chore(kfp): upgrade istio resources -- part 1 (#1719)

* Upgrade KFP Istio RBAC policies to v1.6

* Update test snapshot for KFP Istio 1.6 upgrade

* Temporarily disabling the tests

Disabling test until we can finish upgrading the manifests. For details,
please see
https://github.com/kubeflow/manifests/pull/1719#issuecomment-763860432
and https://github.com/kubeflow/manifests/pull/1719#issuecomment-763909164

* Fix prow_config.yaml. It needs to have a workflows node.

pipeline/installs/multi-user/istio-authorization-config.yaml

@@ -1,61 +1,54 @@
-apiVersion: "rbac.istio.io/v1alpha1"
-kind: ServiceRole
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
 metadata:
   name: ml-pipeline-ui
   namespace: kubeflow
 spec:
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui
   rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
 ---
-apiVersion: "rbac.istio.io/v1alpha1"
-kind: ServiceRole
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
 metadata:
-  name: ml-pipeline-services
+  name: ml-pipeline-internal
   namespace: kubeflow
 spec:
+  selector:
+    matchExpressions:
+    - {key: app, operator: In, values: [ml-pipeline,ml-pipeline-ui,ml-pipeline-visualizationserver,mysql]}
   rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
 ---
-apiVersion: "rbac.istio.io/v1alpha1"
-kind: ServiceRoleBinding
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
 metadata:
-  name: bind-gateway-ml-pipeline-ui
+  name: service-cache-server
   namespace: kubeflow
 spec:
-  subjects:
-  - properties:
-      source.namespace: istio-system # gateway
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
----
-apiVersion: "rbac.istio.io/v1alpha1"
-kind: ServiceRoleBinding
-metadata:
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
+  selector:
+    matchLabels:
+      app: cache-server
+  rules:
+  - to:
+    - operation: {}
 ---
 apiVersion: "networking.istio.io/v1alpha3"
 kind: DestinationRule
@@ -96,25 +89,3 @@ spec:
   trafficPolicy:
     tls:
       mode: ISTIO_MUTUAL
----
-apiVersion: "rbac.istio.io/v1alpha1"
-kind: ServiceRole
-metadata:
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local
----
-apiVersion: "rbac.istio.io/v1alpha1"
-kind: ServiceRoleBinding
-metadata:
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  subjects:
-  - user: "*"
-  roleRef:
-    kind: ServiceRole
-    name: cache-server

pipeline/installs/multi-user/pipelines-profile-controller/composite-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   hooks:

pipeline/installs/multi-user/pipelines-profile-controller/sync.py

@@ -45,8 +45,7 @@ class Controller(BaseHTTPRequestHandler):
                 len(children["Deployment.apps/v1"]) == 2 and \
                 len(children["Service.v1"]) == 2 and \
                 len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
+                len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
                 "True" or "False"
         }
 
@@ -129,36 +128,25 @@ class Controller(BaseHTTPRequestHandler):
                 }
             },
             {
-                "apiVersion": "rbac.istio.io/v1alpha1",
-                "kind": "ServiceRole",
+                "apiVersion": "security.istio.io/v1beta1",
+                "kind": "AuthorizationPolicy",
                 "metadata": {
                     "name": "ml-pipeline-visualizationserver",
                     "namespace": namespace,
                 },
                 "spec": {
-                    "rules": [{
-                        "services": ["ml-pipeline-visualizationserver.*"]
-                    }]
-                }
-            },
-            {
-                "apiVersion": "rbac.istio.io/v1alpha1",
-                "kind": "ServiceRoleBinding",
-                "metadata": {
-                    "name": "ml-pipeline-visualizationserver",
-                    "namespace": namespace,
-                },
-                "spec": {
-                    "subjects": [{
-                        "properties": {
-                            "source.principal":
-                            "cluster.local/ns/kubeflow/sa/ml-pipeline"
+                    "selector": {
+                        "matchLabels": {
+                            "app": "ml-pipeline-visualizationserver"
                         }
-                    }],
-                    "roleRef": {
-                        "kind": "ServiceRole",
-                        "name": "ml-pipeline-visualizationserver"
-                    }
+                    },
+                    "rules": [{
+                        "from": [{
+                            "source": {
+                                "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                            }
+                        }]
+                    }]
                 }
             },
             {

prow_config.yaml

@@ -6,91 +6,91 @@ python_paths:
   - kubeflow/testing/py
   - kubeflow/kfctl/py
   - kubeflow/manifests/py
-workflows:
-  - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
-    name: e2e
-    job_types:
-      - presubmit
-      - postsubmit
-      - periodic
-    include_dirs:
-      - admission-webhook/*
-      - application/*
-      - argo/*
-      - aws/*
-      - cert-manager/*
-      - common/
-      - default-install/*
-      - dex-auth/*
-      - experimental/*
-      - istio-1-3-1/*
-      - istio/*
-      - jupyter/*
-      - katib/*
-      - kfdef/kfctl_istio_dex*
-      - kfserving/*
-      - knative/*
-      - kubebench/*
-      - kubeflow-roles/*
-      - metacontroller/*
-      - metadata/*
-      - mpi-job/*
-      - mxnet-job/*
-      - namespaces/*
-      - pipeline/*
-      - profiles/*
-      - pytorch-job/*
-      - seldon/*
-      - spark/*
-      - stacks/*
-      - tektoncd/*
-      - tf-training/*
-      - xgboost-job/*
-    kwargs:
-      build_and_apply: false
-      config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_istio_dex.yaml
+workflows: []
+#   - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
+#     name: e2e
+#     job_types:
+#       - presubmit
+#       - postsubmit
+#       - periodic
+#     include_dirs:
+#       - admission-webhook/*
+#       - application/*
+#       - argo/*
+#       - aws/*
+#       - cert-manager/*
+#       - common/
+#       - default-install/*
+#       - dex-auth/*
+#       - experimental/*
+#       - istio-1-3-1/*
+#       - istio/*
+#       - jupyter/*
+#       - katib/*
+#       - kfdef/kfctl_istio_dex*
+#       - kfserving/*
+#       - knative/*
+#       - kubebench/*
+#       - kubeflow-roles/*
+#       - metacontroller/*
+#       - metadata/*
+#       - mpi-job/*
+#       - mxnet-job/*
+#       - namespaces/*
+#       - pipeline/*
+#       - profiles/*
+#       - pytorch-job/*
+#       - seldon/*
+#       - spark/*
+#       - stacks/*
+#       - tektoncd/*
+#       - tf-training/*
+#       - xgboost-job/*
+#     kwargs:
+#       build_and_apply: false
+#       config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_istio_dex.yaml
 
-  ####################################### AWS Specific Tests
-  - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
-    name: aws-default
-    job_types:
-      - periodic
-    kwargs:
-      build_and_apply: false
-      config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
+#   ####################################### AWS Specific Tests
+#   - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
+#     name: aws-default
+#     job_types:
+#       - periodic
+#     kwargs:
+#       build_and_apply: false
+#       config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
       
-  - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
-    name: aws-1-15
-    job_types:
-      - periodic
-    kwargs:
-      build_and_apply: false
-      config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
-      eks_cluster_version: "1.15"
+#   - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
+#     name: aws-1-15
+#     job_types:
+#       - periodic
+#     kwargs:
+#       build_and_apply: false
+#       config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
+#       eks_cluster_version: "1.15"
     
-  - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
-    name: aws-1-16
-    job_types:
-      - periodic
-    kwargs:
-      build_and_apply: false
-      config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
-      eks_cluster_version: "1.16"  
+#   - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
+#     name: aws-1-16
+#     job_types:
+#       - periodic
+#     kwargs:
+#       build_and_apply: false
+#       config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
+#       eks_cluster_version: "1.16"  
 
-  - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
-    name: aws-1-17
-    job_types:
-      - periodic
-    kwargs:
-      build_and_apply: false
-      config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
-      eks_cluster_version: "1.17"
+#   - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
+#     name: aws-1-17
+#     job_types:
+#       - periodic
+#     kwargs:
+#       build_and_apply: false
+#       config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
+#       eks_cluster_version: "1.17"
   
-  - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
-    name: aws-1-18
-    job_types:
-      - periodic
-    kwargs:
-      build_and_apply: false
-      config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
-      eks_cluster_version: "1.18"
+#   - py_func: kubeflow.kfctl.testing.ci.kfctl_e2e_workflow.create_workflow
+#     name: aws-1-18
+#     job_types:
+#       - periodic
+#     kwargs:
+#       build_and_apply: false
+#       config_path: https://raw.githubusercontent.com/kubeflow/manifests/master/kfdef/kfctl_aws.yaml
+#       eks_cluster_version: "1.18"

tests/go.mod

@@ -3,22 +3,38 @@ module github.com/kubeflow/manifests/tests
 go 1.13
 
 require (
+	github.com/emicklei/go-restful v2.15.0+incompatible // indirect
+	github.com/evanphx/json-patch v4.9.0+incompatible // indirect
 	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
-	github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48 // indirect
-	github.com/golang/protobuf v1.3.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.19.5 // indirect
+	github.com/go-openapi/spec v0.20.0 // indirect
+	github.com/go-openapi/swag v0.19.12 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/martian v2.1.0+incompatible
-	github.com/json-iterator/go v1.1.7 // indirect
-	github.com/pkg/errors v0.8.1
+	github.com/googleapis/gnostic v0.5.3 // indirect
+	github.com/jessevdk/go-flags v1.4.0 // indirect
+	github.com/json-iterator/go v1.1.10 // indirect
+	github.com/kubernetes-sigs/kustomize v2.0.3+incompatible // indirect
+	github.com/mailru/easyjson v0.7.6 // indirect
+	github.com/pkg/errors v0.9.1
+	github.com/spf13/cobra v1.1.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/text v0.3.2 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2
-	k8s.io/api v0.0.0 // indirect
-	k8s.io/apimachinery v0.0.0
+	golang.org/x/net v0.0.0-20201224014010-6772e930b67b // indirect
+	golang.org/x/text v0.3.5 // indirect
+	google.golang.org/protobuf v1.25.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+	k8s.io/api v0.20.2 // indirect
+	k8s.io/apimachinery v0.20.2
 	k8s.io/client-go v12.0.0+incompatible // indirect
 	k8s.io/klog v1.0.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d // indirect
+	k8s.io/kube-openapi v0.0.0-20210113233702-8566a335510f // indirect
+	sigs.k8s.io/kustomize v2.0.3+incompatible // indirect
 	sigs.k8s.io/kustomize/kyaml v0.1.11
 	sigs.k8s.io/kustomize/v3 v3.2.0
+	sigs.k8s.io/yaml v1.2.0 // indirect
 )
 
 replace (

tests/go.sum

@@ -1,8 +1,20 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
+cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
+cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
+cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
+cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
+cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
+cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
+cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/Azure/go-autorest v11.1.2+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
@@ -18,11 +30,17 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/cascadia v1.0.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
@@ -30,7 +48,9 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
@@ -44,14 +64,25 @@ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v1.1.3 h1:KOKLkEASmIa2roa2xEV6WkADqyWrok5dt3TOMMHF1fE=
 github.com/emicklei/go-restful v2.9.6+incompatible h1:tfrHha8zJ01ywiOEC1miGY8st1/igzWB8OmvPgoYX7w=
 github.com/emicklei/go-restful v2.9.6+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.15.0+incompatible h1:8KpYO/Xl/ZudZs5RNOEhWMBY4hmzlZhhRd9cu+jrZP4=
+github.com/emicklei/go-restful v2.15.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch v0.0.0-20190203023257-5858425f7550/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
+github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
 github.com/evanphx/json-patch v4.5.0+incompatible h1:ouOWdg56aJriqS0huScTkVXPC5IcNrDCXZ6OoTAWu7M=
 github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.9.0+incompatible h1:kLcOMZeuLAJvL2BPWLMIj5oaZQobrkAqrL+WFZwQses=
+github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -62,6 +93,7 @@ github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
@@ -104,62 +136,124 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48 h1:X+zN6RZXsvnrSJaAIQhZezPfAfvsqihKKR8oiLHid34=
 github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3 h1:JjCZWpVbqXDqFVmTfYWEVTMIYrL/NPdPSCHPJ0T/raM=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/google/btree v0.0.0-20160524151835-7d79101e329e/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
 github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
 github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gnostic v0.0.0-20170426233943-68f4ded48ba9/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.3.0 h1:CcQijm0XKekKjP/YCz28LXVSpgguuB+nCxaSjCe09y0=
 github.com/googleapis/gnostic v0.3.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
+github.com/googleapis/gnostic v0.5.3 h1:2qsuRm+bzgwSIKikigPASa2GhW8H2Dn4Qq7UxD8K/48=
+github.com/googleapis/gnostic v0.5.3/go.mod h1:TRWw1s4gxBGjSe301Dai3c7wXJAZy57+/6tawkOvqHQ=
 github.com/gophercloud/gophercloud v0.0.0-20190126172459-c818fa66e4c8/go.mod h1:3WdhXV3rUYy9p6AUW8d94kr+HS62Y4VL9mBnFxsD8q4=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gregjones/httpcache v0.0.0-20170728041850-787624de3eb7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
+github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
+github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
+github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
+github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
+github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
+github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v0.0.0-20180701071628-ab8a2e0c74be/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7 h1:KfgG9LzI+pYjr4xvmz/5H4FXjokeP+rlHLhv3iH62Fo=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr68=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kubernetes-sigs/kustomize v1.0.11 h1:vt7VtxzT8OY+fIafU6BITR7nPzqHTQkF6l4RxEHmtxw=
+github.com/kubernetes-sigs/kustomize v2.0.3+incompatible h1:3hC4tnibtc3SVKd6VLMM6GYrRfFMj77Tc5UmdjMa4B0=
+github.com/kubernetes-sigs/kustomize v2.0.3+incompatible/go.mod h1:LEfoFBposdQuHJ4ZX2gdT7eoybOslchqvocZtlLyTsk=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -167,8 +261,18 @@ github.com/mailru/easyjson v0.0.0-20190620125010-da37f6c1e481 h1:IaSjLMT6WvkoZZj
 github.com/mailru/easyjson v0.0.0-20190620125010-da37f6c1e481/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
+github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
+github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
@@ -190,6 +294,7 @@ github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGV
 github.com/onsi/gomega v0.0.0-20190113212917-5533ce8a0da3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.5.0 h1:izbySO9zDPmjJ8rDjLvkA2zJHIo+HkYXHnf7eN7SSyo=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -197,13 +302,17 @@ github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -211,17 +320,25 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.2/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v1.0.0 h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
+github.com/spf13/cobra v1.1.1 h1:KfztREH0tPxJJ+geloSLaAkaPkr4ki2Er5quFV1TDo4=
+github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJQMI=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
@@ -229,6 +346,8 @@ github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
+github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
+github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
@@ -238,6 +357,8 @@ github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnR
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
@@ -246,58 +367,111 @@ github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca h1:1CFlNzQhALwjS9mBAUkycX616GzgsuYUOCHA5+HSlXI=
 github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6UtZfjr22oyGxGLbauSBp2YVXpARAosm7dHBg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.1.1/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.1.2/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWKMkuqRnW4K8x2vwt6JAaaircg=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181005035420-146acd28ed58/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190206173232-65e2d4e15006/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190320064053-1272bf9dcd53/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b h1:iFwSg7t5GZmB/Q5TjiEAsdoLDrdJRC1RiF2WhuV29Qw=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190321052220-f7bb7a8bee54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190621203818-d432491b9138/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c h1:Vco5b+cuG5NNfORVxZy6bYZQ7rsigisU1WQFkvQ0L5E=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5 h1:i6eZZ+zk0SOf0xgBpEpPD18qWcJda6q1sxt3S0kzyUQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20161028155119-f51c12702a4d/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -305,25 +479,80 @@ golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190125232054-d66bd3c5d5a6/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190617190820-da514acc4774/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
+google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0 h1:UhZDfRO8JRQru4/+LlLE0BRKGF8L+PICnvYZmx/fEGA=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4c=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.0/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
@@ -334,9 +563,20 @@ gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2 h1:XZx7nhd5GMaZpmDaEHFVafUZC7ya0fuo7cSJ3UCKYmM=
 gopkg.in/yaml.v3 v3.0.0-20191120175047-4206685974f2/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 h1:tQIYjPdBoyREyB9XMu+nnTclpTYkz2zFM+lzLJFO4gQ=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 k8s.io/api v0.0.0-20190620084959-7cf5895f2711 h1:BblVYz/wE5WtBsD/Gvu54KyBUTJMflolzc5I2DTvh50=
 k8s.io/api v0.0.0-20190620084959-7cf5895f2711/go.mod h1:TBhBqb1AWbBQbW3XRusr7n7E4v2+5ZY8r8sAMnyFC5A=
 k8s.io/apimachinery v0.0.0-20190612205821-1799e75a0719 h1:uV4S5IB5g4Nvi+TBVNf3e9L4wrirlwYJ6w88jUQxTUw=
@@ -344,20 +584,31 @@ k8s.io/apimachinery v0.0.0-20190612205821-1799e75a0719/go.mod h1:I4A+glKBHiTgiEj
 k8s.io/client-go v0.0.0-20190620085101-78d2af792bab h1:E8Fecph0qbNsAbijJJQryKu4Oi9QTp5cVpjTE+nqg6g=
 k8s.io/client-go v0.0.0-20190620085101-78d2af792bab/go.mod h1:E95RaSlHr79aHaX0aGSwcPNfygDiPKOVXdmivCIZT0k=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.1/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.3/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/kube-openapi v0.0.0-20190228160746-b3a7cee44a30/go.mod h1:BXM9ceUBTj2QnfH2MK1odQs778ajze1RxcmP6S8RVVc=
 k8s.io/kube-openapi v0.0.0-20190603182131-db7b694dc208/go.mod h1:nfDlWeOsu3pUf4yWGL+ERqohP4YsZcBJXWMK+gkzOA4=
 k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d h1:Xpe6sK+RY4ZgCTyZ3y273UmFmURhjtoJiwOMbQsXitY=
 k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+k8s.io/kube-openapi v0.0.0-20210113233702-8566a335510f h1:ZcWbnalfwIst131Zff7dGd1HQdt+NA9q7z9Fi0vbsHY=
+k8s.io/kube-openapi v0.0.0-20210113233702-8566a335510f/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
 k8s.io/utils v0.0.0-20190221042446-c2654d5206da/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+sigs.k8s.io/kustomize v1.0.11 h1:Yb+6DDt9+aR2AvQApvUaKS/ugteeG4MPyoFeUHiPOjk=
+sigs.k8s.io/kustomize v2.0.3+incompatible h1:JUufWFNlI44MdtnjUqVnvh29rR37PQFzPbLXqhyOyX0=
+sigs.k8s.io/kustomize v2.0.3+incompatible/go.mod h1:MkjgH3RdOWrievjo6c9T245dYlB5QeXV4WCbnt/PEpU=
 sigs.k8s.io/kustomize/kyaml v0.1.11 h1:/VvWxVIgH5gG1K4A7trgbyLgO3tRBiAWNhLFVU1HEmo=
 sigs.k8s.io/kustomize/kyaml v0.1.11/go.mod h1:72/rLkSi+L/pHM1oCjwrf3ClU+tH5kZQvvdLSqIHwWU=
 sigs.k8s.io/kustomize/v3 v3.2.0 h1:EKcEubO29vCbigcMoNynfyZH+ANWkML2UHWibt1Do7o=
 sigs.k8s.io/kustomize/v3 v3.2.0/go.mod h1:ztX4zYc/QIww3gSripwF7TBOarBTm5BvyAMem0kCzOE=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

tests/stacks/aws/test_data/expected/apps_v1_deployment_kubeflow-pipelines-profile-controller.yaml

@@ -55,5 +55,5 @@ spec:
           name: hooks
       volumes:
       - configMap:
-          name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+          name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
         name: hooks

tests/stacks/aws/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/aws/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/aws/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/aws/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/aws/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/aws/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/aws/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/aws/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/aws/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/aws/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/aws/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-7g6bb7c22k.yaml

@@ -48,8 +48,7 @@ data:
                     len(children["Deployment.apps/v1"]) == 2 and \
                     len(children["Service.v1"]) == 2 and \
                     len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                    len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                    len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
+                    len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
                     "True" or "False"
             }
 
@@ -132,36 +131,25 @@ data:
                     }
                 },
                 {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRole",
+                    "apiVersion": "security.istio.io/v1beta1",
+                    "kind": "AuthorizationPolicy",
                     "metadata": {
                         "name": "ml-pipeline-visualizationserver",
                         "namespace": namespace,
                     },
                     "spec": {
-                        "rules": [{
-                            "services": ["ml-pipeline-visualizationserver.*"]
-                        }]
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRoleBinding",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "subjects": [{
-                            "properties": {
-                                "source.principal":
-                                "cluster.local/ns/kubeflow/sa/ml-pipeline"
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
                             }
-                        }],
-                        "roleRef": {
-                            "kind": "ServiceRole",
-                            "name": "ml-pipeline-visualizationserver"
-                        }
+                        },
+                        "rules": [{
+                            "from": [{
+                                "source": {
+                                    "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                                }
+                            }]
+                        }]
                     }
                 },
                 {
@@ -288,5 +276,5 @@ metadata:
     app: kubeflow-pipelines-profile-controller
     app.kubernetes.io/component: ml-pipeline
     app.kubernetes.io/name: kubeflow-pipelines
-  name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+  name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
   namespace: kubeflow

tests/stacks/examples/alice/test_data/expected/apps_v1_deployment_kubeflow-pipelines-profile-controller.yaml

@@ -55,5 +55,5 @@ spec:
           name: hooks
       volumes:
       - configMap:
-          name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+          name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
         name: hooks

tests/stacks/examples/alice/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/examples/alice/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/examples/alice/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/examples/alice/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/examples/alice/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/examples/alice/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/examples/alice/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/examples/alice/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/examples/alice/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/examples/alice/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/examples/alice/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-7g6bb7c22k.yaml

@@ -48,8 +48,7 @@ data:
                     len(children["Deployment.apps/v1"]) == 2 and \
                     len(children["Service.v1"]) == 2 and \
                     len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                    len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                    len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
+                    len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
                     "True" or "False"
             }
 
@@ -132,36 +131,25 @@ data:
                     }
                 },
                 {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRole",
+                    "apiVersion": "security.istio.io/v1beta1",
+                    "kind": "AuthorizationPolicy",
                     "metadata": {
                         "name": "ml-pipeline-visualizationserver",
                         "namespace": namespace,
                     },
                     "spec": {
-                        "rules": [{
-                            "services": ["ml-pipeline-visualizationserver.*"]
-                        }]
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRoleBinding",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "subjects": [{
-                            "properties": {
-                                "source.principal":
-                                "cluster.local/ns/kubeflow/sa/ml-pipeline"
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
                             }
-                        }],
-                        "roleRef": {
-                            "kind": "ServiceRole",
-                            "name": "ml-pipeline-visualizationserver"
-                        }
+                        },
+                        "rules": [{
+                            "from": [{
+                                "source": {
+                                    "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                                }
+                            }]
+                        }]
                     }
                 },
                 {
@@ -288,5 +276,5 @@ metadata:
     app: kubeflow-pipelines-profile-controller
     app.kubernetes.io/component: ml-pipeline
     app.kubernetes.io/name: kubeflow-pipelines
-  name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+  name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
   namespace: kubeflow

tests/stacks/gcp/test_data/expected/apps_v1_deployment_kubeflow-pipelines-profile-controller.yaml

@@ -55,5 +55,5 @@ spec:
           name: hooks
       volumes:
       - configMap:
-          name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+          name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
         name: hooks

tests/stacks/gcp/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/gcp/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/gcp/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/gcp/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/gcp/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/gcp/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/gcp/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/gcp/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/gcp/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/gcp/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/gcp/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-7g6bb7c22k.yaml

@@ -48,8 +48,7 @@ data:
                     len(children["Deployment.apps/v1"]) == 2 and \
                     len(children["Service.v1"]) == 2 and \
                     len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                    len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                    len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
+                    len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
                     "True" or "False"
             }
 
@@ -132,36 +131,25 @@ data:
                     }
                 },
                 {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRole",
+                    "apiVersion": "security.istio.io/v1beta1",
+                    "kind": "AuthorizationPolicy",
                     "metadata": {
                         "name": "ml-pipeline-visualizationserver",
                         "namespace": namespace,
                     },
                     "spec": {
-                        "rules": [{
-                            "services": ["ml-pipeline-visualizationserver.*"]
-                        }]
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRoleBinding",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "subjects": [{
-                            "properties": {
-                                "source.principal":
-                                "cluster.local/ns/kubeflow/sa/ml-pipeline"
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
                             }
-                        }],
-                        "roleRef": {
-                            "kind": "ServiceRole",
-                            "name": "ml-pipeline-visualizationserver"
-                        }
+                        },
+                        "rules": [{
+                            "from": [{
+                                "source": {
+                                    "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                                }
+                            }]
+                        }]
                     }
                 },
                 {
@@ -288,5 +276,5 @@ metadata:
     app: kubeflow-pipelines-profile-controller
     app.kubernetes.io/component: ml-pipeline
     app.kubernetes.io/name: kubeflow-pipelines
-  name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+  name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
   namespace: kubeflow

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/apps_v1_deployment_kubeflow-pipelines-profile-controller.yaml

@@ -55,5 +55,5 @@ spec:
           name: hooks
       volumes:
       - configMap:
-          name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+          name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
         name: hooks

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/ibm/application/kfp-argo-multi-user/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-7g6bb7c22k.yaml

@@ -48,8 +48,7 @@ data:
                     len(children["Deployment.apps/v1"]) == 2 and \
                     len(children["Service.v1"]) == 2 and \
                     len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                    len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                    len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
+                    len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
                     "True" or "False"
             }
 
@@ -132,36 +131,25 @@ data:
                     }
                 },
                 {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRole",
+                    "apiVersion": "security.istio.io/v1beta1",
+                    "kind": "AuthorizationPolicy",
                     "metadata": {
                         "name": "ml-pipeline-visualizationserver",
                         "namespace": namespace,
                     },
                     "spec": {
-                        "rules": [{
-                            "services": ["ml-pipeline-visualizationserver.*"]
-                        }]
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRoleBinding",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "subjects": [{
-                            "properties": {
-                                "source.principal":
-                                "cluster.local/ns/kubeflow/sa/ml-pipeline"
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
                             }
-                        }],
-                        "roleRef": {
-                            "kind": "ServiceRole",
-                            "name": "ml-pipeline-visualizationserver"
-                        }
+                        },
+                        "rules": [{
+                            "from": [{
+                                "source": {
+                                    "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                                }
+                            }]
+                        }]
                     }
                 },
                 {
@@ -288,5 +276,5 @@ metadata:
     app: kubeflow-pipelines-profile-controller
     app.kubernetes.io/component: ml-pipeline
     app.kubernetes.io/name: kubeflow-pipelines
-  name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+  name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
   namespace: kubeflow

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/ibm/application/kfp-tekton-multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/ibm/multi-user/test_data/expected/apps_v1_deployment_kubeflow-pipelines-profile-controller.yaml

@@ -55,5 +55,5 @@ spec:
           name: hooks
       volumes:
       - configMap:
-          name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+          name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
         name: hooks

tests/stacks/ibm/multi-user/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/ibm/multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/ibm/multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/ibm/multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/ibm/multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/ibm/multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/ibm/multi-user/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/ibm/multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/ibm/multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/ibm/multi-user/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/ibm/multi-user/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-7g6bb7c22k.yaml

@@ -0,0 +1,280 @@
+apiVersion: v1
+data:
+  sync.py: |
+    # Copyright 2020 Google LLC
+    #
+    # Licensed under the Apache License, Version 2.0 (the "License");
+    # you may not use this file except in compliance with the License.
+    # You may obtain a copy of the License at
+    #
+    #      http://www.apache.org/licenses/LICENSE-2.0
+    #
+    # Unless required by applicable law or agreed to in writing, software
+    # distributed under the License is distributed on an "AS IS" BASIS,
+    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    # See the License for the specific language governing permissions and
+    # limitations under the License.
+
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+    import json
+    import os
+    import base64
+
+    kfp_version = os.environ["KFP_VERSION"]
+    disable_istio_sidecar = os.environ.get("DISABLE_ISTIO_SIDECAR") == "true"
+    mlpipeline_minio_access_key = base64.b64encode(
+        bytes(os.environ.get("MINIO_ACCESS_KEY"), 'utf-8')).decode('utf-8')
+    mlpipeline_minio_secret_key = base64.b64encode(
+        bytes(os.environ.get("MINIO_SECRET_KEY"), 'utf-8')).decode('utf-8')
+
+
+    class Controller(BaseHTTPRequestHandler):
+        def sync(self, parent, children):
+            # HACK: Currently using serving.kubeflow.org/inferenceservice to identify
+            # kubeflow user namespaces.
+            # TODO: let Kubeflow profile controller add a pipeline specific label to
+            # user namespaces and use that label instead.
+            pipeline_enabled = parent.get("metadata", {}).get(
+                "labels", {}).get("serving.kubeflow.org/inferenceservice")
+
+            if not pipeline_enabled:
+                return {"status": {}, "children": []}
+
+            # Compute status based on observed state.
+            desired_status = {
+                "kubeflow-pipelines-ready": \
+                    len(children["Secret.v1"]) == 1 and \
+                    len(children["ConfigMap.v1"]) == 1 and \
+                    len(children["Deployment.apps/v1"]) == 2 and \
+                    len(children["Service.v1"]) == 2 and \
+                    len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
+                    len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
+                    "True" or "False"
+            }
+
+            # Generate the desired child object(s).
+            # parent is a namespace
+            namespace = parent.get("metadata", {}).get("name")
+            desired_resources = [
+                {
+                    "apiVersion": "v1",
+                    "kind": "ConfigMap",
+                    "metadata": {
+                        "name": "metadata-grpc-configmap",
+                        "namespace": namespace,
+                    },
+                    "data": {
+                        "METADATA_GRPC_SERVICE_HOST":
+                        "metadata-grpc-service.kubeflow",
+                        "METADATA_GRPC_SERVICE_PORT": "8080",
+                    },
+                },
+                # Visualization server related manifests below
+                {
+                    "apiVersion": "apps/v1",
+                    "kind": "Deployment",
+                    "metadata": {
+                        "labels": {
+                            "app": "ml-pipeline-visualizationserver"
+                        },
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
+                            },
+                        },
+                        "template": {
+                            "metadata": {
+                                "labels": {
+                                    "app": "ml-pipeline-visualizationserver"
+                                },
+                                "annotations": disable_istio_sidecar and {
+                                    "sidecar.istio.io/inject": "false"
+                                } or {},
+                            },
+                            "spec": {
+                                "containers": [{
+                                    "image":
+                                    "gcr.io/ml-pipeline/visualization-server:" +
+                                    kfp_version,
+                                    "imagePullPolicy":
+                                    "IfNotPresent",
+                                    "name":
+                                    "ml-pipeline-visualizationserver",
+                                    "ports": [{
+                                        "containerPort": 8888
+                                    }],
+                                }],
+                                "serviceAccountName":
+                                "default-editor",
+                            },
+                        },
+                    },
+                },
+                {
+                    "apiVersion": "networking.istio.io/v1alpha3",
+                    "kind": "DestinationRule",
+                    "metadata": {
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "host": "ml-pipeline-visualizationserver",
+                        "trafficPolicy": {
+                            "tls": {
+                                "mode": "ISTIO_MUTUAL"
+                            }
+                        }
+                    }
+                },
+                {
+                    "apiVersion": "security.istio.io/v1beta1",
+                    "kind": "AuthorizationPolicy",
+                    "metadata": {
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
+                            }
+                        },
+                        "rules": [{
+                            "from": [{
+                                "source": {
+                                    "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                                }
+                            }]
+                        }]
+                    }
+                },
+                {
+                    "apiVersion": "v1",
+                    "kind": "Service",
+                    "metadata": {
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "ports": [{
+                            "name": "http",
+                            "port": 8888,
+                            "protocol": "TCP",
+                            "targetPort": 8888,
+                        }],
+                        "selector": {
+                            "app": "ml-pipeline-visualizationserver",
+                        },
+                    },
+                },
+                # Artifact fetcher related resources below.
+                {
+                    "apiVersion": "apps/v1",
+                    "kind": "Deployment",
+                    "metadata": {
+                        "labels": {
+                            "app": "ml-pipeline-ui-artifact"
+                        },
+                        "name": "ml-pipeline-ui-artifact",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-ui-artifact"
+                            }
+                        },
+                        "template": {
+                            "metadata": {
+                                "labels": {
+                                    "app": "ml-pipeline-ui-artifact"
+                                },
+                                "annotations": disable_istio_sidecar and {
+                                    "sidecar.istio.io/inject": "false"
+                                } or {},
+                            },
+                            "spec": {
+                                "containers": [{
+                                    "name":
+                                    "ml-pipeline-ui-artifact",
+                                    "image":
+                                    "gcr.io/ml-pipeline/frontend:" + kfp_version,
+                                    "imagePullPolicy":
+                                    "IfNotPresent",
+                                    "ports": [{
+                                        "containerPort": 3000
+                                    }]
+                                }],
+                                "serviceAccountName":
+                                "default-editor"
+                            }
+                        }
+                    }
+                },
+                {
+                    "apiVersion": "v1",
+                    "kind": "Service",
+                    "metadata": {
+                        "name": "ml-pipeline-ui-artifact",
+                        "namespace": namespace,
+                        "labels": {
+                            "app": "ml-pipeline-ui-artifact"
+                        }
+                    },
+                    "spec": {
+                        "ports": [{
+                            "name":
+                            "http",  # name is required to let istio understand request protocol
+                            "port": 80,
+                            "protocol": "TCP",
+                            "targetPort": 3000
+                        }],
+                        "selector": {
+                            "app": "ml-pipeline-ui-artifact"
+                        }
+                    }
+                },
+            ]
+            print('Received request:', parent)
+            print('Desired resources except secrets:', desired_resources)
+            # Moved after the print argument because this is sensitive data.
+            desired_resources.append({
+                "apiVersion": "v1",
+                "kind": "Secret",
+                "metadata": {
+                    "name": "mlpipeline-minio-artifact",
+                    "namespace": namespace,
+                },
+                "data": {
+                    "accesskey": mlpipeline_minio_access_key,
+                    "secretkey": mlpipeline_minio_secret_key,
+                },
+            })
+
+            return {"status": desired_status, "children": desired_resources}
+
+        def do_POST(self):
+            # Serve the sync() function as a JSON webhook.
+            observed = json.loads(
+                self.rfile.read(int(self.headers.get("content-length"))))
+            desired = self.sync(observed["parent"], observed["children"])
+
+            self.send_response(200)
+            self.send_header("Content-type", "application/json")
+            self.end_headers()
+            self.wfile.write(bytes(json.dumps(desired), 'utf-8'))
+
+
+    HTTPServer(("", 80), Controller).serve_forever()
+kind: ConfigMap
+metadata:
+  labels:
+    app: kubeflow-pipelines-profile-controller
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
+  namespace: kubeflow

tests/stacks/ibm/multi-user/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-gd97t2m5f5.yaml

@@ -1,292 +0,0 @@
-apiVersion: v1
-data:
-  sync.py: |
-    # Copyright 2020 Google LLC
-    #
-    # Licensed under the Apache License, Version 2.0 (the "License");
-    # you may not use this file except in compliance with the License.
-    # You may obtain a copy of the License at
-    #
-    #      http://www.apache.org/licenses/LICENSE-2.0
-    #
-    # Unless required by applicable law or agreed to in writing, software
-    # distributed under the License is distributed on an "AS IS" BASIS,
-    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    # See the License for the specific language governing permissions and
-    # limitations under the License.
-
-    from http.server import BaseHTTPRequestHandler, HTTPServer
-    import json
-    import os
-    import base64
-
-    kfp_version = os.environ["KFP_VERSION"]
-    disable_istio_sidecar = os.environ.get("DISABLE_ISTIO_SIDECAR") == "true"
-    mlpipeline_minio_access_key = base64.b64encode(
-        bytes(os.environ.get("MINIO_ACCESS_KEY"), 'utf-8')).decode('utf-8')
-    mlpipeline_minio_secret_key = base64.b64encode(
-        bytes(os.environ.get("MINIO_SECRET_KEY"), 'utf-8')).decode('utf-8')
-
-
-    class Controller(BaseHTTPRequestHandler):
-        def sync(self, parent, children):
-            # HACK: Currently using serving.kubeflow.org/inferenceservice to identify
-            # kubeflow user namespaces.
-            # TODO: let Kubeflow profile controller add a pipeline specific label to
-            # user namespaces and use that label instead.
-            pipeline_enabled = parent.get("metadata", {}).get(
-                "labels", {}).get("serving.kubeflow.org/inferenceservice")
-
-            if not pipeline_enabled:
-                return {"status": {}, "children": []}
-
-            # Compute status based on observed state.
-            desired_status = {
-                "kubeflow-pipelines-ready": \
-                    len(children["Secret.v1"]) == 1 and \
-                    len(children["ConfigMap.v1"]) == 1 and \
-                    len(children["Deployment.apps/v1"]) == 2 and \
-                    len(children["Service.v1"]) == 2 and \
-                    len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                    len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                    len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
-                    "True" or "False"
-            }
-
-            # Generate the desired child object(s).
-            # parent is a namespace
-            namespace = parent.get("metadata", {}).get("name")
-            desired_resources = [
-                {
-                    "apiVersion": "v1",
-                    "kind": "ConfigMap",
-                    "metadata": {
-                        "name": "metadata-grpc-configmap",
-                        "namespace": namespace,
-                    },
-                    "data": {
-                        "METADATA_GRPC_SERVICE_HOST":
-                        "metadata-grpc-service.kubeflow",
-                        "METADATA_GRPC_SERVICE_PORT": "8080",
-                    },
-                },
-                # Visualization server related manifests below
-                {
-                    "apiVersion": "apps/v1",
-                    "kind": "Deployment",
-                    "metadata": {
-                        "labels": {
-                            "app": "ml-pipeline-visualizationserver"
-                        },
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "selector": {
-                            "matchLabels": {
-                                "app": "ml-pipeline-visualizationserver"
-                            },
-                        },
-                        "template": {
-                            "metadata": {
-                                "labels": {
-                                    "app": "ml-pipeline-visualizationserver"
-                                },
-                                "annotations": disable_istio_sidecar and {
-                                    "sidecar.istio.io/inject": "false"
-                                } or {},
-                            },
-                            "spec": {
-                                "containers": [{
-                                    "image":
-                                    "gcr.io/ml-pipeline/visualization-server:" +
-                                    kfp_version,
-                                    "imagePullPolicy":
-                                    "IfNotPresent",
-                                    "name":
-                                    "ml-pipeline-visualizationserver",
-                                    "ports": [{
-                                        "containerPort": 8888
-                                    }],
-                                }],
-                                "serviceAccountName":
-                                "default-editor",
-                            },
-                        },
-                    },
-                },
-                {
-                    "apiVersion": "networking.istio.io/v1alpha3",
-                    "kind": "DestinationRule",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "host": "ml-pipeline-visualizationserver",
-                        "trafficPolicy": {
-                            "tls": {
-                                "mode": "ISTIO_MUTUAL"
-                            }
-                        }
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRole",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "rules": [{
-                            "services": ["ml-pipeline-visualizationserver.*"]
-                        }]
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRoleBinding",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "subjects": [{
-                            "properties": {
-                                "source.principal":
-                                "cluster.local/ns/kubeflow/sa/ml-pipeline"
-                            }
-                        }],
-                        "roleRef": {
-                            "kind": "ServiceRole",
-                            "name": "ml-pipeline-visualizationserver"
-                        }
-                    }
-                },
-                {
-                    "apiVersion": "v1",
-                    "kind": "Service",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "ports": [{
-                            "name": "http",
-                            "port": 8888,
-                            "protocol": "TCP",
-                            "targetPort": 8888,
-                        }],
-                        "selector": {
-                            "app": "ml-pipeline-visualizationserver",
-                        },
-                    },
-                },
-                # Artifact fetcher related resources below.
-                {
-                    "apiVersion": "apps/v1",
-                    "kind": "Deployment",
-                    "metadata": {
-                        "labels": {
-                            "app": "ml-pipeline-ui-artifact"
-                        },
-                        "name": "ml-pipeline-ui-artifact",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "selector": {
-                            "matchLabels": {
-                                "app": "ml-pipeline-ui-artifact"
-                            }
-                        },
-                        "template": {
-                            "metadata": {
-                                "labels": {
-                                    "app": "ml-pipeline-ui-artifact"
-                                },
-                                "annotations": disable_istio_sidecar and {
-                                    "sidecar.istio.io/inject": "false"
-                                } or {},
-                            },
-                            "spec": {
-                                "containers": [{
-                                    "name":
-                                    "ml-pipeline-ui-artifact",
-                                    "image":
-                                    "gcr.io/ml-pipeline/frontend:" + kfp_version,
-                                    "imagePullPolicy":
-                                    "IfNotPresent",
-                                    "ports": [{
-                                        "containerPort": 3000
-                                    }]
-                                }],
-                                "serviceAccountName":
-                                "default-editor"
-                            }
-                        }
-                    }
-                },
-                {
-                    "apiVersion": "v1",
-                    "kind": "Service",
-                    "metadata": {
-                        "name": "ml-pipeline-ui-artifact",
-                        "namespace": namespace,
-                        "labels": {
-                            "app": "ml-pipeline-ui-artifact"
-                        }
-                    },
-                    "spec": {
-                        "ports": [{
-                            "name":
-                            "http",  # name is required to let istio understand request protocol
-                            "port": 80,
-                            "protocol": "TCP",
-                            "targetPort": 3000
-                        }],
-                        "selector": {
-                            "app": "ml-pipeline-ui-artifact"
-                        }
-                    }
-                },
-            ]
-            print('Received request:', parent)
-            print('Desired resources except secrets:', desired_resources)
-            # Moved after the print argument because this is sensitive data.
-            desired_resources.append({
-                "apiVersion": "v1",
-                "kind": "Secret",
-                "metadata": {
-                    "name": "mlpipeline-minio-artifact",
-                    "namespace": namespace,
-                },
-                "data": {
-                    "accesskey": mlpipeline_minio_access_key,
-                    "secretkey": mlpipeline_minio_secret_key,
-                },
-            })
-
-            return {"status": desired_status, "children": desired_resources}
-
-        def do_POST(self):
-            # Serve the sync() function as a JSON webhook.
-            observed = json.loads(
-                self.rfile.read(int(self.headers.get("content-length"))))
-            desired = self.sync(observed["parent"], observed["children"])
-
-            self.send_response(200)
-            self.send_header("Content-type", "application/json")
-            self.end_headers()
-            self.wfile.write(bytes(json.dumps(desired), 'utf-8'))
-
-
-    HTTPServer(("", 80), Controller).serve_forever()
-kind: ConfigMap
-metadata:
-  labels:
-    app: kubeflow-pipelines-profile-controller
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
-  namespace: kubeflow

tests/stacks/kubernetes/test_data/expected/apps_v1_deployment_kubeflow-pipelines-profile-controller.yaml

@@ -55,5 +55,5 @@ spec:
           name: hooks
       volumes:
       - configMap:
-          name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
+          name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
         name: hooks

tests/stacks/kubernetes/test_data/expected/metacontroller.k8s.io_v1alpha1_compositecontroller_kubeflow-pipelines-profile-controller.yaml

@@ -29,12 +29,8 @@ spec:
     resource: destinationrules
     updateStrategy:
       method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: serviceroles
-    updateStrategy:
-      method: InPlace
-  - apiVersion: rbac.istio.io/v1alpha1
-    resource: servicerolebindings
+  - apiVersion: security.istio.io/v1beta1
+    resource: authorizationpolicies
     updateStrategy:
       method: InPlace
   generateSelector: true

tests/stacks/kubernetes/test_data/expected/rbac.istio.io_v1alpha1_servicerole_cache-server.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: cache-server
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - cache-server.kubeflow.svc.cluster.local

tests/stacks/kubernetes/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-services.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-services
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline.kubeflow.svc.cluster.local
-    - ml-pipeline-ui.kubeflow.svc.cluster.local
-    - ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
-    - mysql.kubeflow.svc.cluster.local

tests/stacks/kubernetes/test_data/expected/rbac.istio.io_v1alpha1_servicerole_ml-pipeline-ui.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRole
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  rules:
-  - services:
-    - ml-pipeline-ui.kubeflow.svc.cluster.local

tests/stacks/kubernetes/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-cache-server-admission-webhook.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-cache-server-admission-webhook
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: cache-server
-  subjects:
-  - user: '*'

tests/stacks/kubernetes/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-gateway-ml-pipeline-ui.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-gateway-ml-pipeline-ui
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-ui
-  subjects:
-  - properties:
-      source.namespace: istio-system

tests/stacks/kubernetes/test_data/expected/rbac.istio.io_v1alpha1_servicerolebinding_bind-ml-pipeline-internal.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.istio.io/v1alpha1
-kind: ServiceRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: bind-ml-pipeline-internal
-  namespace: kubeflow
-spec:
-  roleRef:
-    kind: ServiceRole
-    name: ml-pipeline-services
-  subjects:
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
-  - properties:
-      source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache

tests/stacks/kubernetes/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-internal.yaml

@@ -0,0 +1,30 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-internal
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/kubeflow/sa/ml-pipeline
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-ui
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
+        - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
+        - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+    to:
+    - operation: {}
+  selector:
+    matchExpressions:
+    - key: app
+      operator: In
+      values:
+      - ml-pipeline
+      - ml-pipeline-ui
+      - ml-pipeline-visualizationserver
+      - mysql

tests/stacks/kubernetes/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_ml-pipeline-ui.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: ml-pipeline-ui
+  namespace: kubeflow
+spec:
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - istio-system
+    to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: ml-pipeline-ui

tests/stacks/kubernetes/test_data/expected/security.istio.io_v1beta1_authorizationpolicy_service-cache-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: service-cache-server
+  namespace: kubeflow
+spec:
+  rules:
+  - to:
+    - operation: {}
+  selector:
+    matchLabels:
+      app: cache-server

tests/stacks/kubernetes/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-7g6bb7c22k.yaml

@@ -0,0 +1,280 @@
+apiVersion: v1
+data:
+  sync.py: |
+    # Copyright 2020 Google LLC
+    #
+    # Licensed under the Apache License, Version 2.0 (the "License");
+    # you may not use this file except in compliance with the License.
+    # You may obtain a copy of the License at
+    #
+    #      http://www.apache.org/licenses/LICENSE-2.0
+    #
+    # Unless required by applicable law or agreed to in writing, software
+    # distributed under the License is distributed on an "AS IS" BASIS,
+    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    # See the License for the specific language governing permissions and
+    # limitations under the License.
+
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+    import json
+    import os
+    import base64
+
+    kfp_version = os.environ["KFP_VERSION"]
+    disable_istio_sidecar = os.environ.get("DISABLE_ISTIO_SIDECAR") == "true"
+    mlpipeline_minio_access_key = base64.b64encode(
+        bytes(os.environ.get("MINIO_ACCESS_KEY"), 'utf-8')).decode('utf-8')
+    mlpipeline_minio_secret_key = base64.b64encode(
+        bytes(os.environ.get("MINIO_SECRET_KEY"), 'utf-8')).decode('utf-8')
+
+
+    class Controller(BaseHTTPRequestHandler):
+        def sync(self, parent, children):
+            # HACK: Currently using serving.kubeflow.org/inferenceservice to identify
+            # kubeflow user namespaces.
+            # TODO: let Kubeflow profile controller add a pipeline specific label to
+            # user namespaces and use that label instead.
+            pipeline_enabled = parent.get("metadata", {}).get(
+                "labels", {}).get("serving.kubeflow.org/inferenceservice")
+
+            if not pipeline_enabled:
+                return {"status": {}, "children": []}
+
+            # Compute status based on observed state.
+            desired_status = {
+                "kubeflow-pipelines-ready": \
+                    len(children["Secret.v1"]) == 1 and \
+                    len(children["ConfigMap.v1"]) == 1 and \
+                    len(children["Deployment.apps/v1"]) == 2 and \
+                    len(children["Service.v1"]) == 2 and \
+                    len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
+                    len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and \
+                    "True" or "False"
+            }
+
+            # Generate the desired child object(s).
+            # parent is a namespace
+            namespace = parent.get("metadata", {}).get("name")
+            desired_resources = [
+                {
+                    "apiVersion": "v1",
+                    "kind": "ConfigMap",
+                    "metadata": {
+                        "name": "metadata-grpc-configmap",
+                        "namespace": namespace,
+                    },
+                    "data": {
+                        "METADATA_GRPC_SERVICE_HOST":
+                        "metadata-grpc-service.kubeflow",
+                        "METADATA_GRPC_SERVICE_PORT": "8080",
+                    },
+                },
+                # Visualization server related manifests below
+                {
+                    "apiVersion": "apps/v1",
+                    "kind": "Deployment",
+                    "metadata": {
+                        "labels": {
+                            "app": "ml-pipeline-visualizationserver"
+                        },
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
+                            },
+                        },
+                        "template": {
+                            "metadata": {
+                                "labels": {
+                                    "app": "ml-pipeline-visualizationserver"
+                                },
+                                "annotations": disable_istio_sidecar and {
+                                    "sidecar.istio.io/inject": "false"
+                                } or {},
+                            },
+                            "spec": {
+                                "containers": [{
+                                    "image":
+                                    "gcr.io/ml-pipeline/visualization-server:" +
+                                    kfp_version,
+                                    "imagePullPolicy":
+                                    "IfNotPresent",
+                                    "name":
+                                    "ml-pipeline-visualizationserver",
+                                    "ports": [{
+                                        "containerPort": 8888
+                                    }],
+                                }],
+                                "serviceAccountName":
+                                "default-editor",
+                            },
+                        },
+                    },
+                },
+                {
+                    "apiVersion": "networking.istio.io/v1alpha3",
+                    "kind": "DestinationRule",
+                    "metadata": {
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "host": "ml-pipeline-visualizationserver",
+                        "trafficPolicy": {
+                            "tls": {
+                                "mode": "ISTIO_MUTUAL"
+                            }
+                        }
+                    }
+                },
+                {
+                    "apiVersion": "security.istio.io/v1beta1",
+                    "kind": "AuthorizationPolicy",
+                    "metadata": {
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-visualizationserver"
+                            }
+                        },
+                        "rules": [{
+                            "from": [{
+                                "source": {
+                                    "principals": ["cluster.local/ns/kubeflow/sa/ml-pipeline"]
+                                }
+                            }]
+                        }]
+                    }
+                },
+                {
+                    "apiVersion": "v1",
+                    "kind": "Service",
+                    "metadata": {
+                        "name": "ml-pipeline-visualizationserver",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "ports": [{
+                            "name": "http",
+                            "port": 8888,
+                            "protocol": "TCP",
+                            "targetPort": 8888,
+                        }],
+                        "selector": {
+                            "app": "ml-pipeline-visualizationserver",
+                        },
+                    },
+                },
+                # Artifact fetcher related resources below.
+                {
+                    "apiVersion": "apps/v1",
+                    "kind": "Deployment",
+                    "metadata": {
+                        "labels": {
+                            "app": "ml-pipeline-ui-artifact"
+                        },
+                        "name": "ml-pipeline-ui-artifact",
+                        "namespace": namespace,
+                    },
+                    "spec": {
+                        "selector": {
+                            "matchLabels": {
+                                "app": "ml-pipeline-ui-artifact"
+                            }
+                        },
+                        "template": {
+                            "metadata": {
+                                "labels": {
+                                    "app": "ml-pipeline-ui-artifact"
+                                },
+                                "annotations": disable_istio_sidecar and {
+                                    "sidecar.istio.io/inject": "false"
+                                } or {},
+                            },
+                            "spec": {
+                                "containers": [{
+                                    "name":
+                                    "ml-pipeline-ui-artifact",
+                                    "image":
+                                    "gcr.io/ml-pipeline/frontend:" + kfp_version,
+                                    "imagePullPolicy":
+                                    "IfNotPresent",
+                                    "ports": [{
+                                        "containerPort": 3000
+                                    }]
+                                }],
+                                "serviceAccountName":
+                                "default-editor"
+                            }
+                        }
+                    }
+                },
+                {
+                    "apiVersion": "v1",
+                    "kind": "Service",
+                    "metadata": {
+                        "name": "ml-pipeline-ui-artifact",
+                        "namespace": namespace,
+                        "labels": {
+                            "app": "ml-pipeline-ui-artifact"
+                        }
+                    },
+                    "spec": {
+                        "ports": [{
+                            "name":
+                            "http",  # name is required to let istio understand request protocol
+                            "port": 80,
+                            "protocol": "TCP",
+                            "targetPort": 3000
+                        }],
+                        "selector": {
+                            "app": "ml-pipeline-ui-artifact"
+                        }
+                    }
+                },
+            ]
+            print('Received request:', parent)
+            print('Desired resources except secrets:', desired_resources)
+            # Moved after the print argument because this is sensitive data.
+            desired_resources.append({
+                "apiVersion": "v1",
+                "kind": "Secret",
+                "metadata": {
+                    "name": "mlpipeline-minio-artifact",
+                    "namespace": namespace,
+                },
+                "data": {
+                    "accesskey": mlpipeline_minio_access_key,
+                    "secretkey": mlpipeline_minio_secret_key,
+                },
+            })
+
+            return {"status": desired_status, "children": desired_resources}
+
+        def do_POST(self):
+            # Serve the sync() function as a JSON webhook.
+            observed = json.loads(
+                self.rfile.read(int(self.headers.get("content-length"))))
+            desired = self.sync(observed["parent"], observed["children"])
+
+            self.send_response(200)
+            self.send_header("Content-type", "application/json")
+            self.end_headers()
+            self.wfile.write(bytes(json.dumps(desired), 'utf-8'))
+
+
+    HTTPServer(("", 80), Controller).serve_forever()
+kind: ConfigMap
+metadata:
+  labels:
+    app: kubeflow-pipelines-profile-controller
+    app.kubernetes.io/component: ml-pipeline
+    app.kubernetes.io/name: kubeflow-pipelines
+  name: kubeflow-pipelines-profile-controller-code-7g6bb7c22k
+  namespace: kubeflow

tests/stacks/kubernetes/test_data/expected/~g_v1_configmap_kubeflow-pipelines-profile-controller-code-gd97t2m5f5.yaml

@@ -1,292 +0,0 @@
-apiVersion: v1
-data:
-  sync.py: |
-    # Copyright 2020 Google LLC
-    #
-    # Licensed under the Apache License, Version 2.0 (the "License");
-    # you may not use this file except in compliance with the License.
-    # You may obtain a copy of the License at
-    #
-    #      http://www.apache.org/licenses/LICENSE-2.0
-    #
-    # Unless required by applicable law or agreed to in writing, software
-    # distributed under the License is distributed on an "AS IS" BASIS,
-    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    # See the License for the specific language governing permissions and
-    # limitations under the License.
-
-    from http.server import BaseHTTPRequestHandler, HTTPServer
-    import json
-    import os
-    import base64
-
-    kfp_version = os.environ["KFP_VERSION"]
-    disable_istio_sidecar = os.environ.get("DISABLE_ISTIO_SIDECAR") == "true"
-    mlpipeline_minio_access_key = base64.b64encode(
-        bytes(os.environ.get("MINIO_ACCESS_KEY"), 'utf-8')).decode('utf-8')
-    mlpipeline_minio_secret_key = base64.b64encode(
-        bytes(os.environ.get("MINIO_SECRET_KEY"), 'utf-8')).decode('utf-8')
-
-
-    class Controller(BaseHTTPRequestHandler):
-        def sync(self, parent, children):
-            # HACK: Currently using serving.kubeflow.org/inferenceservice to identify
-            # kubeflow user namespaces.
-            # TODO: let Kubeflow profile controller add a pipeline specific label to
-            # user namespaces and use that label instead.
-            pipeline_enabled = parent.get("metadata", {}).get(
-                "labels", {}).get("serving.kubeflow.org/inferenceservice")
-
-            if not pipeline_enabled:
-                return {"status": {}, "children": []}
-
-            # Compute status based on observed state.
-            desired_status = {
-                "kubeflow-pipelines-ready": \
-                    len(children["Secret.v1"]) == 1 and \
-                    len(children["ConfigMap.v1"]) == 1 and \
-                    len(children["Deployment.apps/v1"]) == 2 and \
-                    len(children["Service.v1"]) == 2 and \
-                    len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and \
-                    len(children["ServiceRole.rbac.istio.io/v1alpha1"]) == 1 and \
-                    len(children["ServiceRoleBinding.rbac.istio.io/v1alpha1"]) == 1 and \
-                    "True" or "False"
-            }
-
-            # Generate the desired child object(s).
-            # parent is a namespace
-            namespace = parent.get("metadata", {}).get("name")
-            desired_resources = [
-                {
-                    "apiVersion": "v1",
-                    "kind": "ConfigMap",
-                    "metadata": {
-                        "name": "metadata-grpc-configmap",
-                        "namespace": namespace,
-                    },
-                    "data": {
-                        "METADATA_GRPC_SERVICE_HOST":
-                        "metadata-grpc-service.kubeflow",
-                        "METADATA_GRPC_SERVICE_PORT": "8080",
-                    },
-                },
-                # Visualization server related manifests below
-                {
-                    "apiVersion": "apps/v1",
-                    "kind": "Deployment",
-                    "metadata": {
-                        "labels": {
-                            "app": "ml-pipeline-visualizationserver"
-                        },
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "selector": {
-                            "matchLabels": {
-                                "app": "ml-pipeline-visualizationserver"
-                            },
-                        },
-                        "template": {
-                            "metadata": {
-                                "labels": {
-                                    "app": "ml-pipeline-visualizationserver"
-                                },
-                                "annotations": disable_istio_sidecar and {
-                                    "sidecar.istio.io/inject": "false"
-                                } or {},
-                            },
-                            "spec": {
-                                "containers": [{
-                                    "image":
-                                    "gcr.io/ml-pipeline/visualization-server:" +
-                                    kfp_version,
-                                    "imagePullPolicy":
-                                    "IfNotPresent",
-                                    "name":
-                                    "ml-pipeline-visualizationserver",
-                                    "ports": [{
-                                        "containerPort": 8888
-                                    }],
-                                }],
-                                "serviceAccountName":
-                                "default-editor",
-                            },
-                        },
-                    },
-                },
-                {
-                    "apiVersion": "networking.istio.io/v1alpha3",
-                    "kind": "DestinationRule",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "host": "ml-pipeline-visualizationserver",
-                        "trafficPolicy": {
-                            "tls": {
-                                "mode": "ISTIO_MUTUAL"
-                            }
-                        }
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRole",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "rules": [{
-                            "services": ["ml-pipeline-visualizationserver.*"]
-                        }]
-                    }
-                },
-                {
-                    "apiVersion": "rbac.istio.io/v1alpha1",
-                    "kind": "ServiceRoleBinding",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "subjects": [{
-                            "properties": {
-                                "source.principal":
-                                "cluster.local/ns/kubeflow/sa/ml-pipeline"
-                            }
-                        }],
-                        "roleRef": {
-                            "kind": "ServiceRole",
-                            "name": "ml-pipeline-visualizationserver"
-                        }
-                    }
-                },
-                {
-                    "apiVersion": "v1",
-                    "kind": "Service",
-                    "metadata": {
-                        "name": "ml-pipeline-visualizationserver",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "ports": [{
-                            "name": "http",
-                            "port": 8888,
-                            "protocol": "TCP",
-                            "targetPort": 8888,
-                        }],
-                        "selector": {
-                            "app": "ml-pipeline-visualizationserver",
-                        },
-                    },
-                },
-                # Artifact fetcher related resources below.
-                {
-                    "apiVersion": "apps/v1",
-                    "kind": "Deployment",
-                    "metadata": {
-                        "labels": {
-                            "app": "ml-pipeline-ui-artifact"
-                        },
-                        "name": "ml-pipeline-ui-artifact",
-                        "namespace": namespace,
-                    },
-                    "spec": {
-                        "selector": {
-                            "matchLabels": {
-                                "app": "ml-pipeline-ui-artifact"
-                            }
-                        },
-                        "template": {
-                            "metadata": {
-                                "labels": {
-                                    "app": "ml-pipeline-ui-artifact"
-                                },
-                                "annotations": disable_istio_sidecar and {
-                                    "sidecar.istio.io/inject": "false"
-                                } or {},
-                            },
-                            "spec": {
-                                "containers": [{
-                                    "name":
-                                    "ml-pipeline-ui-artifact",
-                                    "image":
-                                    "gcr.io/ml-pipeline/frontend:" + kfp_version,
-                                    "imagePullPolicy":
-                                    "IfNotPresent",
-                                    "ports": [{
-                                        "containerPort": 3000
-                                    }]
-                                }],
-                                "serviceAccountName":
-                                "default-editor"
-                            }
-                        }
-                    }
-                },
-                {
-                    "apiVersion": "v1",
-                    "kind": "Service",
-                    "metadata": {
-                        "name": "ml-pipeline-ui-artifact",
-                        "namespace": namespace,
-                        "labels": {
-                            "app": "ml-pipeline-ui-artifact"
-                        }
-                    },
-                    "spec": {
-                        "ports": [{
-                            "name":
-                            "http",  # name is required to let istio understand request protocol
-                            "port": 80,
-                            "protocol": "TCP",
-                            "targetPort": 3000
-                        }],
-                        "selector": {
-                            "app": "ml-pipeline-ui-artifact"
-                        }
-                    }
-                },
-            ]
-            print('Received request:', parent)
-            print('Desired resources except secrets:', desired_resources)
-            # Moved after the print argument because this is sensitive data.
-            desired_resources.append({
-                "apiVersion": "v1",
-                "kind": "Secret",
-                "metadata": {
-                    "name": "mlpipeline-minio-artifact",
-                    "namespace": namespace,
-                },
-                "data": {
-                    "accesskey": mlpipeline_minio_access_key,
-                    "secretkey": mlpipeline_minio_secret_key,
-                },
-            })
-
-            return {"status": desired_status, "children": desired_resources}
-
-        def do_POST(self):
-            # Serve the sync() function as a JSON webhook.
-            observed = json.loads(
-                self.rfile.read(int(self.headers.get("content-length"))))
-            desired = self.sync(observed["parent"], observed["children"])
-
-            self.send_response(200)
-            self.send_header("Content-type", "application/json")
-            self.end_headers()
-            self.wfile.write(bytes(json.dumps(desired), 'utf-8'))
-
-
-    HTTPServer(("", 80), Controller).serve_forever()
-kind: ConfigMap
-metadata:
-  labels:
-    app: kubeflow-pipelines-profile-controller
-    app.kubernetes.io/component: ml-pipeline
-    app.kubernetes.io/name: kubeflow-pipelines
-  name: kubeflow-pipelines-profile-controller-code-gd97t2m5f5
-  namespace: kubeflow