@@ -147,7 +147,7 @@ clone git github.com/docker/containerd 52ef1ceb4b660c42cf4ea9013180a5663968d4c7

 clone git github.com/tonistiigi/fifo 8c56881ce5e63e19e2dfc495c8af0fb90916467d

 # cluster

-clone git github.com/docker/swarmkit 72981f443024da2c57d54b915eae0477be6dada5

+clone git github.com/docker/swarmkit 4dfc88ccce14ced6f0a6ea82d46dca004c6de0e2

 clone git github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9

 clone git github.com/gogo/protobuf v0.3

 clone git github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a

@@ -1,3 +1,3 @@

 package api

-//go:generate protoc -I.:../protobuf:../vendor:../vendor/github.com/gogo/protobuf:../vendor/github.com/gogo/protobuf/protobuf --gogoswarm_out=plugins=grpc+deepcopy+raftproxy+authenticatedwrapper,import_path=github.com/docker/swarmkit/api,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mtimestamp/timestamp.proto=github.com/docker/swarmkit/api/timestamp,Mduration/duration.proto=github.com/docker/swarmkit/api/duration,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mplugin/plugin.proto=github.com/docker/swarmkit/protobuf/plugin:. types.proto specs.proto objects.proto control.proto dispatcher.proto ca.proto snapshot.proto raft.proto health.proto resource.proto

+//go:generate protoc -I.:../protobuf:../vendor:../vendor/github.com/gogo/protobuf --gogoswarm_out=plugins=grpc+deepcopy+raftproxy+authenticatedwrapper,import_path=github.com/docker/swarmkit/api,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mtimestamp/timestamp.proto=github.com/docker/swarmkit/api/timestamp,Mduration/duration.proto=github.com/docker/swarmkit/api/duration,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mplugin/plugin.proto=github.com/docker/swarmkit/protobuf/plugin:. types.proto specs.proto objects.proto control.proto dispatcher.proto ca.proto snapshot.proto raft.proto health.proto resource.proto

@@ -60,6 +60,7 @@

 		SecretReference

 		BlacklistedCertificate

 		HealthConfig

+		MaybeEncryptedRecord

 		NodeSpec

 		ServiceSpec

 		ReplicatedService

@@ -650,34 +651,28 @@ func (EncryptionKey_Algorithm) EnumDescriptor() ([]byte, []int) {

 	return fileDescriptorTypes, []int{37, 0}

 }

-// Mode specifies how this secret should be exposed to the task.

-type SecretReference_Mode int32

+type MaybeEncryptedRecord_Algorithm int32

 const (

-	// SYSTEM means that it is not exposed inside to a task at all, but

-	// only available via direct access, usually at the agent-level

-	SecretReference_SYSTEM SecretReference_Mode = 0

-	// FILE means that it will be exposed to the task as a file

-	SecretReference_FILE SecretReference_Mode = 1

-	// ENV means that it will be exposed to the task as an environment variable

-	SecretReference_ENV SecretReference_Mode = 2

+	MaybeEncryptedRecord_NotEncrypted                 MaybeEncryptedRecord_Algorithm = 0

+	MaybeEncryptedRecord_NACLSecretboxSalsa20Poly1305 MaybeEncryptedRecord_Algorithm = 1

 )

-var SecretReference_Mode_name = map[int32]string{

-	0: "SYSTEM",

-	1: "FILE",

-	2: "ENV",

+var MaybeEncryptedRecord_Algorithm_name = map[int32]string{

+	0: "NONE",

+	1: "SECRETBOX_SALSA20_POLY1305",

 }

-var SecretReference_Mode_value = map[string]int32{

-	"SYSTEM": 0,

-	"FILE":   1,

-	"ENV":    2,

+var MaybeEncryptedRecord_Algorithm_value = map[string]int32{

+	"NONE": 0,

+	"SECRETBOX_SALSA20_POLY1305": 1,

 }

-func (x SecretReference_Mode) String() string {

-	return proto.EnumName(SecretReference_Mode_name, int32(x))

+func (x MaybeEncryptedRecord_Algorithm) String() string {

+	return proto.EnumName(MaybeEncryptedRecord_Algorithm_name, int32(x))

+}

+func (MaybeEncryptedRecord_Algorithm) EnumDescriptor() ([]byte, []int) {

+	return fileDescriptorTypes, []int{42, 0}

 }

-func (SecretReference_Mode) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{39, 0} }

 // Version tracks the last time an object in the store was updated.

 type Version struct {

@@ -786,6 +781,8 @@ func (*RaftMemberStatus) Descriptor() ([]byte, []int) { return fileDescriptorTyp

 type NodeStatus struct {

 	State   NodeStatus_State `protobuf:"varint,1,opt,name=state,proto3,enum=docker.swarmkit.v1.NodeStatus_State" json:"state,omitempty"`

 	Message string           `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`

+	// Addr is the node's IP address as observed by the manager

+	Addr string `protobuf:"bytes,3,opt,name=addr,proto3" json:"addr,omitempty"`

 }

 func (m *NodeStatus) Reset()                    { *m = NodeStatus{} }

@@ -1437,19 +1434,119 @@ type SecretReference struct {

 	// referencing. This identifier exists so that SecretReferences don't leak

 	// any information about the secret contents.

 	SecretID string `protobuf:"bytes,1,opt,name=secret_id,json=secretId,proto3" json:"secret_id,omitempty"`

-	// Mode is the way the secret should be presented.

-	Mode SecretReference_Mode `protobuf:"varint,2,opt,name=mode,proto3,enum=docker.swarmkit.v1.SecretReference_Mode" json:"mode,omitempty"`

-	// Target is the name by which the image accesses the secret.

-	Target string `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`

 	// SecretName is the name of the secret that this references, but this is just provided for

 	// lookup/display purposes.  The secret in the reference will be identified by its ID.

-	SecretName string `protobuf:"bytes,4,opt,name=secret_name,json=secretName,proto3" json:"secret_name,omitempty"`

+	SecretName string `protobuf:"bytes,2,opt,name=secret_name,json=secretName,proto3" json:"secret_name,omitempty"`

+	// Target specifies how this secret should be exposed to the task.

+	//

+	// Types that are valid to be assigned to Target:

+	//	*SecretReference_File

+	Target isSecretReference_Target `protobuf_oneof:"target"`

 }

 func (m *SecretReference) Reset()                    { *m = SecretReference{} }

 func (*SecretReference) ProtoMessage()               {}

 func (*SecretReference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{39} }

+type isSecretReference_Target interface {

+	isSecretReference_Target()

+	MarshalTo([]byte) (int, error)

+	Size() int

+}

+

+type SecretReference_File struct {

+	File *SecretReference_FileTarget `protobuf:"bytes,3,opt,name=file,oneof"`

+}

+

+func (*SecretReference_File) isSecretReference_Target() {}

+

+func (m *SecretReference) GetTarget() isSecretReference_Target {

+	if m != nil {

+		return m.Target

+	}

+	return nil

+}

+

+func (m *SecretReference) GetFile() *SecretReference_FileTarget {

+	if x, ok := m.GetTarget().(*SecretReference_File); ok {

+		return x.File

+	}

+	return nil

+}

+

+// XXX_OneofFuncs is for the internal use of the proto package.

+func (*SecretReference) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {

+	return _SecretReference_OneofMarshaler, _SecretReference_OneofUnmarshaler, _SecretReference_OneofSizer, []interface{}{

+		(*SecretReference_File)(nil),

+	}

+}

+

+func _SecretReference_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {

+	m := msg.(*SecretReference)

+	// target

+	switch x := m.Target.(type) {

+	case *SecretReference_File:

+		_ = b.EncodeVarint(3<<3 | proto.WireBytes)

+		if err := b.EncodeMessage(x.File); err != nil {

+			return err

+		}

+	case nil:

+	default:

+		return fmt.Errorf("SecretReference.Target has unexpected type %T", x)

+	}

+	return nil

+}

+

+func _SecretReference_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {

+	m := msg.(*SecretReference)

+	switch tag {

+	case 3: // target.file

+		if wire != proto.WireBytes {

+			return true, proto.ErrInternalBadWireType

+		}

+		msg := new(SecretReference_FileTarget)

+		err := b.DecodeMessage(msg)

+		m.Target = &SecretReference_File{msg}

+		return true, err

+	default:

+		return false, nil

+	}

+}

+

+func _SecretReference_OneofSizer(msg proto.Message) (n int) {

+	m := msg.(*SecretReference)

+	// target

+	switch x := m.Target.(type) {

+	case *SecretReference_File:

+		s := proto.Size(x.File)

+		n += proto.SizeVarint(3<<3 | proto.WireBytes)

+		n += proto.SizeVarint(uint64(s))

+		n += s

+	case nil:

+	default:

+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))

+	}

+	return n

+}

+

+// FileTarget represents a specific target that is backed by a file

+type SecretReference_FileTarget struct {

+	// Name represents the final filename in the filesystem

+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`

+	// UID represents the file UID

+	UID string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"`

+	// GID represents the file GID

+	GID string `protobuf:"bytes,3,opt,name=gid,proto3" json:"gid,omitempty"`

+	// Mode represents the FileMode of the file

+	Mode os.FileMode `protobuf:"varint,4,opt,name=mode,proto3,customtype=os.FileMode" json:"mode"`

+}

+

+func (m *SecretReference_FileTarget) Reset()      { *m = SecretReference_FileTarget{} }

+func (*SecretReference_FileTarget) ProtoMessage() {}

+func (*SecretReference_FileTarget) Descriptor() ([]byte, []int) {

+	return fileDescriptorTypes, []int{39, 0}

+}

+

 // BlacklistedCertificate is a record for a blacklisted certificate. It does not

 // contain the certificate's CN, because these records are indexed by CN.

 type BlacklistedCertificate struct {

@@ -1486,6 +1583,16 @@ func (m *HealthConfig) Reset()                    { *m = HealthConfig{} }

 func (*HealthConfig) ProtoMessage()               {}

 func (*HealthConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{41} }

+type MaybeEncryptedRecord struct {

+	Algorithm MaybeEncryptedRecord_Algorithm `protobuf:"varint,1,opt,name=algorithm,proto3,enum=docker.swarmkit.v1.MaybeEncryptedRecord_Algorithm" json:"algorithm,omitempty"`

+	Data      []byte                         `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`

+	Nonce     []byte                         `protobuf:"bytes,3,opt,name=nonce,proto3" json:"nonce,omitempty"`

+}

+

+func (m *MaybeEncryptedRecord) Reset()                    { *m = MaybeEncryptedRecord{} }

+func (*MaybeEncryptedRecord) ProtoMessage()               {}

+func (*MaybeEncryptedRecord) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{42} }

+

 func init() {

 	proto.RegisterType((*Version)(nil), "docker.swarmkit.v1.Version")

 	proto.RegisterType((*Annotations)(nil), "docker.swarmkit.v1.Annotations")

@@ -1532,8 +1639,10 @@ func init() {

 	proto.RegisterType((*EncryptionKey)(nil), "docker.swarmkit.v1.EncryptionKey")

 	proto.RegisterType((*ManagerStatus)(nil), "docker.swarmkit.v1.ManagerStatus")

 	proto.RegisterType((*SecretReference)(nil), "docker.swarmkit.v1.SecretReference")

+	proto.RegisterType((*SecretReference_FileTarget)(nil), "docker.swarmkit.v1.SecretReference.FileTarget")

 	proto.RegisterType((*BlacklistedCertificate)(nil), "docker.swarmkit.v1.BlacklistedCertificate")

 	proto.RegisterType((*HealthConfig)(nil), "docker.swarmkit.v1.HealthConfig")

+	proto.RegisterType((*MaybeEncryptedRecord)(nil), "docker.swarmkit.v1.MaybeEncryptedRecord")

 	proto.RegisterEnum("docker.swarmkit.v1.TaskState", TaskState_name, TaskState_value)

 	proto.RegisterEnum("docker.swarmkit.v1.NodeRole", NodeRole_name, NodeRole_value)

 	proto.RegisterEnum("docker.swarmkit.v1.RaftMemberStatus_Reachability", RaftMemberStatus_Reachability_name, RaftMemberStatus_Reachability_value)

@@ -1549,7 +1658,7 @@ func init() {

 	proto.RegisterEnum("docker.swarmkit.v1.IssuanceStatus_State", IssuanceStatus_State_name, IssuanceStatus_State_value)

 	proto.RegisterEnum("docker.swarmkit.v1.ExternalCA_CAProtocol", ExternalCA_CAProtocol_name, ExternalCA_CAProtocol_value)

 	proto.RegisterEnum("docker.swarmkit.v1.EncryptionKey_Algorithm", EncryptionKey_Algorithm_name, EncryptionKey_Algorithm_value)

-	proto.RegisterEnum("docker.swarmkit.v1.SecretReference_Mode", SecretReference_Mode_name, SecretReference_Mode_value)

+	proto.RegisterEnum("docker.swarmkit.v1.MaybeEncryptedRecord_Algorithm", MaybeEncryptedRecord_Algorithm_name, MaybeEncryptedRecord_Algorithm_value)

 }

 func (m *Version) Copy() *Version {

@@ -1698,6 +1807,7 @@ func (m *NodeStatus) Copy() *NodeStatus {

 	o := &NodeStatus{

 		State:   m.State,

 		Message: m.Message,

+		Addr:    m.Addr,

 	}

 	return o

@@ -2248,11 +2358,33 @@ func (m *SecretReference) Copy() *SecretReference {

 	o := &SecretReference{

 		SecretID:   m.SecretID,

-		Mode:       m.Mode,

-		Target:     m.Target,

 		SecretName: m.SecretName,

 	}

+	switch m.Target.(type) {

+	case *SecretReference_File:

+		i := &SecretReference_File{

+			File: m.GetFile().Copy(),

+		}

+

+		o.Target = i

+	}

+

+	return o

+}

+

+func (m *SecretReference_FileTarget) Copy() *SecretReference_FileTarget {

+	if m == nil {

+		return nil

+	}

+

+	o := &SecretReference_FileTarget{

+		Name: m.Name,

+		UID:  m.UID,

+		GID:  m.GID,

+		Mode: m.Mode,

+	}

+

 	return o

 }

@@ -2287,6 +2419,20 @@ func (m *HealthConfig) Copy() *HealthConfig {

 	return o

 }

+func (m *MaybeEncryptedRecord) Copy() *MaybeEncryptedRecord {

+	if m == nil {

+		return nil

+	}

+

+	o := &MaybeEncryptedRecord{

+		Algorithm: m.Algorithm,

+		Data:      m.Data,

+		Nonce:     m.Nonce,

+	}

+

+	return o

+}

+

 func (this *Version) GoString() string {

 	if this == nil {

 		return "nil"

@@ -2429,10 +2575,11 @@ func (this *NodeStatus) GoString() string {

 	if this == nil {

 		return "nil"

 	}

-	s := make([]string, 0, 6)

+	s := make([]string, 0, 7)

 	s = append(s, "&api.NodeStatus{")

 	s = append(s, "State: "+fmt.Sprintf("%#v", this.State)+",\n")

 	s = append(s, "Message: "+fmt.Sprintf("%#v", this.Message)+",\n")

+	s = append(s, "Addr: "+fmt.Sprintf("%#v", this.Addr)+",\n")

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

@@ -2945,12 +3092,34 @@ func (this *SecretReference) GoString() string {

 	if this == nil {

 		return "nil"

 	}

-	s := make([]string, 0, 8)

+	s := make([]string, 0, 7)

 	s = append(s, "&api.SecretReference{")

 	s = append(s, "SecretID: "+fmt.Sprintf("%#v", this.SecretID)+",\n")

-	s = append(s, "Mode: "+fmt.Sprintf("%#v", this.Mode)+",\n")

-	s = append(s, "Target: "+fmt.Sprintf("%#v", this.Target)+",\n")

 	s = append(s, "SecretName: "+fmt.Sprintf("%#v", this.SecretName)+",\n")

+	if this.Target != nil {

+		s = append(s, "Target: "+fmt.Sprintf("%#v", this.Target)+",\n")

+	}

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

+func (this *SecretReference_File) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&api.SecretReference_File{` +

+		`File:` + fmt.Sprintf("%#v", this.File) + `}`}, ", ")

+	return s

+}

+func (this *SecretReference_FileTarget) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 8)

+	s = append(s, "&api.SecretReference_FileTarget{")

+	s = append(s, "Name: "+fmt.Sprintf("%#v", this.Name)+",\n")

+	s = append(s, "UID: "+fmt.Sprintf("%#v", this.UID)+",\n")

+	s = append(s, "GID: "+fmt.Sprintf("%#v", this.GID)+",\n")

+	s = append(s, "Mode: "+fmt.Sprintf("%#v", this.Mode)+",\n")

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

@@ -2983,6 +3152,18 @@ func (this *HealthConfig) GoString() string {

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

+func (this *MaybeEncryptedRecord) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 7)

+	s = append(s, "&api.MaybeEncryptedRecord{")

+	s = append(s, "Algorithm: "+fmt.Sprintf("%#v", this.Algorithm)+",\n")

+	s = append(s, "Data: "+fmt.Sprintf("%#v", this.Data)+",\n")

+	s = append(s, "Nonce: "+fmt.Sprintf("%#v", this.Nonce)+",\n")

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

 func valueToGoStringTypes(v interface{}, typ string) string {

 	rv := reflect.ValueOf(v)

 	if rv.IsNil() {

@@ -3371,6 +3552,12 @@ func (m *NodeStatus) MarshalTo(data []byte) (int, error) {

 		i = encodeVarintTypes(data, i, uint64(len(m.Message)))

 		i += copy(data[i:], m.Message)

 	}

+	if len(m.Addr) > 0 {

+		data[i] = 0x1a

+		i++

+		i = encodeVarintTypes(data, i, uint64(len(m.Addr)))

+		i += copy(data[i:], m.Addr)

+	}

 	return i, nil

 }

@@ -4768,22 +4955,73 @@ func (m *SecretReference) MarshalTo(data []byte) (int, error) {

 		i = encodeVarintTypes(data, i, uint64(len(m.SecretID)))

 		i += copy(data[i:], m.SecretID)

 	}

-	if m.Mode != 0 {

-		data[i] = 0x10

+	if len(m.SecretName) > 0 {

+		data[i] = 0x12

 		i++

-		i = encodeVarintTypes(data, i, uint64(m.Mode))

+		i = encodeVarintTypes(data, i, uint64(len(m.SecretName)))

+		i += copy(data[i:], m.SecretName)

 	}

-	if len(m.Target) > 0 {

+	if m.Target != nil {

+		nn28, err := m.Target.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += nn28

+	}

+	return i, nil

+}

+

+func (m *SecretReference_File) MarshalTo(data []byte) (int, error) {

+	i := 0

+	if m.File != nil {

 		data[i] = 0x1a

 		i++

-		i = encodeVarintTypes(data, i, uint64(len(m.Target)))

-		i += copy(data[i:], m.Target)

+		i = encodeVarintTypes(data, i, uint64(m.File.Size()))

+		n29, err := m.File.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += n29

 	}

-	if len(m.SecretName) > 0 {

-		data[i] = 0x22

+	return i, nil

+}

+func (m *SecretReference_FileTarget) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *SecretReference_FileTarget) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	if len(m.Name) > 0 {

+		data[i] = 0xa

 		i++

-		i = encodeVarintTypes(data, i, uint64(len(m.SecretName)))

-		i += copy(data[i:], m.SecretName)

+		i = encodeVarintTypes(data, i, uint64(len(m.Name)))

+		i += copy(data[i:], m.Name)

+	}

+	if len(m.UID) > 0 {

+		data[i] = 0x12

+		i++

+		i = encodeVarintTypes(data, i, uint64(len(m.UID)))

+		i += copy(data[i:], m.UID)

+	}

+	if len(m.GID) > 0 {

+		data[i] = 0x1a

+		i++

+		i = encodeVarintTypes(data, i, uint64(len(m.GID)))

+		i += copy(data[i:], m.GID)

+	}

+	if m.Mode != 0 {

+		data[i] = 0x20

+		i++

+		i = encodeVarintTypes(data, i, uint64(m.Mode))

 	}

 	return i, nil

 }

@@ -4807,11 +5045,11 @@ func (m *BlacklistedCertificate) MarshalTo(data []byte) (int, error) {

 		data[i] = 0xa

 		i++

 		i = encodeVarintTypes(data, i, uint64(m.Expiry.Size()))

-		n28, err := m.Expiry.MarshalTo(data[i:])

+		n30, err := m.Expiry.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n28

+		i += n30

 	}

 	return i, nil

 }

@@ -4850,21 +5088,21 @@ func (m *HealthConfig) MarshalTo(data []byte) (int, error) {

 		data[i] = 0x12

 		i++

 		i = encodeVarintTypes(data, i, uint64(m.Interval.Size()))

-		n29, err := m.Interval.MarshalTo(data[i:])

+		n31, err := m.Interval.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n29

+		i += n31

 	}

 	if m.Timeout != nil {

 		data[i] = 0x1a

 		i++

 		i = encodeVarintTypes(data, i, uint64(m.Timeout.Size()))

-		n30, err := m.Timeout.MarshalTo(data[i:])

+		n32, err := m.Timeout.MarshalTo(data[i:])

 		if err != nil {

 			return 0, err

 		}

-		i += n30

+		i += n32

 	}

 	if m.Retries != 0 {

 		data[i] = 0x20

@@ -4874,6 +5112,41 @@ func (m *HealthConfig) MarshalTo(data []byte) (int, error) {

 	return i, nil

 }

+func (m *MaybeEncryptedRecord) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *MaybeEncryptedRecord) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	if m.Algorithm != 0 {

+		data[i] = 0x8

+		i++

+		i = encodeVarintTypes(data, i, uint64(m.Algorithm))

+	}

+	if len(m.Data) > 0 {

+		data[i] = 0x12

+		i++

+		i = encodeVarintTypes(data, i, uint64(len(m.Data)))

+		i += copy(data[i:], m.Data)

+	}

+	if len(m.Nonce) > 0 {

+		data[i] = 0x1a

+		i++

+		i = encodeVarintTypes(data, i, uint64(len(m.Nonce)))

+		i += copy(data[i:], m.Nonce)

+	}

+	return i, nil

+}

+

 func encodeFixed64Types(data []byte, offset int, v uint64) int {

 	data[offset] = uint8(v)

 	data[offset+1] = uint8(v >> 8)

@@ -5055,6 +5328,10 @@ func (m *NodeStatus) Size() (n int) {

 	if l > 0 {

 		n += 1 + l + sovTypes(uint64(l))

 	}

+	l = len(m.Addr)

+	if l > 0 {

+		n += 1 + l + sovTypes(uint64(l))

+	}

 	return n

 }

@@ -5660,17 +5937,43 @@ func (m *SecretReference) Size() (n int) {

 	if l > 0 {

 		n += 1 + l + sovTypes(uint64(l))

 	}

-	if m.Mode != 0 {

-		n += 1 + sovTypes(uint64(m.Mode))

+	l = len(m.SecretName)

+	if l > 0 {

+		n += 1 + l + sovTypes(uint64(l))

 	}

-	l = len(m.Target)

+	if m.Target != nil {

+		n += m.Target.Size()

+	}

+	return n

+}

+

+func (m *SecretReference_File) Size() (n int) {

+	var l int

+	_ = l

+	if m.File != nil {

+		l = m.File.Size()

+		n += 1 + l + sovTypes(uint64(l))

+	}

+	return n

+}

+func (m *SecretReference_FileTarget) Size() (n int) {

+	var l int

+	_ = l

+	l = len(m.Name)

 	if l > 0 {

 		n += 1 + l + sovTypes(uint64(l))

 	}

-	l = len(m.SecretName)

+	l = len(m.UID)

 	if l > 0 {

 		n += 1 + l + sovTypes(uint64(l))

 	}

+	l = len(m.GID)

+	if l > 0 {

+		n += 1 + l + sovTypes(uint64(l))

+	}

+	if m.Mode != 0 {

+		n += 1 + sovTypes(uint64(m.Mode))

+	}

 	return n

 }

@@ -5707,6 +6010,23 @@ func (m *HealthConfig) Size() (n int) {

 	return n

 }

+func (m *MaybeEncryptedRecord) Size() (n int) {

+	var l int

+	_ = l

+	if m.Algorithm != 0 {

+		n += 1 + sovTypes(uint64(m.Algorithm))

+	}

+	l = len(m.Data)

+	if l > 0 {

+		n += 1 + l + sovTypes(uint64(l))

+	}

+	l = len(m.Nonce)

+	if l > 0 {

+		n += 1 + l + sovTypes(uint64(l))

+	}

+	return n

+}

+

 func sovTypes(x uint64) (n int) {

 	for {

 		n++

@@ -5849,6 +6169,7 @@ func (this *NodeStatus) String() string {

 	s := strings.Join([]string{`&NodeStatus{`,

 		`State:` + fmt.Sprintf("%v", this.State) + `,`,

 		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,

+		`Addr:` + fmt.Sprintf("%v", this.Addr) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -6314,9 +6635,31 @@ func (this *SecretReference) String() string {

 	}

 	s := strings.Join([]string{`&SecretReference{`,

 		`SecretID:` + fmt.Sprintf("%v", this.SecretID) + `,`,

-		`Mode:` + fmt.Sprintf("%v", this.Mode) + `,`,

-		`Target:` + fmt.Sprintf("%v", this.Target) + `,`,

 		`SecretName:` + fmt.Sprintf("%v", this.SecretName) + `,`,

+		`Target:` + fmt.Sprintf("%v", this.Target) + `,`,

+		`}`,

+	}, "")

+	return s

+}

+func (this *SecretReference_File) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&SecretReference_File{`,

+		`File:` + strings.Replace(fmt.Sprintf("%v", this.File), "SecretReference_FileTarget", "SecretReference_FileTarget", 1) + `,`,

+		`}`,

+	}, "")

+	return s

+}

+func (this *SecretReference_FileTarget) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&SecretReference_FileTarget{`,

+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,

+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,

+		`GID:` + fmt.Sprintf("%v", this.GID) + `,`,

+		`Mode:` + fmt.Sprintf("%v", this.Mode) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -6344,6 +6687,18 @@ func (this *HealthConfig) String() string {

 	}, "")

 	return s

 }

+func (this *MaybeEncryptedRecord) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&MaybeEncryptedRecord{`,

+		`Algorithm:` + fmt.Sprintf("%v", this.Algorithm) + `,`,

+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,

+		`Nonce:` + fmt.Sprintf("%v", this.Nonce) + `,`,

+		`}`,

+	}, "")

+	return s

+}

 func valueToStringTypes(v interface{}) string {

 	rv := reflect.ValueOf(v)

 	if rv.IsNil() {

@@ -7635,6 +7990,35 @@ func (m *NodeStatus) Unmarshal(data []byte) error {

 			}

 			m.Message = string(data[iNdEx:postIndex])

 			iNdEx = postIndex

+		case 3:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Addr", wireType)

+			}

+			var stringLen uint64

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowTypes

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				stringLen |= (uint64(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthTypes

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.Addr = string(data[iNdEx:postIndex])

+			iNdEx = postIndex

 		default:

 			iNdEx = preIndex

 			skippy, err := skipTypes(data[iNdEx:])

@@ -12357,10 +12741,10 @@ func (m *SecretReference) Unmarshal(data []byte) error {

 			m.SecretID = string(data[iNdEx:postIndex])

 			iNdEx = postIndex

 		case 2:

-			if wireType != 0 {

-				return fmt.Errorf("proto: wrong wireType = %d for field Mode", wireType)

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field SecretName", wireType)

 			}

-			m.Mode = 0

+			var stringLen uint64

 			for shift := uint(0); ; shift += 7 {

 				if shift >= 64 {

 					return ErrIntOverflowTypes

@@ -12370,14 +12754,106 @@ func (m *SecretReference) Unmarshal(data []byte) error {

 				}

 				b := data[iNdEx]

 				iNdEx++

-				m.Mode |= (SecretReference_Mode(b) & 0x7F) << shift

+				stringLen |= (uint64(b) & 0x7F) << shift

 				if b < 0x80 {

 					break

 				}

 			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthTypes

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.SecretName = string(data[iNdEx:postIndex])

+			iNdEx = postIndex

 		case 3:

 			if wireType != 2 {

-				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)

+				return fmt.Errorf("proto: wrong wireType = %d for field File", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowTypes

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				msglen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			if msglen < 0 {

+				return ErrInvalidLengthTypes

+			}

+			postIndex := iNdEx + msglen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			v := &SecretReference_FileTarget{}

+			if err := v.Unmarshal(data[iNdEx:postIndex]); err != nil {

+				return err

+			}

+			m.Target = &SecretReference_File{v}

+			iNdEx = postIndex

+		default:

+			iNdEx = preIndex

+			skippy, err := skipTypes(data[iNdEx:])

+			if err != nil {

+				return err

+			}

+			if skippy < 0 {

+				return ErrInvalidLengthTypes

+			}

+			if (iNdEx + skippy) > l {

+				return io.ErrUnexpectedEOF

+			}

+			iNdEx += skippy

+		}

+	}

+

+	if iNdEx > l {

+		return io.ErrUnexpectedEOF

+	}

+	return nil

+}

+func (m *SecretReference_FileTarget) Unmarshal(data []byte) error {

+	l := len(data)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowTypes

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := data[iNdEx]

+			iNdEx++

+			wire |= (uint64(b) & 0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: FileTarget: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: FileTarget: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		case 1:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)

 			}

 			var stringLen uint64

 			for shift := uint(0); ; shift += 7 {

@@ -12402,11 +12878,11 @@ func (m *SecretReference) Unmarshal(data []byte) error {

 			if postIndex > l {

 				return io.ErrUnexpectedEOF

 			}

-			m.Target = string(data[iNdEx:postIndex])

+			m.Name = string(data[iNdEx:postIndex])

 			iNdEx = postIndex

-		case 4:

+		case 2:

 			if wireType != 2 {

-				return fmt.Errorf("proto: wrong wireType = %d for field SecretName", wireType)

+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)

 			}

 			var stringLen uint64

 			for shift := uint(0); ; shift += 7 {

@@ -12431,8 +12907,56 @@ func (m *SecretReference) Unmarshal(data []byte) error {

 			if postIndex > l {

 				return io.ErrUnexpectedEOF

 			}

-			m.SecretName = string(data[iNdEx:postIndex])

+			m.UID = string(data[iNdEx:postIndex])

 			iNdEx = postIndex

+		case 3:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field GID", wireType)

+			}

+			var stringLen uint64