@@ -147,7 +147,7 @@ clone git github.com/docker/containerd 52ef1ceb4b660c42cf4ea9013180a5663968d4c7

 clone git github.com/tonistiigi/fifo 8c56881ce5e63e19e2dfc495c8af0fb90916467d

 # cluster

-clone git github.com/docker/swarmkit 3b221eb0391d34ae0b9dac65df02b5b64de6dff2

+clone git github.com/docker/swarmkit 0ec7c6ee4b3185ec4e3d6bd65f8f5542b1761421

 clone git github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9

 clone git github.com/gogo/protobuf v0.3

 clone git github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a

@@ -48,9 +48,11 @@ func New(config *Config) (*Agent, error) {

 		return nil, err

 	}

+	worker := newWorker(config.DB, config.Executor)

+

 	a := &Agent{

 		config:   config,

-		worker:   newWorker(config.DB, config.Executor),

+		worker:   worker,

 		sessionq: make(chan sessionOperation),

 		started:  make(chan struct{}),

 		stopped:  make(chan struct{}),

@@ -278,8 +280,8 @@ func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMe

 	if message.Node != nil {

 		if a.node == nil || !nodesEqual(a.node, message.Node) {

-			if a.config.NotifyRoleChange != nil {

-				a.config.NotifyRoleChange <- message.Node.Spec.Role

+			if a.config.NotifyNodeChange != nil {

+				a.config.NotifyNodeChange <- message.Node.Copy()

 			}

 			a.node = message.Node.Copy()

 			if err := a.config.Executor.Configure(ctx, a.node); err != nil {

@@ -24,8 +24,8 @@ type Config struct {

 	// DB used for task storage. Must be open for the lifetime of the agent.

 	DB *bolt.DB

-	// NotifyRoleChange channel receives new roles from session messages.

-	NotifyRoleChange chan<- api.NodeRole

+	// NotifyNodeChange channel receives new node changes from session messages.

+	NotifyNodeChange chan<- *api.Node

 	// Credentials is credentials for grpc connection to manager.

 	Credentials credentials.TransportCredentials

@@ -277,7 +277,7 @@ func Do(ctx context.Context, task *api.Task, ctlr Controller) (*api.TaskStatus,

 	}

 	switch status.State {

-	case api.TaskStateNew, api.TaskStateAllocated, api.TaskStateAssigned:

+	case api.TaskStateNew, api.TaskStatePending, api.TaskStateAssigned:

 		return transition(api.TaskStateAccepted, "accepted")

 	case api.TaskStateAccepted:

 		return transition(api.TaskStatePreparing, "preparing")

@@ -21,3 +21,25 @@ type Executor interface {

 	// manager to the executor.

 	SetNetworkBootstrapKeys([]*api.EncryptionKey) error

 }

+

+// SecretsProvider is implemented by objects that can store secrets, typically

+// an executor.

+type SecretsProvider interface {

+	Secrets() SecretsManager

+}

+

+// SecretGetter contains secret data necessary for the Controller.

+type SecretGetter interface {

+	// Get returns the the secret with a specific secret ID, if available.

+	// When the secret is not available, the return will be nil.

+	Get(secretID string) *api.Secret

+}

+

+// SecretsManager is the interface for secret storage and updates.

+type SecretsManager interface {

+	SecretGetter

+

+	Add(secrets ...api.Secret) // add one or more secrets

+	Remove(secrets []string)   // remove the secrets by ID

+	Reset()                    // remove all secrets

+}

deleted file mode 100644

@@ -1,53 +0,0 @@

-package agent

-

-import (

-	"sync"

-

-	"github.com/docker/swarmkit/api"

-)

-

-// secrets is a map that keeps all the currenty available secrets to the agent

-// mapped by secret ID

-type secrets struct {

-	mu sync.RWMutex

-	m  map[string]api.Secret

-}

-

-func newSecrets() *secrets {

-	return &secrets{

-		m: make(map[string]api.Secret),

-	}

-}

-

-// Get returns a secret by ID.  If the secret doesn't exist, returns nil.

-func (s *secrets) Get(secretID string) api.Secret {

-	s.mu.RLock()

-	defer s.mu.RUnlock()

-	return s.m[secretID]

-}

-

-// Add adds one or more secrets to the secret map

-func (s *secrets) Add(secrets ...api.Secret) {

-	s.mu.Lock()

-	defer s.mu.Unlock()

-	for _, secret := range secrets {

-		s.m[secret.ID] = secret

-	}

-}

-

-// Remove removes one or more secrets by ID from the secret map.  Succeeds

-// whether or not the given IDs are in the map.

-func (s *secrets) Remove(secrets []string) {

-	s.mu.Lock()

-	defer s.mu.Unlock()

-	for _, secret := range secrets {

-		delete(s.m, secret)

-	}

-}

-

-// Reset removes all the secrets

-func (s *secrets) Reset() {

-	s.mu.Lock()

-	defer s.mu.Unlock()

-	s.m = make(map[string]api.Secret)

-}

@@ -42,7 +42,6 @@ type worker struct {

 	db        *bolt.DB

 	executor  exec.Executor

 	listeners map[*statusReporterKey]struct{}

-	secrets   *secrets

 	taskManagers map[string]*taskManager

 	mu           sync.RWMutex

@@ -54,7 +53,6 @@ func newWorker(db *bolt.DB, executor exec.Executor) *worker {

 		executor:     executor,

 		listeners:    make(map[*statusReporterKey]struct{}),

 		taskManagers: make(map[string]*taskManager),

-		secrets:      newSecrets(),

 	}

 }

@@ -255,6 +253,15 @@ func reconcileTaskState(ctx context.Context, w *worker, assignments []*api.Assig

 }

 func reconcileSecrets(ctx context.Context, w *worker, assignments []*api.AssignmentChange, fullSnapshot bool) error {

+	var secrets exec.SecretsManager

+	provider, ok := w.executor.(exec.SecretsProvider)

+	if !ok {

+		log.G(ctx).Warn("secrets update ignored; executor does not support secrets")

+		return nil

+	}

+

+	secrets = provider.Secrets()

+

 	var (

 		updatedSecrets []api.Secret

 		removedSecrets []string

@@ -278,11 +285,11 @@ func reconcileSecrets(ctx context.Context, w *worker, assignments []*api.Assignm

 	// If this was a complete set of secrets, we're going to clear the secrets map and add all of them

 	if fullSnapshot {

-		w.secrets.Reset()

+		secrets.Reset()

 	} else {

-		w.secrets.Remove(removedSecrets)

+		secrets.Remove(removedSecrets)

 	}

-	w.secrets.Add(updatedSecrets...)

+	secrets.Add(updatedSecrets...)

 	return nil

 }

@@ -459,6 +459,28 @@ func (m *GetSecretResponse) Reset()                    { *m = GetSecretResponse{

 func (*GetSecretResponse) ProtoMessage()               {}

 func (*GetSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{40} }

+type UpdateSecretRequest struct {

+	// SecretID is the secret ID to update.

+	SecretID string `protobuf:"bytes,1,opt,name=secret_id,json=secretId,proto3" json:"secret_id,omitempty"`

+	// SecretVersion is the version of the secret being updated.

+	SecretVersion *Version `protobuf:"bytes,2,opt,name=secret_version,json=secretVersion" json:"secret_version,omitempty"`

+	// Spec is the new spec to apply to the Secret

+	// Only some fields are allowed to be updated.

+	Spec *SecretSpec `protobuf:"bytes,3,opt,name=spec" json:"spec,omitempty"`

+}

+

+func (m *UpdateSecretRequest) Reset()                    { *m = UpdateSecretRequest{} }

+func (*UpdateSecretRequest) ProtoMessage()               {}

+func (*UpdateSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{41} }

+

+type UpdateSecretResponse struct {

+	Secret *Secret `protobuf:"bytes,1,opt,name=secret" json:"secret,omitempty"`

+}

+

+func (m *UpdateSecretResponse) Reset()                    { *m = UpdateSecretResponse{} }

+func (*UpdateSecretResponse) ProtoMessage()               {}

+func (*UpdateSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{42} }

+

 // ListSecretRequest is the request to list all non-internal secrets in the secret store,

 // or all secrets filtered by (name or name prefix or id prefix) and labels.

 type ListSecretsRequest struct {

@@ -467,7 +489,7 @@ type ListSecretsRequest struct {

 func (m *ListSecretsRequest) Reset()                    { *m = ListSecretsRequest{} }

 func (*ListSecretsRequest) ProtoMessage()               {}

-func (*ListSecretsRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{41} }

+func (*ListSecretsRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{43} }

 type ListSecretsRequest_Filters struct {

 	Names        []string          `protobuf:"bytes,1,rep,name=names" json:"names,omitempty"`

@@ -479,7 +501,7 @@ type ListSecretsRequest_Filters struct {

 func (m *ListSecretsRequest_Filters) Reset()      { *m = ListSecretsRequest_Filters{} }

 func (*ListSecretsRequest_Filters) ProtoMessage() {}

 func (*ListSecretsRequest_Filters) Descriptor() ([]byte, []int) {

-	return fileDescriptorControl, []int{41, 0}

+	return fileDescriptorControl, []int{43, 0}

 }

 // ListSecretResponse contains a list of all the secrets that match the name or

@@ -492,7 +514,7 @@ type ListSecretsResponse struct {

 func (m *ListSecretsResponse) Reset()                    { *m = ListSecretsResponse{} }

 func (*ListSecretsResponse) ProtoMessage()               {}

-func (*ListSecretsResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{42} }

+func (*ListSecretsResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{44} }

 // CreateSecretRequest specifies a new secret (it will not update an existing

 // secret) to create.

@@ -502,7 +524,7 @@ type CreateSecretRequest struct {

 func (m *CreateSecretRequest) Reset()                    { *m = CreateSecretRequest{} }

 func (*CreateSecretRequest) ProtoMessage()               {}

-func (*CreateSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{43} }

+func (*CreateSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{45} }

 // CreateSecretResponse contains the newly created `Secret`` corresponding to the

 // name in `CreateSecretRequest`.  The `Secret.Spec.Data` field should be nil instead

@@ -513,7 +535,7 @@ type CreateSecretResponse struct {

 func (m *CreateSecretResponse) Reset()                    { *m = CreateSecretResponse{} }

 func (*CreateSecretResponse) ProtoMessage()               {}

-func (*CreateSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{44} }

+func (*CreateSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{46} }

 // RemoveSecretRequest contains the ID of the secret that should be removed.  This

 // removes all versions of the secret.

@@ -523,7 +545,7 @@ type RemoveSecretRequest struct {

 func (m *RemoveSecretRequest) Reset()                    { *m = RemoveSecretRequest{} }

 func (*RemoveSecretRequest) ProtoMessage()               {}

-func (*RemoveSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{45} }

+func (*RemoveSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{47} }

 // RemoveSecretResponse is an empty object indicating the successful removal of

 // a secret.

@@ -532,7 +554,7 @@ type RemoveSecretResponse struct {

 func (m *RemoveSecretResponse) Reset()                    { *m = RemoveSecretResponse{} }

 func (*RemoveSecretResponse) ProtoMessage()               {}

-func (*RemoveSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{46} }

+func (*RemoveSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{48} }

 func init() {

 	proto.RegisterType((*GetNodeRequest)(nil), "docker.swarmkit.v1.GetNodeRequest")

@@ -581,6 +603,8 @@ func init() {

 	proto.RegisterType((*UpdateClusterResponse)(nil), "docker.swarmkit.v1.UpdateClusterResponse")

 	proto.RegisterType((*GetSecretRequest)(nil), "docker.swarmkit.v1.GetSecretRequest")

 	proto.RegisterType((*GetSecretResponse)(nil), "docker.swarmkit.v1.GetSecretResponse")

+	proto.RegisterType((*UpdateSecretRequest)(nil), "docker.swarmkit.v1.UpdateSecretRequest")

+	proto.RegisterType((*UpdateSecretResponse)(nil), "docker.swarmkit.v1.UpdateSecretResponse")

 	proto.RegisterType((*ListSecretsRequest)(nil), "docker.swarmkit.v1.ListSecretsRequest")

 	proto.RegisterType((*ListSecretsRequest_Filters)(nil), "docker.swarmkit.v1.ListSecretsRequest.Filters")

 	proto.RegisterType((*ListSecretsResponse)(nil), "docker.swarmkit.v1.ListSecretsResponse")

@@ -762,6 +786,14 @@ func (p *authenticatedWrapperControlServer) GetSecret(ctx context.Context, r *Ge

 	return p.local.GetSecret(ctx, r)

 }

+func (p *authenticatedWrapperControlServer) UpdateSecret(ctx context.Context, r *UpdateSecretRequest) (*UpdateSecretResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.UpdateSecret(ctx, r)

+}

+

 func (p *authenticatedWrapperControlServer) ListSecrets(ctx context.Context, r *ListSecretsRequest) (*ListSecretsResponse, error) {

 	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

@@ -1491,6 +1523,32 @@ func (m *GetSecretResponse) Copy() *GetSecretResponse {

 	return o

 }

+func (m *UpdateSecretRequest) Copy() *UpdateSecretRequest {

+	if m == nil {

+		return nil

+	}

+

+	o := &UpdateSecretRequest{

+		SecretID:      m.SecretID,

+		SecretVersion: m.SecretVersion.Copy(),

+		Spec:          m.Spec.Copy(),

+	}

+

+	return o

+}

+

+func (m *UpdateSecretResponse) Copy() *UpdateSecretResponse {

+	if m == nil {

+		return nil

+	}

+

+	o := &UpdateSecretResponse{

+		Secret: m.Secret.Copy(),

+	}

+

+	return o

+}

+

 func (m *ListSecretsRequest) Copy() *ListSecretsRequest {

 	if m == nil {

 		return nil

@@ -2203,6 +2261,34 @@ func (this *GetSecretResponse) GoString() string {

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

+func (this *UpdateSecretRequest) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 7)

+	s = append(s, "&api.UpdateSecretRequest{")

+	s = append(s, "SecretID: "+fmt.Sprintf("%#v", this.SecretID)+",\n")

+	if this.SecretVersion != nil {

+		s = append(s, "SecretVersion: "+fmt.Sprintf("%#v", this.SecretVersion)+",\n")

+	}

+	if this.Spec != nil {

+		s = append(s, "Spec: "+fmt.Sprintf("%#v", this.Spec)+",\n")

+	}

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

+func (this *UpdateSecretResponse) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 5)

+	s = append(s, "&api.UpdateSecretResponse{")

+	if this.Secret != nil {

+		s = append(s, "Secret: "+fmt.Sprintf("%#v", this.Secret)+",\n")

+	}

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

 func (this *ListSecretsRequest) GoString() string {

 	if this == nil {

 		return "nil"

@@ -2358,6 +2444,12 @@ type ControlClient interface {

 	// - Returns `InvalidArgument` if the `GetSecretRequest.SecretID` is empty.

 	// - Returns an error if getting fails.

 	GetSecret(ctx context.Context, in *GetSecretRequest, opts ...grpc.CallOption) (*GetSecretResponse, error)

+	// UpdateSecret returns a `UpdateSecretResponse` with a `Secret` with the same

+	// id as `GetSecretRequest.SecretID`

+	// - Returns `NotFound` if the Secret with the given id is not found.

+	// - Returns `InvalidArgument` if the `GetSecretRequest.SecretID` is empty.

+	// - Returns an error if updating fails.

+	UpdateSecret(ctx context.Context, in *UpdateSecretRequest, opts ...grpc.CallOption) (*UpdateSecretResponse, error)

 	// ListSecrets returns a `ListSecretResponse` with a list all non-internal `Secret`s being

 	// managed, or all secrets matching any name in `ListSecretsRequest.Names`, any

 	// name prefix in `ListSecretsRequest.NamePrefixes`, any id in

@@ -2565,6 +2657,15 @@ func (c *controlClient) GetSecret(ctx context.Context, in *GetSecretRequest, opt

 	return out, nil

 }

+func (c *controlClient) UpdateSecret(ctx context.Context, in *UpdateSecretRequest, opts ...grpc.CallOption) (*UpdateSecretResponse, error) {

+	out := new(UpdateSecretResponse)

+	err := grpc.Invoke(ctx, "/docker.swarmkit.v1.Control/UpdateSecret", in, out, c.cc, opts...)

+	if err != nil {

+		return nil, err

+	}

+	return out, nil

+}

+

 func (c *controlClient) ListSecrets(ctx context.Context, in *ListSecretsRequest, opts ...grpc.CallOption) (*ListSecretsResponse, error) {

 	out := new(ListSecretsResponse)

 	err := grpc.Invoke(ctx, "/docker.swarmkit.v1.Control/ListSecrets", in, out, c.cc, opts...)

@@ -2620,6 +2721,12 @@ type ControlServer interface {

 	// - Returns `InvalidArgument` if the `GetSecretRequest.SecretID` is empty.

 	// - Returns an error if getting fails.

 	GetSecret(context.Context, *GetSecretRequest) (*GetSecretResponse, error)

+	// UpdateSecret returns a `UpdateSecretResponse` with a `Secret` with the same

+	// id as `GetSecretRequest.SecretID`

+	// - Returns `NotFound` if the Secret with the given id is not found.

+	// - Returns `InvalidArgument` if the `GetSecretRequest.SecretID` is empty.

+	// - Returns an error if updating fails.

+	UpdateSecret(context.Context, *UpdateSecretRequest) (*UpdateSecretResponse, error)

 	// ListSecrets returns a `ListSecretResponse` with a list all non-internal `Secret`s being

 	// managed, or all secrets matching any name in `ListSecretsRequest.Names`, any

 	// name prefix in `ListSecretsRequest.NamePrefixes`, any id in

@@ -3003,6 +3110,24 @@ func _Control_GetSecret_Handler(srv interface{}, ctx context.Context, dec func(i

 	return interceptor(ctx, in, info, handler)

 }

+func _Control_UpdateSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {

+	in := new(UpdateSecretRequest)

+	if err := dec(in); err != nil {

+		return nil, err

+	}

+	if interceptor == nil {

+		return srv.(ControlServer).UpdateSecret(ctx, in)

+	}

+	info := &grpc.UnaryServerInfo{

+		Server:     srv,

+		FullMethod: "/docker.swarmkit.v1.Control/UpdateSecret",

+	}

+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {

+		return srv.(ControlServer).UpdateSecret(ctx, req.(*UpdateSecretRequest))

+	}

+	return interceptor(ctx, in, info, handler)

+}

+

 func _Control_ListSecrets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {

 	in := new(ListSecretsRequest)

 	if err := dec(in); err != nil {

@@ -3142,6 +3267,10 @@ var _Control_serviceDesc = grpc.ServiceDesc{

 			Handler:    _Control_GetSecret_Handler,

 		},

 		{

+			MethodName: "UpdateSecret",

+			Handler:    _Control_UpdateSecret_Handler,

+		},

+		{

 			MethodName: "ListSecrets",

 			Handler:    _Control_ListSecrets_Handler,

 		},

@@ -4775,6 +4904,78 @@ func (m *GetSecretResponse) MarshalTo(data []byte) (int, error) {

 	return i, nil

 }

+func (m *UpdateSecretRequest) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *UpdateSecretRequest) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	if len(m.SecretID) > 0 {

+		data[i] = 0xa

+		i++

+		i = encodeVarintControl(data, i, uint64(len(m.SecretID)))

+		i += copy(data[i:], m.SecretID)

+	}

+	if m.SecretVersion != nil {

+		data[i] = 0x12

+		i++

+		i = encodeVarintControl(data, i, uint64(m.SecretVersion.Size()))

+		n26, err := m.SecretVersion.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += n26

+	}

+	if m.Spec != nil {

+		data[i] = 0x1a

+		i++

+		i = encodeVarintControl(data, i, uint64(m.Spec.Size()))

+		n27, err := m.Spec.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += n27

+	}

+	return i, nil

+}

+

+func (m *UpdateSecretResponse) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *UpdateSecretResponse) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	if m.Secret != nil {

+		data[i] = 0xa

+		i++

+		i = encodeVarintControl(data, i, uint64(m.Secret.Size()))

+		n28, err := m.Secret.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += n28

+	}

+	return i, nil

+}

+

 func (m *ListSecretsRequest) Marshal() (data []byte, err error) {

 	size := m.Size()

 	data = make([]byte, size)

@@ -4794,11 +4995,11 @@ func (m *ListSecretsRequest) MarshalTo(data []byte) (int, error) {

 		data[i] = 0xa

 		i++

 		i = encodeVarintControl(data, i, uint64(m.Filters.Size()))

-		n26, err := m.Filters.MarshalTo(data[i:])

+		n29, err := m.Filters.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n26

+		i += n29

 	}

 	return i, nil

 }

@@ -4932,11 +5133,11 @@ func (m *CreateSecretRequest) MarshalTo(data []byte) (int, error) {

 		data[i] = 0xa

 		i++

 		i = encodeVarintControl(data, i, uint64(m.Spec.Size()))

-		n27, err := m.Spec.MarshalTo(data[i:])

+		n30, err := m.Spec.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n27

+		i += n30

 	}

 	return i, nil

 }

@@ -4960,11 +5161,11 @@ func (m *CreateSecretResponse) MarshalTo(data []byte) (int, error) {

 		data[i] = 0xa

 		i++

 		i = encodeVarintControl(data, i, uint64(m.Secret.Size()))

-		n28, err := m.Secret.MarshalTo(data[i:])

+		n31, err := m.Secret.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n28

+		i += n31

 	}

 	return i, nil

 }

@@ -5725,6 +5926,37 @@ func (p *raftProxyControlServer) GetSecret(ctx context.Context, r *GetSecretRequ

 	return resp, err

 }

+func (p *raftProxyControlServer) UpdateSecret(ctx context.Context, r *UpdateSecretRequest) (*UpdateSecretResponse, error) {

+

+	conn, err := p.connSelector.LeaderConn(ctx)

+	if err != nil {

+		if err == raftselector.ErrIsLeader {

+			return p.local.UpdateSecret(ctx, r)

+		}

+		return nil, err

+	}

+	modCtx, err := p.runCtxMods(ctx)

+	if err != nil {

+		return nil, err

+	}

+

+	resp, err := NewControlClient(conn).UpdateSecret(modCtx, r)

+	if err != nil {

+		if !strings.Contains(err.Error(), "is closing") && !strings.Contains(err.Error(), "the connection is unavailable") && !strings.Contains(err.Error(), "connection error") {

+			return resp, err

+		}

+		conn, err := p.pollNewLeaderConn(ctx)

+		if err != nil {

+			if err == raftselector.ErrIsLeader {

+				return p.local.UpdateSecret(ctx, r)

+			}

+			return nil, err

+		}

+		return NewControlClient(conn).UpdateSecret(modCtx, r)

+	}

+	return resp, err

+}

+

 func (p *raftProxyControlServer) ListSecrets(ctx context.Context, r *ListSecretsRequest) (*ListSecretsResponse, error) {

 	conn, err := p.connSelector.LeaderConn(ctx)

@@ -6448,6 +6680,34 @@ func (m *GetSecretResponse) Size() (n int) {

 	return n

 }

+func (m *UpdateSecretRequest) Size() (n int) {

+	var l int

+	_ = l

+	l = len(m.SecretID)

+	if l > 0 {

+		n += 1 + l + sovControl(uint64(l))

+	}

+	if m.SecretVersion != nil {

+		l = m.SecretVersion.Size()

+		n += 1 + l + sovControl(uint64(l))

+	}

+	if m.Spec != nil {

+		l = m.Spec.Size()

+		n += 1 + l + sovControl(uint64(l))

+	}

+	return n

+}

+

+func (m *UpdateSecretResponse) Size() (n int) {

+	var l int

+	_ = l

+	if m.Secret != nil {

+		l = m.Secret.Size()

+		n += 1 + l + sovControl(uint64(l))

+	}

+	return n

+}

+

 func (m *ListSecretsRequest) Size() (n int) {

 	var l int

 	_ = l

@@ -7088,6 +7348,28 @@ func (this *GetSecretResponse) String() string {

 	}, "")

 	return s

 }

+func (this *UpdateSecretRequest) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&UpdateSecretRequest{`,

+		`SecretID:` + fmt.Sprintf("%v", this.SecretID) + `,`,

+		`SecretVersion:` + strings.Replace(fmt.Sprintf("%v", this.SecretVersion), "Version", "Version", 1) + `,`,

+		`Spec:` + strings.Replace(fmt.Sprintf("%v", this.Spec), "SecretSpec", "SecretSpec", 1) + `,`,

+		`}`,

+	}, "")

+	return s

+}

+func (this *UpdateSecretResponse) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&UpdateSecretResponse{`,

+		`Secret:` + strings.Replace(fmt.Sprintf("%v", this.Secret), "Secret", "Secret", 1) + `,`,

+		`}`,

+	}, "")

+	return s

+}

 func (this *ListSecretsRequest) String() string {

 	if this == nil {

 		return "nil"

@@ -12083,6 +12365,234 @@ func (m *GetSecretResponse) Unmarshal(data []byte) error {

 	}

 	return nil

 }

+func (m *UpdateSecretRequest) Unmarshal(data []byte) error {

+	l := len(data)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowControl

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := data[iNdEx]

+			iNdEx++

+			wire |= (uint64(b) & 0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: UpdateSecretRequest: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: UpdateSecretRequest: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		case 1:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field SecretID", wireType)

+			}

+			var stringLen uint64

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				stringLen |= (uint64(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthControl

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.SecretID = string(data[iNdEx:postIndex])

+			iNdEx = postIndex

+		case 2:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field SecretVersion", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				msglen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			if msglen < 0 {

+				return ErrInvalidLengthControl

+			}

+			postIndex := iNdEx + msglen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			if m.SecretVersion == nil {

+				m.SecretVersion = &Version{}

+			}

+			if err := m.SecretVersion.Unmarshal(data[iNdEx:postIndex]); err != nil {

+				return err

+			}

+			iNdEx = postIndex

+		case 3:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				msglen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			if msglen < 0 {

+				return ErrInvalidLengthControl

+			}

+			postIndex := iNdEx + msglen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			if m.Spec == nil {

+				m.Spec = &SecretSpec{}

+			}

+			if err := m.Spec.Unmarshal(data[iNdEx:postIndex]); err != nil {

+				return err

+			}

+			iNdEx = postIndex

+		default:

+			iNdEx = preIndex

+			skippy, err := skipControl(data[iNdEx:])

+			if err != nil {

+				return err

+			}

+			if skippy < 0 {

+				return ErrInvalidLengthControl

+			}

+			if (iNdEx + skippy) > l {

+				return io.ErrUnexpectedEOF

+			}

+			iNdEx += skippy

+		}

+	}

+

+	if iNdEx > l {

+		return io.ErrUnexpectedEOF

+	}

+	return nil

+}

+func (m *UpdateSecretResponse) Unmarshal(data []byte) error {

+	l := len(data)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowControl

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := data[iNdEx]

+			iNdEx++

+			wire |= (uint64(b) & 0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: UpdateSecretResponse: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: UpdateSecretResponse: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		case 1:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Secret", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				msglen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}