, 0xdc, 0xf9, 0x1b, 0x00, 0x00,

+	0xff, 0xff, 0xb3, 0xf8, 0x41, 0xef, 0x96, 0x04, 0x00, 0x00,

 }

@@ -34,11 +34,15 @@ message NodeCertificateStatusResponse {

 }

 message IssueNodeCertificateRequest {

-	NodeRole role = 1;

+	// DEPRECATED: Role is now selected based on which secret is matched.

+	NodeRole role = 1 [deprecated=true];

+

+	// CSR is the certificate signing request.

 	bytes csr = 2 [(gogoproto.customname) = "CSR"];

-	// Secret represents a user-provided string that is necessary for new

+

+	// Token represents a user-provided string that is necessary for new

 	// nodes to join the cluster

-	string secret = 3;

+	string token = 3;

 }

 message IssueNodeCertificateResponse {

@@ -403,6 +403,17 @@ func (m *ListClustersResponse) Reset()                    { *m = ListClustersRes

 func (*ListClustersResponse) ProtoMessage()               {}

 func (*ListClustersResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{35} }

+type JoinTokenRotation struct {

+	// RotateWorkerToken tells UpdateCluster to rotate the worker secret.

+	RotateWorkerToken bool `protobuf:"varint,1,opt,name=rotate_worker_token,json=rotateWorkerToken,proto3" json:"rotate_worker_token,omitempty"`

+	// RotateManagerSecret tells UpdateCluster to rotate the manager secret.

+	RotateManagerToken bool `protobuf:"varint,2,opt,name=rotate_manager_token,json=rotateManagerToken,proto3" json:"rotate_manager_token,omitempty"`

+}

+

+func (m *JoinTokenRotation) Reset()                    { *m = JoinTokenRotation{} }

+func (*JoinTokenRotation) ProtoMessage()               {}

+func (*JoinTokenRotation) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{36} }

+

 type UpdateClusterRequest struct {

 	// ClusterID is the cluster ID to update.

 	ClusterID string `protobuf:"bytes,1,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`

@@ -410,11 +421,13 @@ type UpdateClusterRequest struct {

 	ClusterVersion *Version `protobuf:"bytes,2,opt,name=cluster_version,json=clusterVersion" json:"cluster_version,omitempty"`

 	// Spec is the new spec to apply to the cluster.

 	Spec *ClusterSpec `protobuf:"bytes,3,opt,name=spec" json:"spec,omitempty"`

+	// Rotation contains flags for join token rotation

+	Rotation JoinTokenRotation `protobuf:"bytes,4,opt,name=rotation" json:"rotation"`

 }

 func (m *UpdateClusterRequest) Reset()                    { *m = UpdateClusterRequest{} }

 func (*UpdateClusterRequest) ProtoMessage()               {}

-func (*UpdateClusterRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{36} }

+func (*UpdateClusterRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{37} }

 type UpdateClusterResponse struct {

 	Cluster *Cluster `protobuf:"bytes,1,opt,name=cluster" json:"cluster,omitempty"`

@@ -422,7 +435,7 @@ type UpdateClusterResponse struct {

 func (m *UpdateClusterResponse) Reset()                    { *m = UpdateClusterResponse{} }

 func (*UpdateClusterResponse) ProtoMessage()               {}

-func (*UpdateClusterResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{37} }

+func (*UpdateClusterResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{38} }

 func init() {

 	proto.RegisterType((*GetNodeRequest)(nil), "docker.swarmkit.v1.GetNodeRequest")

@@ -466,6 +479,7 @@ func init() {

 	proto.RegisterType((*ListClustersRequest)(nil), "docker.swarmkit.v1.ListClustersRequest")

 	proto.RegisterType((*ListClustersRequest_Filters)(nil), "docker.swarmkit.v1.ListClustersRequest.Filters")

 	proto.RegisterType((*ListClustersResponse)(nil), "docker.swarmkit.v1.ListClustersResponse")

+	proto.RegisterType((*JoinTokenRotation)(nil), "docker.swarmkit.v1.JoinTokenRotation")

 	proto.RegisterType((*UpdateClusterRequest)(nil), "docker.swarmkit.v1.UpdateClusterRequest")

 	proto.RegisterType((*UpdateClusterResponse)(nil), "docker.swarmkit.v1.UpdateClusterResponse")

 }

@@ -1314,6 +1328,19 @@ func (m *ListClustersResponse) Copy() *ListClustersResponse {

 	return o

 }

+func (m *JoinTokenRotation) Copy() *JoinTokenRotation {

+	if m == nil {

+		return nil

+	}

+

+	o := &JoinTokenRotation{

+		RotateWorkerToken:  m.RotateWorkerToken,

+		RotateManagerToken: m.RotateManagerToken,

+	}

+

+	return o

+}

+

 func (m *UpdateClusterRequest) Copy() *UpdateClusterRequest {

 	if m == nil {

 		return nil

@@ -1323,6 +1350,7 @@ func (m *UpdateClusterRequest) Copy() *UpdateClusterRequest {

 		ClusterID:      m.ClusterID,

 		ClusterVersion: m.ClusterVersion.Copy(),

 		Spec:           m.Spec.Copy(),

+		Rotation:       *m.Rotation.Copy(),

 	}

 	return o

@@ -1882,11 +1910,22 @@ func (this *ListClustersResponse) GoString() string {

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

+func (this *JoinTokenRotation) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 6)

+	s = append(s, "&api.JoinTokenRotation{")

+	s = append(s, "RotateWorkerToken: "+fmt.Sprintf("%#v", this.RotateWorkerToken)+",\n")

+	s = append(s, "RotateManagerToken: "+fmt.Sprintf("%#v", this.RotateManagerToken)+",\n")

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

 func (this *UpdateClusterRequest) GoString() string {

 	if this == nil {

 		return "nil"

 	}

-	s := make([]string, 0, 7)

+	s := make([]string, 0, 8)

 	s = append(s, "&api.UpdateClusterRequest{")

 	s = append(s, "ClusterID: "+fmt.Sprintf("%#v", this.ClusterID)+",\n")

 	if this.ClusterVersion != nil {

@@ -1895,6 +1934,7 @@ func (this *UpdateClusterRequest) GoString() string {

 	if this.Spec != nil {

 		s = append(s, "Spec: "+fmt.Sprintf("%#v", this.Spec)+",\n")

 	}

+	s = append(s, "Rotation: "+strings.Replace(this.Rotation.GoString(), `&`, ``, 1)+",\n")

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

@@ -4038,6 +4078,44 @@ func (m *ListClustersResponse) MarshalTo(data []byte) (int, error) {

 	return i, nil

 }

+func (m *JoinTokenRotation) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *JoinTokenRotation) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	if m.RotateWorkerToken {

+		data[i] = 0x8

+		i++

+		if m.RotateWorkerToken {

+			data[i] = 1

+		} else {

+			data[i] = 0

+		}

+		i++

+	}

+	if m.RotateManagerToken {

+		data[i] = 0x10

+		i++

+		if m.RotateManagerToken {

+			data[i] = 1

+		} else {

+			data[i] = 0

+		}

+		i++

+	}

+	return i, nil

+}

+

 func (m *UpdateClusterRequest) Marshal() (data []byte, err error) {

 	size := m.Size()

 	data = make([]byte, size)

@@ -4079,6 +4157,14 @@ func (m *UpdateClusterRequest) MarshalTo(data []byte) (int, error) {

 		}

 		i += n22

 	}

+	data[i] = 0x22

+	i++

+	i = encodeVarintControl(data, i, uint64(m.Rotation.Size()))

+	n23, err := m.Rotation.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n23

 	return i, nil

 }

@@ -4101,11 +4187,11 @@ func (m *UpdateClusterResponse) MarshalTo(data []byte) (int, error) {

 		data[i] = 0xa

 		i++

 		i = encodeVarintControl(data, i, uint64(m.Cluster.Size()))

-		n23, err := m.Cluster.MarshalTo(data[i:])

+		n24, err := m.Cluster.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n23

+		i += n24

 	}

 	return i, nil

 }

@@ -5052,6 +5138,18 @@ func (m *ListClustersResponse) Size() (n int) {

 	return n

 }

+func (m *JoinTokenRotation) Size() (n int) {

+	var l int

+	_ = l

+	if m.RotateWorkerToken {

+		n += 2

+	}

+	if m.RotateManagerToken {

+		n += 2

+	}

+	return n

+}

+

 func (m *UpdateClusterRequest) Size() (n int) {

 	var l int

 	_ = l

@@ -5067,6 +5165,8 @@ func (m *UpdateClusterRequest) Size() (n int) {

 		l = m.Spec.Size()

 		n += 1 + l + sovControl(uint64(l))

 	}

+	l = m.Rotation.Size()

+	n += 1 + l + sovControl(uint64(l))

 	return n

 }

@@ -5575,6 +5675,17 @@ func (this *ListClustersResponse) String() string {

 	}, "")

 	return s

 }

+func (this *JoinTokenRotation) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&JoinTokenRotation{`,

+		`RotateWorkerToken:` + fmt.Sprintf("%v", this.RotateWorkerToken) + `,`,

+		`RotateManagerToken:` + fmt.Sprintf("%v", this.RotateManagerToken) + `,`,

+		`}`,

+	}, "")

+	return s

+}

 func (this *UpdateClusterRequest) String() string {

 	if this == nil {

 		return "nil"

@@ -5583,6 +5694,7 @@ func (this *UpdateClusterRequest) String() string {

 		`ClusterID:` + fmt.Sprintf("%v", this.ClusterID) + `,`,

 		`ClusterVersion:` + strings.Replace(fmt.Sprintf("%v", this.ClusterVersion), "Version", "Version", 1) + `,`,

 		`Spec:` + strings.Replace(fmt.Sprintf("%v", this.Spec), "ClusterSpec", "ClusterSpec", 1) + `,`,

+		`Rotation:` + strings.Replace(strings.Replace(this.Rotation.String(), "JoinTokenRotation", "JoinTokenRotation", 1), `&`, ``, 1) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -9955,6 +10067,96 @@ func (m *ListClustersResponse) Unmarshal(data []byte) error {

 	}

 	return nil

 }

+func (m *JoinTokenRotation) Unmarshal(data []byte) error {

+	l := len(data)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowControl

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := data[iNdEx]

+			iNdEx++

+			wire |= (uint64(b) & 0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: JoinTokenRotation: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: JoinTokenRotation: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		case 1:

+			if wireType != 0 {

+				return fmt.Errorf("proto: wrong wireType = %d for field RotateWorkerToken", wireType)

+			}

+			var v int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				v |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			m.RotateWorkerToken = bool(v != 0)

+		case 2:

+			if wireType != 0 {

+				return fmt.Errorf("proto: wrong wireType = %d for field RotateManagerToken", wireType)

+			}

+			var v int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				v |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			m.RotateManagerToken = bool(v != 0)

+		default:

+			iNdEx = preIndex

+			skippy, err := skipControl(data[iNdEx:])

+			if err != nil {

+				return err

+			}

+			if skippy < 0 {

+				return ErrInvalidLengthControl

+			}

+			if (iNdEx + skippy) > l {

+				return io.ErrUnexpectedEOF

+			}

+			iNdEx += skippy

+		}

+	}

+

+	if iNdEx > l {

+		return io.ErrUnexpectedEOF

+	}

+	return nil

+}

 func (m *UpdateClusterRequest) Unmarshal(data []byte) error {

 	l := len(data)

 	iNdEx := 0

@@ -10079,6 +10281,36 @@ func (m *UpdateClusterRequest) Unmarshal(data []byte) error {

 				return err

 			}

 			iNdEx = postIndex

+		case 4:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Rotation", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				msglen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			if msglen < 0 {

+				return ErrInvalidLengthControl

+			}

+			postIndex := iNdEx + msglen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			if err := m.Rotation.Unmarshal(data[iNdEx:postIndex]); err != nil {

+				return err

+			}

+			iNdEx = postIndex

 		default:

 			iNdEx = preIndex

 			skippy, err := skipControl(data[iNdEx:])

@@ -10289,93 +10521,99 @@ var (

 )

 var fileDescriptorControl = []byte{

-	// 1406 bytes of a gzipped FileDescriptorProto

-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x6f, 0x1b, 0x45,

-	0x14, 0xc7, 0xce, 0x1f, 0xd7, 0xcf, 0xb1, 0xd3, 0x4c, 0x1d, 0x11, 0xb9, 0x21, 0x45, 0x5b, 0x48,

-	0x13, 0x29, 0x38, 0xe0, 0xa8, 0x22, 0x80, 0x04, 0x22, 0x09, 0x45, 0x16, 0x25, 0x54, 0x1b, 0x8a,

-	0xb8, 0x45, 0x8e, 0x3d, 0x0d, 0x4b, 0x6c, 0xaf, 0xd9, 0xdd, 0xa4, 0x8d, 0xb8, 0xc0, 0x81, 0xef,

-	0xc0, 0x95, 0x2b, 0x07, 0xbe, 0x02, 0xd7, 0x8a, 0x13, 0x17, 0x24, 0x4e, 0x15, 0xed, 0x89, 0x13,

-	0xe2, 0x13, 0x20, 0x66, 0x76, 0xde, 0xec, 0xae, 0xc7, 0xb3, 0x63, 0x3b, 0x49, 0x95, 0x1e, 0xac,

-	0xee, 0xce, 0xfc, 0xde, 0x9f, 0x99, 0xf7, 0x7b, 0x2f, 0xef, 0x6d, 0xa1, 0xd8, 0x74, 0xbb, 0x81,

-	0xe7, 0xb6, 0xab, 0x3d, 0xcf, 0x0d, 0x5c, 0x42, 0x5a, 0x6e, 0xf3, 0x88, 0x7a, 0x55, 0xff, 0x61,

-	0xc3, 0xeb, 0x1c, 0x39, 0x41, 0xf5, 0xe4, 0xad, 0x4a, 0xc1, 0xef, 0xd1, 0xa6, 0x2f, 0x00, 0x95,

-	0xa2, 0x7b, 0xf0, 0x35, 0x6d, 0x06, 0xf2, 0xb5, 0x10, 0x9c, 0xf6, 0xa8, 0x7c, 0x29, 0x1f, 0xba,

-	0x87, 0x6e, 0xf8, 0xb8, 0xce, 0x9f, 0x70, 0xf5, 0x5a, 0xaf, 0x7d, 0x7c, 0xe8, 0x74, 0xd7, 0xc5,

-	0x3f, 0x62, 0xd1, 0xba, 0x0d, 0xa5, 0x8f, 0x69, 0xb0, 0xeb, 0xb6, 0xa8, 0x4d, 0xbf, 0x39, 0xa6,

-	0x7e, 0x40, 0x6e, 0x42, 0xae, 0xcb, 0x5e, 0xf7, 0x9d, 0xd6, 0x42, 0xe6, 0xd5, 0xcc, 0x4a, 0x7e,

-	0x0b, 0x9e, 0x3d, 0xb9, 0x31, 0xcd, 0x11, 0xf5, 0x1d, 0x7b, 0x9a, 0x6f, 0xd5, 0x5b, 0xd6, 0x07,

-	0x30, 0x1b, 0x89, 0xf9, 0x3d, 0xb7, 0xeb, 0x53, 0xb2, 0x06, 0x93, 0x7c, 0x33, 0x14, 0x2a, 0xd4,

-	0x16, 0xaa, 0x83, 0x07, 0xa8, 0x86, 0xf8, 0x10, 0x65, 0x3d, 0x99, 0x80, 0xab, 0x77, 0x1d, 0x3f,

-	0x54, 0xe1, 0x4b, 0xd3, 0x77, 0x20, 0xf7, 0xc0, 0x69, 0x07, 0xd4, 0xf3, 0x51, 0xcb, 0x9a, 0x4e,

-	0x8b, 0x2a, 0x56, 0xbd, 0x23, 0x64, 0x6c, 0x29, 0x5c, 0xf9, 0x7e, 0x02, 0x72, 0xb8, 0x48, 0xca,

-	0x30, 0xd5, 0x6d, 0x74, 0x28, 0xd7, 0x38, 0xb1, 0x92, 0xb7, 0xc5, 0x0b, 0x59, 0x87, 0x82, 0xd3,

-	0xda, 0xef, 0x79, 0xf4, 0x81, 0xf3, 0x88, 0xed, 0x65, 0xf9, 0xde, 0x56, 0x89, 0x1d, 0x14, 0xea,

-	0x3b, 0xf7, 0x70, 0xd5, 0x06, 0xa7, 0x25, 0x9f, 0xc9, 0x3d, 0x98, 0x6e, 0x37, 0x0e, 0x68, 0xdb,

-	0x5f, 0x98, 0x60, 0xd8, 0x42, 0x6d, 0x73, 0x1c, 0xcf, 0xaa, 0x77, 0x43, 0xd1, 0x8f, 0x58, 0x80,

-	0x4f, 0x6d, 0xd4, 0x43, 0xea, 0x50, 0xe8, 0xd0, 0xce, 0x01, 0xdb, 0xfe, 0xca, 0xe9, 0xf9, 0x0b,

-	0x93, 0x4c, 0x6d, 0xa9, 0x76, 0x2b, 0xed, 0xda, 0xf6, 0x58, 0xe8, 0xab, 0x9f, 0x46, 0x78, 0x3b,

-	0x29, 0x4b, 0x6a, 0x30, 0xc5, 0x98, 0xc3, 0xce, 0x31, 0x15, 0x2a, 0x59, 0x4c, 0xbd, 0x7b, 0x06,

-	0xb2, 0x05, 0x94, 0x85, 0xb9, 0xc8, 0xaf, 0x22, 0xbe, 0x83, 0xe9, 0xf0, 0x7e, 0x66, 0xf8, 0xa2,

-	0x3c, 0x75, 0xe5, 0x1d, 0x28, 0x24, 0x5c, 0x27, 0x57, 0x61, 0xe2, 0x88, 0x9e, 0x0a, 0x5a, 0xd8,

-	0xfc, 0x91, 0xdf, 0xee, 0x49, 0xa3, 0x7d, 0x4c, 0xd9, 0x0d, 0xf2, 0x35, 0xf1, 0xf2, 0x6e, 0x76,

-	0x33, 0x63, 0x6d, 0xc3, 0x5c, 0xe2, 0x3a, 0x90, 0x23, 0x55, 0x16, 0x0c, 0xbe, 0x10, 0x06, 0xc3,

-	0x44, 0x12, 0x01, 0xb3, 0x7e, 0xce, 0xc0, 0xdc, 0xfd, 0x5e, 0xab, 0x11, 0xd0, 0x71, 0x19, 0x4a,

-	0xde, 0x87, 0x99, 0x10, 0x74, 0xc2, 0x2e, 0xc9, 0x71, 0xbb, 0xa1, 0x83, 0x85, 0xda, 0x75, 0x9d,

-	0xc5, 0x2f, 0x04, 0xc4, 0x2e, 0x70, 0x01, 0x7c, 0x21, 0x6f, 0xc2, 0x24, 0x4f, 0x37, 0x16, 0x6e,

-	0x2e, 0xb7, 0x68, 0x8a, 0x8b, 0x1d, 0x22, 0xad, 0x2d, 0x20, 0x49, 0x5f, 0xcf, 0x94, 0x16, 0x9b,

-	0x30, 0x67, 0xd3, 0x8e, 0x7b, 0x32, 0xf6, 0x79, 0xad, 0x32, 0x90, 0xa4, 0xa4, 0xb0, 0x8e, 0xe9,

-	0xfd, 0x79, 0xc3, 0x3f, 0x4a, 0x28, 0x0b, 0xd8, 0xab, 0xa2, 0x8c, 0x23, 0xb8, 0x32, 0xbe, 0x15,

-	0xa5, 0xb7, 0x10, 0x8b, 0xcf, 0xc1, 0x37, 0x4d, 0xe7, 0x08, 0xf1, 0x21, 0x2a, 0x3e, 0xc7, 0xd8,

-	0xa6, 0xa3, 0x73, 0x24, 0xad, 0x5b, 0xff, 0x61, 0xb9, 0xe0, 0x8b, 0x67, 0x28, 0x17, 0x49, 0xb1,

-	0xc1, 0x72, 0xf1, 0xd3, 0x25, 0x96, 0x0b, 0x9d, 0x67, 0xda, 0x72, 0xc1, 0x5c, 0xf0, 0xa9, 0x77,

-	0xe2, 0x34, 0x39, 0x0f, 0x44, 0xb9, 0x40, 0x17, 0xf6, 0xc4, 0x72, 0x7d, 0x87, 0xb9, 0x80, 0x90,

-	0x7a, 0xcb, 0x27, 0xcb, 0x70, 0x05, 0x59, 0x23, 0xea, 0x42, 0x7e, 0xab, 0xc0, 0xd0, 0x39, 0x41,

-	0x1b, 0x76, 0x7a, 0xc1, 0x1b, 0x9f, 0xec, 0x40, 0x89, 0xa5, 0x9a, 0xe3, 0xd1, 0xd6, 0xbe, 0x1f,

-	0x30, 0xf6, 0x8a, 0x4a, 0x50, 0xaa, 0xbd, 0x92, 0x16, 0xe2, 0x3d, 0x8e, 0xb2, 0x8b, 0x28, 0x14,

-	0xbe, 0x69, 0xca, 0x49, 0xee, 0xb9, 0x94, 0x13, 0xbc, 0xae, 0xb8, 0x9c, 0x70, 0xd6, 0x18, 0xcb,

-	0x49, 0x48, 0x23, 0x01, 0xb3, 0x3e, 0x81, 0xf2, 0xb6, 0x47, 0x99, 0xbf, 0x78, 0x65, 0x92, 0x48,

-	0x1b, 0x98, 0xeb, 0x82, 0x45, 0x37, 0x74, 0x6a, 0x50, 0x22, 0x91, 0xee, 0xbb, 0x30, 0xaf, 0x28,

-	0x43, 0xaf, 0x6e, 0x43, 0x0e, 0xc3, 0x80, 0x0a, 0xaf, 0x1b, 0x14, 0xda, 0x12, 0x6b, 0x7d, 0x08,

-	0x73, 0x2c, 0xe7, 0x14, 0xcf, 0xd6, 0x00, 0xe2, 0xa8, 0x63, 0xd6, 0x14, 0x59, 0x18, 0xf3, 0x51,

-	0xd0, 0xed, 0x7c, 0x14, 0x73, 0x76, 0x3e, 0x92, 0x54, 0x71, 0x3e, 0x7f, 0x7e, 0xcd, 0x40, 0x59,

-	0xd4, 0xb3, 0xf3, 0xf8, 0xc4, 0xe8, 0x35, 0x2b, 0xd1, 0x63, 0x94, 0xe2, 0x12, 0xca, 0xc8, 0x6a,

-	0xbc, 0xd1, 0x57, 0x8d, 0x47, 0x8f, 0x90, 0x72, 0x80, 0xf3, 0xdd, 0xc8, 0x0e, 0x94, 0x45, 0x69,

-	0x3a, 0x57, 0x90, 0x5e, 0x86, 0x79, 0x45, 0x0b, 0xd6, 0xb8, 0xbf, 0xb3, 0x70, 0x8d, 0x73, 0x1c,

-	0xd7, 0xa3, 0x32, 0x57, 0x57, 0xcb, 0xdc, 0x7a, 0x5a, 0x31, 0x51, 0x24, 0x07, 0x2b, 0xdd, 0x0f,

-	0xd9, 0x0b, 0xaf, 0x74, 0x7b, 0x4a, 0xa5, 0x7b, 0x6f, 0x4c, 0xe7, 0xb4, 0xc5, 0x6e, 0xa0, 0x9a,

-	0x4c, 0x5e, 0x6c, 0x35, 0xf9, 0x0c, 0xca, 0xfd, 0x2e, 0x21, 0x31, 0xde, 0x86, 0x2b, 0x18, 0x28,

-	0x59, 0x53, 0x8c, 0xcc, 0x88, 0xc0, 0x71, 0x65, 0xd9, 0xa5, 0xc1, 0x43, 0xd7, 0x3b, 0x1a, 0xa3,

-	0xb2, 0xa0, 0x84, 0xae, 0xb2, 0x44, 0xca, 0x62, 0xde, 0x76, 0xc5, 0x92, 0x89, 0xb7, 0x52, 0x4a,

-	0x62, 0xad, 0xfb, 0x61, 0x65, 0x51, 0x3c, 0x23, 0xac, 0x2f, 0x61, 0xb7, 0x89, 0xf7, 0x15, 0x3e,

-	0x73, 0x22, 0xa3, 0x0c, 0x27, 0x72, 0x36, 0x26, 0x32, 0xca, 0x72, 0x22, 0x23, 0x20, 0xaa, 0x36,

-	0x17, 0xe4, 0xe3, 0x97, 0x32, 0xb7, 0x2e, 0xdc, 0xcd, 0x28, 0xdf, 0x14, 0x4f, 0xa3, 0x7c, 0xc3,

-	0xf5, 0x33, 0xe4, 0x9b, 0x22, 0xf9, 0x62, 0xe5, 0x5b, 0x8a, 0x73, 0x97, 0x99, 0x6f, 0xb1, 0x4b,

-	0x71, 0xbe, 0x61, 0xa0, 0x8c, 0xf9, 0x26, 0x23, 0x17, 0x81, 0xf1, 0x8f, 0xe5, 0x76, 0xfb, 0xd8,

-	0x67, 0x67, 0x4a, 0xd4, 0xe1, 0xa6, 0x58, 0x51, 0xea, 0x30, 0xe2, 0x38, 0x2f, 0x10, 0x10, 0xd1,

-	0x37, 0x52, 0x11, 0xd3, 0x17, 0x21, 0x26, 0xfa, 0x4a, 0x29, 0x89, 0x8d, 0xb8, 0x84, 0x1b, 0x67,

-	0xe0, 0x92, 0x22, 0xf9, 0x62, 0x71, 0x29, 0xc5, 0xb9, 0xcb, 0xe4, 0x52, 0xec, 0x52, 0xcc, 0x25,

-	0x8c, 0x86, 0x91, 0x4b, 0x32, 0x74, 0x11, 0x38, 0xd1, 0xe8, 0x9c, 0x87, 0x4f, 0xbc, 0xd1, 0x91,

-	0xe8, 0x71, 0x1a, 0x1d, 0x94, 0x19, 0xa3, 0xd1, 0x41, 0xeb, 0xba, 0x46, 0xe7, 0x62, 0xd8, 0x5c,

-	0xfb, 0x63, 0x0e, 0x72, 0xdb, 0xe2, 0x73, 0x14, 0x71, 0x20, 0x87, 0x5f, 0x7a, 0x88, 0xa5, 0x13,

-	0xee, 0xff, 0x7a, 0x54, 0xb9, 0x69, 0xc4, 0x60, 0xe5, 0x9d, 0xff, 0xed, 0x97, 0x7f, 0x7e, 0xcc,

-	0xce, 0x42, 0x31, 0x04, 0xbd, 0xd1, 0x69, 0x74, 0x1b, 0x87, 0xd4, 0x23, 0x2e, 0xe4, 0xa3, 0x4f,

-	0x06, 0xe4, 0xb5, 0x51, 0x3e, 0xb0, 0x54, 0x5e, 0x1f, 0x82, 0x32, 0x1b, 0xf4, 0x00, 0xe2, 0x89,

-	0x9d, 0x68, 0x75, 0x0d, 0x7c, 0x7d, 0xa8, 0x2c, 0x0f, 0x83, 0x0d, 0xb5, 0x19, 0xcf, 0xe9, 0x7a,

-	0x9b, 0x03, 0x5f, 0x00, 0xf4, 0x36, 0x35, 0xe3, 0x7e, 0x8a, 0x4d, 0x11, 0x43, 0x3e, 0x09, 0xa5,

-	0xc6, 0x30, 0x31, 0xa7, 0xa7, 0xc6, 0xb0, 0x6f, 0x22, 0x37, 0xc7, 0x30, 0x9c, 0xd3, 0xd2, 0x63,

-	0x98, 0x9c, 0x7a, 0xd3, 0x63, 0xd8, 0x37, 0xec, 0x0d, 0xbd, 0xcf, 0xf0, 0x78, 0x86, 0xfb, 0x4c,

-	0x9e, 0x70, 0x79, 0x18, 0x6c, 0xa8, 0xcd, 0x78, 0xce, 0xd2, 0xdb, 0x1c, 0x18, 0xe5, 0xf4, 0x36,

-	0x07, 0xc7, 0xb5, 0x34, 0x9b, 0x8f, 0x60, 0x26, 0xd9, 0xb2, 0x92, 0x5b, 0x23, 0xf6, 0xd9, 0x95,

-	0x95, 0xe1, 0x40, 0xb3, 0xe5, 0x6f, 0xa1, 0xd8, 0x37, 0xe8, 0x12, 0xad, 0x46, 0xdd, 0x60, 0x5d,

-	0x59, 0x1d, 0x01, 0x39, 0xd4, 0x78, 0xdf, 0x0c, 0xa7, 0x37, 0xae, 0x9b, 0x53, 0xf5, 0xc6, 0xb5,

-	0x03, 0xa1, 0xc1, 0x78, 0xdf, 0xa8, 0xa6, 0x37, 0xae, 0x9b, 0x09, 0xf5, 0xc6, 0xf5, 0x73, 0x9f,

-	0x91, 0x64, 0xd8, 0xfa, 0xa4, 0x92, 0xac, 0xbf, 0x5d, 0x4e, 0x25, 0x99, 0xda, 0xfb, 0x9a, 0x49,

-	0x26, 0xfb, 0xb4, 0x74, 0x92, 0x29, 0xcd, 0x65, 0x3a, 0xc9, 0xd4, 0x96, 0x6f, 0x28, 0xc9, 0xe4,

-	0x81, 0x0d, 0x24, 0x53, 0xce, 0xbc, 0x3a, 0x02, 0x72, 0xc4, 0x38, 0x1b, 0x8d, 0xeb, 0xe6, 0x13,

-	0x53, 0x9c, 0x47, 0x34, 0x2e, 0xe2, 0x8c, 0x7f, 0x83, 0x53, 0xe3, 0xdc, 0xdf, 0x9a, 0xa4, 0xc6,

-	0x59, 0x69, 0x00, 0x86, 0xc4, 0x59, 0xf6, 0x50, 0xe9, 0x71, 0x56, 0x1a, 0xbf, 0xf4, 0x38, 0xab,

-	0xed, 0xd8, 0xd0, 0x7c, 0x96, 0x07, 0x36, 0xe4, 0xb3, 0x72, 0xe6, 0xd5, 0x11, 0x90, 0x46, 0xe3,

-	0x5b, 0x8b, 0x8f, 0x9f, 0x2e, 0xbd, 0xf4, 0x27, 0xfb, 0xfd, 0xfb, 0x74, 0x29, 0xf3, 0xdd, 0xb3,

-	0xa5, 0xcc, 0x63, 0xf6, 0xfb, 0x9d, 0xfd, 0xfe, 0x62, 0xbf, 0x83, 0xe9, 0xf0, 0x7f, 0xc4, 0x36,

-	0xfe, 0x0f, 0x00, 0x00, 0xff, 0xff, 0x53, 0x9c, 0xb7, 0x2f, 0x8a, 0x1b, 0x00, 0x00,

+	// 1498 bytes of a gzipped FileDescriptorProto

+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xcc, 0x59, 0xcf, 0x6f, 0x1b, 0xc5,

+	0x17, 0xaf, 0x9d, 0x34, 0x8e, 0x9f, 0x6b, 0xb7, 0x9e, 0xba, 0xfa, 0x46, 0x6e, 0xbf, 0x09, 0xda,

+	0xd2, 0x34, 0x91, 0x82, 0x03, 0x8e, 0x2a, 0x02, 0x48, 0x20, 0x9c, 0xd0, 0xca, 0xd0, 0x86, 0x6a,

+	0xd3, 0x02, 0xb7, 0xc8, 0xb1, 0xa7, 0x61, 0xf1, 0x8f, 0x35, 0xbb, 0x9b, 0xb4, 0x11, 0x17, 0x38,

+	0x20, 0xf1, 0x27, 0x70, 0xe5, 0xca, 0x81, 0x7f, 0x81, 0x6b, 0xc4, 0x89, 0x0b, 0x12, 0xa7, 0x88,

+	0xf6, 0xc4, 0x09, 0xf1, 0x17, 0x20, 0xe6, 0xc7, 0x9b, 0xdd, 0xf5, 0x7a, 0x76, 0x6d, 0x27, 0x41,

+	0xe9, 0xc1, 0xca, 0xee, 0xcc, 0xe7, 0xfd, 0x98, 0x79, 0x9f, 0xf7, 0xf6, 0xcd, 0x04, 0xf2, 0x4d,

+	0xbb, 0xe7, 0x39, 0x76, 0xa7, 0xd2, 0x77, 0x6c, 0xcf, 0x26, 0xa4, 0x65, 0x37, 0xdb, 0xd4, 0xa9,

+	0xb8, 0x4f, 0x1b, 0x4e, 0xb7, 0x6d, 0x79, 0x95, 0x83, 0x37, 0xca, 0x39, 0xb7, 0x4f, 0x9b, 0xae,

+	0x04, 0x94, 0xf3, 0xf6, 0xee, 0x17, 0xb4, 0xe9, 0xa9, 0xd7, 0x9c, 0x77, 0xd8, 0xa7, 0xea, 0xa5,

+	0xb4, 0x67, 0xef, 0xd9, 0xe2, 0x71, 0x95, 0x3f, 0xe1, 0xe8, 0xd5, 0x7e, 0x67, 0x7f, 0xcf, 0xea,

+	0xad, 0xca, 0x3f, 0x72, 0xd0, 0xb8, 0x03, 0x85, 0x7b, 0xd4, 0xdb, 0xb2, 0x5b, 0xd4, 0xa4, 0x5f,

+	0xee, 0x53, 0xd7, 0x23, 0x37, 0x21, 0xd3, 0x63, 0xaf, 0x3b, 0x56, 0x6b, 0x2e, 0xf5, 0x4a, 0x6a,

+	0x29, 0x5b, 0x83, 0x17, 0xc7, 0x0b, 0x33, 0x1c, 0x51, 0xdf, 0x34, 0x67, 0xf8, 0x54, 0xbd, 0x65,

+	0xbc, 0x07, 0x97, 0x7d, 0x31, 0xb7, 0x6f, 0xf7, 0x5c, 0x4a, 0x56, 0x60, 0x9a, 0x4f, 0x0a, 0xa1,

+	0x5c, 0x75, 0xae, 0x32, 0xbc, 0x80, 0x8a, 0xc0, 0x0b, 0x94, 0x71, 0x3c, 0x05, 0x57, 0xee, 0x5b,

+	0xae, 0x50, 0xe1, 0x2a, 0xd3, 0x77, 0x21, 0xf3, 0xc4, 0xea, 0x78, 0xd4, 0x71, 0x51, 0xcb, 0x8a,

+	0x4e, 0x4b, 0x54, 0xac, 0x72, 0x57, 0xca, 0x98, 0x4a, 0xb8, 0xfc, 0xcd, 0x14, 0x64, 0x70, 0x90,

+	0x94, 0xe0, 0x62, 0xaf, 0xd1, 0xa5, 0x5c, 0xe3, 0xd4, 0x52, 0xd6, 0x94, 0x2f, 0x64, 0x15, 0x72,

+	0x56, 0x6b, 0xa7, 0xef, 0xd0, 0x27, 0xd6, 0x33, 0x36, 0x97, 0xe6, 0x73, 0xb5, 0x02, 0x5b, 0x28,

+	0xd4, 0x37, 0x1f, 0xe2, 0xa8, 0x09, 0x56, 0x4b, 0x3d, 0x93, 0x87, 0x30, 0xd3, 0x69, 0xec, 0xd2,

+	0x8e, 0x3b, 0x37, 0xc5, 0xb0, 0xb9, 0xea, 0xfa, 0x24, 0x9e, 0x55, 0xee, 0x0b, 0xd1, 0x0f, 0x58,

+	0x80, 0x0f, 0x4d, 0xd4, 0x43, 0xea, 0x90, 0xeb, 0xd2, 0xee, 0x2e, 0x9b, 0xfe, 0xdc, 0xea, 0xbb,

+	0x73, 0xd3, 0x4c, 0x6d, 0xa1, 0x7a, 0x3b, 0x6e, 0xdb, 0xb6, 0x59, 0xe8, 0x2b, 0x0f, 0x7c, 0xbc,

+	0x19, 0x96, 0x25, 0x55, 0xb8, 0xc8, 0x98, 0xc3, 0xd6, 0x71, 0x51, 0x28, 0xb9, 0x11, 0xbb, 0xf7,

+	0x0c, 0x64, 0x4a, 0x28, 0x0b, 0x73, 0x9e, 0x6f, 0x45, 0xb0, 0x07, 0x33, 0x62, 0x7f, 0x2e, 0xf1,

+	0x41, 0xb5, 0xea, 0xf2, 0x5b, 0x90, 0x0b, 0xb9, 0x4e, 0xae, 0xc0, 0x54, 0x9b, 0x1e, 0x4a, 0x5a,

+	0x98, 0xfc, 0x91, 0xef, 0xee, 0x41, 0xa3, 0xb3, 0x4f, 0xd9, 0x0e, 0xf2, 0x31, 0xf9, 0xf2, 0x76,

+	0x7a, 0x3d, 0x65, 0x6c, 0x40, 0x31, 0xb4, 0x1d, 0xc8, 0x91, 0x0a, 0x0b, 0x06, 0x1f, 0x10, 0xc1,

+	0x48, 0x22, 0x89, 0x84, 0x19, 0x3f, 0xa6, 0xa0, 0xf8, 0xb8, 0xdf, 0x6a, 0x78, 0x74, 0x52, 0x86,

+	0x92, 0x77, 0xe1, 0x92, 0x00, 0x1d, 0xb0, 0x4d, 0xb2, 0xec, 0x9e, 0x70, 0x30, 0x57, 0xbd, 0xae,

+	0xb3, 0xf8, 0x89, 0x84, 0x98, 0x39, 0x2e, 0x80, 0x2f, 0xe4, 0x75, 0x98, 0xe6, 0xe9, 0xc6, 0xc2,

+	0xcd, 0xe5, 0x6e, 0x24, 0xc5, 0xc5, 0x14, 0x48, 0xa3, 0x06, 0x24, 0xec, 0xeb, 0x89, 0xd2, 0x62,

+	0x1d, 0x8a, 0x26, 0xed, 0xda, 0x07, 0x13, 0xaf, 0xd7, 0x28, 0x01, 0x09, 0x4b, 0x4a, 0xeb, 0x98,

+	0xde, 0x8f, 0x1a, 0x6e, 0x3b, 0xa4, 0xcc, 0x63, 0xaf, 0x11, 0x65, 0x1c, 0xc1, 0x95, 0xf1, 0x29,

+	0x3f, 0xbd, 0xa5, 0x58, 0xb0, 0x0e, 0x3e, 0x99, 0xb4, 0x0e, 0x81, 0x17, 0xa8, 0x60, 0x1d, 0x13,

+	0x9b, 0xf6, 0xd7, 0x11, 0xb6, 0x6e, 0xfc, 0x83, 0xe5, 0x82, 0x0f, 0x9e, 0xa0, 0x5c, 0x84, 0xc5,

+	0x86, 0xcb, 0xc5, 0x0f, 0xe7, 0x58, 0x2e, 0x74, 0x9e, 0x69, 0xcb, 0x05, 0x73, 0xc1, 0xa5, 0xce,

+	0x81, 0xd5, 0xe4, 0x3c, 0x90, 0xe5, 0x02, 0x5d, 0xd8, 0x96, 0xc3, 0xf5, 0x4d, 0xe6, 0x02, 0x42,

+	0xea, 0x2d, 0x97, 0x2c, 0xc2, 0x2c, 0xb2, 0x46, 0xd6, 0x85, 0x6c, 0x2d, 0xc7, 0xd0, 0x19, 0x49,

+	0x1b, 0xb6, 0x7a, 0xc9, 0x1b, 0x97, 0x6c, 0x42, 0x81, 0xa5, 0x9a, 0xe5, 0xd0, 0xd6, 0x8e, 0xeb,

+	0x31, 0xf6, 0xca, 0x4a, 0x50, 0xa8, 0xfe, 0x3f, 0x2e, 0xc4, 0xdb, 0x1c, 0x65, 0xe6, 0x51, 0x48,

+	0xbc, 0x69, 0xca, 0x49, 0xe6, 0x3f, 0x29, 0x27, 0xb8, 0x5d, 0x41, 0x39, 0xe1, 0xac, 0x49, 0x2c,

+	0x27, 0x82, 0x46, 0x12, 0x66, 0x7c, 0x04, 0xa5, 0x0d, 0x87, 0x32, 0x7f, 0x71, 0xcb, 0x14, 0x91,

+	0xd6, 0x30, 0xd7, 0x25, 0x8b, 0x16, 0x74, 0x6a, 0x50, 0x22, 0x94, 0xee, 0x5b, 0x70, 0x2d, 0xa2,

+	0x0c, 0xbd, 0xba, 0x03, 0x19, 0x0c, 0x03, 0x2a, 0xbc, 0x9e, 0xa0, 0xd0, 0x54, 0x58, 0xe3, 0x7d,

+	0x28, 0xb2, 0x9c, 0x8b, 0x78, 0xb6, 0x02, 0x10, 0x44, 0x1d, 0xb3, 0x26, 0xcf, 0xc2, 0x98, 0xf5,

+	0x83, 0x6e, 0x66, 0xfd, 0x98, 0xb3, 0xf5, 0x91, 0xb0, 0x8a, 0xd3, 0xf9, 0xf3, 0x73, 0x0a, 0x4a,

+	0xb2, 0x9e, 0x9d, 0xc6, 0x27, 0x46, 0xaf, 0xcb, 0x0a, 0x3d, 0x41, 0x29, 0x2e, 0xa0, 0x8c, 0xaa,

+	0xc6, 0x6b, 0x03, 0xd5, 0x78, 0xfc, 0x08, 0x45, 0x16, 0x70, 0xba, 0x1d, 0xd9, 0x84, 0x92, 0x2c,

+	0x4d, 0xa7, 0x0a, 0xd2, 0xff, 0xe0, 0x5a, 0x44, 0x0b, 0xd6, 0xb8, 0x3f, 0xd3, 0x70, 0x95, 0x73,

+	0x1c, 0xc7, 0xfd, 0x32, 0x57, 0x8f, 0x96, 0xb9, 0xd5, 0xb8, 0x62, 0x12, 0x91, 0x1c, 0xae, 0x74,

+	0xdf, 0xa6, 0xcf, 0xbc, 0xd2, 0x6d, 0x47, 0x2a, 0xdd, 0x3b, 0x13, 0x3a, 0xa7, 0x2d, 0x76, 0x43,

+	0xd5, 0x64, 0xfa, 0x6c, 0xab, 0xc9, 0xc7, 0x50, 0x1a, 0x74, 0x09, 0x89, 0xf1, 0x26, 0xcc, 0x62,

+	0xa0, 0x54, 0x4d, 0x49, 0x64, 0x86, 0x0f, 0x0e, 0x2a, 0xcb, 0x16, 0xf5, 0x9e, 0xda, 0x4e, 0x7b,

+	0x82, 0xca, 0x82, 0x12, 0xba, 0xca, 0xe2, 0x2b, 0x0b, 0x78, 0xdb, 0x93, 0x43, 0x49, 0xbc, 0x55,

+	0x52, 0x0a, 0x6b, 0x3c, 0x16, 0x95, 0x25, 0xe2, 0x19, 0x61, 0x7d, 0x09, 0xdb, 0x4d, 0xdc, 0x2f,

+	0xf1, 0xcc, 0x89, 0x8c, 0x32, 0x9c, 0xc8, 0xe9, 0x80, 0xc8, 0x28, 0xcb, 0x89, 0x8c, 0x00, 0xbf,

+	0xda, 0x9c, 0x91, 0x8f, 0x9f, 0xa9, 0xdc, 0x3a, 0x73, 0x37, 0xfd, 0x7c, 0x8b, 0x78, 0xea, 0xe7,

+	0x1b, 0x8e, 0x9f, 0x20, 0xdf, 0x22, 0x92, 0x2f, 0x57, 0xbe, 0xc5, 0x38, 0x77, 0x9e, 0xf9, 0x16,

+	0xb8, 0x14, 0xe4, 0x1b, 0x06, 0x2a, 0x31, 0xdf, 0x54, 0xe4, 0x7c, 0x30, 0x7e, 0x2c, 0x37, 0x3a,

+	0xfb, 0x2e, 0x5b, 0x53, 0xa8, 0x0e, 0x37, 0xe5, 0x48, 0xa4, 0x0e, 0x23, 0x8e, 0xf3, 0x02, 0x01,

+	0x3e, 0x7d, 0x7d, 0x15, 0x01, 0x7d, 0x11, 0x92, 0x44, 0x5f, 0x25, 0xa5, 0xb0, 0x3e, 0x97, 0x70,

+	0xe2, 0x04, 0x5c, 0x8a, 0x48, 0xbe, 0x5c, 0x5c, 0x8a, 0x71, 0xee, 0x3c, 0xb9, 0x14, 0xb8, 0x14,

+	0x70, 0x09, 0xa3, 0x91, 0xc8, 0x25, 0x15, 0x3a, 0x1f, 0x6c, 0xec, 0x43, 0xf1, 0x43, 0xdb, 0xea,

+	0x3d, 0xb2, 0xdb, 0xb4, 0x67, 0xda, 0xac, 0x9d, 0xe5, 0x0d, 0x47, 0x05, 0xae, 0x3a, 0xfc, 0x99,

+	0xee, 0x70, 0xc2, 0x31, 0x46, 0x79, 0x7c, 0x5a, 0x78, 0x38, 0x6b, 0x16, 0xe5, 0xd4, 0xa7, 0x62,

+	0x46, 0xc8, 0xb1, 0xe3, 0x62, 0x09, 0xf1, 0xdd, 0x46, 0xaf, 0xb1, 0xe7, 0x0b, 0xa4, 0x85, 0x00,

+	0x91, 0x73, 0x0f, 0xe4, 0x94, 0x90, 0x30, 0xbe, 0x4b, 0xab, 0xfe, 0xea, 0x34, 0x34, 0xe6, 0xfd,

+	0x95, 0x42, 0x4f, 0xd2, 0x5f, 0xa1, 0xcc, 0x04, 0xfd, 0x15, 0x5a, 0x0f, 0xbe, 0x53, 0xe4, 0x1e,

+	0xcc, 0x3a, 0xb8, 0x5f, 0x2c, 0xc8, 0x5c, 0xf0, 0x96, 0x4e, 0x70, 0x68, 0x73, 0x6b, 0xd3, 0x47,

+	0xc7, 0x0b, 0x17, 0x4c, 0x5f, 0x38, 0x68, 0xd4, 0xce, 0x26, 0x1b, 0xab, 0xbf, 0x15, 0x21, 0xb3,

+	0x21, 0xaf, 0xd3, 0x88, 0x05, 0x19, 0xbc, 0xa9, 0x22, 0x86, 0x4e, 0x78, 0xf0, 0xf6, 0xab, 0x7c,

+	0x33, 0x11, 0x83, 0x5f, 0x8e, 0x6b, 0xbf, 0xfc, 0xf4, 0xd7, 0xf7, 0xe9, 0xcb, 0x90, 0x17, 0xa0,

+	0xd7, 0x30, 0xe2, 0xc4, 0x86, 0xac, 0x7f, 0xe5, 0x41, 0x5e, 0x1d, 0xe7, 0x82, 0xa8, 0x7c, 0x6b,

+	0x04, 0x2a, 0xd9, 0xa0, 0x03, 0x10, 0xdc, 0x38, 0x10, 0xad, 0xae, 0xa1, 0xdb, 0x93, 0xf2, 0xe2,

+	0x28, 0xd8, 0x48, 0x9b, 0xc1, 0x3d, 0x83, 0xde, 0xe6, 0xd0, 0x0d, 0x86, 0xde, 0xa6, 0xe6, 0xba,

+	0x22, 0xc6, 0xa6, 0x8c, 0x21, 0x3f, 0xc9, 0xc5, 0xc6, 0x30, 0x74, 0xcf, 0x10, 0x1b, 0xc3, 0x81,

+	0x1b, 0x85, 0xe4, 0x18, 0x8a, 0x73, 0x66, 0x7c, 0x0c, 0xc3, 0xa7, 0xf6, 0xf8, 0x18, 0x0e, 0x1c,

+	0x56, 0x47, 0xee, 0xa7, 0x58, 0x5e, 0xc2, 0x7e, 0x86, 0x57, 0xb8, 0x38, 0x0a, 0x36, 0xd2, 0x66,

+	0x70, 0x4e, 0xd4, 0xdb, 0x1c, 0x3a, 0x8a, 0xea, 0x6d, 0x0e, 0x1f, 0x37, 0xe3, 0x6c, 0x3e, 0x83,

+	0x4b, 0xe1, 0x96, 0x9b, 0xdc, 0x1e, 0xf3, 0x9c, 0x50, 0x5e, 0x1a, 0x0d, 0x4c, 0xb6, 0xfc, 0x15,

+	0xe4, 0x07, 0x0e, 0xea, 0x44, 0xab, 0x51, 0x77, 0x31, 0x50, 0x5e, 0x1e, 0x03, 0x39, 0xd2, 0xf8,

+	0xc0, 0x19, 0x54, 0x6f, 0x5c, 0x77, 0xce, 0xd6, 0x1b, 0xd7, 0x1e, 0x68, 0x13, 0x8c, 0x0f, 0x1c,

+	0x35, 0xf5, 0xc6, 0x75, 0x67, 0x5a, 0xbd, 0x71, 0xfd, 0xb9, 0x35, 0x91, 0x64, 0xd8, 0xba, 0xc5,

+	0x92, 0x6c, 0xb0, 0xdd, 0x8f, 0x25, 0x59, 0xb4, 0x77, 0x4f, 0x26, 0x99, 0xea, 0x33, 0xe3, 0x49,

+	0x16, 0x69, 0x8e, 0xe3, 0x49, 0x16, 0x6d, 0x59, 0x47, 0x92, 0x4c, 0x2d, 0x38, 0x81, 0x64, 0x91,

+	0x35, 0x2f, 0x8f, 0x81, 0x1c, 0x33, 0xce, 0x89, 0xc6, 0x75, 0xe7, 0xab, 0xa4, 0x38, 0x8f, 0x69,

+	0x5c, 0xc6, 0x19, 0xbf, 0xc1, 0xb1, 0x71, 0x1e, 0xec, 0x71, 0x62, 0xe3, 0x1c, 0x69, 0x00, 0x46,

+	0xc4, 0x59, 0xf5, 0x80, 0xf1, 0x71, 0x8e, 0x34, 0xae, 0xf1, 0x71, 0x8e, 0xb6, 0x93, 0x23, 0xf3,

+	0x59, 0x2d, 0x38, 0x21, 0x9f, 0x23, 0x6b, 0x5e, 0x1e, 0x03, 0x99, 0x68, 0xbc, 0x76, 0xe3, 0xe8,

+	0xf9, 0xfc, 0x85, 0xdf, 0xd9, 0xef, 0xef, 0xe7, 0xf3, 0xa9, 0xaf, 0x5f, 0xcc, 0xa7, 0x8e, 0xd8,

+	0xef, 0x57, 0xf6, 0xfb, 0x83, 0xfd, 0x76, 0x67, 0xc4, 0x7f, 0xf4, 0xd6, 0xfe, 0x0d, 0x00, 0x00,

+	0xff, 0xff, 0xf3, 0xcc, 0x22, 0xcd, 0x4a, 0x1c, 0x00, 0x00,

 }

@@ -267,6 +267,14 @@ message ListClustersResponse {

 	repeated Cluster clusters = 1;

 }

+message JoinTokenRotation {

+	// RotateWorkerToken tells UpdateCluster to rotate the worker secret.

+	bool rotate_worker_token = 1;

+

+	// RotateManagerSecret tells UpdateCluster to rotate the manager secret.

+	bool rotate_manager_token = 2;

+}

+

 message UpdateClusterRequest {

 	// ClusterID is the cluster ID to update.

 	string cluster_id = 1 [(gogoproto.customname) = "ClusterID"];

@@ -276,6 +284,9 @@ message UpdateClusterRequest {

 	// Spec is the new spec to apply to the cluster.

 	ClusterSpec spec = 3;

+

+	// Rotation contains flags for join token rotation

+	JoinTokenRotation rotation = 4 [(gogoproto.nullable) = false];

 }

 message UpdateClusterResponse {

@@ -493,7 +493,9 @@ func (*NetworkSpec) Descriptor() ([]byte, []int) { return fileDescriptorSpecs, [

 // ClusterSpec specifies global cluster settings.

 type ClusterSpec struct {

 	Annotations Annotations `protobuf:"bytes,1,opt,name=annotations" json:"annotations"`

-	// AcceptancePolicy defines the certificate issuance policy.

+	// DEPRECATED: AcceptancePolicy defines the certificate issuance policy.

+	// Acceptance policy is no longer customizable, and secrets have been

+	// replaced with join tokens.

 	AcceptancePolicy AcceptancePolicy `protobuf:"bytes,2,opt,name=acceptance_policy,json=acceptancePolicy" json:"acceptance_policy"`

 	// Orchestration defines cluster-level orchestration settings.

 	Orchestration OrchestrationConfig `protobuf:"bytes,3,opt,name=orchestration" json:"orchestration"`

@@ -503,12 +505,8 @@ type ClusterSpec struct {

 	Dispatcher DispatcherConfig `protobuf:"bytes,5,opt,name=dispatcher" json:"dispatcher"`

 	// CAConfig defines cluster-level certificate authority settings.

 	CAConfig CAConfig `protobuf:"bytes,6,opt,name=ca_config,json=caConfig" json:"ca_config"`

-	// DefaultLogDriver specifies the log driver to use for the cluster if not

-	// specified for each task.

-	//

-	// If this is changed, only new tasks will pick up the new log driver.

-	// Existing tasks will continue to use the previous default until rescheduled.

-	DefaultLogDriver *Driver `protobuf:"bytes,7,opt,name=default_log_driver,json=defaultLogDriver" json:"default_log_driver,omitempty"`

+	// TaskDefaults specifies the default values to use for task creation.

+	TaskDefaults TaskDefaults `protobuf:"bytes,7,opt,name=task_defaults,json=taskDefaults" json:"task_defaults"`

 }

 func (m *ClusterSpec) Reset()                    { *m = ClusterSpec{} }