Update Kubernetes to v1.21.0

.drone.yml

@@ -190,7 +190,6 @@ steps:
   environment:
     GCLOUD_AUTH:
       from_secret: gcloud_auth
-    GOLANG: golang:1.16.2-alpine3.12
   commands:
   - dapper ci
   - echo "${DRONE_TAG}-arm" | sed -e 's/+/-/g' >.tags

Dockerfile.dapper

-ARG GOLANG=golang:1.15.10-alpine3.12
+ARG GOLANG=golang:1.16.2-alpine3.12
 FROM ${GOLANG}
 
 ARG http_proxy=$http_proxy

Dockerfile.manifest

-ARG GOLANG=golang:1.15.10-alpine3.12
+ARG GOLANG=golang:1.16.2-alpine3.12
 FROM ${GOLANG}
 
 COPY --from=plugins/manifest:1.2.3 /bin/* /bin/

Dockerfile.test.dapper

-ARG GOLANG=golang:1.15.10-alpine3.12
+ARG GOLANG=golang:1.16.2-alpine3.12
 FROM ${GOLANG}
 
 RUN apk -U --no-cache add bash git gcc musl-dev docker curl jq coreutils python2 openssl py-pip

pkg/agent/flannel/flannel.go

@@ -21,18 +21,18 @@ import (
 	"path/filepath"
 	"sync"
 
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/network"
-	"github.com/coreos/flannel/pkg/ip"
-	"github.com/coreos/flannel/subnet/kube"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/network"
+	"github.com/flannel-io/flannel/pkg/ip"
+	"github.com/flannel-io/flannel/subnet/kube"
 	"golang.org/x/net/context"
 	log "k8s.io/klog"
 
 	// Backends need to be imported for their init() to get executed and them to register
-	_ "github.com/coreos/flannel/backend/extension"
-	_ "github.com/coreos/flannel/backend/hostgw"
-	_ "github.com/coreos/flannel/backend/ipsec"
-	_ "github.com/coreos/flannel/backend/vxlan"
+	_ "github.com/flannel-io/flannel/backend/extension"
+	_ "github.com/flannel-io/flannel/backend/hostgw"
+	_ "github.com/flannel-io/flannel/backend/ipsec"
+	_ "github.com/flannel-io/flannel/backend/vxlan"
 )
 
 const (
@@ -40,12 +40,12 @@ const (
 )
 
 func flannel(ctx context.Context, flannelIface *net.Interface, flannelConf, kubeConfigFile string) error {
-	extIface, err := LookupExtIface(flannelIface)
+	extIface, err := LookupExtInterface(flannelIface)
 	if err != nil {
 		return err
 	}
 
-	sm, err := kube.NewSubnetManager("", kubeConfigFile, "flannel.alpha.coreos.com", flannelConf)
+	sm, err := kube.NewSubnetManager(ctx, "", kubeConfigFile, "flannel.alpha.coreos.com", flannelConf)
 	if err != nil {
 		return err
 	}
@@ -63,7 +63,7 @@ func flannel(ctx context.Context, flannelIface *net.Interface, flannelConf, kube
 		return err
 	}
 
-	bn, err := be.RegisterNetwork(ctx, sync.WaitGroup{}, config)
+	bn, err := be.RegisterNetwork(ctx, &sync.WaitGroup{}, config)
 	if err != nil {
 		return err
 	}
@@ -84,20 +84,20 @@ func flannel(ctx context.Context, flannelIface *net.Interface, flannelConf, kube
 	return nil
 }
 
-func LookupExtIface(iface *net.Interface) (*backend.ExternalInterface, error) {
+func LookupExtInterface(iface *net.Interface) (*backend.ExternalInterface, error) {
 	var ifaceAddr net.IP
 	var err error
 
 	if iface == nil {
 		log.Info("Determining IP address of default interface")
-		if iface, err = ip.GetDefaultGatewayIface(); err != nil {
+		if iface, err = ip.GetDefaultGatewayInterface(); err != nil {
 			return nil, fmt.Errorf("failed to get default interface: %s", err)
 		}
 	} else {
 		log.Info("Determining IP address of specified interface: ", iface.Name)
 	}
 
-	ifaceAddr, err = ip.GetIfaceIP4Addr(iface)
+	ifaceAddr, err = ip.GetInterfaceIP4Addr(iface)
 	if err != nil {
 		return nil, fmt.Errorf("failed to find IPv4 address for interface %s", iface.Name)
 	}

pkg/daemons/control/server.go

@@ -20,12 +20,16 @@ import (
 	"github.com/rancher/wrangler-api/pkg/generated/controllers/rbac"
 	"github.com/sirupsen/logrus"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
 	ccm "k8s.io/cloud-provider"
+	cloudprovider "k8s.io/cloud-provider"
 	ccmapp "k8s.io/cloud-provider/app"
+	cloudcontrollerconfig "k8s.io/cloud-provider/app/config"
 	ccmopt "k8s.io/cloud-provider/options"
+	cliflag "k8s.io/component-base/cli/flag"
 	app2 "k8s.io/controller-manager/app"
 	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
 	"k8s.io/kubernetes/pkg/proxy/util"
@@ -183,7 +187,6 @@ func apiServer(ctx context.Context, cfg *config.Control, runtime *config.Control
 	argsMap["enable-admission-plugins"] = "NodeRestriction"
 	argsMap["anonymous-auth"] = "false"
 	argsMap["profiling"] = "false"
-	argsMap["feature-gates=ServiceAccountIssuerDiscovery"] = "false"
 	if cfg.EncryptSecrets {
 		argsMap["encryption-provider-config"] = runtime.EncryptionConfig
 	}
@@ -342,55 +345,55 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control, runtime *c
 	// The above-linked change made the in-tree cloud-controller-manager command much more flexible
 	// but much more complicated to wrap. It now validates some of the configuration very early on, before
 	// the CLI args are parsed, so some of the configuration needs to be hardcoded instead of set via flags.
+	// Reference: https://github.com/kubernetes/kubernetes/pull/98210
+	// The above-linked change further clarifies the intent of the example cloud-controller-manager.
 
 	argsMap := map[string]string{
 		"profiling": "false",
 	}
 	args := config.GetArgsList(argsMap, cfg.ExtraCloudControllerArgs)
 
-	s, err := ccmopt.NewCloudControllerManagerOptions()
+	ccmOptions, err := ccmopt.NewCloudControllerManagerOptions()
 	if err != nil {
 		logrus.Fatalf("Unable to initialize cloudcontroller options: %v", err)
 	}
 
-	s.KubeCloudShared.AllocateNodeCIDRs = true
-	s.KubeCloudShared.CloudProvider.Name = version.Program
-	s.KubeCloudShared.ClusterCIDR = cfg.ClusterIPRange.String()
-	s.KubeCloudShared.ConfigureCloudRoutes = false
-	s.Kubeconfig = runtime.KubeConfigCloudController
-	s.NodeStatusUpdateFrequency = metav1.Duration{Duration: 1 * time.Minute}
-	s.SecureServing.BindAddress = localhostIP
-	s.SecureServing.BindPort = 0
+	ccmOptions.KubeCloudShared.AllocateNodeCIDRs = true
+	ccmOptions.KubeCloudShared.CloudProvider.Name = version.Program
+	ccmOptions.KubeCloudShared.ClusterCIDR = cfg.ClusterIPRange.String()
+	ccmOptions.KubeCloudShared.ConfigureCloudRoutes = false
+	ccmOptions.Kubeconfig = runtime.KubeConfigCloudController
+	ccmOptions.NodeStatusUpdateFrequency = metav1.Duration{Duration: 1 * time.Minute}
+	ccmOptions.SecureServing.BindAddress = localhostIP
+	ccmOptions.SecureServing.BindPort = 0
 
 	if cfg.NoLeaderElect {
-		s.Generic.LeaderElection.LeaderElect = false
+		ccmOptions.Generic.LeaderElection.LeaderElect = false
 	}
 
-	c, err := s.Config([]string{}, []string{})
-	if err != nil {
-		logrus.Fatalf("Unable to create cloudcontroller config from options: %v", err)
-	}
+	controllerInitializers := ccmapp.DefaultInitFuncConstructors
+	delete(controllerInitializers, "service")
+	delete(controllerInitializers, "route")
 
-	cloud, err := ccm.InitCloudProvider(version.Program, runtime.KubeConfigCloudController)
-	if err != nil {
-		logrus.Fatalf("Cloud provider could not be initialized: %v", err)
-	}
-	if cloud == nil {
-		logrus.Fatalf("Cloud provider is nil")
-	}
+	cloudInitializer := func(config *cloudcontrollerconfig.CompletedConfig) cloudprovider.Interface {
+		cloud, err := ccm.InitCloudProvider(version.Program, runtime.KubeConfigCloudController)
+		if err != nil {
+			logrus.Fatalf("Cloud provider could not be initialized: %v", err)
+		}
+		if cloud == nil {
+			logrus.Fatalf("Cloud provider is nil")
+		}
 
-	cloud.Initialize(c.ClientBuilder, make(chan struct{}))
-	if informerUserCloud, ok := cloud.(ccm.InformerUser); ok {
-		informerUserCloud.SetInformers(c.SharedInformers)
-	}
+		cloud.Initialize(config.ClientBuilder, make(chan struct{}))
+		if informerUserCloud, ok := cloud.(ccm.InformerUser); ok {
+			informerUserCloud.SetInformers(config.SharedInformers)
+		}
 
-	controllerInitializers := ccmapp.DefaultControllerInitializers(c.Complete(), cloud)
-	delete(controllerInitializers, "service")
-	delete(controllerInitializers, "route")
+		return cloud
+	}
 
-	command := ccmapp.NewCloudControllerManagerCommand(s, c, controllerInitializers)
+	command := ccmapp.NewCloudControllerManagerCommand(ccmOptions, cloudInitializer, controllerInitializers, cliflag.NamedFlagSets{}, wait.NeverStop)
 	command.SetArgs(args)
-	// register k3s cloud provider
 
 	go func() {
 		for {
@@ -406,7 +409,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control, runtime *c
 			}
 			break
 		}
-		logrus.Infof("Running cloud-controller-manager for provider %v with args %v", cloud.ProviderName(), config.ArgString(args))
+		logrus.Infof("Running cloud-controller-manager with args %v", config.ArgString(args))
 		logrus.Fatalf("cloud-controller-manager exited: %v", command.ExecuteContext(ctx))
 	}()
 }

vendor/github.com/Azure/azure-sdk-for-go/services/containerregistry/mgmt/2019-05-01/containerregistry/client.go

+// Package containerregistry implements the Azure ARM Containerregistry service API version .
+//
+//
+package containerregistry
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"github.com/Azure/go-autorest/autorest"
+)
+
+const (
+	// DefaultBaseURI is the default URI used for the service Containerregistry
+	DefaultBaseURI = "https://management.azure.com"
+)
+
+// BaseClient is the base client for Containerregistry.
+type BaseClient struct {
+	autorest.Client
+	BaseURI        string
+	SubscriptionID string
+}
+
+// New creates an instance of the BaseClient client.
+func New(subscriptionID string) BaseClient {
+	return NewWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewWithBaseURI creates an instance of the BaseClient client using a custom endpoint.  Use this when interacting with
+// an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).
+func NewWithBaseURI(baseURI string, subscriptionID string) BaseClient {
+	return BaseClient{
+		Client:         autorest.NewClientWithUserAgent(UserAgent()),
+		BaseURI:        baseURI,
+		SubscriptionID: subscriptionID,
+	}
+}

vendor/github.com/Azure/azure-sdk-for-go/services/containerregistry/mgmt/2019-05-01/containerregistry/operations.go

+package containerregistry
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/tracing"
+	"net/http"
+)
+
+// OperationsClient is the client for the Operations methods of the Containerregistry service.
+type OperationsClient struct {
+	BaseClient
+}
+
+// NewOperationsClient creates an instance of the OperationsClient client.
+func NewOperationsClient(subscriptionID string) OperationsClient {
+	return NewOperationsClientWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewOperationsClientWithBaseURI creates an instance of the OperationsClient client using a custom endpoint.  Use this
+// when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).
+func NewOperationsClientWithBaseURI(baseURI string, subscriptionID string) OperationsClient {
+	return OperationsClient{NewWithBaseURI(baseURI, subscriptionID)}
+}
+
+// List lists all of the available Azure Container Registry REST API operations.
+func (client OperationsClient) List(ctx context.Context) (result OperationListResultPage, err error) {
+	if tracing.IsEnabled() {
+		ctx = tracing.StartSpan(ctx, fqdn+"/OperationsClient.List")
+		defer func() {
+			sc := -1
+			if result.olr.Response.Response != nil {
+				sc = result.olr.Response.Response.StatusCode
+			}
+			tracing.EndSpan(ctx, sc, err)
+		}()
+	}
+	result.fn = client.listNextResults
+	req, err := client.ListPreparer(ctx)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "containerregistry.OperationsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.olr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "containerregistry.OperationsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.olr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "containerregistry.OperationsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client OperationsClient) ListPreparer(ctx context.Context) (*http.Request, error) {
+	const APIVersion = "2019-05-01"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPath("/providers/Microsoft.ContainerRegistry/operations"),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client OperationsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return client.Send(req, autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client OperationsClient) ListResponder(resp *http.Response) (result OperationListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listNextResults retrieves the next set of results, if any.
+func (client OperationsClient) listNextResults(ctx context.Context, lastResults OperationListResult) (result OperationListResult, err error) {
+	req, err := lastResults.operationListResultPreparer(ctx)
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "containerregistry.OperationsClient", "listNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "containerregistry.OperationsClient", "listNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "containerregistry.OperationsClient", "listNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client OperationsClient) ListComplete(ctx context.Context) (result OperationListResultIterator, err error) {
+	if tracing.IsEnabled() {
+		ctx = tracing.StartSpan(ctx, fqdn+"/OperationsClient.List")
+		defer func() {
+			sc := -1
+			if result.Response().Response.Response != nil {
+				sc = result.page.Response().Response.Response.StatusCode
+			}
+			tracing.EndSpan(ctx, sc, err)
+		}()
+	}
+	result.page, err = client.List(ctx)
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/containerregistry/mgmt/2019-05-01/containerregistry/version.go

+package containerregistry
+
+import "github.com/Azure/azure-sdk-for-go/version"
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+// UserAgent returns the UserAgent string to use when sending http.Requests.
+func UserAgent() string {
+	return "Azure-SDK-For-Go/" + Version() + " containerregistry/2019-05-01"
+}
+
+// Version returns the semantic version (see http://semver.org) of the client.
+func Version() string {
+	return version.Number
+}

vendor/github.com/Azure/go-autorest/autorest/authorization.go

@@ -299,18 +299,24 @@ type MultiTenantServicePrincipalTokenAuthorizer interface {
 
 // NewMultiTenantServicePrincipalTokenAuthorizer crates a BearerAuthorizer using the given token provider
 func NewMultiTenantServicePrincipalTokenAuthorizer(tp adal.MultitenantOAuthTokenProvider) MultiTenantServicePrincipalTokenAuthorizer {
-	return &multiTenantSPTAuthorizer{tp: tp}
+	return NewMultiTenantBearerAuthorizer(tp)
 }
 
-type multiTenantSPTAuthorizer struct {
+// MultiTenantBearerAuthorizer implements bearer authorization across multiple tenants.
+type MultiTenantBearerAuthorizer struct {
 	tp adal.MultitenantOAuthTokenProvider
 }
 
+// NewMultiTenantBearerAuthorizer creates a MultiTenantBearerAuthorizer using the given token provider.
+func NewMultiTenantBearerAuthorizer(tp adal.MultitenantOAuthTokenProvider) *MultiTenantBearerAuthorizer {
+	return &MultiTenantBearerAuthorizer{tp: tp}
+}
+
 // WithAuthorization returns a PrepareDecorator that adds an HTTP Authorization header using the
 // primary token along with the auxiliary authorization header using the auxiliary tokens.
 //
 // By default, the token will be automatically refreshed through the Refresher interface.
-func (mt multiTenantSPTAuthorizer) WithAuthorization() PrepareDecorator {
+func (mt *MultiTenantBearerAuthorizer) WithAuthorization() PrepareDecorator {
 	return func(p Preparer) Preparer {
 		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
 			r, err := p.Prepare(r)
@@ -340,3 +346,8 @@ func (mt multiTenantSPTAuthorizer) WithAuthorization() PrepareDecorator {
 		})
 	}
 }
+
+// TokenProvider returns the underlying MultitenantOAuthTokenProvider for this authorizer.
+func (mt *MultiTenantBearerAuthorizer) TokenProvider() adal.MultitenantOAuthTokenProvider {
+	return mt.tp
+}

vendor/github.com/Azure/go-autorest/autorest/authorization_sas.go

@@ -54,13 +54,12 @@ func (sas *SASTokenAuthorizer) WithAuthorization() PrepareDecorator {
 				return r, err
 			}
 
-			if r.URL.RawQuery != "" {
-				r.URL.RawQuery = fmt.Sprintf("%s&%s", r.URL.RawQuery, sas.sasToken)
-			} else {
+			if r.URL.RawQuery == "" {
 				r.URL.RawQuery = sas.sasToken
+			} else if !strings.Contains(r.URL.RawQuery, sas.sasToken) {
+				r.URL.RawQuery = fmt.Sprintf("%s&%s", r.URL.RawQuery, sas.sasToken)
 			}
 
-			r.RequestURI = r.URL.String()
 			return Prepare(r)
 		})
 	}

vendor/github.com/Azure/go-autorest/autorest/authorization_storage.go

@@ -152,6 +152,9 @@ func buildCanonicalizedResource(accountName, uri string, keyType SharedKeyType)
 		// the resource's URI should be encoded exactly as it is in the URI.
 		// -- https://msdn.microsoft.com/en-gb/library/azure/dd179428.aspx
 		cr.WriteString(u.EscapedPath())
+	} else {
+		// a slash is required to indicate the root path
+		cr.WriteString("/")
 	}
 
 	params, err := url.ParseQuery(u.RawQuery)

vendor/github.com/Azure/go-autorest/autorest/azure/async.go

@@ -413,12 +413,12 @@ func (pt *pollingTrackerBase) updateRawBody() error {
 		if err != nil {
 			return autorest.NewErrorWithError(err, "pollingTrackerBase", "updateRawBody", nil, "failed to read response body")
 		}
+		// put the body back so it's available to other callers
+		pt.resp.Body = ioutil.NopCloser(bytes.NewReader(b))
 		// observed in 204 responses over HTTP/2.0; the content length is -1 but body is empty
 		if len(b) == 0 {
 			return nil
 		}
-		// put the body back so it's available to other callers
-		pt.resp.Body = ioutil.NopCloser(bytes.NewReader(b))
 		if err = json.Unmarshal(b, &pt.rawBody); err != nil {
 			return autorest.NewErrorWithError(err, "pollingTrackerBase", "updateRawBody", nil, "failed to unmarshal response body")
 		}
@@ -466,7 +466,12 @@ func (pt *pollingTrackerBase) updateErrorFromResponse() {
 		re := respErr{}
 		defer pt.resp.Body.Close()
 		var b []byte
-		if b, err = ioutil.ReadAll(pt.resp.Body); err != nil || len(b) == 0 {
+		if b, err = ioutil.ReadAll(pt.resp.Body); err != nil {
+			goto Default
+		}
+		// put the body back so it's available to other callers
+		pt.resp.Body = ioutil.NopCloser(bytes.NewReader(b))
+		if len(b) == 0 {
 			goto Default
 		}
 		if err = json.Unmarshal(b, &re); err != nil {

vendor/github.com/Azure/go-autorest/autorest/azure/azure.go

@@ -171,6 +171,11 @@ type Resource struct {
 	ResourceName   string
 }
 
+// String function returns a string in form of azureResourceID
+func (r Resource) String() string {
+	return fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/%s/%s/%s", r.SubscriptionID, r.ResourceGroup, r.Provider, r.ResourceType, r.ResourceName)
+}
+
 // ParseResourceID parses a resource ID into a ResourceDetails struct.
 // See https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-functions-resource#return-value-4.
 func ParseResourceID(resourceID string) (Resource, error) {

vendor/github.com/Azure/go-autorest/autorest/azure/environments.go

@@ -46,6 +46,8 @@ type ResourceIdentifier struct {
 	Batch               string `json:"batch"`
 	OperationalInsights string `json:"operationalInsights"`
 	Storage             string `json:"storage"`
+	Synapse             string `json:"synapse"`
+	ServiceBus          string `json:"serviceBus"`
 }
 
 // Environment represents a set of endpoints for each of Azure's Clouds.
@@ -71,6 +73,8 @@ type Environment struct {
 	ContainerRegistryDNSSuffix   string             `json:"containerRegistryDNSSuffix"`
 	CosmosDBDNSSuffix            string             `json:"cosmosDBDNSSuffix"`
 	TokenAudience                string             `json:"tokenAudience"`
+	APIManagementHostNameSuffix  string             `json:"apiManagementHostNameSuffix"`
+	SynapseEndpointSuffix        string             `json:"synapseEndpointSuffix"`
 	ResourceIdentifiers          ResourceIdentifier `json:"resourceIdentifiers"`
 }
 
@@ -98,6 +102,8 @@ var (
 		ContainerRegistryDNSSuffix:   "azurecr.io",
 		CosmosDBDNSSuffix:            "documents.azure.com",
 		TokenAudience:                "https://management.azure.com/",
+		APIManagementHostNameSuffix:  "azure-api.net",
+		SynapseEndpointSuffix:        "dev.azuresynapse.net",
 		ResourceIdentifiers: ResourceIdentifier{
 			Graph:               "https://graph.windows.net/",
 			KeyVault:            "https://vault.azure.net",
@@ -105,6 +111,8 @@ var (
 			Batch:               "https://batch.core.windows.net/",
 			OperationalInsights: "https://api.loganalytics.io",
 			Storage:             "https://storage.azure.com/",
+			Synapse:             "https://dev.azuresynapse.net",
+			ServiceBus:          "https://servicebus.azure.net/",
 		},
 	}
 
@@ -131,6 +139,8 @@ var (
 		ContainerRegistryDNSSuffix:   "azurecr.us",
 		CosmosDBDNSSuffix:            "documents.azure.us",
 		TokenAudience:                "https://management.usgovcloudapi.net/",
+		APIManagementHostNameSuffix:  "azure-api.us",
+		SynapseEndpointSuffix:        NotAvailable,
 		ResourceIdentifiers: ResourceIdentifier{
 			Graph:               "https://graph.windows.net/",
 			KeyVault:            "https://vault.usgovcloudapi.net",
@@ -138,6 +148,8 @@ var (
 			Batch:               "https://batch.core.usgovcloudapi.net/",
 			OperationalInsights: "https://api.loganalytics.us",
 			Storage:             "https://storage.azure.com/",
+			Synapse:             NotAvailable,
+			ServiceBus:          "https://servicebus.azure.net/",
 		},
 	}
 
@@ -164,6 +176,8 @@ var (
 		ContainerRegistryDNSSuffix:   "azurecr.cn",
 		CosmosDBDNSSuffix:            "documents.azure.cn",
 		TokenAudience:                "https://management.chinacloudapi.cn/",
+		APIManagementHostNameSuffix:  "azure-api.cn",
+		SynapseEndpointSuffix:        "dev.azuresynapse.azure.cn",
 		ResourceIdentifiers: ResourceIdentifier{
 			Graph:               "https://graph.chinacloudapi.cn/",
 			KeyVault:            "https://vault.azure.cn",
@@ -171,6 +185,8 @@ var (
 			Batch:               "https://batch.chinacloudapi.cn/",
 			OperationalInsights: NotAvailable,
 			Storage:             "https://storage.azure.com/",
+			Synapse:             "https://dev.azuresynapse.net",
+			ServiceBus:          "https://servicebus.azure.net/",
 		},
 	}
 
@@ -197,6 +213,8 @@ var (
 		ContainerRegistryDNSSuffix:   NotAvailable,
 		CosmosDBDNSSuffix:            "documents.microsoftazure.de",
 		TokenAudience:                "https://management.microsoftazure.de/",
+		APIManagementHostNameSuffix:  NotAvailable,
+		SynapseEndpointSuffix:        NotAvailable,
 		ResourceIdentifiers: ResourceIdentifier{
 			Graph:               "https://graph.cloudapi.de/",
 			KeyVault:            "https://vault.microsoftazure.de",
@@ -204,6 +222,8 @@ var (
 			Batch:               "https://batch.cloudapi.de/",
 			OperationalInsights: NotAvailable,
 			Storage:             "https://storage.azure.com/",
+			Synapse:             NotAvailable,
+			ServiceBus:          "https://servicebus.azure.net/",
 		},
 	}
 )

vendor/github.com/Azure/go-autorest/autorest/go.mod

@@ -4,9 +4,9 @@ go 1.12
 
 require (
 	github.com/Azure/go-autorest v14.2.0+incompatible
-	github.com/Azure/go-autorest/autorest/adal v0.9.0
-	github.com/Azure/go-autorest/autorest/mocks v0.4.0
+	github.com/Azure/go-autorest/autorest/adal v0.9.5
+	github.com/Azure/go-autorest/autorest/mocks v0.4.1
 	github.com/Azure/go-autorest/logger v0.2.0
 	github.com/Azure/go-autorest/tracing v0.6.0
-	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
+	golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0
 )

vendor/github.com/Azure/go-autorest/autorest/go.sum

 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest/autorest/adal v0.9.0 h1:SigMbuFNuKgc1xcGhaeapbh+8fgsu+GxgDRFyg7f5lM=
-github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
+github.com/Azure/go-autorest/autorest/adal v0.9.5 h1:Y3bBUV4rTuxenJJs41HU3qmqsb+auo+a3Lz+PlJPpL0=
+github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
 github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
 github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
-github.com/Azure/go-autorest/autorest/mocks v0.4.0 h1:z20OWOSG5aCye0HEkDp6TPmP17ZcfeMxPi6HnSALa8c=
-github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1 h1:K0laFcLE6VLTOwNgSxaGbUcLPuGXlNkbVvq4cW4nIHk=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/logger v0.2.0 h1:e4RVHVZKC5p6UANLJHkM4OfR1UKZPj8Wt8Pcx+3oqrE=
 github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
 github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 h1:hb9wdF1z5waM+dSIICn1l0DkLVDT3hqhhQsDNUmHPRE=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

vendor/github.com/Azure/go-autorest/autorest/preparer.go

@@ -127,10 +127,7 @@ func WithHeader(header string, value string) PrepareDecorator {
 		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
 			r, err := p.Prepare(r)
 			if err == nil {
-				if r.Header == nil {
-					r.Header = make(http.Header)
-				}
-				r.Header.Set(http.CanonicalHeaderKey(header), value)
+				setHeader(r, http.CanonicalHeaderKey(header), value)
 			}
 			return r, err
 		})
@@ -230,7 +227,7 @@ func AsPost() PrepareDecorator { return WithMethod("POST") }
 func AsPut() PrepareDecorator { return WithMethod("PUT") }
 
 // WithBaseURL returns a PrepareDecorator that populates the http.Request with a url.URL constructed
-// from the supplied baseUrl.
+// from the supplied baseUrl.  Query parameters will be encoded as required.
 func WithBaseURL(baseURL string) PrepareDecorator {
 	return func(p Preparer) Preparer {
 		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
@@ -241,11 +238,16 @@ func WithBaseURL(baseURL string) PrepareDecorator {
 					return r, err
 				}
 				if u.Scheme == "" {
-					err = fmt.Errorf("autorest: No scheme detected in URL %s", baseURL)
+					return r, fmt.Errorf("autorest: No scheme detected in URL %s", baseURL)
 				}
-				if err == nil {
-					r.URL = u
+				if u.RawQuery != "" {
+					q, err := url.ParseQuery(u.RawQuery)
+					if err != nil {
+						return r, err
+					}
+					u.RawQuery = q.Encode()
 				}
+				r.URL = u
 			}
 			return r, err
 		})
@@ -290,10 +292,7 @@ func WithFormData(v url.Values) PrepareDecorator {
 			if err == nil {
 				s := v.Encode()
 
-				if r.Header == nil {
-					r.Header = make(http.Header)
-				}
-				r.Header.Set(http.CanonicalHeaderKey(headerContentType), mimeTypeFormPost)
+				setHeader(r, http.CanonicalHeaderKey(headerContentType), mimeTypeFormPost)
 				r.ContentLength = int64(len(s))
 				r.Body = ioutil.NopCloser(strings.NewReader(s))
 			}
@@ -329,10 +328,7 @@ func WithMultiPartFormData(formDataParameters map[string]interface{}) PrepareDec
 				if err = writer.Close(); err != nil {
 					return r, err
 				}
-				if r.Header == nil {
-					r.Header = make(http.Header)
-				}
-				r.Header.Set(http.CanonicalHeaderKey(headerContentType), writer.FormDataContentType())
+				setHeader(r, http.CanonicalHeaderKey(headerContentType), writer.FormDataContentType())
 				r.Body = ioutil.NopCloser(bytes.NewReader(body.Bytes()))
 				r.ContentLength = int64(body.Len())
 				return r, err
@@ -437,6 +433,7 @@ func WithXML(v interface{}) PrepareDecorator {
 					bytesWithHeader := []byte(withHeader)
 
 					r.ContentLength = int64(len(bytesWithHeader))
+					setHeader(r, headerContentLength, fmt.Sprintf("%d", len(bytesWithHeader)))
 					r.Body = ioutil.NopCloser(bytes.NewReader(bytesWithHeader))
 				}
 			}

vendor/github.com/Azure/go-autorest/autorest/sender.go

@@ -23,11 +23,29 @@ import (
 	"net/http"
 	"net/http/cookiejar"
 	"strconv"
+	"sync"
 	"time"
 
 	"github.com/Azure/go-autorest/tracing"
 )
 
+// there is one sender per TLS renegotiation type, i.e. count of tls.RenegotiationSupport enums
+const defaultSendersCount = 3
+
+type defaultSender struct {
+	sender Sender
+	init   *sync.Once
+}
+
+// each type of sender will be created on demand in sender()
+var defaultSenders [defaultSendersCount]defaultSender
+
+func init() {
+	for i := 0; i < defaultSendersCount; i++ {
+		defaultSenders[i].init = &sync.Once{}
+	}
+}
+
 // used as a key type in context.WithValue()
 type ctxSendDecorators struct{}
 
@@ -107,26 +125,31 @@ func SendWithSender(s Sender, r *http.Request, decorators ...SendDecorator) (*ht
 }
 
 func sender(renengotiation tls.RenegotiationSupport) Sender {
-	// Use behaviour compatible with DefaultTransport, but require TLS minimum version.
-	defaultTransport := http.DefaultTransport.(*http.Transport)
-	transport := &http.Transport{
-		Proxy:                 defaultTransport.Proxy,
-		DialContext:           defaultTransport.DialContext,
-		MaxIdleConns:          defaultTransport.MaxIdleConns,
-		IdleConnTimeout:       defaultTransport.IdleConnTimeout,
-		TLSHandshakeTimeout:   defaultTransport.TLSHandshakeTimeout,
-		ExpectContinueTimeout: defaultTransport.ExpectContinueTimeout,
-		TLSClientConfig: &tls.Config{
-			MinVersion:    tls.VersionTLS12,
-			Renegotiation: renengotiation,
-		},
-	}
-	var roundTripper http.RoundTripper = transport
-	if tracing.IsEnabled() {
-		roundTripper = tracing.NewTransport(transport)
-	}
-	j, _ := cookiejar.New(nil)
-	return &http.Client{Jar: j, Transport: roundTripper}
+	// note that we can't init defaultSenders in init() since it will
+	// execute before calling code has had a chance to enable tracing
+	defaultSenders[renengotiation].init.Do(func() {
+		// Use behaviour compatible with DefaultTransport, but require TLS minimum version.
+		defaultTransport := http.DefaultTransport.(*http.Transport)
+		transport := &http.Transport{
+			Proxy:                 defaultTransport.Proxy,
+			DialContext:           defaultTransport.DialContext,
+			MaxIdleConns:          defaultTransport.MaxIdleConns,
+			IdleConnTimeout:       defaultTransport.IdleConnTimeout,
+			TLSHandshakeTimeout:   defaultTransport.TLSHandshakeTimeout,
+			ExpectContinueTimeout: defaultTransport.ExpectContinueTimeout,
+			TLSClientConfig: &tls.Config{
+				MinVersion:    tls.VersionTLS12,
+				Renegotiation: renengotiation,
+			},
+		}
+		var roundTripper http.RoundTripper = transport
+		if tracing.IsEnabled() {
+			roundTripper = tracing.NewTransport(transport)
+		}
+		j, _ := cookiejar.New(nil)
+		defaultSenders[renengotiation].sender = &http.Client{Jar: j, Transport: roundTripper}
+	})
+	return defaultSenders[renengotiation].sender
 }
 
 // AfterDelay returns a SendDecorator that delays for the passed time.Duration before

vendor/github.com/Azure/go-autorest/autorest/utility.go

@@ -237,3 +237,10 @@ func DrainResponseBody(resp *http.Response) error {
 	}
 	return nil
 }
+
+func setHeader(r *http.Request, key, value string) {
+	if r.Header == nil {
+		r.Header = make(http.Header)
+	}
+	r.Header.Set(key, value)
+}

vendor/github.com/aws/aws-sdk-go/service/ecr/doc.go

+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+// Package ecr provides the client and types for making API
+// requests to Amazon EC2 Container Registry.
+//
+// Amazon Elastic Container Registry (Amazon ECR) is a managed container image
+// registry service. Customers can use the familiar Docker CLI, or their preferred
+// client, to push, pull, and manage images. Amazon ECR provides a secure, scalable,
+// and reliable registry for your Docker or Open Container Initiative (OCI)
+// images. Amazon ECR supports private repositories with resource-based permissions
+// using IAM so that specific users or Amazon EC2 instances can access repositories
+// and images.
+//
+// See https://docs.aws.amazon.com/goto/WebAPI/ecr-2015-09-21 for more information on this service.
+//
+// See ecr package documentation for more information.
+// https://docs.aws.amazon.com/sdk-for-go/api/service/ecr/
+//
+// Using the Client
+//
+// To contact Amazon EC2 Container Registry with the SDK use the New function to create
+// a new service client. With that client you can make API requests to the service.
+// These clients are safe to use concurrently.
+//
+// See the SDK's documentation for more information on how to use the SDK.
+// https://docs.aws.amazon.com/sdk-for-go/api/
+//
+// See aws.Config documentation for more information on configuring SDK clients.
+// https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config
+//
+// See the Amazon EC2 Container Registry client ECR for more
+// information on creating client for this service.
+// https://docs.aws.amazon.com/sdk-for-go/api/service/ecr/#New
+package ecr

vendor/github.com/aws/aws-sdk-go/service/ecr/service.go

+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package ecr
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/private/protocol"
+	"github.com/aws/aws-sdk-go/private/protocol/jsonrpc"
+)
+
+// ECR provides the API operation methods for making requests to
+// Amazon EC2 Container Registry. See this package's package overview docs
+// for details on the service.
+//
+// ECR methods are safe to use concurrently. It is not safe to
+// modify mutate any of the struct's properties though.
+type ECR struct {
+	*client.Client
+}
+
+// Used for custom client initialization logic
+var initClient func(*client.Client)
+
+// Used for custom request initialization logic
+var initRequest func(*request.Request)
+
+// Service information constants
+const (
+	ServiceName = "ecr"     // Name of service.
+	EndpointsID = "api.ecr" // ID to lookup a service endpoint with.
+	ServiceID   = "ECR"     // ServiceID is a unique identifier of a specific service.
+)
+
+// New creates a new instance of the ECR client with a session.
+// If additional configuration is needed for the client instance use the optional
+// aws.Config parameter to add your extra config.
+//
+// Example:
+//     mySession := session.Must(session.NewSession())
+//
+//     // Create a ECR client from just a session.
+//     svc := ecr.New(mySession)
+//
+//     // Create a ECR client with additional configuration
+//     svc := ecr.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
+func New(p client.ConfigProvider, cfgs ...*aws.Config) *ECR {
+	c := p.ClientConfig(EndpointsID, cfgs...)
+	if c.SigningNameDerived || len(c.SigningName) == 0 {
+		c.SigningName = "ecr"
+	}
+	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
+}
+
+// newClient creates, initializes and returns a new service client instance.
+func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *ECR {
+	svc := &ECR{
+		Client: client.New(
+			cfg,
+			metadata.ClientInfo{
+				ServiceName:   ServiceName,
+				ServiceID:     ServiceID,
+				SigningName:   signingName,
+				SigningRegion: signingRegion,
+				PartitionID:   partitionID,
+				Endpoint:      endpoint,
+				APIVersion:    "2015-09-21",
+				JSONVersion:   "1.1",
+				TargetPrefix:  "AmazonEC2ContainerRegistry_V20150921",
+			},
+			handlers,
+		),
+	}
+
+	// Handlers
+	svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
+	svc.Handlers.Build.PushBackNamed(jsonrpc.BuildHandler)
+	svc.Handlers.Unmarshal.PushBackNamed(jsonrpc.UnmarshalHandler)
+	svc.Handlers.UnmarshalMeta.PushBackNamed(jsonrpc.UnmarshalMetaHandler)
+	svc.Handlers.UnmarshalError.PushBackNamed(
+		protocol.NewUnmarshalErrorHandler(jsonrpc.NewUnmarshalTypedError(exceptionFromCode)).NamedHandler(),
+	)
+
+	// Run custom client initialization if present
+	if initClient != nil {
+		initClient(svc.Client)
+	}
+
+	return svc
+}
+
+// newRequest creates a new request for a ECR operation and runs any
+// custom request initialization.
+func (c *ECR) newRequest(op *request.Operation, params, data interface{}) *request.Request {
+	req := c.NewRequest(op, params, data)
+
+	// Run custom request initialization if present
+	if initRequest != nil {
+		initRequest(req)
+	}
+
+	return req
+}

vendor/github.com/aws/aws-sdk-go/service/ecr/waiters.go

+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package ecr
+
+import (
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// WaitUntilImageScanComplete uses the Amazon ECR API operation
+// DescribeImageScanFindings to wait for a condition to be met before returning.
+// If the condition is not met within the max attempt window, an error will
+// be returned.
+func (c *ECR) WaitUntilImageScanComplete(input *DescribeImageScanFindingsInput) error {
+	return c.WaitUntilImageScanCompleteWithContext(aws.BackgroundContext(), input)
+}
+
+// WaitUntilImageScanCompleteWithContext is an extended version of WaitUntilImageScanComplete.
+// With the support for passing in a context and options to configure the
+// Waiter and the underlying request options.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ECR) WaitUntilImageScanCompleteWithContext(ctx aws.Context, input *DescribeImageScanFindingsInput, opts ...request.WaiterOption) error {
+	w := request.Waiter{
+		Name:        "WaitUntilImageScanComplete",
+		MaxAttempts: 60,
+		Delay:       request.ConstantWaiterDelay(5 * time.Second),
+		Acceptors: []request.WaiterAcceptor{
+			{
+				State:   request.SuccessWaiterState,
+				Matcher: request.PathWaiterMatch, Argument: "imageScanStatus.status",
+				Expected: "COMPLETE",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathWaiterMatch, Argument: "imageScanStatus.status",
+				Expected: "FAILED",
+			},
+		},
+		Logger: c.Config.Logger,
+		NewRequest: func(opts []request.Option) (*request.Request, error) {
+			var inCpy *DescribeImageScanFindingsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeImageScanFindingsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+	w.ApplyOptions(opts...)
+
+	return w.WaitWithContext(ctx)
+}
+
+// WaitUntilLifecyclePolicyPreviewComplete uses the Amazon ECR API operation
+// GetLifecyclePolicyPreview to wait for a condition to be met before returning.
+// If the condition is not met within the max attempt window, an error will
+// be returned.
+func (c *ECR) WaitUntilLifecyclePolicyPreviewComplete(input *GetLifecyclePolicyPreviewInput) error {
+	return c.WaitUntilLifecyclePolicyPreviewCompleteWithContext(aws.BackgroundContext(), input)
+}
+
+// WaitUntilLifecyclePolicyPreviewCompleteWithContext is an extended version of WaitUntilLifecyclePolicyPreviewComplete.
+// With the support for passing in a context and options to configure the
+// Waiter and the underlying request options.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ECR) WaitUntilLifecyclePolicyPreviewCompleteWithContext(ctx aws.Context, input *GetLifecyclePolicyPreviewInput, opts ...request.WaiterOption) error {
+	w := request.Waiter{
+		Name:        "WaitUntilLifecyclePolicyPreviewComplete",
+		MaxAttempts: 20,
+		Delay:       request.ConstantWaiterDelay(5 * time.Second),
+		Acceptors: []request.WaiterAcceptor{
+			{
+				State:   request.SuccessWaiterState,
+				Matcher: request.PathWaiterMatch, Argument: "status",
+				Expected: "COMPLETE",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathWaiterMatch, Argument: "status",
+				Expected: "FAILED",
+			},
+		},
+		Logger: c.Config.Logger,
+		NewRequest: func(opts []request.Option) (*request.Request, error) {
+			var inCpy *GetLifecyclePolicyPreviewInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.GetLifecyclePolicyPreviewRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+	w.ApplyOptions(opts...)
+
+	return w.WaitWithContext(ctx)
+}

vendor/github.com/benmoss/go-powershell/README.md

-# go-powershell
-
-_NOTE: this repository has been recently (2020-11-18) moved out of the github.com/rancher org to github.com/k3s-io
-supporting the [acceptance of K3s as a CNCF sandbox project](https://github.com/cncf/toc/pull/447)_.
----
-
-This package is inspired by [jPowerShell](https://github.com/profesorfalken/jPowerShell)
-and allows one to run and remote-control a PowerShell session. Use this if you
-don't have a static script that you want to execute, bur rather run dynamic
-commands.
-
-## Installation
-
-    go get github.com/k3s-io/go-powershell
-
-## Usage
-
-To start a PowerShell shell, you need a backend. Backends take care of starting
-and controlling the actual powershell.exe process. In most cases, you will want
-to use the Local backend, which just uses ``os/exec`` to start the process.
-
-```go
-package main
-
-import (
-	"fmt"
-
-	ps "github.com/k3s-io/go-powershell"
-	"github.com/k3s-io/go-powershell/backend"
-)
-
-func main() {
-	// choose a backend
-	back := &backend.Local{}
-
-	// start a local powershell process
-	shell, err := ps.New(back)
-	if err != nil {
-		panic(err)
-	}
-	defer shell.Exit()
-
-	// ... and interact with it
-	stdout, stderr, err := shell.Execute("Get-WmiObject -Class Win32_Processor")
-	if err != nil {
-		panic(err)
-	}
-
-	fmt.Println(stdout)
-}
-```
-
-## Remote Sessions
-
-You can use an existing PS shell to use PSSession cmdlets to connect to remote
-computers. Instead of manually handling that, you can use the Session middleware,
-which takes care of authentication. Note that you can still use the "raw" shell
-to execute commands on the computer where the powershell host process is running.
-
-```go
-package main
-
-import (
-	"fmt"
-
-	ps "github.com/k3s-io/go-powershell"
-	"github.com/k3s-io/go-powershell/backend"
-	"github.com/k3s-io/go-powershell/middleware"
-)
-
-func main() {
-	// choose a backend
-	back := &backend.Local{}
-
-	// start a local powershell process
-	shell, err := ps.New(back)
-	if err != nil {
-		panic(err)
-	}
-
-	// prepare remote session configuration
-	config := middleware.NewSessionConfig()
-	config.ComputerName = "remote-pc-1"
-
-	// create a new shell by wrapping the existing one in the session middleware
-	session, err := middleware.NewSession(shell, config)
-	if err != nil {
-		panic(err)
-	}
-	defer session.Exit() // will also close the underlying ps shell!
-
-	// everything run via the session is run on the remote machine
-	stdout, stderr, err = session.Execute("Get-WmiObject -Class Win32_Processor")
-	if err != nil {
-		panic(err)
-	}
-
-	fmt.Println(stdout)
-}
-```
-
-Note that a single shell instance is not safe for concurrent use, as are remote
-sessions. You can have as many remote sessions using the same shell as you like,
-but you must execute commands serially. If you need concurrency, you can just
-spawn multiple PowerShell processes (i.e. call ``.New()`` multiple times).
-
-Also, note that all commands that you execute are wrapped in special echo
-statements to delimit the stdout/stderr streams. After ``.Execute()``ing a command,
-you can therefore not access ``$LastExitCode`` anymore and expect meaningful
-results.
-
-## License
-
-MIT, see LICENSE file.

vendor/github.com/benmoss/go-powershell/backend/local.go

-// Copyright (c) 2017 Gorillalabs. All rights reserved.
-
-package backend
-
-import (
-	"io"
-	"os/exec"
-
-	"github.com/pkg/errors"
-)
-
-type Local struct{}
-
-func (b *Local) StartProcess(cmd string, args ...string) (Waiter, io.Writer, io.Reader, io.Reader, error) {
-	command := exec.Command(cmd, args...)
-
-	stdin, err := command.StdinPipe()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not get hold of the PowerShell's stdin stream")
-	}
-
-	stdout, err := command.StdoutPipe()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not get hold of the PowerShell's stdout stream")
-	}
-
-	stderr, err := command.StderrPipe()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not get hold of the PowerShell's stderr stream")
-	}
-
-	err = command.Start()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not spawn PowerShell process")
-	}
-
-	return command, stdin, stdout, stderr, nil
-}

vendor/github.com/benmoss/go-powershell/backend/ssh.go

-// Copyright (c) 2017 Gorillalabs. All rights reserved.
-
-package backend
-
-import (
-	"fmt"
-	"io"
-	"regexp"
-	"strings"
-
-	"github.com/pkg/errors"
-)
-
-// sshSession exists so we don't create a hard dependency on crypto/ssh.
-type sshSession interface {
-	Waiter
-
-	StdinPipe() (io.WriteCloser, error)
-	StdoutPipe() (io.Reader, error)
-	StderrPipe() (io.Reader, error)
-	Start(string) error
-}
-
-type SSH struct {
-	Session sshSession
-}
-
-func (b *SSH) StartProcess(cmd string, args ...string) (Waiter, io.Writer, io.Reader, io.Reader, error) {
-	stdin, err := b.Session.StdinPipe()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not get hold of the SSH session's stdin stream")
-	}
-
-	stdout, err := b.Session.StdoutPipe()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not get hold of the SSH session's stdout stream")
-	}
-
-	stderr, err := b.Session.StderrPipe()
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not get hold of the SSH session's stderr stream")
-	}
-
-	err = b.Session.Start(b.createCmd(cmd, args))
-	if err != nil {
-		return nil, nil, nil, nil, errors.Wrap(err, "Could not spawn process via SSH")
-	}
-
-	return b.Session, stdin, stdout, stderr, nil
-}
-
-func (b *SSH) createCmd(cmd string, args []string) string {
-	parts := []string{cmd}
-	simple := regexp.MustCompile(`^[a-z0-9_/.~+-]+$`)
-
-	for _, arg := range args {
-		if !simple.MatchString(arg) {
-			arg = b.quote(arg)
-		}
-
-		parts = append(parts, arg)
-	}
-
-	return strings.Join(parts, " ")
-}
-
-func (b *SSH) quote(s string) string {
-	return fmt.Sprintf(`"%s"`, s)
-}

vendor/github.com/benmoss/go-powershell/backend/types.go

-// Copyright (c) 2017 Gorillalabs. All rights reserved.
-
-package backend
-
-import "io"
-
-type Waiter interface {
-	Wait() error
-}
-
-type Starter interface {
-	StartProcess(cmd string, args ...string) (Waiter, io.Writer, io.Reader, io.Reader, error)
-}

vendor/github.com/benmoss/go-powershell/go.mod

-module github.com/k3s-io/go-powershell
-
-go 1.14
-
-require github.com/pkg/errors v0.9.1

vendor/github.com/benmoss/go-powershell/go.sum

-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=

vendor/github.com/benmoss/go-powershell/shell.go

-// Copyright (c) 2017 Gorillalabs. All rights reserved.
-
-package powershell
-
-import (
-	"fmt"
-	"io"
-	"regexp"
-	"sync"
-
-	"github.com/k3s-io/go-powershell/backend"
-	"github.com/k3s-io/go-powershell/utils"
-	"github.com/pkg/errors"
-)
-
-const newline = "\r\n"
-
-type Shell interface {
-	Execute(cmd string) (string, string, error)
-	Exit()
-}
-
-type shell struct {
-	handle backend.Waiter
-	stdin  io.Writer
-	stdout io.Reader
-	stderr io.Reader
-}
-
-func New(backend backend.Starter) (Shell, error) {
-	handle, stdin, stdout, stderr, err := backend.StartProcess("powershell.exe", "-NoExit", "-Command", "-")
-	if err != nil {
-		return nil, err
-	}
-
-	return &shell{handle, stdin, stdout, stderr}, nil
-}
-
-func (s *shell) Execute(cmd string) (string, string, error) {
-	if s.handle == nil {
-		return "", "", errors.Wrap(errors.New(cmd), "Cannot execute commands on closed shells.")
-	}
-
-	outBoundary := createBoundary()
-	errBoundary := createBoundary()
-
-	// wrap the command in special markers so we know when to stop reading from the pipes
-	full := fmt.Sprintf("%s; echo '%s'; [Console]::Error.WriteLine('%s')%s", cmd, outBoundary, errBoundary, newline)
-
-	_, err := s.stdin.Write([]byte(full))
-	if err != nil {
-		return "", "", errors.Wrap(errors.Wrap(err, cmd), "Could not send PowerShell command")
-	}
-
-	// read stdout and stderr
-	sout := ""
-	serr := ""
-
-	waiter := &sync.WaitGroup{}
-	waiter.Add(2)
-
-	go streamReader(s.stdout, outBoundary, &sout, waiter)
-	go streamReader(s.stderr, errBoundary, &serr, waiter)
-
-	waiter.Wait()
-
-	if len(serr) > 0 {
-		return sout, serr, errors.Wrap(errors.New(cmd), serr)
-	}
-
-	return sout, serr, nil
-}
-
-func (s *shell) Exit() {
-	s.stdin.Write([]byte("exit" + newline))
-
-	// if it's possible to close stdin, do so (some backends, like the local one,
-	// do support it)
-	closer, ok := s.stdin.(io.Closer)
-	if ok {
-		closer.Close()
-	}
-
-	s.handle.Wait()
-
-	s.handle = nil
-	s.stdin = nil
-	s.stdout = nil
-	s.stderr = nil
-}
-
-func streamReader(stream io.Reader, boundary string, buffer *string, signal *sync.WaitGroup) error {
-	// read all output until we have found our boundary token
-	output := ""
-	bufsize := 64
-	marker := regexp.MustCompile("(?s)(.*)" + regexp.QuoteMeta(boundary))
-
-	for {
-		buf := make([]byte, bufsize)
-		read, err := stream.Read(buf)
-		if err != nil {
-			return err
-		}
-
-		output = output + string(buf[:read])
-
-		if marker.MatchString(output) {
-			break
-		}
-	}
-
-	*buffer = marker.FindStringSubmatch(output)[1]
-	signal.Done()
-
-	return nil
-}
-
-func createBoundary() string {
-	return "$gorilla" + utils.CreateRandomString(12) + "$"
-}

vendor/github.com/containernetworking/plugins/pkg/utils/sysctl/sysctl_linux.go

+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sysctl
+
+import (
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"strings"
+)
+
+// Sysctl provides a method to set/get values from /proc/sys - in linux systems
+// new interface to set/get values of variables formerly handled by sysctl syscall
+// If optional `params` have only one string value - this function will
+// set this value into corresponding sysctl variable
+func Sysctl(name string, params ...string) (string, error) {
+	if len(params) > 1 {
+		return "", fmt.Errorf("unexcepted additional parameters")
+	} else if len(params) == 1 {
+		return setSysctl(name, params[0])
+	}
+	return getSysctl(name)
+}
+
+func getSysctl(name string) (string, error) {
+	fullName := filepath.Join("/proc/sys", toNormalName(name))
+	fullName = filepath.Clean(fullName)
+	data, err := ioutil.ReadFile(fullName)
+	if err != nil {
+		return "", err
+	}
+
+	return string(data[:len(data)-1]), nil
+}
+
+func setSysctl(name, value string) (string, error) {
+	fullName := filepath.Join("/proc/sys", toNormalName(name))
+	fullName = filepath.Clean(fullName)
+	if err := ioutil.WriteFile(fullName, []byte(value), 0644); err != nil {
+		return "", err
+	}
+
+	return getSysctl(name)
+}
+
+// Normalize names by using slash as separator
+// Sysctl names can use dots or slashes as separator:
+// - if dots are used, dots and slashes are interchanged.
+// - if slashes are used, slashes and dots are left intact.
+// Separator in use is determined by first occurrence.
+func toNormalName(name string) string {
+	interchange := false
+	for _, c := range name {
+		if c == '.' {
+			interchange = true
+			break
+		}
+		if c == '/' {
+			break
+		}
+	}
+
+	if interchange {
+		r := strings.NewReplacer(".", "/", "/", ".")
+		return r.Replace(name)
+	}
+	return name
+}

vendor/github.com/coreos/flannel/pkg/ip/iface_windows.go

-// Copyright 2015 flannel authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip
-
-import (
-	netsh "github.com/rakelkar/gonetsh/netsh"
-	"net"
-)
-
-func GetIfaceIP4Addr(iface *net.Interface) (net.IP, error) {
-	// get ip address for the interface
-	// prefer global unicast to link local addresses
-	netHelper := netsh.New(nil)
-	ifaceDetails, err := netHelper.GetInterfaceByName(iface.Name)
-	if err != nil {
-		return nil, err
-	}
-
-	ifAddr := net.ParseIP(ifaceDetails.IpAddress)
-
-	return ifAddr, nil
-}
-
-func GetDefaultGatewayIface() (*net.Interface, error) {
-	netHelper := netsh.New(nil)
-
-	defaultIfaceName, err := netHelper.GetDefaultGatewayIfaceName()
-	if err != nil {
-		return nil, err
-	}
-
-	iface, err := net.InterfaceByName(defaultIfaceName)
-	if err != nil {
-		return nil, err
-	}
-
-	return iface, nil
-}
-
-func GetInterfaceByIP(ip net.IP) (*net.Interface, error) {
-	netHelper := netsh.New(nil)
-
-	ifaceDetails, err := netHelper.GetInterfaceByIP(ip.String())
-	if err != nil {
-		return nil, err
-	}
-
-	iface, err := net.InterfaceByName(ifaceDetails.Name)
-	if err != nil {
-		return nil, err
-	}
-
-	return iface, nil
-}

vendor/github.com/docker/distribution/reference/normalize.go

@@ -56,35 +56,6 @@ func ParseNormalizedNamed(s string) (Named, error) {
 	return named, nil
 }
 
-// ParseDockerRef normalizes the image reference following the docker convention. This is added
-// mainly for backward compatibility.
-// The reference returned can only be either tagged or digested. For reference contains both tag
-// and digest, the function returns digested reference, e.g. docker.io/library/busybox:latest@
-// sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa will be returned as
-// docker.io/library/busybox@sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa.
-func ParseDockerRef(ref string) (Named, error) {
-	named, err := ParseNormalizedNamed(ref)
-	if err != nil {
-		return nil, err
-	}
-	if _, ok := named.(NamedTagged); ok {
-		if canonical, ok := named.(Canonical); ok {
-			// The reference is both tagged and digested, only
-			// return digested.
-			newNamed, err := WithName(canonical.Name())
-			if err != nil {
-				return nil, err
-			}
-			newCanonical, err := WithDigest(newNamed, canonical.Digest())
-			if err != nil {
-				return nil, err
-			}
-			return newCanonical, nil
-		}
-	}
-	return TagNameOnly(named), nil
-}
-
 // splitDockerDomain splits a repository name to domain and remotename string.
 // If no valid domain is found, the default domain is used. Repository name
 // needs to be already validated before.

vendor/github.com/docker/distribution/reference/reference.go

@@ -205,7 +205,7 @@ func Parse(s string) (Reference, error) {
 	var repo repository
 
 	nameMatch := anchoredNameRegexp.FindStringSubmatch(matches[1])
-	if len(nameMatch) == 3 {
+	if nameMatch != nil && len(nameMatch) == 3 {
 		repo.domain = nameMatch[1]
 		repo.path = nameMatch[2]
 	} else {

vendor/github.com/docker/distribution/registry/api/errcode/errors.go

@@ -207,11 +207,11 @@ func (errs Errors) MarshalJSON() ([]byte, error) {
 	for _, daErr := range errs {
 		var err Error
 
-		switch daErr := daErr.(type) {
+		switch daErr.(type) {
 		case ErrorCode:
-			err = daErr.WithDetail(nil)
+			err = daErr.(ErrorCode).WithDetail(nil)
 		case Error:
-			err = daErr
+			err = daErr.(Error)
 		default:
 			err = ErrorCodeUnknown.WithDetail(daErr)
 

vendor/github.com/docker/docker/api/types/configs.go

@@ -3,6 +3,7 @@ package types // import "github.com/docker/docker/api/types"
 import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // configs holds structs used for internal communication between the
@@ -15,6 +16,7 @@ type ContainerCreateConfig struct {
 	Config           *container.Config
 	HostConfig       *container.HostConfig
 	NetworkingConfig *network.NetworkingConfig
+	Platform         *specs.Platform
 	AdjustCPUShares  bool
 }
 

vendor/github.com/docker/docker/api/types/container/container_top.go

@@ -10,7 +10,9 @@ package container // import "github.com/docker/docker/api/types/container"
 // swagger:model ContainerTopOKBody
 type ContainerTopOKBody struct {
 
-	// Each process running in the container, where each is process is an array of values corresponding to the titles
+	// Each process running in the container, where each is process
+	// is an array of values corresponding to the titles.
+	//
 	// Required: true
 	Processes [][]string `json:"Processes"`
 

vendor/github.com/docker/docker/api/types/container/host_config.go

@@ -361,7 +361,7 @@ type Resources struct {
 	Devices              []DeviceMapping // List of devices to map inside the container
 	DeviceCgroupRules    []string        // List of rule to be added to the device cgroup
 	DeviceRequests       []DeviceRequest // List of device requests for device drivers
-	KernelMemory         int64           // Kernel memory limit (in bytes)
+	KernelMemory         int64           // Kernel memory limit (in bytes), Deprecated: kernel 5.4 deprecated kmem.limit_in_bytes
 	KernelMemoryTCP      int64           // Hard limit for kernel TCP buffer memory (in bytes)
 	MemoryReservation    int64           // Memory soft limit (in bytes)
 	MemorySwap           int64           // Total memory usage (memory + swap); set `-1` to enable unlimited swap
@@ -403,7 +403,6 @@ type HostConfig struct {
 	// Applicable to UNIX platforms
 	CapAdd          strslice.StrSlice // List of kernel capabilities to add to the container
 	CapDrop         strslice.StrSlice // List of kernel capabilities to remove from the container
-	Capabilities    []string          `json:"Capabilities"` // List of kernel capabilities to be available for container (this overrides the default set)
 	CgroupnsMode    CgroupnsMode      // Cgroup namespace mode to use for the container
 	DNS             []string          `json:"Dns"`        // List of DNS server to lookup
 	DNSOptions      []string          `json:"DnsOptions"` // List of DNSOption to look for

vendor/github.com/docker/docker/api/types/events/events.go

 package events // import "github.com/docker/docker/api/types/events"
 
 const (
+	// BuilderEventType is the event type that the builder generates
+	BuilderEventType = "builder"
 	// ContainerEventType is the event type that containers generate
 	ContainerEventType = "container"
 	// DaemonEventType is the event type that daemon generate

vendor/github.com/docker/docker/api/types/mount/mount.go

@@ -113,7 +113,7 @@ type TmpfsOptions struct {
 	// TODO(stevvooe): There are several more tmpfs flags, specified in the
 	// daemon, that are accepted. Only the most basic are added for now.
 	//
-	// From docker/docker/pkg/mount/flags.go:
+	// From https://github.com/moby/sys/blob/mount/v0.1.1/mount/flags.go#L47-L56
 	//
 	// var validFlags = map[string]bool{
 	// 	"":          true,

vendor/github.com/docker/docker/api/types/network/network.go

 package network // import "github.com/docker/docker/api/types/network"
 import (
 	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/errdefs"
 )
 
 // Address represents an IP address
@@ -123,5 +122,5 @@ var acceptedFilters = map[string]bool{
 
 // ValidateFilters validates the list of filter args with the available filters.
 func ValidateFilters(filter filters.Args) error {
-	return errdefs.InvalidParameter(filter.Validate(acceptedFilters))
+	return filter.Validate(acceptedFilters)
 }

vendor/github.com/docker/docker/api/types/seccomp.go

-package types // import "github.com/docker/docker/api/types"
-
-// Seccomp represents the config for a seccomp profile for syscall restriction.
-type Seccomp struct {
-	DefaultAction Action `json:"defaultAction"`
-	// Architectures is kept to maintain backward compatibility with the old
-	// seccomp profile.
-	Architectures []Arch         `json:"architectures,omitempty"`
-	ArchMap       []Architecture `json:"archMap,omitempty"`
-	Syscalls      []*Syscall     `json:"syscalls"`
-}
-
-// Architecture is used to represent a specific architecture
-// and its sub-architectures
-type Architecture struct {
-	Arch      Arch   `json:"architecture"`
-	SubArches []Arch `json:"subArchitectures"`
-}
-
-// Arch used for architectures
-type Arch string
-
-// Additional architectures permitted to be used for system calls
-// By default only the native architecture of the kernel is permitted
-const (
-	ArchX86         Arch = "SCMP_ARCH_X86"
-	ArchX86_64      Arch = "SCMP_ARCH_X86_64"
-	ArchX32         Arch = "SCMP_ARCH_X32"
-	ArchARM         Arch = "SCMP_ARCH_ARM"
-	ArchAARCH64     Arch = "SCMP_ARCH_AARCH64"
-	ArchMIPS        Arch = "SCMP_ARCH_MIPS"
-	ArchMIPS64      Arch = "SCMP_ARCH_MIPS64"
-	ArchMIPS64N32   Arch = "SCMP_ARCH_MIPS64N32"
-	ArchMIPSEL      Arch = "SCMP_ARCH_MIPSEL"
-	ArchMIPSEL64    Arch = "SCMP_ARCH_MIPSEL64"
-	ArchMIPSEL64N32 Arch = "SCMP_ARCH_MIPSEL64N32"
-	ArchPPC         Arch = "SCMP_ARCH_PPC"
-	ArchPPC64       Arch = "SCMP_ARCH_PPC64"
-	ArchPPC64LE     Arch = "SCMP_ARCH_PPC64LE"
-	ArchS390        Arch = "SCMP_ARCH_S390"
-	ArchS390X       Arch = "SCMP_ARCH_S390X"
-)
-
-// Action taken upon Seccomp rule match
-type Action string
-
-// Define actions for Seccomp rules
-const (
-	ActKill  Action = "SCMP_ACT_KILL"
-	ActTrap  Action = "SCMP_ACT_TRAP"
-	ActErrno Action = "SCMP_ACT_ERRNO"
-	ActTrace Action = "SCMP_ACT_TRACE"
-	ActAllow Action = "SCMP_ACT_ALLOW"
-)
-
-// Operator used to match syscall arguments in Seccomp
-type Operator string
-
-// Define operators for syscall arguments in Seccomp
-const (
-	OpNotEqual     Operator = "SCMP_CMP_NE"
-	OpLessThan     Operator = "SCMP_CMP_LT"
-	OpLessEqual    Operator = "SCMP_CMP_LE"
-	OpEqualTo      Operator = "SCMP_CMP_EQ"
-	OpGreaterEqual Operator = "SCMP_CMP_GE"
-	OpGreaterThan  Operator = "SCMP_CMP_GT"
-	OpMaskedEqual  Operator = "SCMP_CMP_MASKED_EQ"
-)
-
-// Arg used for matching specific syscall arguments in Seccomp
-type Arg struct {
-	Index    uint     `json:"index"`
-	Value    uint64   `json:"value"`
-	ValueTwo uint64   `json:"valueTwo"`
-	Op       Operator `json:"op"`
-}
-
-// Filter is used to conditionally apply Seccomp rules
-type Filter struct {
-	Caps      []string `json:"caps,omitempty"`
-	Arches    []string `json:"arches,omitempty"`
-	MinKernel string   `json:"minKernel,omitempty"`
-}
-
-// Syscall is used to match a group of syscalls in Seccomp
-type Syscall struct {
-	Name     string   `json:"name,omitempty"`
-	Names    []string `json:"names,omitempty"`
-	Action   Action   `json:"action"`
-	Args     []*Arg   `json:"args"`
-	Comment  string   `json:"comment"`
-	Includes Filter   `json:"includes"`
-	Excludes Filter   `json:"excludes"`
-}

vendor/github.com/docker/docker/api/types/swarm/container.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/go-units"
 )
 
 // DNSConfig specifies DNS related configurations in resolver configuration file (resolv.conf)
@@ -67,11 +68,13 @@ type ContainerSpec struct {
 	// The format of extra hosts on swarmkit is specified in:
 	// http://man7.org/linux/man-pages/man5/hosts.5.html
 	//    IP_address canonical_hostname [aliases...]
-	Hosts        []string            `json:",omitempty"`
-	DNSConfig    *DNSConfig          `json:",omitempty"`
-	Secrets      []*SecretReference  `json:",omitempty"`
-	Configs      []*ConfigReference  `json:",omitempty"`
-	Isolation    container.Isolation `json:",omitempty"`
-	Sysctls      map[string]string   `json:",omitempty"`
-	Capabilities []string            `json:",omitempty"`
+	Hosts          []string            `json:",omitempty"`
+	DNSConfig      *DNSConfig          `json:",omitempty"`
+	Secrets        []*SecretReference  `json:",omitempty"`
+	Configs        []*ConfigReference  `json:",omitempty"`
+	Isolation      container.Isolation `json:",omitempty"`
+	Sysctls        map[string]string   `json:",omitempty"`
+	CapabilityAdd  []string            `json:",omitempty"`
+	CapabilityDrop []string            `json:",omitempty"`
+	Ulimits        []*units.Ulimit     `json:",omitempty"`
 }

vendor/github.com/docker/docker/api/types/swarm/task.go

@@ -91,13 +91,21 @@ type TaskSpec struct {
 	Runtime RuntimeType `json:",omitempty"`
 }
 
-// Resources represents resources (CPU/Memory).
+// Resources represents resources (CPU/Memory) which can be advertised by a
+// node and requested to be reserved for a task.
 type Resources struct {
 	NanoCPUs         int64             `json:",omitempty"`
 	MemoryBytes      int64             `json:",omitempty"`
 	GenericResources []GenericResource `json:",omitempty"`
 }
 
+// Limit describes limits on resources which can be requested by a task.
+type Limit struct {
+	NanoCPUs    int64 `json:",omitempty"`
+	MemoryBytes int64 `json:",omitempty"`
+	Pids        int64 `json:",omitempty"`
+}
+
 // GenericResource represents a "user defined" resource which can
 // be either an integer (e.g: SSD=3) or a string (e.g: SSD=sda1)
 type GenericResource struct {
@@ -125,7 +133,7 @@ type DiscreteGenericResource struct {
 
 // ResourceRequirements represents resources requirements.
 type ResourceRequirements struct {
-	Limits       *Resources `json:",omitempty"`
+	Limits       *Limit     `json:",omitempty"`
 	Reservations *Resources `json:",omitempty"`
 }
 

vendor/github.com/docker/docker/api/types/types.go

@@ -158,7 +158,7 @@ type Info struct {
 	Plugins            PluginsInfo
 	MemoryLimit        bool
 	SwapLimit          bool
-	KernelMemory       bool
+	KernelMemory       bool // Deprecated: kernel 5.4 deprecated kmem.limit_in_bytes
 	KernelMemoryTCP    bool
 	CPUCfsPeriod       bool `json:"CpuCfsPeriod"`
 	CPUCfsQuota        bool `json:"CpuCfsQuota"`
@@ -175,6 +175,7 @@ type Info struct {
 	SystemTime         string
 	LoggingDriver      string
 	CgroupDriver       string
+	CgroupVersion      string `json:",omitempty"`
 	NEventsListener    int
 	KernelVersion      string
 	OperatingSystem    string
@@ -202,15 +203,16 @@ type Info struct {
 	// LiveRestoreEnabled determines whether containers should be kept
 	// running when the daemon is shutdown or upon daemon start if
 	// running containers are detected
-	LiveRestoreEnabled bool
-	Isolation          container.Isolation
-	InitBinary         string
-	ContainerdCommit   Commit
-	RuncCommit         Commit
-	InitCommit         Commit
-	SecurityOptions    []string
-	ProductLicense     string `json:",omitempty"`
-	Warnings           []string
+	LiveRestoreEnabled  bool
+	Isolation           container.Isolation
+	InitBinary          string
+	ContainerdCommit    Commit
+	RuncCommit          Commit
+	InitCommit          Commit
+	SecurityOptions     []string
+	ProductLicense      string               `json:",omitempty"`
+	DefaultAddressPools []NetworkAddressPool `json:",omitempty"`
+	Warnings            []string
 }
 
 // KeyValue holds a key/value pair
@@ -218,6 +220,12 @@ type KeyValue struct {
 	Key, Value string
 }
 
+// NetworkAddressPool is a temp struct used by Info struct
+type NetworkAddressPool struct {
+	Base string
+	Size int
+}
+
 // SecurityOpt contains the name and options of a security option
 type SecurityOpt struct {
 	Name    string
@@ -510,6 +518,16 @@ type Checkpoint struct {
 type Runtime struct {
 	Path string   `json:"path"`
 	Args []string `json:"runtimeArgs,omitempty"`
+
+	// This is exposed here only for internal use
+	// It is not currently supported to specify custom shim configs
+	Shim *ShimConfig `json:"-"`
+}
+
+// ShimConfig is used by runtime to configure containerd shims
+type ShimConfig struct {
+	Binary string
+	Opts   interface{}
 }
 
 // DiskUsage contains response of Engine API:

vendor/github.com/docker/docker/api/types/volume.go

@@ -27,10 +27,13 @@ type Volume struct {
 	Name string `json:"Name"`
 
 	// The driver specific options used when creating the volume.
+	//
 	// Required: true
 	Options map[string]string `json:"Options"`
 
-	// The level at which the volume exists. Either `global` for cluster-wide, or `local` for machine level.
+	// The level at which the volume exists. Either `global` for cluster-wide,
+	// or `local` for machine level.
+	//
 	// Required: true
 	Scope string `json:"Scope"`
 

vendor/github.com/docker/docker/api/types/volume/volume_create.go

@@ -14,7 +14,9 @@ type VolumeCreateBody struct {
 	// Required: true
 	Driver string `json:"Driver"`
 
-	// A mapping of driver options and values. These options are passed directly to the driver and are driver specific.
+	// A mapping of driver options and values. These options are
+	// passed directly to the driver and are driver specific.
+	//
 	// Required: true
 	DriverOpts map[string]string `json:"DriverOpts"`
 
@@ -23,6 +25,7 @@ type VolumeCreateBody struct {
 	Labels map[string]string `json:"Labels"`
 
 	// The new volume's name. If not specified, Docker generates a name.
+	//
 	// Required: true
 	Name string `json:"Name"`
 }

vendor/github.com/docker/docker/api/types/volume/volume_list.go

@@ -16,7 +16,8 @@ type VolumeListOKBody struct {
 	// Required: true
 	Volumes []*types.Volume `json:"Volumes"`
 
-	// Warnings that occurred when fetching the list of volumes
+	// Warnings that occurred when fetching the list of volumes.
+	//
 	// Required: true
 	Warnings []string `json:"Warnings"`
 }

vendor/github.com/docker/docker/client/client.go

@@ -7,8 +7,8 @@ https://docs.docker.com/engine/reference/api/
 Usage
 
 You use the library by creating a client object and calling methods on it. The
-client can be created either from environment variables with NewEnvClient, or
-configured manually with NewClient.
+client can be created either from environment variables with NewClientWithOpts(client.FromEnv),
+or configured manually with NewClient().
 
 For example, to list running containers (the equivalent of "docker ps"):
 

vendor/github.com/docker/docker/client/client_unix.go

-// +build linux freebsd openbsd darwin solaris illumos
+// +build linux freebsd openbsd netbsd darwin solaris illumos dragonfly
 
 package client // import "github.com/docker/docker/client"
 

vendor/github.com/docker/docker/client/container_create.go

@@ -5,20 +5,23 @@ import (
 	"encoding/json"
 	"net/url"
 
+	"github.com/containerd/containerd/platforms"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/versions"
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 type configWrapper struct {
 	*container.Config
 	HostConfig       *container.HostConfig
 	NetworkingConfig *network.NetworkingConfig
+	Platform         *specs.Platform
 }
 
 // ContainerCreate creates a new container based in the given configuration.
 // It can be associated with a name, but it's not mandatory.
-func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, containerName string) (container.ContainerCreateCreatedBody, error) {
+func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, platform *specs.Platform, containerName string) (container.ContainerCreateCreatedBody, error) {
 	var response container.ContainerCreateCreatedBody
 
 	if err := cli.NewVersionError("1.25", "stop timeout"); config != nil && config.StopTimeout != nil && err != nil {
@@ -30,7 +33,15 @@ func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config
 		hostConfig.AutoRemove = false
 	}
 
+	if err := cli.NewVersionError("1.41", "specify container image platform"); platform != nil && err != nil {
+		return response, err
+	}
+
 	query := url.Values{}
+	if platform != nil {
+		query.Set("platform", platforms.Format(*platform))
+	}
+
 	if containerName != "" {
 		query.Set("name", containerName)
 	}

vendor/github.com/docker/docker/client/container_stats.go

@@ -24,3 +24,19 @@ func (cli *Client) ContainerStats(ctx context.Context, containerID string, strea
 	osType := getDockerOS(resp.header.Get("Server"))
 	return types.ContainerStats{Body: resp.body, OSType: osType}, err
 }
+
+// ContainerStatsOneShot gets a single stat entry from a container.
+// It differs from `ContainerStats` in that the API should not wait to prime the stats
+func (cli *Client) ContainerStatsOneShot(ctx context.Context, containerID string) (types.ContainerStats, error) {
+	query := url.Values{}
+	query.Set("stream", "0")
+	query.Set("one-shot", "1")
+
+	resp, err := cli.get(ctx, "/containers/"+containerID+"/stats", query, nil)
+	if err != nil {
+		return types.ContainerStats{}, err
+	}
+
+	osType := getDockerOS(resp.header.Get("Server"))
+	return types.ContainerStats{Body: resp.body, OSType: osType}, err
+}

vendor/github.com/docker/docker/client/errors.go

@@ -24,8 +24,7 @@ func (err errConnectionFailed) Error() string {
 
 // IsErrConnectionFailed returns true if the error is caused by connection failed.
 func IsErrConnectionFailed(err error) bool {
-	_, ok := errors.Cause(err).(errConnectionFailed)
-	return ok
+	return errors.As(err, &errConnectionFailed{})
 }
 
 // ErrorConnectionFailed returns an error with host in the error message when connection to docker daemon failed.
@@ -42,8 +41,9 @@ type notFound interface {
 // IsErrNotFound returns true if the error is a NotFound error, which is returned
 // by the API when some object is not found.
 func IsErrNotFound(err error) bool {
-	if _, ok := err.(notFound); ok {
-		return ok
+	var e notFound
+	if errors.As(err, &e) {
+		return true
 	}
 	return errdefs.IsNotFound(err)
 }

vendor/github.com/docker/docker/client/interface.go

@@ -16,6 +16,7 @@ import (
 	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/api/types/swarm"
 	volumetypes "github.com/docker/docker/api/types/volume"
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // CommonAPIClient is the common methods between stable and experimental versions of APIClient.
@@ -47,7 +48,7 @@ type CommonAPIClient interface {
 type ContainerAPIClient interface {
 	ContainerAttach(ctx context.Context, container string, options types.ContainerAttachOptions) (types.HijackedResponse, error)
 	ContainerCommit(ctx context.Context, container string, options types.ContainerCommitOptions) (types.IDResponse, error)
-	ContainerCreate(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, containerName string) (containertypes.ContainerCreateCreatedBody, error)
+	ContainerCreate(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error)
 	ContainerDiff(ctx context.Context, container string) ([]containertypes.ContainerChangeResponseItem, error)
 	ContainerExecAttach(ctx context.Context, execID string, config types.ExecStartCheck) (types.HijackedResponse, error)
 	ContainerExecCreate(ctx context.Context, container string, config types.ExecConfig) (types.IDResponse, error)
@@ -67,6 +68,7 @@ type ContainerAPIClient interface {
 	ContainerRestart(ctx context.Context, container string, timeout *time.Duration) error
 	ContainerStatPath(ctx context.Context, container, path string) (types.ContainerPathStat, error)
 	ContainerStats(ctx context.Context, container string, stream bool) (types.ContainerStats, error)
+	ContainerStatsOneShot(ctx context.Context, container string) (types.ContainerStats, error)
 	ContainerStart(ctx context.Context, container string, options types.ContainerStartOptions) error
 	ContainerStop(ctx context.Context, container string, timeout *time.Duration) error
 	ContainerTop(ctx context.Context, container string, arguments []string) (containertypes.ContainerTopOKBody, error)

vendor/github.com/docker/docker/client/request.go

@@ -134,8 +134,7 @@ func (cli *Client) doRequest(ctx context.Context, req *http.Request) (serverResp
 
 		// Don't decorate context sentinel errors; users may be comparing to
 		// them directly.
-		switch err {
-		case context.Canceled, context.DeadlineExceeded:
+		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 			return serverResp, err
 		}
 

vendor/github.com/docker/docker/client/service_create.go

@@ -15,8 +15,7 @@ import (
 
 // ServiceCreate creates a new Service.
 func (cli *Client) ServiceCreate(ctx context.Context, service swarm.ServiceSpec, options types.ServiceCreateOptions) (types.ServiceCreateResponse, error) {
-	var distErr error
-
+	var response types.ServiceCreateResponse
 	headers := map[string][]string{
 		"version": {cli.version},
 	}
@@ -31,46 +30,28 @@ func (cli *Client) ServiceCreate(ctx context.Context, service swarm.ServiceSpec,
 	}
 
 	if err := validateServiceSpec(service); err != nil {
-		return types.ServiceCreateResponse{}, err
+		return response, err
 	}
 
 	// ensure that the image is tagged
-	var imgPlatforms []swarm.Platform
-	if service.TaskTemplate.ContainerSpec != nil {
+	var resolveWarning string
+	switch {
+	case service.TaskTemplate.ContainerSpec != nil:
 		if taggedImg := imageWithTagString(service.TaskTemplate.ContainerSpec.Image); taggedImg != "" {
 			service.TaskTemplate.ContainerSpec.Image = taggedImg
 		}
 		if options.QueryRegistry {
-			var img string
-			img, imgPlatforms, distErr = imageDigestAndPlatforms(ctx, cli, service.TaskTemplate.ContainerSpec.Image, options.EncodedRegistryAuth)
-			if img != "" {
-				service.TaskTemplate.ContainerSpec.Image = img
-			}
+			resolveWarning = resolveContainerSpecImage(ctx, cli, &service.TaskTemplate, options.EncodedRegistryAuth)
 		}
-	}
-
-	// ensure that the image is tagged
-	if service.TaskTemplate.PluginSpec != nil {
+	case service.TaskTemplate.PluginSpec != nil:
 		if taggedImg := imageWithTagString(service.TaskTemplate.PluginSpec.Remote); taggedImg != "" {
 			service.TaskTemplate.PluginSpec.Remote = taggedImg
 		}
 		if options.QueryRegistry {
-			var img string
-			img, imgPlatforms, distErr = imageDigestAndPlatforms(ctx, cli, service.TaskTemplate.PluginSpec.Remote, options.EncodedRegistryAuth)
-			if img != "" {
-				service.TaskTemplate.PluginSpec.Remote = img
-			}
+			resolveWarning = resolvePluginSpecRemote(ctx, cli, &service.TaskTemplate, options.EncodedRegistryAuth)
 		}
 	}
 
-	if service.TaskTemplate.Placement == nil && len(imgPlatforms) > 0 {
-		service.TaskTemplate.Placement = &swarm.Placement{}
-	}
-	if len(imgPlatforms) > 0 {
-		service.TaskTemplate.Placement.Platforms = imgPlatforms
-	}
-
-	var response types.ServiceCreateResponse
 	resp, err := cli.post(ctx, "/services/create", nil, service, headers)
 	defer ensureReaderClosed(resp)
 	if err != nil {
@@ -78,14 +59,45 @@ func (cli *Client) ServiceCreate(ctx context.Context, service swarm.ServiceSpec,
 	}
 
 	err = json.NewDecoder(resp.body).Decode(&response)
-
-	if distErr != nil {
-		response.Warnings = append(response.Warnings, digestWarning(service.TaskTemplate.ContainerSpec.Image))
+	if resolveWarning != "" {
+		response.Warnings = append(response.Warnings, resolveWarning)
 	}
 
 	return response, err
 }
 
+func resolveContainerSpecImage(ctx context.Context, cli DistributionAPIClient, taskSpec *swarm.TaskSpec, encodedAuth string) string {
+	var warning string
+	if img, imgPlatforms, err := imageDigestAndPlatforms(ctx, cli, taskSpec.ContainerSpec.Image, encodedAuth); err != nil {
+		warning = digestWarning(taskSpec.ContainerSpec.Image)
+	} else {
+		taskSpec.ContainerSpec.Image = img
+		if len(imgPlatforms) > 0 {
+			if taskSpec.Placement == nil {
+				taskSpec.Placement = &swarm.Placement{}
+			}
+			taskSpec.Placement.Platforms = imgPlatforms
+		}
+	}
+	return warning
+}
+
+func resolvePluginSpecRemote(ctx context.Context, cli DistributionAPIClient, taskSpec *swarm.TaskSpec, encodedAuth string) string {
+	var warning string
+	if img, imgPlatforms, err := imageDigestAndPlatforms(ctx, cli, taskSpec.PluginSpec.Remote, encodedAuth); err != nil {
+		warning = digestWarning(taskSpec.PluginSpec.Remote)
+	} else {
+		taskSpec.PluginSpec.Remote = img
+		if len(imgPlatforms) > 0 {
+			if taskSpec.Placement == nil {
+				taskSpec.Placement = &swarm.Placement{}
+			}
+			taskSpec.Placement.Platforms = imgPlatforms
+		}
+	}
+	return warning
+}
+
 func imageDigestAndPlatforms(ctx context.Context, cli DistributionAPIClient, image, encodedAuth string) (string, []swarm.Platform, error) {
 	distributionInspect, err := cli.DistributionInspect(ctx, image, encodedAuth)
 	var platforms []swarm.Platform
@@ -119,7 +131,7 @@ func imageDigestAndPlatforms(ctx context.Context, cli DistributionAPIClient, ima
 
 // imageWithDigestString takes an image string and a digest, and updates
 // the image string if it didn't originally contain a digest. It returns
-// an empty string if there are no updates.
+// image unmodified in other situations.
 func imageWithDigestString(image string, dgst digest.Digest) string {
 	namedRef, err := reference.ParseNormalizedNamed(image)
 	if err == nil {
@@ -131,7 +143,7 @@ func imageWithDigestString(image string, dgst digest.Digest) string {
 			}
 		}
 	}
-	return ""
+	return image
 }
 
 // imageWithTagString takes an image string, and returns a tagged image

vendor/github.com/docker/docker/client/service_update.go

@@ -15,8 +15,8 @@ import (
 // of swarm.Service, which can be found using ServiceInspectWithRaw.
 func (cli *Client) ServiceUpdate(ctx context.Context, serviceID string, version swarm.Version, service swarm.ServiceSpec, options types.ServiceUpdateOptions) (types.ServiceUpdateResponse, error) {
 	var (
-		query   = url.Values{}
-		distErr error
+		query    = url.Values{}
+		response = types.ServiceUpdateResponse{}
 	)
 
 	headers := map[string][]string{
@@ -38,46 +38,28 @@ func (cli *Client) ServiceUpdate(ctx context.Context, serviceID string, version
 	query.Set("version", strconv.FormatUint(version.Index, 10))
 
 	if err := validateServiceSpec(service); err != nil {
-		return types.ServiceUpdateResponse{}, err
+		return response, err
 	}
 
-	var imgPlatforms []swarm.Platform
 	// ensure that the image is tagged
-	if service.TaskTemplate.ContainerSpec != nil {
+	var resolveWarning string
+	switch {
+	case service.TaskTemplate.ContainerSpec != nil:
 		if taggedImg := imageWithTagString(service.TaskTemplate.ContainerSpec.Image); taggedImg != "" {
 			service.TaskTemplate.ContainerSpec.Image = taggedImg
 		}
 		if options.QueryRegistry {
-			var img string
-			img, imgPlatforms, distErr = imageDigestAndPlatforms(ctx, cli, service.TaskTemplate.ContainerSpec.Image, options.EncodedRegistryAuth)
-			if img != "" {
-				service.TaskTemplate.ContainerSpec.Image = img
-			}
+			resolveWarning = resolveContainerSpecImage(ctx, cli, &service.TaskTemplate, options.EncodedRegistryAuth)
 		}
-	}
-
-	// ensure that the image is tagged
-	if service.TaskTemplate.PluginSpec != nil {
+	case service.TaskTemplate.PluginSpec != nil:
 		if taggedImg := imageWithTagString(service.TaskTemplate.PluginSpec.Remote); taggedImg != "" {
 			service.TaskTemplate.PluginSpec.Remote = taggedImg
 		}
 		if options.QueryRegistry {
-			var img string
-			img, imgPlatforms, distErr = imageDigestAndPlatforms(ctx, cli, service.TaskTemplate.PluginSpec.Remote, options.EncodedRegistryAuth)
-			if img != "" {
-				service.TaskTemplate.PluginSpec.Remote = img
-			}
+			resolveWarning = resolvePluginSpecRemote(ctx, cli, &service.TaskTemplate, options.EncodedRegistryAuth)
 		}
 	}
 
-	if service.TaskTemplate.Placement == nil && len(imgPlatforms) > 0 {
-		service.TaskTemplate.Placement = &swarm.Placement{}
-	}
-	if len(imgPlatforms) > 0 {
-		service.TaskTemplate.Placement.Platforms = imgPlatforms
-	}
-
-	var response types.ServiceUpdateResponse
 	resp, err := cli.post(ctx, "/services/"+serviceID+"/update", query, service, headers)
 	defer ensureReaderClosed(resp)
 	if err != nil {
@@ -85,9 +67,8 @@ func (cli *Client) ServiceUpdate(ctx context.Context, serviceID string, version
 	}
 
 	err = json.NewDecoder(resp.body).Decode(&response)
-
-	if distErr != nil {
-		response.Warnings = append(response.Warnings, digestWarning(service.TaskTemplate.ContainerSpec.Image))
+	if resolveWarning != "" {
+		response.Warnings = append(response.Warnings, resolveWarning)
 	}
 
 	return response, err

vendor/github.com/docker/docker/errdefs/helpers.go

@@ -10,6 +10,10 @@ func (e errNotFound) Cause() error {
 	return e.error
 }
 
+func (e errNotFound) Unwrap() error {
+	return e.error
+}
+
 // NotFound is a helper to create an error of the class with the same name from any error type
 func NotFound(err error) error {
 	if err == nil || IsNotFound(err) {
@@ -26,6 +30,10 @@ func (e errInvalidParameter) Cause() error {
 	return e.error
 }
 
+func (e errInvalidParameter) Unwrap() error {
+	return e.error
+}
+
 // InvalidParameter is a helper to create an error of the class with the same name from any error type
 func InvalidParameter(err error) error {
 	if err == nil || IsInvalidParameter(err) {
@@ -42,6 +50,10 @@ func (e errConflict) Cause() error {
 	return e.error
 }
 
+func (e errConflict) Unwrap() error {
+	return e.error
+}
+
 // Conflict is a helper to create an error of the class with the same name from any error type
 func Conflict(err error) error {
 	if err == nil || IsConflict(err) {
@@ -58,6 +70,10 @@ func (e errUnauthorized) Cause() error {
 	return e.error
 }
 
+func (e errUnauthorized) Unwrap() error {
+	return e.error
+}
+
 // Unauthorized is a helper to create an error of the class with the same name from any error type
 func Unauthorized(err error) error {
 	if err == nil || IsUnauthorized(err) {
@@ -74,6 +90,10 @@ func (e errUnavailable) Cause() error {
 	return e.error
 }
 
+func (e errUnavailable) Unwrap() error {
+	return e.error
+}
+
 // Unavailable is a helper to create an error of the class with the same name from any error type
 func Unavailable(err error) error {
 	if err == nil || IsUnavailable(err) {
@@ -90,6 +110,10 @@ func (e errForbidden) Cause() error {
 	return e.error
 }
 
+func (e errForbidden) Unwrap() error {
+	return e.error
+}
+
 // Forbidden is a helper to create an error of the class with the same name from any error type
 func Forbidden(err error) error {
 	if err == nil || IsForbidden(err) {
@@ -106,6 +130,10 @@ func (e errSystem) Cause() error {
 	return e.error
 }
 
+func (e errSystem) Unwrap() error {
+	return e.error
+}
+
 // System is a helper to create an error of the class with the same name from any error type
 func System(err error) error {
 	if err == nil || IsSystem(err) {
@@ -122,6 +150,10 @@ func (e errNotModified) Cause() error {
 	return e.error
 }
 
+func (e errNotModified) Unwrap() error {
+	return e.error
+}
+
 // NotModified is a helper to create an error of the class with the same name from any error type
 func NotModified(err error) error {
 	if err == nil || IsNotModified(err) {
@@ -138,6 +170,10 @@ func (e errNotImplemented) Cause() error {
 	return e.error
 }
 
+func (e errNotImplemented) Unwrap() error {
+	return e.error
+}
+
 // NotImplemented is a helper to create an error of the class with the same name from any error type
 func NotImplemented(err error) error {
 	if err == nil || IsNotImplemented(err) {
@@ -154,6 +190,10 @@ func (e errUnknown) Cause() error {
 	return e.error
 }
 
+func (e errUnknown) Unwrap() error {
+	return e.error
+}
+
 // Unknown is a helper to create an error of the class with the same name from any error type
 func Unknown(err error) error {
 	if err == nil || IsUnknown(err) {
@@ -170,6 +210,10 @@ func (e errCancelled) Cause() error {
 	return e.error
 }
 
+func (e errCancelled) Unwrap() error {
+	return e.error
+}
+
 // Cancelled is a helper to create an error of the class with the same name from any error type
 func Cancelled(err error) error {
 	if err == nil || IsCancelled(err) {
@@ -186,6 +230,10 @@ func (e errDeadline) Cause() error {
 	return e.error
 }
 
+func (e errDeadline) Unwrap() error {
+	return e.error
+}
+
 // Deadline is a helper to create an error of the class with the same name from any error type
 func Deadline(err error) error {
 	if err == nil || IsDeadline(err) {
@@ -202,6 +250,10 @@ func (e errDataLoss) Cause() error {
 	return e.error
 }
 
+func (e errDataLoss) Unwrap() error {
+	return e.error
+}
+
 // DataLoss is a helper to create an error of the class with the same name from any error type
 func DataLoss(err error) error {
 	if err == nil || IsDataLoss(err) {

vendor/github.com/docker/docker/pkg/jsonmessage/jsonmessage.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/docker/docker/pkg/term"
 	units "github.com/docker/go-units"
+	"github.com/moby/term"
 	"github.com/morikuni/aec"
 )
 

vendor/github.com/docker/docker/pkg/symlink/deprecated.go

+package symlink // import "github.com/docker/docker/pkg/symlink"
+
+import "github.com/moby/sys/symlink"
+
+var (
+	// EvalSymlinks is deprecated and moved to github.com/moby/sys/symlink
+	// Deprecated: use github.com/moby/sys/symlink.EvalSymlinks instead
+	EvalSymlinks = symlink.EvalSymlinks
+	// FollowSymlinkInScope is deprecated and moved to github.com/moby/sys/symlink
+	// Deprecated: use github.com/moby/sys/symlink.FollowSymlinkInScope instead
+	FollowSymlinkInScope = symlink.FollowSymlinkInScope
+)

vendor/github.com/docker/docker/pkg/term/ascii.go

-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"fmt"
-	"strings"
-)
-
-// ASCII list the possible supported ASCII key sequence
-var ASCII = []string{
-	"ctrl-@",
-	"ctrl-a",
-	"ctrl-b",
-	"ctrl-c",
-	"ctrl-d",
-	"ctrl-e",
-	"ctrl-f",
-	"ctrl-g",
-	"ctrl-h",
-	"ctrl-i",
-	"ctrl-j",
-	"ctrl-k",
-	"ctrl-l",
-	"ctrl-m",
-	"ctrl-n",
-	"ctrl-o",
-	"ctrl-p",
-	"ctrl-q",
-	"ctrl-r",
-	"ctrl-s",
-	"ctrl-t",
-	"ctrl-u",
-	"ctrl-v",
-	"ctrl-w",
-	"ctrl-x",
-	"ctrl-y",
-	"ctrl-z",
-	"ctrl-[",
-	"ctrl-\\",
-	"ctrl-]",
-	"ctrl-^",
-	"ctrl-_",
-}
-
-// ToBytes converts a string representing a suite of key-sequence to the corresponding ASCII code.
-func ToBytes(keys string) ([]byte, error) {
-	codes := []byte{}
-next:
-	for _, key := range strings.Split(keys, ",") {
-		if len(key) != 1 {
-			for code, ctrl := range ASCII {
-				if ctrl == key {
-					codes = append(codes, byte(code))
-					continue next
-				}
-			}
-			if key == "DEL" {
-				codes = append(codes, 127)
-			} else {
-				return nil, fmt.Errorf("Unknown character: '%s'", key)
-			}
-		} else {
-			codes = append(codes, key[0])
-		}
-	}
-	return codes, nil
-}

vendor/github.com/docker/docker/pkg/term/deprecated.go

+// Package term provides structures and helper functions to work with
+// terminal (state, sizes).
+//
+// Deprecated: use github.com/moby/term instead
+package term // import "github.com/docker/docker/pkg/term"
+
+import (
+	"github.com/moby/term"
+)
+
+// EscapeError is special error which returned by a TTY proxy reader's Read()
+// method in case its detach escape sequence is read.
+// Deprecated: use github.com/moby/term.EscapeError
+type EscapeError = term.EscapeError
+
+// State represents the state of the terminal.
+// Deprecated: use github.com/moby/term.State
+type State = term.State
+
+// Winsize represents the size of the terminal window.
+// Deprecated: use github.com/moby/term.Winsize
+type Winsize = term.Winsize
+
+var (
+	// ASCII list the possible supported ASCII key sequence
+	ASCII = term.ASCII
+
+	// ToBytes converts a string representing a suite of key-sequence to the corresponding ASCII code.
+	// Deprecated: use github.com/moby/term.ToBytes
+	ToBytes = term.ToBytes
+
+	// StdStreams returns the standard streams (stdin, stdout, stderr).
+	// Deprecated: use github.com/moby/term.StdStreams
+	StdStreams = term.StdStreams
+
+	// GetFdInfo returns the file descriptor for an os.File and indicates whether the file represents a terminal.
+	// Deprecated: use github.com/moby/term.GetFdInfo
+	GetFdInfo = term.GetFdInfo
+
+	// GetWinsize returns the window size based on the specified file descriptor.
+	// Deprecated: use github.com/moby/term.GetWinsize
+	GetWinsize = term.GetWinsize
+
+	// IsTerminal returns true if the given file descriptor is a terminal.
+	// Deprecated: use github.com/moby/term.IsTerminal
+	IsTerminal = term.IsTerminal
+
+	// RestoreTerminal restores the terminal connected to the given file descriptor
+	// to a previous state.
+	// Deprecated: use github.com/moby/term.RestoreTerminal
+	RestoreTerminal = term.RestoreTerminal
+
+	// SaveState saves the state of the terminal connected to the given file descriptor.
+	// Deprecated: use github.com/moby/term.SaveState
+	SaveState = term.SaveState
+
+	// DisableEcho applies the specified state to the terminal connected to the file
+	// descriptor, with echo disabled.
+	// Deprecated: use github.com/moby/term.DisableEcho
+	DisableEcho = term.DisableEcho
+
+	// SetRawTerminal puts the terminal connected to the given file descriptor into
+	// raw mode and returns the previous state. On UNIX, this puts both the input
+	// and output into raw mode. On Windows, it only puts the input into raw mode.
+	// Deprecated: use github.com/moby/term.SetRawTerminal
+	SetRawTerminal = term.SetRawTerminal
+
+	// SetRawTerminalOutput puts the output of terminal connected to the given file
+	// descriptor into raw mode. On UNIX, this does nothing and returns nil for the
+	// state. On Windows, it disables LF -> CRLF translation.
+	// Deprecated: use github.com/moby/term.SetRawTerminalOutput
+	SetRawTerminalOutput = term.SetRawTerminalOutput
+
+	// MakeRaw puts the terminal connected to the given file descriptor into raw
+	// mode and returns the previous state of the terminal so that it can be restored.
+	// Deprecated: use github.com/moby/term.MakeRaw
+	MakeRaw = term.MakeRaw
+
+	// NewEscapeProxy returns a new TTY proxy reader which wraps the given reader
+	// and detects when the specified escape keys are read, in which case the Read
+	// method will return an error of type EscapeError.
+	// Deprecated: use github.com/moby/term.NewEscapeProxy
+	NewEscapeProxy = term.NewEscapeProxy
+)

vendor/github.com/docker/docker/pkg/term/deprecated_unix.go

+// +build !windows
+
+package term // import "github.com/docker/docker/pkg/term"
+
+import (
+	"github.com/moby/term"
+)
+
+// Termios is the Unix API for terminal I/O.
+// Deprecated: use github.com/moby/term.Termios
+type Termios = term.Termios
+
+var (
+	// ErrInvalidState is returned if the state of the terminal is invalid.
+	ErrInvalidState = term.ErrInvalidState
+
+	// SetWinsize tries to set the specified window size for the specified file descriptor.
+	// Deprecated: use github.com/moby/term.GetWinsize
+	SetWinsize = term.SetWinsize
+)

vendor/github.com/docker/docker/pkg/term/proxy.go

-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"io"
-)
-
-// EscapeError is special error which returned by a TTY proxy reader's Read()
-// method in case its detach escape sequence is read.
-type EscapeError struct{}
-
-func (EscapeError) Error() string {
-	return "read escape sequence"
-}
-
-// escapeProxy is used only for attaches with a TTY. It is used to proxy
-// stdin keypresses from the underlying reader and look for the passed in
-// escape key sequence to signal a detach.
-type escapeProxy struct {
-	escapeKeys   []byte
-	escapeKeyPos int
-	r            io.Reader
-}
-
-// NewEscapeProxy returns a new TTY proxy reader which wraps the given reader
-// and detects when the specified escape keys are read, in which case the Read
-// method will return an error of type EscapeError.
-func NewEscapeProxy(r io.Reader, escapeKeys []byte) io.Reader {
-	return &escapeProxy{
-		escapeKeys: escapeKeys,
-		r:          r,
-	}
-}
-
-func (r *escapeProxy) Read(buf []byte) (int, error) {
-	nr, err := r.r.Read(buf)
-
-	if len(r.escapeKeys) == 0 {
-		return nr, err
-	}
-
-	preserve := func() {
-		// this preserves the original key presses in the passed in buffer
-		nr += r.escapeKeyPos
-		preserve := make([]byte, 0, r.escapeKeyPos+len(buf))
-		preserve = append(preserve, r.escapeKeys[:r.escapeKeyPos]...)
-		preserve = append(preserve, buf...)
-		r.escapeKeyPos = 0
-		copy(buf[0:nr], preserve)
-	}
-
-	if nr != 1 || err != nil {
-		if r.escapeKeyPos > 0 {
-			preserve()
-		}
-		return nr, err
-	}
-
-	if buf[0] != r.escapeKeys[r.escapeKeyPos] {
-		if r.escapeKeyPos > 0 {
-			preserve()
-		}
-		return nr, nil
-	}
-
-	if r.escapeKeyPos == len(r.escapeKeys)-1 {
-		return 0, EscapeError{}
-	}
-
-	// Looks like we've got an escape key, but we need to match again on the next
-	// read.
-	// Store the current escape key we found so we can look for the next one on
-	// the next read.
-	// Since this is an escape key, make sure we don't let the caller read it
-	// If later on we find that this is not the escape sequence, we'll add the
-	// keys back
-	r.escapeKeyPos++
-	return nr - r.escapeKeyPos, nil
-}

vendor/github.com/docker/docker/pkg/term/tc.go

-// +build !windows
-
-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-func tcget(fd uintptr, p *Termios) syscall.Errno {
-	_, _, err := unix.Syscall(unix.SYS_IOCTL, fd, uintptr(getTermios), uintptr(unsafe.Pointer(p)))
-	return err
-}
-
-func tcset(fd uintptr, p *Termios) syscall.Errno {
-	_, _, err := unix.Syscall(unix.SYS_IOCTL, fd, setTermios, uintptr(unsafe.Pointer(p)))
-	return err
-}

vendor/github.com/docker/docker/pkg/term/term.go

-// +build !windows
-
-// Package term provides structures and helper functions to work with
-// terminal (state, sizes).
-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/signal"
-
-	"golang.org/x/sys/unix"
-)
-
-var (
-	// ErrInvalidState is returned if the state of the terminal is invalid.
-	ErrInvalidState = errors.New("Invalid terminal state")
-)
-
-// State represents the state of the terminal.
-type State struct {
-	termios Termios
-}
-
-// Winsize represents the size of the terminal window.
-type Winsize struct {
-	Height uint16
-	Width  uint16
-	x      uint16
-	y      uint16
-}
-
-// StdStreams returns the standard streams (stdin, stdout, stderr).
-func StdStreams() (stdIn io.ReadCloser, stdOut, stdErr io.Writer) {
-	return os.Stdin, os.Stdout, os.Stderr
-}
-
-// GetFdInfo returns the file descriptor for an os.File and indicates whether the file represents a terminal.
-func GetFdInfo(in interface{}) (uintptr, bool) {
-	var inFd uintptr
-	var isTerminalIn bool
-	if file, ok := in.(*os.File); ok {
-		inFd = file.Fd()
-		isTerminalIn = IsTerminal(inFd)
-	}
-	return inFd, isTerminalIn
-}
-
-// IsTerminal returns true if the given file descriptor is a terminal.
-func IsTerminal(fd uintptr) bool {
-	var termios Termios
-	return tcget(fd, &termios) == 0
-}
-
-// RestoreTerminal restores the terminal connected to the given file descriptor
-// to a previous state.
-func RestoreTerminal(fd uintptr, state *State) error {
-	if state == nil {
-		return ErrInvalidState
-	}
-	if err := tcset(fd, &state.termios); err != 0 {
-		return err
-	}
-	return nil
-}
-
-// SaveState saves the state of the terminal connected to the given file descriptor.
-func SaveState(fd uintptr) (*State, error) {
-	var oldState State
-	if err := tcget(fd, &oldState.termios); err != 0 {
-		return nil, err
-	}
-
-	return &oldState, nil
-}
-
-// DisableEcho applies the specified state to the terminal connected to the file
-// descriptor, with echo disabled.
-func DisableEcho(fd uintptr, state *State) error {
-	newState := state.termios
-	newState.Lflag &^= unix.ECHO
-
-	if err := tcset(fd, &newState); err != 0 {
-		return err
-	}
-	handleInterrupt(fd, state)
-	return nil
-}
-
-// SetRawTerminal puts the terminal connected to the given file descriptor into
-// raw mode and returns the previous state. On UNIX, this puts both the input
-// and output into raw mode. On Windows, it only puts the input into raw mode.
-func SetRawTerminal(fd uintptr) (*State, error) {
-	oldState, err := MakeRaw(fd)
-	if err != nil {
-		return nil, err
-	}
-	handleInterrupt(fd, oldState)
-	return oldState, err
-}
-
-// SetRawTerminalOutput puts the output of terminal connected to the given file
-// descriptor into raw mode. On UNIX, this does nothing and returns nil for the
-// state. On Windows, it disables LF -> CRLF translation.
-func SetRawTerminalOutput(fd uintptr) (*State, error) {
-	return nil, nil
-}
-
-func handleInterrupt(fd uintptr, state *State) {
-	sigchan := make(chan os.Signal, 1)
-	signal.Notify(sigchan, os.Interrupt)
-	go func() {
-		for range sigchan {
-			// quit cleanly and the new terminal item is on a new line
-			fmt.Println()
-			signal.Stop(sigchan)
-			close(sigchan)
-			RestoreTerminal(fd, state)
-			os.Exit(1)
-		}
-	}()
-}

vendor/github.com/docker/docker/pkg/term/term_windows.go

-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"io"
-	"os"
-	"os/signal"
-	"syscall" // used for STD_INPUT_HANDLE, STD_OUTPUT_HANDLE and STD_ERROR_HANDLE
-
-	"github.com/Azure/go-ansiterm/winterm"
-	windowsconsole "github.com/docker/docker/pkg/term/windows"
-)
-
-// State holds the console mode for the terminal.
-type State struct {
-	mode uint32
-}
-
-// Winsize is used for window size.
-type Winsize struct {
-	Height uint16
-	Width  uint16
-}
-
-// vtInputSupported is true if winterm.ENABLE_VIRTUAL_TERMINAL_INPUT is supported by the console
-var vtInputSupported bool
-
-// StdStreams returns the standard streams (stdin, stdout, stderr).
-func StdStreams() (stdIn io.ReadCloser, stdOut, stdErr io.Writer) {
-	// Turn on VT handling on all std handles, if possible. This might
-	// fail, in which case we will fall back to terminal emulation.
-	var emulateStdin, emulateStdout, emulateStderr bool
-	fd := os.Stdin.Fd()
-	if mode, err := winterm.GetConsoleMode(fd); err == nil {
-		// Validate that winterm.ENABLE_VIRTUAL_TERMINAL_INPUT is supported, but do not set it.
-		if err = winterm.SetConsoleMode(fd, mode|winterm.ENABLE_VIRTUAL_TERMINAL_INPUT); err != nil {
-			emulateStdin = true
-		} else {
-			vtInputSupported = true
-		}
-		// Unconditionally set the console mode back even on failure because SetConsoleMode
-		// remembers invalid bits on input handles.
-		winterm.SetConsoleMode(fd, mode)
-	}
-
-	fd = os.Stdout.Fd()
-	if mode, err := winterm.GetConsoleMode(fd); err == nil {
-		// Validate winterm.DISABLE_NEWLINE_AUTO_RETURN is supported, but do not set it.
-		if err = winterm.SetConsoleMode(fd, mode|winterm.ENABLE_VIRTUAL_TERMINAL_PROCESSING|winterm.DISABLE_NEWLINE_AUTO_RETURN); err != nil {
-			emulateStdout = true
-		} else {
-			winterm.SetConsoleMode(fd, mode|winterm.ENABLE_VIRTUAL_TERMINAL_PROCESSING)
-		}
-	}
-
-	fd = os.Stderr.Fd()
-	if mode, err := winterm.GetConsoleMode(fd); err == nil {
-		// Validate winterm.DISABLE_NEWLINE_AUTO_RETURN is supported, but do not set it.
-		if err = winterm.SetConsoleMode(fd, mode|winterm.ENABLE_VIRTUAL_TERMINAL_PROCESSING|winterm.DISABLE_NEWLINE_AUTO_RETURN); err != nil {
-			emulateStderr = true
-		} else {
-			winterm.SetConsoleMode(fd, mode|winterm.ENABLE_VIRTUAL_TERMINAL_PROCESSING)
-		}
-	}
-
-	// Temporarily use STD_INPUT_HANDLE, STD_OUTPUT_HANDLE and
-	// STD_ERROR_HANDLE from syscall rather than x/sys/windows as long as
-	// go-ansiterm hasn't switch to x/sys/windows.
-	// TODO: switch back to x/sys/windows once go-ansiterm has switched
-	if emulateStdin {
-		stdIn = windowsconsole.NewAnsiReader(syscall.STD_INPUT_HANDLE)
-	} else {
-		stdIn = os.Stdin
-	}
-
-	if emulateStdout {
-		stdOut = windowsconsole.NewAnsiWriter(syscall.STD_OUTPUT_HANDLE)
-	} else {
-		stdOut = os.Stdout
-	}
-
-	if emulateStderr {
-		stdErr = windowsconsole.NewAnsiWriter(syscall.STD_ERROR_HANDLE)
-	} else {
-		stdErr = os.Stderr
-	}
-
-	return
-}
-
-// GetFdInfo returns the file descriptor for an os.File and indicates whether the file represents a terminal.
-func GetFdInfo(in interface{}) (uintptr, bool) {
-	return windowsconsole.GetHandleInfo(in)
-}
-
-// GetWinsize returns the window size based on the specified file descriptor.
-func GetWinsize(fd uintptr) (*Winsize, error) {
-	info, err := winterm.GetConsoleScreenBufferInfo(fd)
-	if err != nil {
-		return nil, err
-	}
-
-	winsize := &Winsize{
-		Width:  uint16(info.Window.Right - info.Window.Left + 1),
-		Height: uint16(info.Window.Bottom - info.Window.Top + 1),
-	}
-
-	return winsize, nil
-}
-
-// IsTerminal returns true if the given file descriptor is a terminal.
-func IsTerminal(fd uintptr) bool {
-	return windowsconsole.IsConsole(fd)
-}
-
-// RestoreTerminal restores the terminal connected to the given file descriptor
-// to a previous state.
-func RestoreTerminal(fd uintptr, state *State) error {
-	return winterm.SetConsoleMode(fd, state.mode)
-}
-
-// SaveState saves the state of the terminal connected to the given file descriptor.
-func SaveState(fd uintptr) (*State, error) {
-	mode, e := winterm.GetConsoleMode(fd)
-	if e != nil {
-		return nil, e
-	}
-
-	return &State{mode: mode}, nil
-}
-
-// DisableEcho disables echo for the terminal connected to the given file descriptor.
-// -- See https://msdn.microsoft.com/en-us/library/windows/desktop/ms683462(v=vs.85).aspx
-func DisableEcho(fd uintptr, state *State) error {
-	mode := state.mode
-	mode &^= winterm.ENABLE_ECHO_INPUT
-	mode |= winterm.ENABLE_PROCESSED_INPUT | winterm.ENABLE_LINE_INPUT
-	err := winterm.SetConsoleMode(fd, mode)
-	if err != nil {
-		return err
-	}
-
-	// Register an interrupt handler to catch and restore prior state
-	restoreAtInterrupt(fd, state)
-	return nil
-}
-
-// SetRawTerminal puts the terminal connected to the given file descriptor into
-// raw mode and returns the previous state. On UNIX, this puts both the input
-// and output into raw mode. On Windows, it only puts the input into raw mode.
-func SetRawTerminal(fd uintptr) (*State, error) {
-	state, err := MakeRaw(fd)
-	if err != nil {
-		return nil, err
-	}
-
-	// Register an interrupt handler to catch and restore prior state
-	restoreAtInterrupt(fd, state)
-	return state, err
-}
-
-// SetRawTerminalOutput puts the output of terminal connected to the given file
-// descriptor into raw mode. On UNIX, this does nothing and returns nil for the
-// state. On Windows, it disables LF -> CRLF translation.
-func SetRawTerminalOutput(fd uintptr) (*State, error) {
-	state, err := SaveState(fd)
-	if err != nil {
-		return nil, err
-	}
-
-	// Ignore failures, since winterm.DISABLE_NEWLINE_AUTO_RETURN might not be supported on this
-	// version of Windows.
-	winterm.SetConsoleMode(fd, state.mode|winterm.DISABLE_NEWLINE_AUTO_RETURN)
-	return state, err
-}
-
-// MakeRaw puts the terminal (Windows Console) connected to the given file descriptor into raw
-// mode and returns the previous state of the terminal so that it can be restored.
-func MakeRaw(fd uintptr) (*State, error) {
-	state, err := SaveState(fd)
-	if err != nil {
-		return nil, err
-	}
-
-	mode := state.mode
-
-	// See
-	// -- https://msdn.microsoft.com/en-us/library/windows/desktop/ms686033(v=vs.85).aspx
-	// -- https://msdn.microsoft.com/en-us/library/windows/desktop/ms683462(v=vs.85).aspx
-
-	// Disable these modes
-	mode &^= winterm.ENABLE_ECHO_INPUT
-	mode &^= winterm.ENABLE_LINE_INPUT
-	mode &^= winterm.ENABLE_MOUSE_INPUT
-	mode &^= winterm.ENABLE_WINDOW_INPUT
-	mode &^= winterm.ENABLE_PROCESSED_INPUT
-
-	// Enable these modes
-	mode |= winterm.ENABLE_EXTENDED_FLAGS
-	mode |= winterm.ENABLE_INSERT_MODE
-	mode |= winterm.ENABLE_QUICK_EDIT_MODE
-	if vtInputSupported {
-		mode |= winterm.ENABLE_VIRTUAL_TERMINAL_INPUT
-	}
-
-	err = winterm.SetConsoleMode(fd, mode)
-	if err != nil {
-		return nil, err
-	}
-	return state, nil
-}
-
-func restoreAtInterrupt(fd uintptr, state *State) {
-	sigchan := make(chan os.Signal, 1)
-	signal.Notify(sigchan, os.Interrupt)
-
-	go func() {
-		_ = <-sigchan
-		RestoreTerminal(fd, state)
-		os.Exit(0)
-	}()
-}

vendor/github.com/docker/docker/pkg/term/termios_bsd.go

-// +build darwin freebsd openbsd netbsd
-
-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	getTermios = unix.TIOCGETA
-	setTermios = unix.TIOCSETA
-)
-
-// Termios is the Unix API for terminal I/O.
-type Termios unix.Termios
-
-// MakeRaw put the terminal connected to the given file descriptor into raw
-// mode and returns the previous state of the terminal so that it can be
-// restored.
-func MakeRaw(fd uintptr) (*State, error) {
-	var oldState State
-	if _, _, err := unix.Syscall(unix.SYS_IOCTL, fd, getTermios, uintptr(unsafe.Pointer(&oldState.termios))); err != 0 {
-		return nil, err
-	}
-
-	newState := oldState.termios
-	newState.Iflag &^= (unix.IGNBRK | unix.BRKINT | unix.PARMRK | unix.ISTRIP | unix.INLCR | unix.IGNCR | unix.ICRNL | unix.IXON)
-	newState.Oflag &^= unix.OPOST
-	newState.Lflag &^= (unix.ECHO | unix.ECHONL | unix.ICANON | unix.ISIG | unix.IEXTEN)
-	newState.Cflag &^= (unix.CSIZE | unix.PARENB)
-	newState.Cflag |= unix.CS8
-	newState.Cc[unix.VMIN] = 1
-	newState.Cc[unix.VTIME] = 0
-
-	if _, _, err := unix.Syscall(unix.SYS_IOCTL, fd, setTermios, uintptr(unsafe.Pointer(&newState))); err != 0 {
-		return nil, err
-	}
-
-	return &oldState, nil
-}

vendor/github.com/docker/docker/pkg/term/windows/ansi_reader.go

-// +build windows
-
-package windowsconsole // import "github.com/docker/docker/pkg/term/windows"
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-	"unsafe"
-
-	ansiterm "github.com/Azure/go-ansiterm"
-	"github.com/Azure/go-ansiterm/winterm"
-)
-
-const (
-	escapeSequence = ansiterm.KEY_ESC_CSI
-)
-
-// ansiReader wraps a standard input file (e.g., os.Stdin) providing ANSI sequence translation.
-type ansiReader struct {
-	file     *os.File
-	fd       uintptr
-	buffer   []byte
-	cbBuffer int
-	command  []byte
-}
-
-// NewAnsiReader returns an io.ReadCloser that provides VT100 terminal emulation on top of a
-// Windows console input handle.
-func NewAnsiReader(nFile int) io.ReadCloser {
-	initLogger()
-	file, fd := winterm.GetStdFile(nFile)
-	return &ansiReader{
-		file:    file,
-		fd:      fd,
-		command: make([]byte, 0, ansiterm.ANSI_MAX_CMD_LENGTH),
-		buffer:  make([]byte, 0),
-	}
-}
-
-// Close closes the wrapped file.
-func (ar *ansiReader) Close() (err error) {
-	return ar.file.Close()
-}
-
-// Fd returns the file descriptor of the wrapped file.
-func (ar *ansiReader) Fd() uintptr {
-	return ar.fd
-}
-
-// Read reads up to len(p) bytes of translated input events into p.
-func (ar *ansiReader) Read(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-
-	// Previously read bytes exist, read as much as we can and return
-	if len(ar.buffer) > 0 {
-		logger.Debugf("Reading previously cached bytes")
-
-		originalLength := len(ar.buffer)
-		copiedLength := copy(p, ar.buffer)
-
-		if copiedLength == originalLength {
-			ar.buffer = make([]byte, 0, len(p))
-		} else {
-			ar.buffer = ar.buffer[copiedLength:]
-		}
-
-		logger.Debugf("Read from cache p[%d]: % x", copiedLength, p)
-		return copiedLength, nil
-	}
-
-	// Read and translate key events
-	events, err := readInputEvents(ar.fd, len(p))
-	if err != nil {
-		return 0, err
-	} else if len(events) == 0 {
-		logger.Debug("No input events detected")
-		return 0, nil
-	}
-
-	keyBytes := translateKeyEvents(events, []byte(escapeSequence))
-
-	// Save excess bytes and right-size keyBytes
-	if len(keyBytes) > len(p) {
-		logger.Debugf("Received %d keyBytes, only room for %d bytes", len(keyBytes), len(p))
-		ar.buffer = keyBytes[len(p):]
-		keyBytes = keyBytes[:len(p)]
-	} else if len(keyBytes) == 0 {
-		logger.Debug("No key bytes returned from the translator")
-		return 0, nil
-	}
-
-	copiedLength := copy(p, keyBytes)
-	if copiedLength != len(keyBytes) {
-		return 0, errors.New("unexpected copy length encountered")
-	}
-
-	logger.Debugf("Read        p[%d]: % x", copiedLength, p)
-	logger.Debugf("Read keyBytes[%d]: % x", copiedLength, keyBytes)
-	return copiedLength, nil
-}
-
-// readInputEvents polls until at least one event is available.
-func readInputEvents(fd uintptr, maxBytes int) ([]winterm.INPUT_RECORD, error) {
-	// Determine the maximum number of records to retrieve
-	// -- Cast around the type system to obtain the size of a single INPUT_RECORD.
-	//    unsafe.Sizeof requires an expression vs. a type-reference; the casting
-	//    tricks the type system into believing it has such an expression.
-	recordSize := int(unsafe.Sizeof(*((*winterm.INPUT_RECORD)(unsafe.Pointer(&maxBytes)))))
-	countRecords := maxBytes / recordSize
-	if countRecords > ansiterm.MAX_INPUT_EVENTS {
-		countRecords = ansiterm.MAX_INPUT_EVENTS
-	} else if countRecords == 0 {
-		countRecords = 1
-	}
-	logger.Debugf("[windows] readInputEvents: Reading %v records (buffer size %v, record size %v)", countRecords, maxBytes, recordSize)
-
-	// Wait for and read input events
-	events := make([]winterm.INPUT_RECORD, countRecords)
-	nEvents := uint32(0)
-	eventsExist, err := winterm.WaitForSingleObject(fd, winterm.WAIT_INFINITE)
-	if err != nil {
-		return nil, err
-	}
-
-	if eventsExist {
-		err = winterm.ReadConsoleInput(fd, events, &nEvents)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// Return a slice restricted to the number of returned records
-	logger.Debugf("[windows] readInputEvents: Read %v events", nEvents)
-	return events[:nEvents], nil
-}
-
-// KeyEvent Translation Helpers
-
-var arrowKeyMapPrefix = map[uint16]string{
-	winterm.VK_UP:    "%s%sA",
-	winterm.VK_DOWN:  "%s%sB",
-	winterm.VK_RIGHT: "%s%sC",
-	winterm.VK_LEFT:  "%s%sD",
-}
-
-var keyMapPrefix = map[uint16]string{
-	winterm.VK_UP:     "\x1B[%sA",
-	winterm.VK_DOWN:   "\x1B[%sB",
-	winterm.VK_RIGHT:  "\x1B[%sC",
-	winterm.VK_LEFT:   "\x1B[%sD",
-	winterm.VK_HOME:   "\x1B[1%s~", // showkey shows ^[[1
-	winterm.VK_END:    "\x1B[4%s~", // showkey shows ^[[4
-	winterm.VK_INSERT: "\x1B[2%s~",
-	winterm.VK_DELETE: "\x1B[3%s~",
-	winterm.VK_PRIOR:  "\x1B[5%s~",
-	winterm.VK_NEXT:   "\x1B[6%s~",
-	winterm.VK_F1:     "",
-	winterm.VK_F2:     "",
-	winterm.VK_F3:     "\x1B[13%s~",
-	winterm.VK_F4:     "\x1B[14%s~",
-	winterm.VK_F5:     "\x1B[15%s~",
-	winterm.VK_F6:     "\x1B[17%s~",
-	winterm.VK_F7:     "\x1B[18%s~",
-	winterm.VK_F8:     "\x1B[19%s~",
-	winterm.VK_F9:     "\x1B[20%s~",
-	winterm.VK_F10:    "\x1B[21%s~",
-	winterm.VK_F11:    "\x1B[23%s~",
-	winterm.VK_F12:    "\x1B[24%s~",
-}
-
-// translateKeyEvents converts the input events into the appropriate ANSI string.
-func translateKeyEvents(events []winterm.INPUT_RECORD, escapeSequence []byte) []byte {
-	var buffer bytes.Buffer
-	for _, event := range events {
-		if event.EventType == winterm.KEY_EVENT && event.KeyEvent.KeyDown != 0 {
-			buffer.WriteString(keyToString(&event.KeyEvent, escapeSequence))
-		}
-	}
-
-	return buffer.Bytes()
-}
-
-// keyToString maps the given input event record to the corresponding string.
-func keyToString(keyEvent *winterm.KEY_EVENT_RECORD, escapeSequence []byte) string {
-	if keyEvent.UnicodeChar == 0 {
-		return formatVirtualKey(keyEvent.VirtualKeyCode, keyEvent.ControlKeyState, escapeSequence)
-	}
-
-	_, alt, control := getControlKeys(keyEvent.ControlKeyState)
-	if control {
-		// TODO(azlinux): Implement following control sequences
-		// <Ctrl>-D  Signals the end of input from the keyboard; also exits current shell.
-		// <Ctrl>-H  Deletes the first character to the left of the cursor. Also called the ERASE key.
-		// <Ctrl>-Q  Restarts printing after it has been stopped with <Ctrl>-s.
-		// <Ctrl>-S  Suspends printing on the screen (does not stop the program).
-		// <Ctrl>-U  Deletes all characters on the current line. Also called the KILL key.
-		// <Ctrl>-E  Quits current command and creates a core
-
-	}
-
-	// <Alt>+Key generates ESC N Key
-	if !control && alt {
-		return ansiterm.KEY_ESC_N + strings.ToLower(string(keyEvent.UnicodeChar))
-	}
-
-	return string(keyEvent.UnicodeChar)
-}
-
-// formatVirtualKey converts a virtual key (e.g., up arrow) into the appropriate ANSI string.
-func formatVirtualKey(key uint16, controlState uint32, escapeSequence []byte) string {
-	shift, alt, control := getControlKeys(controlState)
-	modifier := getControlKeysModifier(shift, alt, control)
-
-	if format, ok := arrowKeyMapPrefix[key]; ok {
-		return fmt.Sprintf(format, escapeSequence, modifier)
-	}
-
-	if format, ok := keyMapPrefix[key]; ok {
-		return fmt.Sprintf(format, modifier)
-	}
-
-	return ""
-}
-
-// getControlKeys extracts the shift, alt, and ctrl key states.
-func getControlKeys(controlState uint32) (shift, alt, control bool) {
-	shift = 0 != (controlState & winterm.SHIFT_PRESSED)
-	alt = 0 != (controlState & (winterm.LEFT_ALT_PRESSED | winterm.RIGHT_ALT_PRESSED))
-	control = 0 != (controlState & (winterm.LEFT_CTRL_PRESSED | winterm.RIGHT_CTRL_PRESSED))
-	return shift, alt, control
-}
-
-// getControlKeysModifier returns the ANSI modifier for the given combination of control keys.
-func getControlKeysModifier(shift, alt, control bool) string {
-	if shift && alt && control {
-		return ansiterm.KEY_CONTROL_PARAM_8
-	}
-	if alt && control {
-		return ansiterm.KEY_CONTROL_PARAM_7
-	}
-	if shift && control {
-		return ansiterm.KEY_CONTROL_PARAM_6
-	}
-	if control {
-		return ansiterm.KEY_CONTROL_PARAM_5
-	}
-	if shift && alt {
-		return ansiterm.KEY_CONTROL_PARAM_4
-	}
-	if alt {
-		return ansiterm.KEY_CONTROL_PARAM_3
-	}
-	if shift {
-		return ansiterm.KEY_CONTROL_PARAM_2
-	}
-	return ""
-}

vendor/github.com/docker/docker/pkg/term/windows/ansi_writer.go

-// +build windows
-
-package windowsconsole // import "github.com/docker/docker/pkg/term/windows"
-
-import (
-	"io"
-	"os"
-
-	ansiterm "github.com/Azure/go-ansiterm"
-	"github.com/Azure/go-ansiterm/winterm"
-)
-
-// ansiWriter wraps a standard output file (e.g., os.Stdout) providing ANSI sequence translation.
-type ansiWriter struct {
-	file           *os.File
-	fd             uintptr
-	infoReset      *winterm.CONSOLE_SCREEN_BUFFER_INFO
-	command        []byte
-	escapeSequence []byte
-	inAnsiSequence bool
-	parser         *ansiterm.AnsiParser
-}
-
-// NewAnsiWriter returns an io.Writer that provides VT100 terminal emulation on top of a
-// Windows console output handle.
-func NewAnsiWriter(nFile int) io.Writer {
-	initLogger()
-	file, fd := winterm.GetStdFile(nFile)
-	info, err := winterm.GetConsoleScreenBufferInfo(fd)
-	if err != nil {
-		return nil
-	}
-
-	parser := ansiterm.CreateParser("Ground", winterm.CreateWinEventHandler(fd, file))
-	logger.Infof("newAnsiWriter: parser %p", parser)
-
-	aw := &ansiWriter{
-		file:           file,
-		fd:             fd,
-		infoReset:      info,
-		command:        make([]byte, 0, ansiterm.ANSI_MAX_CMD_LENGTH),
-		escapeSequence: []byte(ansiterm.KEY_ESC_CSI),
-		parser:         parser,
-	}
-
-	logger.Infof("newAnsiWriter: aw.parser %p", aw.parser)
-	logger.Infof("newAnsiWriter: %v", aw)
-	return aw
-}
-
-func (aw *ansiWriter) Fd() uintptr {
-	return aw.fd
-}
-
-// Write writes len(p) bytes from p to the underlying data stream.
-func (aw *ansiWriter) Write(p []byte) (total int, err error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-
-	logger.Infof("Write: % x", p)
-	logger.Infof("Write: %s", string(p))
-	return aw.parser.Parse(p)
-}

vendor/github.com/docker/docker/pkg/term/windows/console.go

-// +build windows
-
-package windowsconsole // import "github.com/docker/docker/pkg/term/windows"
-
-import (
-	"os"
-
-	"github.com/Azure/go-ansiterm/winterm"
-)
-
-// GetHandleInfo returns file descriptor and bool indicating whether the file is a console.
-func GetHandleInfo(in interface{}) (uintptr, bool) {
-	switch t := in.(type) {
-	case *ansiReader:
-		return t.Fd(), true
-	case *ansiWriter:
-		return t.Fd(), true
-	}
-
-	var inFd uintptr
-	var isTerminal bool
-
-	if file, ok := in.(*os.File); ok {
-		inFd = file.Fd()
-		isTerminal = IsConsole(inFd)
-	}
-	return inFd, isTerminal
-}
-
-// IsConsole returns true if the given file descriptor is a Windows Console.
-// The code assumes that GetConsoleMode will return an error for file descriptors that are not a console.
-func IsConsole(fd uintptr) bool {
-	_, e := winterm.GetConsoleMode(fd)
-	return e == nil
-}

vendor/github.com/docker/docker/pkg/term/windows/windows.go

-// +build windows
-// These files implement ANSI-aware input and output streams for use by the Docker Windows client.
-// When asked for the set of standard streams (e.g., stdin, stdout, stderr), the code will create
-// and return pseudo-streams that convert ANSI sequences to / from Windows Console API calls.
-
-package windowsconsole // import "github.com/docker/docker/pkg/term/windows"
-
-import (
-	"io/ioutil"
-	"os"
-	"sync"
-
-	ansiterm "github.com/Azure/go-ansiterm"
-	"github.com/sirupsen/logrus"
-)
-
-var logger *logrus.Logger
-var initOnce sync.Once
-
-func initLogger() {
-	initOnce.Do(func() {
-		logFile := ioutil.Discard
-
-		if isDebugEnv := os.Getenv(ansiterm.LogEnv); isDebugEnv == "1" {
-			logFile, _ = os.Create("ansiReaderWriter.log")
-		}
-
-		logger = &logrus.Logger{
-			Out:       logFile,
-			Formatter: new(logrus.TextFormatter),
-			Level:     logrus.DebugLevel,
-		}
-	})
-}

vendor/github.com/docker/docker/pkg/term/winsize.go

-// +build !windows
-
-package term // import "github.com/docker/docker/pkg/term"
-
-import (
-	"golang.org/x/sys/unix"
-)
-
-// GetWinsize returns the window size based on the specified file descriptor.
-func GetWinsize(fd uintptr) (*Winsize, error) {
-	uws, err := unix.IoctlGetWinsize(int(fd), unix.TIOCGWINSZ)
-	ws := &Winsize{Height: uws.Row, Width: uws.Col, x: uws.Xpixel, y: uws.Ypixel}
-	return ws, err
-}
-
-// SetWinsize tries to set the specified window size for the specified file descriptor.
-func SetWinsize(fd uintptr, ws *Winsize) error {
-	uws := &unix.Winsize{Row: ws.Height, Col: ws.Width, Xpixel: ws.x, Ypixel: ws.y}
-	return unix.IoctlSetWinsize(int(fd), unix.TIOCSWINSZ, uws)
-}

vendor/github.com/coreos/flannel/backend/common.go → vendor/github.com/flannel-io/flannel/backend/common.go

@@ -20,7 +20,7 @@ import (
 
 	"golang.org/x/net/context"
 
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/subnet"
 )
 
 type ExternalInterface struct {
@@ -35,7 +35,7 @@ type ExternalInterface struct {
 // needed.
 type Backend interface {
 	// Called when the backend should create or begin managing a new network
-	RegisterNetwork(ctx context.Context, wg sync.WaitGroup, config *subnet.Config) (Network, error)
+	RegisterNetwork(ctx context.Context, wg *sync.WaitGroup, config *subnet.Config) (Network, error)
 }
 
 type Network interface {

vendor/github.com/coreos/flannel/backend/extension/extension.go → vendor/github.com/flannel-io/flannel/backend/extension/extension.go

@@ -24,12 +24,11 @@ import (
 	"os/exec"
 	"sync"
 
-	log "k8s.io/klog"
-
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/pkg/ip"
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/pkg/ip"
+	"github.com/flannel-io/flannel/subnet"
 	"golang.org/x/net/context"
+	log "k8s.io/klog"
 )
 
 func init() {
@@ -56,7 +55,7 @@ func (_ *ExtensionBackend) Run(ctx context.Context) {
 	<-ctx.Done()
 }
 
-func (be *ExtensionBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
+func (be *ExtensionBackend) RegisterNetwork(ctx context.Context, wg *sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
 	n := &network{
 		extIface: be.extIface,
 		sm:       be.sm,
@@ -134,9 +133,8 @@ func (be *ExtensionBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGro
 
 // Run a cmd, returning a combined stdout and stderr.
 func runCmd(env []string, stdin string, name string, arg ...string) (string, error) {
-	env = append(env, fmt.Sprintf("PATH=%s", os.Getenv("PATH")))
 	cmd := exec.Command(name, arg...)
-	cmd.Env = env
+	cmd.Env = append(os.Environ(), env...)
 
 	stdinpipe, err := cmd.StdinPipe()
 	if err != nil {

vendor/github.com/coreos/flannel/backend/extension/extension_network.go → vendor/github.com/flannel-io/flannel/backend/extension/extension_network.go

@@ -18,13 +18,13 @@ import (
 	"encoding/json"
 	"sync"
 
-	log "k8s.io/klog"
 	"golang.org/x/net/context"
 
 	"fmt"
 
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/subnet"
+	log "k8s.io/klog"
 )
 
 type network struct {
@@ -61,11 +61,12 @@ func (n *network) Run(ctx context.Context) {
 
 	for {
 		select {
-		case evtBatch := <-evts:
+		case evtBatch, ok := <-evts:
+			if !ok {
+				log.Infof("evts chan closed")
+				return
+			}
 			n.handleSubnetEvents(evtBatch)
-
-		case <-ctx.Done():
-			return
 		}
 	}
 }

vendor/github.com/coreos/flannel/backend/hostgw/hostgw.go → vendor/github.com/flannel-io/flannel/backend/hostgw/hostgw.go

@@ -22,9 +22,9 @@ import (
 
 	"sync"
 
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/pkg/ip"
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/pkg/ip"
+	"github.com/flannel-io/flannel/subnet"
 	"github.com/vishvananda/netlink"
 	"golang.org/x/net/context"
 )
@@ -50,7 +50,7 @@ func New(sm subnet.Manager, extIface *backend.ExternalInterface) (backend.Backen
 	return be, nil
 }
 
-func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
+func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg *sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
 	n := &backend.RouteNetwork{
 		SimpleNetwork: backend.SimpleNetwork{
 			ExtIface: be.extIface,

vendor/github.com/coreos/flannel/backend/hostgw/hostgw_windows.go → vendor/github.com/flannel-io/flannel/backend/hostgw/hostgw_windows.go

@@ -16,22 +16,20 @@ package hostgw
 
 import (
 	"fmt"
-	"strconv"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/Microsoft/hcsshim"
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/pkg/ip"
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/pkg/ip"
+	"github.com/flannel-io/flannel/pkg/routing"
+	"github.com/flannel-io/flannel/subnet"
 	"github.com/pkg/errors"
-	"github.com/rakelkar/gonetsh/netroute"
-	"github.com/rakelkar/gonetsh/netsh"
 	"golang.org/x/net/context"
 	"k8s.io/apimachinery/pkg/util/json"
 	"k8s.io/apimachinery/pkg/util/wait"
 	log "k8s.io/klog"
-	utilexec "k8s.io/utils/exec"
 )
 
 func init() {
@@ -56,7 +54,7 @@ func New(sm subnet.Manager, extIface *backend.ExternalInterface) (backend.Backen
 	return be, nil
 }
 
-func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
+func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg *sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
 	// 1. Parse configuration
 	cfg := struct {
 		Name          string
@@ -81,11 +79,11 @@ func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup,
 		Mtu:         be.extIface.Iface.MTU,
 		LinkIndex:   be.extIface.Iface.Index,
 	}
-	n.GetRoute = func(lease *subnet.Lease) *netroute.Route {
-		return &netroute.Route{
+	n.GetRoute = func(lease *subnet.Lease) *routing.Route {
+		return &routing.Route{
 			DestinationSubnet: lease.Subnet.ToIPNet(),
 			GatewayAddress:    lease.Attrs.PublicIP.ToIP(),
-			LinkIndex:         n.LinkIndex,
+			InterfaceIndex:    n.LinkIndex,
 		}
 	}
 
@@ -108,7 +106,6 @@ func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup,
 	}
 
 	// 3. Check if the network exists and has the expected settings
-	netshHelper := netsh.New(utilexec.New())
 	createNewNetwork := true
 	expectedSubnet := n.SubnetLease.Subnet
 	expectedAddressPrefix := expectedSubnet.String()
@@ -162,18 +159,28 @@ func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup,
 
 		// Wait for the network to populate Management IP
 		log.Infof("Waiting to get ManagementIP from HNSNetwork %s", networkName)
+		var newNetworkID = newNetwork.Id
 		waitErr = wait.Poll(500*time.Millisecond, 30*time.Second, func() (done bool, err error) {
-			newNetwork, lastErr = hcsshim.HNSNetworkRequest("GET", newNetwork.Id, "")
+			newNetwork, lastErr = hcsshim.HNSNetworkRequest("GET", newNetworkID, "")
 			return newNetwork != nil && len(newNetwork.ManagementIP) != 0, nil
 		})
 		if waitErr == wait.ErrWaitTimeout {
+			// Do not swallow the root cause
+			if lastErr != nil {
+				waitErr = lastErr
+			}
 			return nil, errors.Wrapf(waitErr, "timeout, failed to get management IP from HNSNetwork %s", networkName)
 		}
 
 		// Wait for the interface with the management IP
 		log.Infof("Waiting to get net interface for HNSNetwork %s (%s)", networkName, newNetwork.ManagementIP)
+		managementIP, err := ip.ParseIP4(newNetwork.ManagementIP)
+		if err != nil {
+			return nil, errors.Wrapf(err, "Failed to parse management ip (%s)", newNetwork.ManagementIP)
+		}
+
 		waitErr = wait.Poll(500*time.Millisecond, 5*time.Second, func() (done bool, err error) {
-			_, lastErr = netshHelper.GetInterfaceByIP(newNetwork.ManagementIP)
+			_, lastErr = ip.GetInterfaceByIP(managementIP.ToIP())
 			return lastErr == nil, nil
 		})
 		if waitErr == wait.ErrWaitTimeout {
@@ -221,7 +228,15 @@ func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup,
 	log.Infof("Waiting to attach bridge endpoint %s to host", bridgeEndpointName)
 	waitErr = wait.Poll(500*time.Millisecond, 5*time.Second, func() (done bool, err error) {
 		lastErr = expectedBridgeEndpoint.HostAttach(1)
-		return lastErr == nil, nil
+		if lastErr == nil {
+			return true, nil
+		}
+		// See https://github.com/flannel-io/flannel/issues/1391 and
+		// hcsshim lacks some validations to detect the error, so we judge it by error message.
+		if strings.Contains(lastErr.Error(), "This endpoint is already attached to the switch.") {
+			return true, nil
+		}
+		return false, nil
 	})
 	if waitErr == wait.ErrWaitTimeout {
 		return nil, errors.Wrapf(lastErr, "failed to hot attach bridge HNSEndpoint %s to host compartment", bridgeEndpointName)
@@ -230,23 +245,27 @@ func (be *HostgwBackend) RegisterNetwork(ctx context.Context, wg sync.WaitGroup,
 
 	// 7. Enable forwarding on the host interface and endpoint
 	for _, interfaceIpAddress := range []string{expectedNetwork.ManagementIP, expectedBridgeEndpoint.IPAddress.String()} {
-		netInterface, err := netshHelper.GetInterfaceByIP(interfaceIpAddress)
+		ipv4, err := ip.ParseIP4(interfaceIpAddress)
+		if err != nil {
+			return nil, errors.Wrapf(err, "Failed to parse expected net interface ip (%s)", interfaceIpAddress)
+		}
+
+		netInterface, err := ip.GetInterfaceByIP(ipv4.ToIP())
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to find interface for IP Address %s", interfaceIpAddress)
 		}
 		log.Infof("Found %+v interface with IP %s", netInterface, interfaceIpAddress)
 
 		// When a new hns network is created, the interface is modified, esp the name, index
-		if expectedNetwork.ManagementIP == netInterface.IpAddress {
-			n.LinkIndex = netInterface.Idx
+		if expectedNetwork.ManagementIP == ipv4.String() {
+			n.LinkIndex = netInterface.Index
 			n.Name = netInterface.Name
 		}
 
-		interfaceIdx := strconv.Itoa(netInterface.Idx)
-		if err := netshHelper.EnableForwarding(interfaceIdx); err != nil {
-			return nil, errors.Wrapf(err, "failed to enable forwarding on %s index %s", netInterface.Name, interfaceIdx)
+		if err := ip.EnableForwardingForInterface(netInterface); err != nil {
+			return nil, errors.Wrapf(err, "failed to enable forwarding on %s index %d", netInterface.Name, netInterface.Index)
 		}
-		log.Infof("Enabled forwarding on %s index %s", netInterface.Name, interfaceIdx)
+		log.Infof("Enabled forwarding on %s index %d", netInterface.Name, netInterface.Index)
 	}
 
 	return n, nil

vendor/github.com/coreos/flannel/backend/ipsec/handle_charon.go → vendor/github.com/flannel-io/flannel/backend/ipsec/handle_charon.go

@@ -26,9 +26,9 @@ import (
 	"time"
 
 	"github.com/bronze1man/goStrongswanVici"
-	"github.com/coreos/flannel/subnet"
-	log "k8s.io/klog"
+	"github.com/flannel-io/flannel/subnet"
 	"golang.org/x/net/context"
+	log "k8s.io/klog"
 )
 
 type Uri struct {
@@ -41,15 +41,19 @@ type CharonIKEDaemon struct {
 	ctx         context.Context
 }
 
-func NewCharonIKEDaemon(ctx context.Context, wg sync.WaitGroup, espProposal string) (*CharonIKEDaemon, error) {
-
+func NewCharonIKEDaemon(ctx context.Context, wg *sync.WaitGroup, espProposal string) (*CharonIKEDaemon, error) {
 	charon := &CharonIKEDaemon{ctx: ctx, espProposal: espProposal}
 
 	addr := strings.Split("unix:///var/run/charon.vici", "://")
 	charon.viciUri = Uri{addr[0], addr[1]}
 
-	cmd, err := charon.runBundled("/usr/lib/strongswan/", "charon")
+	execPath, err := findExecPath()
+	if err != nil {
+		log.Errorf("Charon daemon not found: %v", err)
+		return nil, err
+	}
 
+	cmd, err := charon.run(execPath)
 	if err != nil {
 		log.Errorf("Error starting charon daemon: %v", err)
 		return nil, err
@@ -93,13 +97,9 @@ func (charon *CharonIKEDaemon) getClient(wait bool) (client *goStrongswanVici.Cl
 	}
 }
 
-func (charon *CharonIKEDaemon) runBundled(staticLocation string, command string) (cmd *exec.Cmd, err error) {
-	path, err := exec.LookPath(command)
-	if err != nil {
-		path = staticLocation + command
-	}
+func (charon *CharonIKEDaemon) run(execPath string) (cmd *exec.Cmd, err error) {
 	cmd = &exec.Cmd{
-		Path: path,
+		Path: execPath,
 		SysProcAttr: &syscall.SysProcAttr{
 			Pdeathsig: syscall.SIGTERM,
 		},
@@ -234,3 +234,25 @@ func formatConnectionName(localLease, remoteLease *subnet.Lease) string {
 func formatChildSAConfName(localLease, remoteLease *subnet.Lease) string {
 	return fmt.Sprintf("%s-%s", localLease.Subnet, remoteLease.Subnet)
 }
+
+func findExecPath() (string, error) {
+	// try well known charon paths
+	paths := []string{
+		"charon",                         // PATH
+		"/usr/lib/strongswan/charon",     // alpine, arch, flannel container
+		"/usr/lib/ipsec/charon",          // debian/ubuntu
+		"/usr/libexec/strongswan/charon", // centos/rhel
+		"/usr/libexec/ipsec/charon",      // opensuse/sles
+	}
+	for _, path := range paths {
+		path, err := exec.LookPath(path)
+		if err != nil {
+			log.Warningf("No valid charon executable found at path %s: %v", path, err)
+			continue
+		}
+		return path, nil
+	}
+
+	err := fmt.Errorf("No valid charon executable found at paths %v", paths)
+	return "", err
+}

vendor/github.com/coreos/flannel/backend/ipsec/handle_xfrm.go → vendor/github.com/flannel-io/flannel/backend/ipsec/handle_xfrm.go

@@ -16,13 +16,14 @@
 package ipsec
 
 import (
+	"errors"
 	"fmt"
 	"net"
+	"syscall"
 
-	log "k8s.io/klog"
+	"github.com/flannel-io/flannel/subnet"
 	"github.com/vishvananda/netlink"
-
-	"github.com/coreos/flannel/subnet"
+	log "k8s.io/klog"
 )
 
 func AddXFRMPolicy(myLease, remoteLease *subnet.Lease, dir netlink.Dir, reqID int) error {
@@ -30,7 +31,7 @@ func AddXFRMPolicy(myLease, remoteLease *subnet.Lease, dir netlink.Dir, reqID in
 
 	dst := remoteLease.Subnet.ToIPNet()
 
-	policy := netlink.XfrmPolicy{
+	policy := &netlink.XfrmPolicy{
 		Src: src,
 		Dst: dst,
 		Dir: dir,
@@ -47,14 +48,23 @@ func AddXFRMPolicy(myLease, remoteLease *subnet.Lease, dir netlink.Dir, reqID in
 		Reqid: reqID,
 	}
 
-	log.Infof("Adding ipsec policy: %+v", tmpl)
-
 	policy.Tmpls = append(policy.Tmpls, tmpl)
 
-	if err := netlink.XfrmPolicyAdd(&policy); err != nil {
-		return fmt.Errorf("error adding policy: %+v err: %v", policy, err)
+	if existingPolicy, err := netlink.XfrmPolicyGet(policy); err != nil {
+		if errors.Is(err, syscall.ENOENT) {
+			log.Infof("Adding ipsec policy: %+v", tmpl)
+			if err := netlink.XfrmPolicyAdd(policy); err != nil {
+				return fmt.Errorf("error adding policy: %+v err: %v", policy, err)
+			}
+		} else {
+			return fmt.Errorf("error getting policy: %+v err: %v", policy, err)
+		}
+	} else {
+		log.Infof("Updating ipsec policy %+v with %+v", existingPolicy, policy)
+		if err := netlink.XfrmPolicyUpdate(policy); err != nil {
+			return fmt.Errorf("error updating policy: %+v err: %v", policy, err)
+		}
 	}
-
 	return nil
 }
 

vendor/github.com/coreos/flannel/backend/ipsec/ipsec.go → vendor/github.com/flannel-io/flannel/backend/ipsec/ipsec.go

@@ -20,21 +20,21 @@ import (
 	"fmt"
 	"sync"
 
-	log "k8s.io/klog"
 	"golang.org/x/net/context"
 
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/pkg/ip"
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/pkg/ip"
+	"github.com/flannel-io/flannel/subnet"
+	log "k8s.io/klog"
 )
 
 /*
 	Flannel's approach to IPSec uses Strongswan to handle the key exchange (using IKEv2) and the kernel to handle the
 	actual encryption.
 
-	Strongswan's "charon" is bundled in the flannel container. Flannel runs it as a child process when the ipsec backend
-	is selected and communicates with it using the "VICI" interface. Strongswan ships a utility "swanctl" which also
-	uses the VICI interface. This utility is bundled in the flannel container and can help with debugging.
+	Flannel runs Strongswan's "charon" as a child process when the ipsec backend is selected and communicates with it
+	using the "VICI" interface. Strongswan ships a utility "swanctl" which also uses the VICI interface. This utility
+	is bundled in the flannel container and can help with debugging.
 
 	The file "handle_charon.go" contains the logic for working with the charon. It supports creating a "CharonIKEDaemon"
 	which supports loading the PSK into the charon and adding and removing connections.
@@ -70,7 +70,7 @@ func New(sm subnet.Manager, extIface *backend.ExternalInterface) (
 }
 
 func (be *IPSECBackend) RegisterNetwork(
-	ctx context.Context, wg sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
+	ctx context.Context, wg *sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
 
 	cfg := struct {
 		UDPEncap    bool

vendor/github.com/coreos/flannel/backend/ipsec/ipsec_network.go → vendor/github.com/flannel-io/flannel/backend/ipsec/ipsec_network.go

@@ -21,12 +21,11 @@ import (
 	"strconv"
 	"sync"
 
-	log "k8s.io/klog"
+	"github.com/flannel-io/flannel/backend"
+	"github.com/flannel-io/flannel/subnet"
 	"github.com/vishvananda/netlink"
 	"golang.org/x/net/context"
-
-	"github.com/coreos/flannel/backend"
-	"github.com/coreos/flannel/subnet"
+	log "k8s.io/klog"
 )
 
 const (
@@ -95,12 +94,13 @@ func (n *network) Run(ctx context.Context) {
 
 	for {
 		select {
-		case evtsBatch := <-evts:
+		case evtsBatch, ok := <-evts:
+			if !ok {
+				log.Infof("evts chan closed")
+				return
+			}
 			log.Info("Handling event")
 			n.handleSubnetEvents(evtsBatch)
-		case <-ctx.Done():
-			log.Info("Received DONE")
-			return
 		}
 	}
 }

vendor/github.com/coreos/flannel/backend/manager.go → vendor/github.com/flannel-io/flannel/backend/manager.go

@@ -21,7 +21,7 @@ import (
 
 	"golang.org/x/net/context"
 
-	"github.com/coreos/flannel/subnet"
+	"github.com/flannel-io/flannel/subnet"
 )
 
 var constructors = make(map[string]BackendCtor)