diff --git a/authentication/v1alpha1/policy.pb.go b/authentication/v1alpha1/policy.pb.go
index 36859f70..00604aa3 100644
--- a/authentication/v1alpha1/policy.pb.go
+++ b/authentication/v1alpha1/policy.pb.go
@@ -22,7 +22,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Associates authentication with request principal.
 type PrincipalBinding int32
@@ -185,9 +185,9 @@ func (m *StringMatch) GetRegex() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*StringMatch) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _StringMatch_OneofMarshaler, _StringMatch_OneofUnmarshaler, _StringMatch_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*StringMatch) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*StringMatch_Exact)(nil),
 		(*StringMatch_Prefix)(nil),
 		(*StringMatch_Suffix)(nil),
@@ -195,92 +195,6 @@ func (*StringMatch) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) e
 	}
 }
 
-func _StringMatch_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*StringMatch)
-	// match_type
-	switch x := m.MatchType.(type) {
-	case *StringMatch_Exact:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Exact)
-	case *StringMatch_Prefix:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Prefix)
-	case *StringMatch_Suffix:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Suffix)
-	case *StringMatch_Regex:
-		_ = b.EncodeVarint(4<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Regex)
-	case nil:
-	default:
-		return fmt.Errorf("StringMatch.MatchType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _StringMatch_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*StringMatch)
-	switch tag {
-	case 1: // match_type.exact
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Exact{x}
-		return true, err
-	case 2: // match_type.prefix
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Prefix{x}
-		return true, err
-	case 3: // match_type.suffix
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Suffix{x}
-		return true, err
-	case 4: // match_type.regex
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Regex{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _StringMatch_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*StringMatch)
-	// match_type
-	switch x := m.MatchType.(type) {
-	case *StringMatch_Exact:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Exact)))
-		n += len(x.Exact)
-	case *StringMatch_Prefix:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Prefix)))
-		n += len(x.Prefix)
-	case *StringMatch_Suffix:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Suffix)))
-		n += len(x.Suffix)
-	case *StringMatch_Regex:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Regex)))
-		n += len(x.Regex)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // TLS authentication params.
 type MutualTls struct {
 	// WILL BE DEPRECATED, if set, will translates to `TLS_PERMISSIVE` mode.
@@ -691,80 +605,14 @@ func (m *PeerAuthenticationMethod) GetJwt() *Jwt {
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*PeerAuthenticationMethod) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _PeerAuthenticationMethod_OneofMarshaler, _PeerAuthenticationMethod_OneofUnmarshaler, _PeerAuthenticationMethod_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*PeerAuthenticationMethod) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*PeerAuthenticationMethod_Mtls)(nil),
 		(*PeerAuthenticationMethod_Jwt)(nil),
 	}
 }
 
-func _PeerAuthenticationMethod_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*PeerAuthenticationMethod)
-	// params
-	switch x := m.Params.(type) {
-	case *PeerAuthenticationMethod_Mtls:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Mtls); err != nil {
-			return err
-		}
-	case *PeerAuthenticationMethod_Jwt:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Jwt); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("PeerAuthenticationMethod.Params has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _PeerAuthenticationMethod_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*PeerAuthenticationMethod)
-	switch tag {
-	case 1: // params.mtls
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(MutualTls)
-		err := b.DecodeMessage(msg)
-		m.Params = &PeerAuthenticationMethod_Mtls{msg}
-		return true, err
-	case 2: // params.jwt
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(Jwt)
-		err := b.DecodeMessage(msg)
-		m.Params = &PeerAuthenticationMethod_Jwt{msg}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _PeerAuthenticationMethod_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*PeerAuthenticationMethod)
-	// params
-	switch x := m.Params.(type) {
-	case *PeerAuthenticationMethod_Mtls:
-		s := proto.Size(x.Mtls)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *PeerAuthenticationMethod_Jwt:
-		s := proto.Size(x.Jwt)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // OriginAuthenticationMethod defines authentication method/params for origin
 // authentication. Origin could be end-user, device, delegate service etc.
 // Currently, only JWT is supported for origin authentication.
@@ -1184,71 +1032,14 @@ func (m *PortSelector) GetName() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*PortSelector) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _PortSelector_OneofMarshaler, _PortSelector_OneofUnmarshaler, _PortSelector_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*PortSelector) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*PortSelector_Number)(nil),
 		(*PortSelector_Name)(nil),
 	}
 }
 
-func _PortSelector_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*PortSelector)
-	// port
-	switch x := m.Port.(type) {
-	case *PortSelector_Number:
-		_ = b.EncodeVarint(1<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(uint64(x.Number))
-	case *PortSelector_Name:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Name)
-	case nil:
-	default:
-		return fmt.Errorf("PortSelector.Port has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _PortSelector_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*PortSelector)
-	switch tag {
-	case 1: // port.number
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.Port = &PortSelector_Number{uint32(x)}
-		return true, err
-	case 2: // port.name
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Port = &PortSelector_Name{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _PortSelector_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*PortSelector)
-	// port
-	switch x := m.Port.(type) {
-	case *PortSelector_Number:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(x.Number))
-	case *PortSelector_Name:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Name)))
-		n += len(x.Name)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 func init() {
 	proto.RegisterEnum("istio.authentication.v1alpha1.PrincipalBinding", PrincipalBinding_name, PrincipalBinding_value)
 	proto.RegisterEnum("istio.authentication.v1alpha1.MutualTls_Mode", MutualTls_Mode_name, MutualTls_Mode_value)
diff --git a/go.mod b/go.mod
index ec116277..325a1c3b 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,8 @@ module istio.io/api
 go 1.12
 
 require (
-	github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48
+	github.com/gogo/protobuf v1.3.0
 	github.com/golang/protobuf v1.3.2 // indirect
-	google.golang.org/grpc v1.21.0
-	istio.io/gogo-genproto v0.0.0-20190731221249-06e20ada0df2
+	google.golang.org/grpc v1.23.0
+	istio.io/gogo-genproto v0.0.0-20190930162913-45029607206a
 )
diff --git a/go.sum b/go.sum
index a44ad9e8..1a8c8acd 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,8 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48 h1:X+zN6RZXsvnrSJaAIQhZezPfAfvsqihKKR8oiLHid34=
-github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.0 h1:G8O7TerXerS4F6sx9OV7/nRfJdnXgHZu/S/7F2SN+UE=
+github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -18,19 +18,19 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/grpc v1.21.0 h1:G+97AoqBnmZIT91cLG/EkCoK9NSelj64P8bOHHNmGn0=
-google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-istio.io/gogo-genproto v0.0.0-20190731221249-06e20ada0df2 h1:AZ+aTgKSBmBc6KtZU+P+Wr2dOdPriJu09cU8wGMG+/M=
-istio.io/gogo-genproto v0.0.0-20190731221249-06e20ada0df2/go.mod h1:IjvrbUlRbbw4JCpsgvgihcz9USUwEoNTL/uwMtyV5yk=
+google.golang.org/grpc v1.23.0 h1:AzbTB6ux+okLTzP8Ru1Xs41C303zdcfEht7MQnYJt5A=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+istio.io/gogo-genproto v0.0.0-20190930162913-45029607206a h1:w7zILua2dnYo9CxImhpNW4NE/8ZxEoc/wfBfHrhUhrE=
+istio.io/gogo-genproto v0.0.0-20190930162913-45029607206a/go.mod h1:OzpAts7jljZceG4Vqi5/zXy/pOg1b209T3jb7Nv5wIs=
diff --git a/mixer/v1/config/client/api_spec.pb.go b/mixer/v1/config/client/api_spec.pb.go
index 1fd24703..bba6eb1b 100644
--- a/mixer/v1/config/client/api_spec.pb.go
+++ b/mixer/v1/config/client/api_spec.pb.go
@@ -24,7 +24,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // HTTPAPISpec defines the canonical configuration for generating
 // API-related attributes from HTTP requests based on the method and
@@ -228,72 +228,14 @@ func (m *HTTPAPISpecPattern) GetRegex() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*HTTPAPISpecPattern) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _HTTPAPISpecPattern_OneofMarshaler, _HTTPAPISpecPattern_OneofUnmarshaler, _HTTPAPISpecPattern_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*HTTPAPISpecPattern) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*HTTPAPISpecPattern_UriTemplate)(nil),
 		(*HTTPAPISpecPattern_Regex)(nil),
 	}
 }
 
-func _HTTPAPISpecPattern_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*HTTPAPISpecPattern)
-	// pattern
-	switch x := m.Pattern.(type) {
-	case *HTTPAPISpecPattern_UriTemplate:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.UriTemplate)
-	case *HTTPAPISpecPattern_Regex:
-		_ = b.EncodeVarint(4<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Regex)
-	case nil:
-	default:
-		return fmt.Errorf("HTTPAPISpecPattern.Pattern has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _HTTPAPISpecPattern_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*HTTPAPISpecPattern)
-	switch tag {
-	case 3: // pattern.uri_template
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Pattern = &HTTPAPISpecPattern_UriTemplate{x}
-		return true, err
-	case 4: // pattern.regex
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Pattern = &HTTPAPISpecPattern_Regex{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _HTTPAPISpecPattern_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*HTTPAPISpecPattern)
-	// pattern
-	switch x := m.Pattern.(type) {
-	case *HTTPAPISpecPattern_UriTemplate:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.UriTemplate)))
-		n += len(x.UriTemplate)
-	case *HTTPAPISpecPattern_Regex:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Regex)))
-		n += len(x.Regex)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // APIKey defines the explicit configuration for generating the
 // `request.api_key` attribute from HTTP requests.
 //
@@ -383,87 +325,15 @@ func (m *APIKey) GetCookie() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*APIKey) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _APIKey_OneofMarshaler, _APIKey_OneofUnmarshaler, _APIKey_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*APIKey) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*APIKey_Query)(nil),
 		(*APIKey_Header)(nil),
 		(*APIKey_Cookie)(nil),
 	}
 }
 
-func _APIKey_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*APIKey)
-	// key
-	switch x := m.Key.(type) {
-	case *APIKey_Query:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Query)
-	case *APIKey_Header:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Header)
-	case *APIKey_Cookie:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Cookie)
-	case nil:
-	default:
-		return fmt.Errorf("APIKey.Key has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _APIKey_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*APIKey)
-	switch tag {
-	case 1: // key.query
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Key = &APIKey_Query{x}
-		return true, err
-	case 2: // key.header
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Key = &APIKey_Header{x}
-		return true, err
-	case 3: // key.cookie
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Key = &APIKey_Cookie{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _APIKey_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*APIKey)
-	// key
-	switch x := m.Key.(type) {
-	case *APIKey_Query:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Query)))
-		n += len(x.Query)
-	case *APIKey_Header:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Header)))
-		n += len(x.Header)
-	case *APIKey_Cookie:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Cookie)))
-		n += len(x.Cookie)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // HTTPAPISpecReference defines a reference to an HTTPAPISpec. This is
 // typically used for establishing bindings between an HTTPAPISpec and an
 // IstioService. For example, the following defines an
diff --git a/mixer/v1/config/client/client_config.pb.go b/mixer/v1/config/client/client_config.pb.go
index bd5e9527..d25a86c2 100644
--- a/mixer/v1/config/client/client_config.pb.go
+++ b/mixer/v1/config/client/client_config.pb.go
@@ -29,7 +29,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Describes the policy.
 type NetworkFailPolicy_FailPolicy int32
diff --git a/mixer/v1/config/client/quota.pb.go b/mixer/v1/config/client/quota.pb.go
index 4445d610..92aa772b 100644
--- a/mixer/v1/config/client/quota.pb.go
+++ b/mixer/v1/config/client/quota.pb.go
@@ -24,7 +24,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Determines the quotas used for individual requests.
 //
@@ -191,87 +191,15 @@ func (m *StringMatch) GetRegex() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*StringMatch) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _StringMatch_OneofMarshaler, _StringMatch_OneofUnmarshaler, _StringMatch_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*StringMatch) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*StringMatch_Exact)(nil),
 		(*StringMatch_Prefix)(nil),
 		(*StringMatch_Regex)(nil),
 	}
 }
 
-func _StringMatch_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*StringMatch)
-	// match_type
-	switch x := m.MatchType.(type) {
-	case *StringMatch_Exact:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Exact)
-	case *StringMatch_Prefix:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Prefix)
-	case *StringMatch_Regex:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Regex)
-	case nil:
-	default:
-		return fmt.Errorf("StringMatch.MatchType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _StringMatch_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*StringMatch)
-	switch tag {
-	case 1: // match_type.exact
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Exact{x}
-		return true, err
-	case 2: // match_type.prefix
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Prefix{x}
-		return true, err
-	case 3: // match_type.regex
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Regex{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _StringMatch_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*StringMatch)
-	// match_type
-	switch x := m.MatchType.(type) {
-	case *StringMatch_Exact:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Exact)))
-		n += len(x.Exact)
-	case *StringMatch_Prefix:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Prefix)))
-		n += len(x.Prefix)
-	case *StringMatch_Regex:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Regex)))
-		n += len(x.Regex)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Specifies a match clause to match Istio attributes
 type AttributeMatch struct {
 	// Map of attribute names to StringMatch type.
diff --git a/mixer/v1/config/client/service.pb.go b/mixer/v1/config/client/service.pb.go
index 95dc3e62..f4f8fd73 100644
--- a/mixer/v1/config/client/service.pb.go
+++ b/mixer/v1/config/client/service.pb.go
@@ -24,7 +24,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // IstioService identifies a service and optionally service version.
 // The FQDN of the service is composed from the name, namespace, and implementation-specific domain suffix
diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go
index 6aa73b5f..47a3a9bd 100644
--- a/networking/v1alpha3/destination_rule.pb.go
+++ b/networking/v1alpha3/destination_rule.pb.go
@@ -96,7 +96,7 @@ var _ = time.Kitchen
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Standard load balancing algorithms that require no tuning.
 type LoadBalancerSettings_SimpleLB int32
@@ -739,75 +739,14 @@ func (m *LoadBalancerSettings) GetConsistentHash() *LoadBalancerSettings_Consist
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*LoadBalancerSettings) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _LoadBalancerSettings_OneofMarshaler, _LoadBalancerSettings_OneofUnmarshaler, _LoadBalancerSettings_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*LoadBalancerSettings) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*LoadBalancerSettings_Simple)(nil),
 		(*LoadBalancerSettings_ConsistentHash)(nil),
 	}
 }
 
-func _LoadBalancerSettings_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*LoadBalancerSettings)
-	// lb_policy
-	switch x := m.LbPolicy.(type) {
-	case *LoadBalancerSettings_Simple:
-		_ = b.EncodeVarint(1<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(uint64(x.Simple))
-	case *LoadBalancerSettings_ConsistentHash:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.ConsistentHash); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("LoadBalancerSettings.LbPolicy has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _LoadBalancerSettings_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*LoadBalancerSettings)
-	switch tag {
-	case 1: // lb_policy.simple
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.LbPolicy = &LoadBalancerSettings_Simple{LoadBalancerSettings_SimpleLB(x)}
-		return true, err
-	case 2: // lb_policy.consistent_hash
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(LoadBalancerSettings_ConsistentHashLB)
-		err := b.DecodeMessage(msg)
-		m.LbPolicy = &LoadBalancerSettings_ConsistentHash{msg}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _LoadBalancerSettings_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*LoadBalancerSettings)
-	// lb_policy
-	switch x := m.LbPolicy.(type) {
-	case *LoadBalancerSettings_Simple:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(x.Simple))
-	case *LoadBalancerSettings_ConsistentHash:
-		s := proto.Size(x.ConsistentHash)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Consistent Hash-based load balancing can be used to provide soft
 // session affinity based on HTTP headers, cookies or other
 // properties. This load balancing policy is applicable only for HTTP
@@ -924,94 +863,15 @@ func (m *LoadBalancerSettings_ConsistentHashLB) GetMinimumRingSize() uint64 {
 	return 0
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*LoadBalancerSettings_ConsistentHashLB) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _LoadBalancerSettings_ConsistentHashLB_OneofMarshaler, _LoadBalancerSettings_ConsistentHashLB_OneofUnmarshaler, _LoadBalancerSettings_ConsistentHashLB_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*LoadBalancerSettings_ConsistentHashLB) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*LoadBalancerSettings_ConsistentHashLB_HttpHeaderName)(nil),
 		(*LoadBalancerSettings_ConsistentHashLB_HttpCookie)(nil),
 		(*LoadBalancerSettings_ConsistentHashLB_UseSourceIp)(nil),
 	}
 }
 
-func _LoadBalancerSettings_ConsistentHashLB_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*LoadBalancerSettings_ConsistentHashLB)
-	// hash_key
-	switch x := m.HashKey.(type) {
-	case *LoadBalancerSettings_ConsistentHashLB_HttpHeaderName:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.HttpHeaderName)
-	case *LoadBalancerSettings_ConsistentHashLB_HttpCookie:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.HttpCookie); err != nil {
-			return err
-		}
-	case *LoadBalancerSettings_ConsistentHashLB_UseSourceIp:
-		t := uint64(0)
-		if x.UseSourceIp {
-			t = 1
-		}
-		_ = b.EncodeVarint(3<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(t)
-	case nil:
-	default:
-		return fmt.Errorf("LoadBalancerSettings_ConsistentHashLB.HashKey has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _LoadBalancerSettings_ConsistentHashLB_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*LoadBalancerSettings_ConsistentHashLB)
-	switch tag {
-	case 1: // hash_key.http_header_name
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.HashKey = &LoadBalancerSettings_ConsistentHashLB_HttpHeaderName{x}
-		return true, err
-	case 2: // hash_key.http_cookie
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(LoadBalancerSettings_ConsistentHashLB_HTTPCookie)
-		err := b.DecodeMessage(msg)
-		m.HashKey = &LoadBalancerSettings_ConsistentHashLB_HttpCookie{msg}
-		return true, err
-	case 3: // hash_key.use_source_ip
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.HashKey = &LoadBalancerSettings_ConsistentHashLB_UseSourceIp{x != 0}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _LoadBalancerSettings_ConsistentHashLB_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*LoadBalancerSettings_ConsistentHashLB)
-	// hash_key
-	switch x := m.HashKey.(type) {
-	case *LoadBalancerSettings_ConsistentHashLB_HttpHeaderName:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.HttpHeaderName)))
-		n += len(x.HttpHeaderName)
-	case *LoadBalancerSettings_ConsistentHashLB_HttpCookie:
-		s := proto.Size(x.HttpCookie)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *LoadBalancerSettings_ConsistentHashLB_UseSourceIp:
-		n += 1 // tag and wire
-		n += 1
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Describes a HTTP cookie that will be used as the hash key for the
 // Consistent Hash load balancer. If the cookie is not present, it will
 // be generated.
diff --git a/networking/v1alpha3/envoy_filter.pb.go b/networking/v1alpha3/envoy_filter.pb.go
index 34372395..28500c54 100644
--- a/networking/v1alpha3/envoy_filter.pb.go
+++ b/networking/v1alpha3/envoy_filter.pb.go
@@ -198,7 +198,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // ApplyTo specifies where in the Envoy configuration, the given patch should be applied.
 type EnvoyFilter_ApplyTo int32
@@ -1755,99 +1755,15 @@ func (m *EnvoyFilter_EnvoyConfigObjectMatch) GetCluster() *EnvoyFilter_ClusterMa
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*EnvoyFilter_EnvoyConfigObjectMatch) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _EnvoyFilter_EnvoyConfigObjectMatch_OneofMarshaler, _EnvoyFilter_EnvoyConfigObjectMatch_OneofUnmarshaler, _EnvoyFilter_EnvoyConfigObjectMatch_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*EnvoyFilter_EnvoyConfigObjectMatch) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*EnvoyFilter_EnvoyConfigObjectMatch_Listener)(nil),
 		(*EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration)(nil),
 		(*EnvoyFilter_EnvoyConfigObjectMatch_Cluster)(nil),
 	}
 }
 
-func _EnvoyFilter_EnvoyConfigObjectMatch_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*EnvoyFilter_EnvoyConfigObjectMatch)
-	// object_types
-	switch x := m.ObjectTypes.(type) {
-	case *EnvoyFilter_EnvoyConfigObjectMatch_Listener:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Listener); err != nil {
-			return err
-		}
-	case *EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration:
-		_ = b.EncodeVarint(4<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.RouteConfiguration); err != nil {
-			return err
-		}
-	case *EnvoyFilter_EnvoyConfigObjectMatch_Cluster:
-		_ = b.EncodeVarint(5<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Cluster); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("EnvoyFilter_EnvoyConfigObjectMatch.ObjectTypes has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _EnvoyFilter_EnvoyConfigObjectMatch_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*EnvoyFilter_EnvoyConfigObjectMatch)
-	switch tag {
-	case 3: // object_types.listener
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(EnvoyFilter_ListenerMatch)
-		err := b.DecodeMessage(msg)
-		m.ObjectTypes = &EnvoyFilter_EnvoyConfigObjectMatch_Listener{msg}
-		return true, err
-	case 4: // object_types.route_configuration
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(EnvoyFilter_RouteConfigurationMatch)
-		err := b.DecodeMessage(msg)
-		m.ObjectTypes = &EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration{msg}
-		return true, err
-	case 5: // object_types.cluster
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(EnvoyFilter_ClusterMatch)
-		err := b.DecodeMessage(msg)
-		m.ObjectTypes = &EnvoyFilter_EnvoyConfigObjectMatch_Cluster{msg}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _EnvoyFilter_EnvoyConfigObjectMatch_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*EnvoyFilter_EnvoyConfigObjectMatch)
-	// object_types
-	switch x := m.ObjectTypes.(type) {
-	case *EnvoyFilter_EnvoyConfigObjectMatch_Listener:
-		s := proto.Size(x.Listener)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration:
-		s := proto.Size(x.RouteConfiguration)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *EnvoyFilter_EnvoyConfigObjectMatch_Cluster:
-		s := proto.Size(x.Cluster)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Changes to be made to various envoy config objects.
 type EnvoyFilter_EnvoyConfigObjectPatch struct {
 	// Specifies where in the Envoy configuration, the patch should be
diff --git a/networking/v1alpha3/gateway.pb.go b/networking/v1alpha3/gateway.pb.go
index 28e05b2e..7c0d5e65 100644
--- a/networking/v1alpha3/gateway.pb.go
+++ b/networking/v1alpha3/gateway.pb.go
@@ -192,7 +192,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // TLS modes enforced by the proxy
 type Server_TLSOptions_TLSmode int32
diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index 3ff92563..a17fc374 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -333,7 +333,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Location specifies whether the service is part of Istio mesh or
 // outside the mesh.  Location determines the behavior of several
diff --git a/networking/v1alpha3/sidecar.pb.go b/networking/v1alpha3/sidecar.pb.go
index 4d1b455d..f2fdb6e8 100644
--- a/networking/v1alpha3/sidecar.pb.go
+++ b/networking/v1alpha3/sidecar.pb.go
@@ -223,7 +223,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // CaptureMode describes how traffic to a listener is expected to be
 // captured. Applicable only when the listener is bound to an IP.
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index 9cf67e6e..e3ad6ea5 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -114,7 +114,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Configuration affecting traffic routing.
 //
@@ -2003,87 +2003,15 @@ func (m *StringMatch) GetRegex() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*StringMatch) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _StringMatch_OneofMarshaler, _StringMatch_OneofUnmarshaler, _StringMatch_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*StringMatch) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*StringMatch_Exact)(nil),
 		(*StringMatch_Prefix)(nil),
 		(*StringMatch_Regex)(nil),
 	}
 }
 
-func _StringMatch_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*StringMatch)
-	// match_type
-	switch x := m.MatchType.(type) {
-	case *StringMatch_Exact:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Exact)
-	case *StringMatch_Prefix:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Prefix)
-	case *StringMatch_Regex:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Regex)
-	case nil:
-	default:
-		return fmt.Errorf("StringMatch.MatchType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _StringMatch_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*StringMatch)
-	switch tag {
-	case 1: // match_type.exact
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Exact{x}
-		return true, err
-	case 2: // match_type.prefix
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Prefix{x}
-		return true, err
-	case 3: // match_type.regex
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.MatchType = &StringMatch_Regex{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _StringMatch_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*StringMatch)
-	// match_type
-	switch x := m.MatchType.(type) {
-	case *StringMatch_Exact:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Exact)))
-		n += len(x.Exact)
-	case *StringMatch_Prefix:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Prefix)))
-		n += len(x.Prefix)
-	case *StringMatch_Regex:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Regex)))
-		n += len(x.Regex)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Describes the retry policy to use when a HTTP request fails. For
 // example, the following rule sets the maximum number of retries to 3 when
 // calling ratings:v1 service, with a 2s timeout per retry attempt.
@@ -2511,80 +2439,14 @@ func (m *HTTPFaultInjection_Delay) GetPercentage() *Percent {
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*HTTPFaultInjection_Delay) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _HTTPFaultInjection_Delay_OneofMarshaler, _HTTPFaultInjection_Delay_OneofUnmarshaler, _HTTPFaultInjection_Delay_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*HTTPFaultInjection_Delay) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*HTTPFaultInjection_Delay_FixedDelay)(nil),
 		(*HTTPFaultInjection_Delay_ExponentialDelay)(nil),
 	}
 }
 
-func _HTTPFaultInjection_Delay_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*HTTPFaultInjection_Delay)
-	// http_delay_type
-	switch x := m.HttpDelayType.(type) {
-	case *HTTPFaultInjection_Delay_FixedDelay:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.FixedDelay); err != nil {
-			return err
-		}
-	case *HTTPFaultInjection_Delay_ExponentialDelay:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.ExponentialDelay); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("HTTPFaultInjection_Delay.HttpDelayType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _HTTPFaultInjection_Delay_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*HTTPFaultInjection_Delay)
-	switch tag {
-	case 2: // http_delay_type.fixed_delay
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(types.Duration)
-		err := b.DecodeMessage(msg)
-		m.HttpDelayType = &HTTPFaultInjection_Delay_FixedDelay{msg}
-		return true, err
-	case 3: // http_delay_type.exponential_delay
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(types.Duration)
-		err := b.DecodeMessage(msg)
-		m.HttpDelayType = &HTTPFaultInjection_Delay_ExponentialDelay{msg}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _HTTPFaultInjection_Delay_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*HTTPFaultInjection_Delay)
-	// http_delay_type
-	switch x := m.HttpDelayType.(type) {
-	case *HTTPFaultInjection_Delay_FixedDelay:
-		s := proto.Size(x.FixedDelay)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *HTTPFaultInjection_Delay_ExponentialDelay:
-		s := proto.Size(x.ExponentialDelay)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Abort specification is used to prematurely abort a request with a
 // pre-specified error code. The following example will return an HTTP 400
 // error code for 1 out of every 1000 requests to the "ratings" service "v1".
@@ -2726,86 +2588,15 @@ func (m *HTTPFaultInjection_Abort) GetPercentage() *Percent {
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*HTTPFaultInjection_Abort) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _HTTPFaultInjection_Abort_OneofMarshaler, _HTTPFaultInjection_Abort_OneofUnmarshaler, _HTTPFaultInjection_Abort_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*HTTPFaultInjection_Abort) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*HTTPFaultInjection_Abort_HttpStatus)(nil),
 		(*HTTPFaultInjection_Abort_GrpcStatus)(nil),
 		(*HTTPFaultInjection_Abort_Http2Error)(nil),
 	}
 }
 
-func _HTTPFaultInjection_Abort_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*HTTPFaultInjection_Abort)
-	// error_type
-	switch x := m.ErrorType.(type) {
-	case *HTTPFaultInjection_Abort_HttpStatus:
-		_ = b.EncodeVarint(2<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(uint64(x.HttpStatus))
-	case *HTTPFaultInjection_Abort_GrpcStatus:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.GrpcStatus)
-	case *HTTPFaultInjection_Abort_Http2Error:
-		_ = b.EncodeVarint(4<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.Http2Error)
-	case nil:
-	default:
-		return fmt.Errorf("HTTPFaultInjection_Abort.ErrorType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _HTTPFaultInjection_Abort_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*HTTPFaultInjection_Abort)
-	switch tag {
-	case 2: // error_type.http_status
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.ErrorType = &HTTPFaultInjection_Abort_HttpStatus{int32(x)}
-		return true, err
-	case 3: // error_type.grpc_status
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.ErrorType = &HTTPFaultInjection_Abort_GrpcStatus{x}
-		return true, err
-	case 4: // error_type.http2_error
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.ErrorType = &HTTPFaultInjection_Abort_Http2Error{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _HTTPFaultInjection_Abort_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*HTTPFaultInjection_Abort)
-	// error_type
-	switch x := m.ErrorType.(type) {
-	case *HTTPFaultInjection_Abort_HttpStatus:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(x.HttpStatus))
-	case *HTTPFaultInjection_Abort_GrpcStatus:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.GrpcStatus)))
-		n += len(x.GrpcStatus)
-	case *HTTPFaultInjection_Abort_Http2Error:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.Http2Error)))
-		n += len(x.Http2Error)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // PortSelector specifies the number of a port to be used for
 // matching or selection for final routing.
 type PortSelector struct {
diff --git a/networking/v1alpha3/virtual_service_json.gen.go b/networking/v1alpha3/virtual_service_json.gen.go
index c0b922e7..49f10d60 100644
--- a/networking/v1alpha3/virtual_service_json.gen.go
+++ b/networking/v1alpha3/virtual_service_json.gen.go
@@ -142,17 +142,6 @@ func (this *HTTPFaultInjection_Abort) UnmarshalJSON(b []byte) error {
 	return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
 }
 
-// MarshalJSON is a custom marshaler supporting oneof fields for PortSelector
-func (this *PortSelector) MarshalJSON() ([]byte, error) {
-	str, err := VirtualServiceMarshaler.MarshalToString(this)
-	return []byte(str), err
-}
-
-// UnmarshalJSON is a custom unmarshaler supporting oneof fields for PortSelector
-func (this *PortSelector) UnmarshalJSON(b []byte) error {
-	return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
-}
-
 var (
 	VirtualServiceMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
 	VirtualServiceUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
diff --git a/policy/v1beta1/cfg.pb.go b/policy/v1beta1/cfg.pb.go
index f8f66656..69f21fbd 100644
--- a/policy/v1beta1/cfg.pb.go
+++ b/policy/v1beta1/cfg.pb.go
@@ -29,7 +29,7 @@ var _ = time.Kitchen
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Header operation type.
 type Rule_HeaderOperationTemplate_Operation int32
@@ -1250,80 +1250,14 @@ func (m *Authentication) GetMutual() *Mutual {
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*Authentication) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _Authentication_OneofMarshaler, _Authentication_OneofUnmarshaler, _Authentication_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*Authentication) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*Authentication_Tls)(nil),
 		(*Authentication_Mutual)(nil),
 	}
 }
 
-func _Authentication_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*Authentication)
-	// auth_type
-	switch x := m.AuthType.(type) {
-	case *Authentication_Tls:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Tls); err != nil {
-			return err
-		}
-	case *Authentication_Mutual:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Mutual); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("Authentication.AuthType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _Authentication_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*Authentication)
-	switch tag {
-	case 1: // auth_type.tls
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(Tls)
-		err := b.DecodeMessage(msg)
-		m.AuthType = &Authentication_Tls{msg}
-		return true, err
-	case 2: // auth_type.mutual
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(Mutual)
-		err := b.DecodeMessage(msg)
-		m.AuthType = &Authentication_Mutual{msg}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _Authentication_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*Authentication)
-	// auth_type
-	switch x := m.AuthType.(type) {
-	case *Authentication_Tls:
-		s := proto.Size(x.Tls)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Authentication_Mutual:
-		s := proto.Size(x.Mutual)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // Tls let operator specify client authentication setting when TLS is used for
 // connection to the backend.
 type Tls struct {
@@ -1465,9 +1399,9 @@ func (m *Tls) GetServerName() string {
 	return ""
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*Tls) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _Tls_OneofMarshaler, _Tls_OneofUnmarshaler, _Tls_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*Tls) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*Tls_TokenPath)(nil),
 		(*Tls_Oauth)(nil),
 		(*Tls_AuthHeader_)(nil),
@@ -1475,107 +1409,6 @@ func (*Tls) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, fu
 	}
 }
 
-func _Tls_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*Tls)
-	// token_source
-	switch x := m.TokenSource.(type) {
-	case *Tls_TokenPath:
-		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.TokenPath)
-	case *Tls_Oauth:
-		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.Oauth); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("Tls.TokenSource has unexpected type %T", x)
-	}
-	// token_type
-	switch x := m.TokenType.(type) {
-	case *Tls_AuthHeader_:
-		_ = b.EncodeVarint(4<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(uint64(x.AuthHeader))
-	case *Tls_CustomHeader:
-		_ = b.EncodeVarint(5<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.CustomHeader)
-	case nil:
-	default:
-		return fmt.Errorf("Tls.TokenType has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _Tls_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*Tls)
-	switch tag {
-	case 2: // token_source.token_path
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.TokenSource = &Tls_TokenPath{x}
-		return true, err
-	case 3: // token_source.oauth
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(OAuth)
-		err := b.DecodeMessage(msg)
-		m.TokenSource = &Tls_Oauth{msg}
-		return true, err
-	case 4: // token_type.auth_header
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.TokenType = &Tls_AuthHeader_{Tls_AuthHeader(x)}
-		return true, err
-	case 5: // token_type.custom_header
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.TokenType = &Tls_CustomHeader{x}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _Tls_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*Tls)
-	// token_source
-	switch x := m.TokenSource.(type) {
-	case *Tls_TokenPath:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.TokenPath)))
-		n += len(x.TokenPath)
-	case *Tls_Oauth:
-		s := proto.Size(x.Oauth)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	// token_type
-	switch x := m.TokenType.(type) {
-	case *Tls_AuthHeader_:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(x.AuthHeader))
-	case *Tls_CustomHeader:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.CustomHeader)))
-		n += len(x.CustomHeader)
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // OAuth let operator specify config to fetch access token via oauth when using
 // TLS for connection to the backend.
 type OAuth struct {
diff --git a/policy/v1beta1/http_response.pb.go b/policy/v1beta1/http_response.pb.go
index e245e0f2..9119dd99 100644
--- a/policy/v1beta1/http_response.pb.go
+++ b/policy/v1beta1/http_response.pb.go
@@ -24,7 +24,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // HTTP response codes.
 // For more details: http://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
diff --git a/policy/v1beta1/type.pb.go b/policy/v1beta1/type.pb.go
index 1a7ef95f..77a94532 100644
--- a/policy/v1beta1/type.pb.go
+++ b/policy/v1beta1/type.pb.go
@@ -28,7 +28,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // An instance field of type Value denotes that the expression for the field is of dynamic type and can evaluate to any
 // [ValueType][istio.policy.v1beta1.ValueType] enum values. For example, when
@@ -224,9 +224,9 @@ func (m *Value) GetStringMapValue() *StringMap {
 	return nil
 }
 
-// XXX_OneofFuncs is for the internal use of the proto package.
-func (*Value) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
-	return _Value_OneofMarshaler, _Value_OneofUnmarshaler, _Value_OneofSizer, []interface{}{
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*Value) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
 		(*Value_StringValue)(nil),
 		(*Value_Int64Value)(nil),
 		(*Value_DoubleValue)(nil),
@@ -241,219 +241,6 @@ func (*Value) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error,
 	}
 }
 
-func _Value_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
-	m := msg.(*Value)
-	// value
-	switch x := m.Value.(type) {
-	case *Value_StringValue:
-		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
-		_ = b.EncodeStringBytes(x.StringValue)
-	case *Value_Int64Value:
-		_ = b.EncodeVarint(2<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(uint64(x.Int64Value))
-	case *Value_DoubleValue:
-		_ = b.EncodeVarint(3<<3 | proto.WireFixed64)
-		_ = b.EncodeFixed64(math.Float64bits(x.DoubleValue))
-	case *Value_BoolValue:
-		t := uint64(0)
-		if x.BoolValue {
-			t = 1
-		}
-		_ = b.EncodeVarint(4<<3 | proto.WireVarint)
-		_ = b.EncodeVarint(t)
-	case *Value_IpAddressValue:
-		_ = b.EncodeVarint(5<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.IpAddressValue); err != nil {
-			return err
-		}
-	case *Value_TimestampValue:
-		_ = b.EncodeVarint(6<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.TimestampValue); err != nil {
-			return err
-		}
-	case *Value_DurationValue:
-		_ = b.EncodeVarint(7<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.DurationValue); err != nil {
-			return err
-		}
-	case *Value_EmailAddressValue:
-		_ = b.EncodeVarint(8<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.EmailAddressValue); err != nil {
-			return err
-		}
-	case *Value_DnsNameValue:
-		_ = b.EncodeVarint(9<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.DnsNameValue); err != nil {
-			return err
-		}
-	case *Value_UriValue:
-		_ = b.EncodeVarint(10<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.UriValue); err != nil {
-			return err
-		}
-	case *Value_StringMapValue:
-		_ = b.EncodeVarint(11<<3 | proto.WireBytes)
-		if err := b.EncodeMessage(x.StringMapValue); err != nil {
-			return err
-		}
-	case nil:
-	default:
-		return fmt.Errorf("Value.Value has unexpected type %T", x)
-	}
-	return nil
-}
-
-func _Value_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
-	m := msg.(*Value)
-	switch tag {
-	case 1: // value.string_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeStringBytes()
-		m.Value = &Value_StringValue{x}
-		return true, err
-	case 2: // value.int64_value
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.Value = &Value_Int64Value{int64(x)}
-		return true, err
-	case 3: // value.double_value
-		if wire != proto.WireFixed64 {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeFixed64()
-		m.Value = &Value_DoubleValue{math.Float64frombits(x)}
-		return true, err
-	case 4: // value.bool_value
-		if wire != proto.WireVarint {
-			return true, proto.ErrInternalBadWireType
-		}
-		x, err := b.DecodeVarint()
-		m.Value = &Value_BoolValue{x != 0}
-		return true, err
-	case 5: // value.ip_address_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(IPAddress)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_IpAddressValue{msg}
-		return true, err
-	case 6: // value.timestamp_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(TimeStamp)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_TimestampValue{msg}
-		return true, err
-	case 7: // value.duration_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(Duration)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_DurationValue{msg}
-		return true, err
-	case 8: // value.email_address_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(EmailAddress)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_EmailAddressValue{msg}
-		return true, err
-	case 9: // value.dns_name_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(DNSName)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_DnsNameValue{msg}
-		return true, err
-	case 10: // value.uri_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(Uri)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_UriValue{msg}
-		return true, err
-	case 11: // value.string_map_value
-		if wire != proto.WireBytes {
-			return true, proto.ErrInternalBadWireType
-		}
-		msg := new(StringMap)
-		err := b.DecodeMessage(msg)
-		m.Value = &Value_StringMapValue{msg}
-		return true, err
-	default:
-		return false, nil
-	}
-}
-
-func _Value_OneofSizer(msg proto.Message) (n int) {
-	m := msg.(*Value)
-	// value
-	switch x := m.Value.(type) {
-	case *Value_StringValue:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(len(x.StringValue)))
-		n += len(x.StringValue)
-	case *Value_Int64Value:
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(x.Int64Value))
-	case *Value_DoubleValue:
-		n += 1 // tag and wire
-		n += 8
-	case *Value_BoolValue:
-		n += 1 // tag and wire
-		n += 1
-	case *Value_IpAddressValue:
-		s := proto.Size(x.IpAddressValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Value_TimestampValue:
-		s := proto.Size(x.TimestampValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Value_DurationValue:
-		s := proto.Size(x.DurationValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Value_EmailAddressValue:
-		s := proto.Size(x.EmailAddressValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Value_DnsNameValue:
-		s := proto.Size(x.DnsNameValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Value_UriValue:
-		s := proto.Size(x.UriValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case *Value_StringMapValue:
-		s := proto.Size(x.StringMapValue)
-		n += 1 // tag and wire
-		n += proto.SizeVarint(uint64(s))
-		n += s
-	case nil:
-	default:
-		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
-	}
-	return n
-}
-
 // An instance field of type IPAddress denotes that the expression for the field must evaluate to
 // [ValueType.IP_ADDRESS][istio.policy.v1beta1.ValueType.IP_ADDRESS]
 //
diff --git a/policy/v1beta1/value_type.pb.go b/policy/v1beta1/value_type.pb.go
index 1dbd9a04..bc2dfa5a 100644
--- a/policy/v1beta1/value_type.pb.go
+++ b/policy/v1beta1/value_type.pb.go
@@ -19,7 +19,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // ValueType describes the types that values in the Istio system can take. These
 // are used to describe the type of Attributes at run time, describe the type of
diff --git a/rbac/v1alpha1/rbac.pb.go b/rbac/v1alpha1/rbac.pb.go
index 78a823c4..d24404ee 100644
--- a/rbac/v1alpha1/rbac.pb.go
+++ b/rbac/v1alpha1/rbac.pb.go
@@ -85,7 +85,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // $hide_from_docs
 // RBAC ServiceRoleBinding enforcement mode, used to verify new ServiceRoleBinding
diff --git a/security/v1beta1/authorization.pb.go b/security/v1beta1/authorization.pb.go
index 2b667f2e..36ada50f 100644
--- a/security/v1beta1/authorization.pb.go
+++ b/security/v1beta1/authorization.pb.go
@@ -123,7 +123,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // AuthorizationPolicy enables access control on workloads.
 //