From b1cbdd9986d182d67173a544a6836e46a6aad2f3 Mon Sep 17 00:00:00 2001
From: Tobias Klauser <tobias@cilium.io>
Date: Thu, 24 Feb 2022 09:05:22 +0100
Subject: [PATCH 1/3] defaults: add image digests for Cilium v1.9.13, v1.10.8,
 v1.11.2

Signed-off-by: Tobias Klauser <tobias@cilium.io>
---
 defaults/imagedigests.json | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/defaults/imagedigests.json b/defaults/imagedigests.json
index 52755e4513..2fa6307fc2 100644
--- a/defaults/imagedigests.json
+++ b/defaults/imagedigests.json
@@ -5,11 +5,14 @@
     "v1.10.5": "@sha256:0612218e28288db360c63677c09fafa2d17edda4f13867bcabf87056046b33bb",
     "v1.10.6": "@sha256:cf52b14bf9bc62e4eb1967661a51e5f5482cbb05b784c0a0e38ee16d66f85773",
     "v1.10.7": "@sha256:e23f55e80e1988db083397987a89967aa204ad6fc32da243b9160fbcea29b0ca",
+    "v1.10.8": "@sha256:e6147e39a03c685e5f1225c5642e1358dcd4899bbd94e8a043bb4be52cd2f008",
     "v1.11.0": "@sha256:ea677508010800214b0b5497055f38ed3bff57963fa2399bcb1c69cf9476453a",
     "v1.11.1": "@sha256:251ff274acf22fd2067b29a31e9fda94253d2961c061577203621583d7e85bd2",
+    "v1.11.2": "@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60",
     "v1.8.13": "@sha256:070a57faa72ca55b045861453a2f1697e4d582a75cf2b24937e0397684abcb3f",
     "v1.9.11": "@sha256:47f923325069a697d5baf5314c7fe936bdf34e7c8154666e6762a78be1ddc3ec",
-    "v1.9.12": "@sha256:7d4ef9dc7e504ba1a55a01dd743260daced11ded02fc268965ef2c98eb8b8bde"
+    "v1.9.12": "@sha256:7d4ef9dc7e504ba1a55a01dd743260daced11ded02fc268965ef2c98eb8b8bde",
+    "v1.9.13": "@sha256:12752fd66c5448194062befaf59aaefc446cbff729aa8b2d7ea4801113d3a31a"
   },
   "quay.io/cilium/cilium-service-mesh": {
     "v1.11.0-beta.1": "@sha256:4252b95ce4d02f5b772fd7756d240e3c036e6c9a19e3d77bae9c3fa31c837e50"
@@ -20,10 +23,13 @@
     "v1.10.5": "@sha256:6c6d57195de2595a3c58f688e26bf5c5f4715011a07fdf22e48917d47418b410",
     "v1.10.6": "@sha256:07e0ba11f74b8ea00303a3705457994f99e64e423b0ebe7f0e1bfda7a3493dec",
     "v1.10.7": "@sha256:9afb0a15afffdf84812c8174df9de86e35239fb87a6ffd9539877a9e643d8132",
+    "v1.10.8": "@sha256:c675830b9f87596680d2a45cd78c2d64ab1ceb8707629e8da71217f64e5e72e1",
     "v1.11.0": "@sha256:361942671ce067cc7f3e97c2114512283148bcee5ec29e4f0a828869aedd4ced",
     "v1.11.1": "@sha256:5732f2ce99096d1c740f3805260dbcfefbe6d7d18d1ac07707ff4ef9536b0ec6",
+    "v1.11.2": "@sha256:2be171e91944a7f764c0fe13618401f68d1b7a7b199d09711db0da38f8cbaf70",
     "v1.9.11": "@sha256:3cc472bbb288ece4d496674de048d01e5dd6c4c9044e392153a63e385ff864a5",
-    "v1.9.12": "@sha256:f9eba125ca3d9e9014613a8e43e92afd635320e82736e75d9329de5054076449"
+    "v1.9.12": "@sha256:f9eba125ca3d9e9014613a8e43e92afd635320e82736e75d9329de5054076449",
+    "v1.9.13": "@sha256:3c5ae05e0c10a24a2e1c1d269a8522346dc33671fae82d9b15a4b93f9d25710c"
   },
   "quay.io/cilium/clustermesh-apiserver-service-mesh": {
     "v1.11.0-beta.1": "@sha256:658cdec3995c81dec6b78cf2320ef5bc162cbf208b6dcd08dd688e5bb27d9bf6"
@@ -34,11 +40,14 @@
     "v1.10.5": "@sha256:5d83c9d674e01c449f7fa65f176f2bde6568498acb726f5fe25cc12149c216c5",
     "v1.10.6": "@sha256:4d8de723d64e5aecb9de2e12b624e50c0a4388d3e43f697f8e5781be33f7e888",
     "v1.10.7": "@sha256:385fcc4fa315eb6b66626c3e5f607b6b6514c8c3a863c47c2b2dbc97790acb47",
+    "v1.10.8": "@sha256:4d2ee6b41475f6d74855d77b018f508ba978d964528f903c8e3e7be8dd275b31",
     "v1.11.0": "@sha256:306ce38354a0a892b0c175ae7013cf178a46b79f51c52adb5465d87f14df0838",
     "v1.11.1": "@sha256:23d40b2a87a5bf94e0365bd9606721c96f78b8304b61725dca45a0b8a6048203",
+    "v1.11.2": "@sha256:f031f95f3c9ba8962094649c0cc913f90723d553203444c8fb9a591e38873c9d",
     "v1.8.13": "@sha256:ddb57b1f0cb5953bb090853f72334a11a59d1732f685baac191dea0ff2acefd0",
     "v1.9.11": "@sha256:d3bd31dc823704a865c0f6091865c6876798e461e445e2f90f6e51f419a85257",
-    "v1.9.12": "@sha256:67c5ce60e2f7cfd6f28b68b164bb910c41be365b9e17553c8a963dd456de204f"
+    "v1.9.12": "@sha256:67c5ce60e2f7cfd6f28b68b164bb910c41be365b9e17553c8a963dd456de204f",
+    "v1.9.13": "@sha256:bd374bd8cd6abccce817f6cfabd5e58f243a7ec8d0fcf4dd22f0713713ab6969"
   },
   "quay.io/cilium/hubble-relay-service-mesh": {
     "v1.11.0-beta.1": "@sha256:db4e82f2905073b99dc9da656a23efb6856833a8a1353f8317a3c52ff5ee53aa"
@@ -57,11 +66,14 @@
     "v1.10.5": "@sha256:8c43aebef64a024a4d0406e61dafe3f875227826f551d377825d3d4bf14a965e",
     "v1.10.6": "@sha256:e78b6e2904b694ca08635d2485d5dcd342d06ee3d6a7ef6c5f31cd2901a8fd67",
     "v1.10.7": "@sha256:97b378e0e3b6b5ade6ae1706024c7a25fe6fc48e00102b65a6b7ac51d6327f40",
+    "v1.10.8": "@sha256:d591b998273f8601dd42a3f0a0b097d65077c30255b7dc5af837e0118bda6f5f",
     "v1.11.0": "@sha256:5f60a4e17ab33a3dcd2a942802b15f9e7be3d18f24464f31bba81a65a117e094",
     "v1.11.1": "@sha256:61895007b65fdc703614c92072d8e81fd0562c02dd605c411a088c355840ea50",
+    "v1.11.2": "@sha256:abb7af69d6679e64dab9d7a87eae73377b3e9b880ff90ab8689ad1bf9e6ff3cd",
     "v1.8.13": "@sha256:1829d3cbcbf7541a6960f6cea7991fd4a55e921936a9d67636928f6481070162",
     "v1.9.11": "@sha256:48659c02c2de76a8af039ebe6e77aedc51a545bb6c94a861485b4182dde6a576",
-    "v1.9.12": "@sha256:5702f3e1195e3ba7dfadeb6dd6eeb585af6051abf81fb633dc796489660d1b8b"
+    "v1.9.12": "@sha256:5702f3e1195e3ba7dfadeb6dd6eeb585af6051abf81fb633dc796489660d1b8b",
+    "v1.9.13": "@sha256:9a3d04b41be1b3d79d079e3ee8021230440845073aa1beca6e7835743fbdc017"
   },
   "quay.io/cilium/operator-aws-service-mesh": {
     "v1.11.0-beta.1": "@sha256:d8cd32cf4c03f28318300aaba4a40e7598b0d0a595cc5598f4e907e1f0f745ec"
@@ -72,11 +84,14 @@
     "v1.10.5": "@sha256:11f82e09123f79e336583cfe32b250e025738f6a8ed8d5e18e1177b566f77a00",
     "v1.10.6": "@sha256:3c7e7a9e23d721e4845793ece54bcd1393ebcb9b3fdf3581a90796c95f356cc0",
     "v1.10.7": "@sha256:556d692b2f08822101c159d9d6f731efe6c437d2b80f0ef96813e8745203c852",
+    "v1.10.8": "@sha256:81b62495f6c682446a07f7a5ca9ec2887c99f4820b460a3c5610ecec05789140",
     "v1.11.0": "@sha256:c1b41e6cbf6f1e0bb417170ac79eb6d78a7e39b775f1131a1104546fd18d745f",
     "v1.11.1": "@sha256:dbe0da6d8cd82d036bd8d1162140c203f1375ae5a6084a09f704ddc42485f0fb",
+    "v1.11.2": "@sha256:6221ea3e47ae6ad4ab226d7dc886d74ad666e54f50b85863b09d913ae06a497d",
     "v1.8.13": "@sha256:3e8c511cf17791b37f90afe502d39e62d4cfa7c891fa76c7347317a58d5e0652",
     "v1.9.11": "@sha256:32e052b3bebbecff0a7feb8b462141387628d2d78e0a67e9dd9a1c28fc2f60da",
-    "v1.9.12": "@sha256:0e3e1e07f4b0847b26363d6100e57a743963307a2f781a292d5831046b4e51f7"
+    "v1.9.12": "@sha256:0e3e1e07f4b0847b26363d6100e57a743963307a2f781a292d5831046b4e51f7",
+    "v1.9.13": "@sha256:aab870367b39b7220fcc0997b13a4d5b8f78696ee9e39caf742f90b504a92fa8"
   },
   "quay.io/cilium/operator-azure-service-mesh": {
     "v1.11.0-beta.1": "@sha256:712830af1c8c031c2ef9a5e0e3bc4de139d0a3cfed5a165678919eb8ee1f269b"
@@ -87,11 +102,14 @@
     "v1.10.5": "@sha256:2d2f730f219d489ff0702923bf24c0002cd93eb4b47ba344375566202f56d972",
     "v1.10.6": "@sha256:6bd47edc4d8f8b5b984509c68f5625a4141c0f5a4c8931f012b0453d9b62bd92",
     "v1.10.7": "@sha256:d0b491d8d8cb45862ed7f0410f65e7c141832f0f95262643fa5ff1edfcddcafe",
+    "v1.10.8": "@sha256:a77dff6103d047d8810ea5e80067b2fade6d099771c8dda197bdba5e4e2f0255",
     "v1.11.0": "@sha256:b522279577d0d5f1ad7cadaacb7321d1b172d8ae8c8bc816e503c897b420cfe3",
     "v1.11.1": "@sha256:977240a4783c7be821e215ead515da3093a10f4a7baea9f803511a2c2b44a235",
+    "v1.11.2": "@sha256:4c8bea6818ee3e4932f99e9c1d7efa88b8c0f3cd516160caec878406531e45e7",
     "v1.8.13": "@sha256:9e6677599565637d479886d038c366b40ce4acded54ab7bca1c7ad660b0c0a83",
     "v1.9.11": "@sha256:63a01e508ada5a123942b5afe24105d738f98ce543381ff48b1f9f905c22845e",
-    "v1.9.12": "@sha256:b89b16476cf6500d68763a70fb3d449e0309296bd00122cbe24f306c7e5e5180"
+    "v1.9.12": "@sha256:b89b16476cf6500d68763a70fb3d449e0309296bd00122cbe24f306c7e5e5180",
+    "v1.9.13": "@sha256:826136116ce840ae37efad5e63d4e2a6d7f47a3277b840ab3d45758f19f1fc78"
   },
   "quay.io/cilium/operator-generic-service-mesh": {
     "v1.11.0-beta.1": "@sha256:dcf364d807e26bc3a62fc8190e6ca40b40e9fceb71c7a934e34cbf24d5a9bfa8"

From 860833a85d2f1769d70c5d0ce72f4ac6c75e1257 Mon Sep 17 00:00:00 2001
From: Tobias Klauser <tobias@cilium.io>
Date: Thu, 24 Feb 2022 09:09:00 +0100
Subject: [PATCH 2/3] go.mod, vendor: update cilium to v1.11.2

Signed-off-by: Tobias Klauser <tobias@cilium.io>
---
 go.mod                                        |  10 +-
 go.sum                                        |  35 ++--
 vendor/github.com/cilium/cilium/AUTHORS       |   6 +-
 .../cilium/cilium/pkg/command/map_string.go   |  80 ++++++++
 .../cilium/cilium/pkg/command/output.go       | 152 +++++++++++++++
 .../cilium/cilium/pkg/option/config.go        |  40 +++-
 .../cilium/cilium/pkg/option/map_options.go   |   6 +-
 .../prometheus/client_model/go/metrics.pb.go  | 120 ++++++------
 vendor/golang.org/x/net/http2/server.go       |  10 +-
 vendor/golang.org/x/net/http2/transport.go    |  94 ++++++----
 vendor/golang.org/x/net/http2/writesched.go   |   4 +-
 .../x/net/http2/writesched_random.go          |   6 +-
 vendor/golang.org/x/net/idna/go118.go         |  14 ++
 vendor/golang.org/x/net/idna/idna10.0.0.go    |   6 +-
 vendor/golang.org/x/net/idna/idna9.0.0.go     |   4 +-
 vendor/golang.org/x/net/idna/pre_go118.go     |  12 ++
 vendor/golang.org/x/net/idna/punycode.go      |  36 ++--
 vendor/modules.txt                            |  11 +-
 .../structured-merge-diff/v4/typed/merge.go   | 176 ++++++++++++------
 19 files changed, 619 insertions(+), 203 deletions(-)
 create mode 100644 vendor/github.com/cilium/cilium/pkg/command/map_string.go
 create mode 100644 vendor/github.com/cilium/cilium/pkg/command/output.go
 create mode 100644 vendor/golang.org/x/net/idna/go118.go
 create mode 100644 vendor/golang.org/x/net/idna/pre_go118.go

diff --git a/go.mod b/go.mod
index eb6ec3742e..22f0e9b72c 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ replace (
 
 require (
 	github.com/blang/semver/v4 v4.0.0
-	github.com/cilium/cilium v1.11.1
+	github.com/cilium/cilium v1.11.2
 	github.com/cilium/hubble v0.9.0
 	github.com/cilium/workerpool v1.1.1
 	github.com/cloudflare/cfssl v1.6.1
@@ -130,7 +130,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.11.0 // indirect
-	github.com/prometheus/client_model v0.2.1-0.20200623203004-60555c9708c7 // indirect
+	github.com/prometheus/client_model v0.2.1-0.20210607210712-147c58e9608a // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
@@ -185,7 +185,7 @@ require (
 	go.uber.org/zap v1.19.1 // indirect
 	golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
 	golang.org/x/mod v0.5.0 // indirect
-	golang.org/x/net v0.0.0-20211101193420-4a448f8816b3 // indirect
+	golang.org/x/net v0.0.0-20211209124913-491a49abca63 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
 	golang.org/x/sys v0.0.0-20211205182925-97ca703d548d // indirect
@@ -204,10 +204,10 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 	k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
-	k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b // indirect
+	k8s.io/utils v0.0.0-20211116205334-6203023598ed // indirect
 	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
 	sigs.k8s.io/kustomize/api v0.10.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.13.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 20dedf6800..46f41ae462 100644
--- a/go.sum
+++ b/go.sum
@@ -296,8 +296,8 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/cilium/cilium v1.11.0-rc3/go.mod h1:saQ+u3UA8vXGwFvcYpFTTFvhmJtfRiD74B/+yUSs0qE=
-github.com/cilium/cilium v1.11.1 h1:Q6GRmmZxADW/GxaYKJc2vo2z5n8haBxav3pLCgzjsdI=
-github.com/cilium/cilium v1.11.1/go.mod h1:xdLxOE/3FhilCPBFrOyhuyUzze3siRoIWmEQ2uJGHQk=
+github.com/cilium/cilium v1.11.2 h1:lpCgoLqnPOryj4KikPADkQJSQIeuqt+ehetShRTWx6I=
+github.com/cilium/cilium v1.11.2/go.mod h1:5//yZGCcUvOh+JlXk8ADfiLFTiVh92xzAn9t/5bpjj4=
 github.com/cilium/customvet v0.0.0-20201209211516-9852765c1ac4/go.mod h1:MEn5V1CejgUNFP3Y1JKmBC6Mb9TuK53ecHG9lffctFg=
 github.com/cilium/deepequal-gen v0.0.0-20200406125435-ad6a9003139e/go.mod h1:c4R5wxGyXhbM6zyKeRKNIc9aab5EZi4z4oOSZvUMvZA=
 github.com/cilium/dns v1.1.4-0.20190417235132-8e25ec9a0ff3/go.mod h1:cXN7jgo+gsGlNvQ7Vqu2ELdc3f7i7PPgupHqSkLzzBo=
@@ -314,6 +314,7 @@ github.com/cilium/ipam v0.0.0-20211026130907-54a76012817c/go.mod h1:Ascfar4FtgB+
 github.com/cilium/kafka v0.0.0-20180809090225-01ce283b732b/go.mod h1:ktgizta3CPZBKz5uW272SJyjiro0vn4nOVP7Pk4RopA=
 github.com/cilium/metallb v0.1.1-0.20210831235406-48667b93284d/go.mod h1:8nydvUTW+/9nVywCQ9bE/YGzb4EISALP4lKNpK3fFqo=
 github.com/cilium/proxy v0.0.0-20210511221533-82a70d56bf32/go.mod h1:mvauc94lqkyJunRsU9Ef5FIsixi8vBeDoxuMYoGBemk=
+github.com/cilium/proxy v0.0.0-20220202185058-28b3c32edfee/go.mod h1:ontBl/RX7G0GwcR38YQVp6d75MjIsL1FbBidVpn+F8I=
 github.com/cilium/workerpool v1.1.1 h1:OTs+dZBzYTP1XC9iO9SnTGaCSEI/Xs1Eohi/y0cGdDU=
 github.com/cilium/workerpool v1.1.1/go.mod h1:GOYJhwlnIjR+jWSDNBb5kw47G1H/XA9X4WOBpgr4pQU=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
@@ -1367,8 +1368,9 @@ github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.1-0.20200623203004-60555c9708c7 h1:NkLt0ne/zifxULGse6IDsHU45hKk3w6lIVs8yFSVzKU=
 github.com/prometheus/client_model v0.2.1-0.20200623203004-60555c9708c7/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.1-0.20210607210712-147c58e9608a h1:CmF68hwI0XsOQ5UwlBopMi2Ow4Pbg32akc4KIVCOm+Y=
+github.com/prometheus/client_model v0.2.1-0.20210607210712-147c58e9608a/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
 github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -1569,6 +1571,7 @@ github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYp
 github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netlink v1.1.1-0.20210330154013-f5de75959ad5/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netlink v1.1.1-0.20211101163509-b10eb8fe5cf6/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
+github.com/vishvananda/netlink v1.1.1-0.20220117225832-796d4ea903f3/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
 github.com/vishvananda/netns v0.0.0-20190625233234-7109fa855b0f/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
@@ -1895,8 +1898,9 @@ golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210917221730-978cfadd31cf/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210927181540-4e4d966f7476/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211101193420-4a448f8816b3 h1:VrJZAjbekhoRn7n5FBujY31gboH+iB3pdLxn3gE9FjU=
 golang.org/x/net v0.0.0-20211101193420-4a448f8816b3/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211209124913-491a49abca63 h1:iocB37TsdFuN6IBRZ+ry36wrkoV51/tl5vOWqkcPGvY=
+golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2367,6 +2371,7 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
+google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.44.0 h1:weqSxi/TMs1SqFRMHCtBgXRs8k3X39QIDEZ0pRcttUg=
 google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
@@ -2454,19 +2459,19 @@ k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
 k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
 k8s.io/api v0.21.3/go.mod h1:hUgeYHUbBp23Ue4qdX9tR8/ANi/g3ehylAqDn9NWVOg=
 k8s.io/api v0.22.3/go.mod h1:azgiXFiXqiWyLCfI62/eYBOu19rj2LKmIhFPP4+33fs=
-k8s.io/api v0.23.0/go.mod h1:8wmDdLBHBNxtOIytwLstXt5E9PddnZb0GaMcqsvDBpg=
+k8s.io/api v0.23.3/go.mod h1:w258XdGyvCmnBj/vGzQMj6kzdufJZVUwEM1U2fRJwSQ=
 k8s.io/api v0.24.0-alpha.0 h1:M/31Z1GKgTE0/fWu2/arAfvIoMmL/oQ5ykYN9RTzgKg=
 k8s.io/api v0.24.0-alpha.0/go.mod h1:deWo+4OwHTtia+zwLZirxNA0Unp1Y/a4lsmydSRUqp8=
 k8s.io/apiextensions-apiserver v0.21.3/go.mod h1:kl6dap3Gd45+21Jnh6utCx8Z2xxLm8LGDkprcd+KbsE=
 k8s.io/apiextensions-apiserver v0.22.3/go.mod h1:f4plF+CXeqI89jAXL0Ml4LI/kSAZ54JS94+XOX1sae8=
-k8s.io/apiextensions-apiserver v0.23.0/go.mod h1:xIFAEEDlAZgpVBl/1VSjGDmLoXAWRG40+GsWhKhAxY4=
+k8s.io/apiextensions-apiserver v0.23.3/go.mod h1:/ZpRXdgKZA6DvIVPEmXDCZJN53YIQEUDF+hrpIQJL38=
 k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.20.2/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
 k8s.io/apimachinery v0.21.3/go.mod h1:H/IM+5vH9kZRNJ4l3x/fXP/5bOPJaVP/guptnZPeCFI=
 k8s.io/apimachinery v0.22.3/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0=
-k8s.io/apimachinery v0.23.0/go.mod h1:fFCTTBKvKcwTPFzjlcxp91uPFZr+JA0FubU4fLzzFYc=
+k8s.io/apimachinery v0.23.3/go.mod h1:BEuFMMBaIbcOqVIJqNZJXGFTP4W6AycEpb5+m/97hrM=
 k8s.io/apimachinery v0.24.0-alpha.0 h1:FChRBdwz3dJDpfIBXaSRlDQQ6FOHiRvgAHaRAynx73s=
 k8s.io/apimachinery v0.24.0-alpha.0/go.mod h1:SqloDTPqePPNhEp8K4qUgqpKc3tE+ymn05iIUbSAQ7g=
 k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
@@ -2474,7 +2479,7 @@ k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
 k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
 k8s.io/apiserver v0.21.3/go.mod h1:eDPWlZG6/cCCMj/JBcEpDoK+I+6i3r9GsChYBHSbAzU=
 k8s.io/apiserver v0.22.3/go.mod h1:oam7lH/F1Kto/WTamyQYrD68fS0mGUBORAFf6x/9Mxs=
-k8s.io/apiserver v0.23.0/go.mod h1:Cec35u/9zAepDPPFyT+UMrgqOCjgJ5qtfVJDxjZYmt4=
+k8s.io/apiserver v0.23.3/go.mod h1:3HhsTmC+Pn+Jctw+Ow0LHA4dQ4oXrQ4XJDzrVDG64T4=
 k8s.io/cli-runtime v0.24.0-alpha.0 h1:o3xx1RrdTLH6dwlT0KntsWaueiOyI7Ov+vY5+4TL6Bs=
 k8s.io/cli-runtime v0.24.0-alpha.0/go.mod h1:9tFZCnHDd5u56V2j4jj4M/ql7bAj09adJ8TdY608DdI=
 k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
@@ -2483,18 +2488,18 @@ k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
 k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
 k8s.io/client-go v0.21.3/go.mod h1:+VPhCgTsaFmGILxR/7E1N0S+ryO010QBeNCv5JwRGYU=
 k8s.io/client-go v0.22.3/go.mod h1:ElDjYf8gvZsKDYexmsmnMQ0DYO8W9RwBjfQ1PI53yow=
-k8s.io/client-go v0.23.0/go.mod h1:hrDnpnK1mSr65lHHcUuIZIXDgEbzc7/683c6hyG4jTA=
+k8s.io/client-go v0.23.3/go.mod h1:47oMd+YvAOqZM7pcQ6neJtBiFH7alOyfunYN48VsmwE=
 k8s.io/client-go v0.24.0-alpha.0 h1:qeU8M+gy+bTDzJQMMy6VsvYXtNJAPkP0QvJw/Cl7gnA=
 k8s.io/client-go v0.24.0-alpha.0/go.mod h1:tQEmSne6/r+o6F5m9q0zx2R7zgm9xXmnNuIgsUWcMxw=
 k8s.io/code-generator v0.21.3/go.mod h1:K3y0Bv9Cz2cOW2vXUrNZlFbflhuPvuadW6JdnN6gGKo=
 k8s.io/code-generator v0.22.3/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o=
-k8s.io/code-generator v0.23.0/go.mod h1:vQvOhDXhuzqiVfM/YHp+dmg10WDZCchJVObc9MvowsE=
+k8s.io/code-generator v0.23.3/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
 k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
 k8s.io/component-base v0.20.4/go.mod h1:t4p9EdiagbVCJKrQ1RsA5/V4rFQNDfRlevJajlGwgjI=
 k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
 k8s.io/component-base v0.21.3/go.mod h1:kkuhtfEHeZM6LkX0saqSK8PbdO7A0HigUngmhhrwfGQ=
 k8s.io/component-base v0.22.3/go.mod h1:kuybv1miLCMoOk3ebrqF93GbQHQx6W2287FC0YEQY6s=
-k8s.io/component-base v0.23.0/go.mod h1:DHH5uiFvLC1edCpvcTDV++NKULdYYU6pR9Tt3HIKMKI=
+k8s.io/component-base v0.23.3/go.mod h1:1Smc4C60rWG7d3HjSYpIwEbySQ3YWg0uzH5a2AtaTLg=
 k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
 k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
 k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
@@ -2523,8 +2528,9 @@ k8s.io/kubernetes v1.13.0/go.mod h1:ocZa8+6APFNC2tX1DZASIbocyYT5jHzqFVsY5aoB7Jk=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b h1:wxEMGetGMur3J1xuGLQY7GEQYg9bZxKn3tKo5k/eYcs=
 k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+k8s.io/utils v0.0.0-20211116205334-6203023598ed h1:ck1fRPWPJWsMd8ZRFsWc6mh/zHp5fZ/shhbrgPUxDAE=
+k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 pack.ag/amqp v0.11.2/go.mod h1:4/cbmt4EJXSKlG6LCfWHoqmN0uFdy5i/+YFz+fTfhV4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/goversion v1.2.0/go.mod h1:Eih9y/uIBS3ulggl7KNJ09xGSLcuNaLgmvvqa07sgfo=
@@ -2535,7 +2541,7 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyz
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.19/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.25/go.mod h1:Mlj9PNLmG9bZ6BHFwFKDo5afkpWyUISkb9Me0GnK66I=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.27/go.mod h1:tq2nT0Kx7W+/f2JVE+zxYtUhdjuELJkVpNz+x/QN5R4=
 sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 h1:fD1pz4yfdADVNfFmcP2aBEtudwUQ1AlLnRBALr33v3s=
 sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
 sigs.k8s.io/kustomize/api v0.10.1 h1:KgU7hfYoscuqag84kxtzKdEC3mKMb99DPI3a0eaV1d0=
@@ -2545,8 +2551,9 @@ sigs.k8s.io/kustomize/kyaml v0.13.0/go.mod h1:FTJxEZ86ScK184NpGSAQcfEqee0nul8oLC
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.0 h1:kDvPBbnPk+qYmkHmSo8vKGp438IASWofnbbUKDE/bv0=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.0/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.1 h1:bKCqE9GvQ5tiVHn5rfn1r+yao3aLQEaLzkkmAkf+A6Y=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.1/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
diff --git a/vendor/github.com/cilium/cilium/AUTHORS b/vendor/github.com/cilium/cilium/AUTHORS
index 62f35af8d9..4ace13173b 100644
--- a/vendor/github.com/cilium/cilium/AUTHORS
+++ b/vendor/github.com/cilium/cilium/AUTHORS
@@ -2,6 +2,7 @@ The following people, in alphabetical order, have either authored or signed
 off on commits in the Cilium repository:
 
 Àbéjídé Àyodélé                         abejideayodele@gmail.com
+Adam Bocim                              adam.bocim@firma.seznam.cz
 Adam Korcz                              adam@adalogics.com
 Adam Wolfe Gordon                       awg@digitalocean.com
 adamzhoul                               adamzhoul186@gmail.com
@@ -307,11 +308,12 @@ Strukov Anton                           anstrukov@luxoft.com
 Sugang Li                               sugangli@google.com
 Swaminathan Vasudevan                   svasudevan@suse.com
 Taeung Song                             treeze.taeung@gmail.com
-Tam Mach                                sayboras@yahoo.com
+Tam Mach                                tam.mach@isovalent.com
 Tasdik Rahman                           prodicus@outlook.com
 Te-Yu Chang                             dale.teyuchang@gmail.com
 Thales Paiva                            thales@accuknox.com
 Thiago Navarro                          navarro@accuknox.com
+Thi Van Le                              vannnyle@gmail.com
 Thomas Bachman                          tbachman@yahoo.com
 Thomas Gosteli                          thomas.gosteli@protonmail.com
 Thomas Graf                             thomas@cilium.io
@@ -357,6 +359,8 @@ Youssef Azrak                           yazrak.tech@gmail.com
 Yuan Liu                                liuyuan@google.com
 Yurii Dzobak                            yurii.dzobak@lotusflare.com
 Yurii Komar                             Subreptivus@gmail.com
+Yusuke Suzuki                           yusuke-suzuki@cybozu.co.jp
+Yutaro Hayakawa                         yutaro.hayakawa@isovalent.com
 Yves Blusseau                           yves.blusseau@acoss.fr
 Zang Li                                 zangli@google.com
 Zhang Qiang                             qiangzhang@qiyi.com
diff --git a/vendor/github.com/cilium/cilium/pkg/command/map_string.go b/vendor/github.com/cilium/cilium/pkg/command/map_string.go
new file mode 100644
index 0000000000..5ea284c82e
--- /dev/null
+++ b/vendor/github.com/cilium/cilium/pkg/command/map_string.go
@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2022 Authors of Cilium
+
+package command
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+	"unicode"
+
+	"github.com/spf13/cast"
+	"github.com/spf13/viper"
+)
+
+var keyValueRegex = regexp.MustCompile(`([\w-:./]+=[\w-:./]+,)*([\w-:./]+=[\w-:./]+)$`)
+
+// GetStringMapString contains one enhancement to support k1=v2,k2=v2 compared to original
+// implementation of GetStringMapString function
+// Related upstream issue https://github.com/spf13/viper/issues/911
+func GetStringMapString(vp *viper.Viper, key string) map[string]string {
+	v, _ := GetStringMapStringE(vp, key)
+	return v
+}
+
+// GetStringMapStringE is same as GetStringMapString, but with error
+func GetStringMapStringE(vp *viper.Viper, key string) (map[string]string, error) {
+	data := vp.Get(key)
+	if data == nil {
+		return map[string]string{}, nil
+	}
+	v, err := cast.ToStringMapStringE(data)
+	if err != nil {
+		var syntaxErr *json.SyntaxError
+		if !errors.As(err, &syntaxErr) {
+			return v, err
+		}
+
+		switch s := data.(type) {
+		case string:
+			if len(s) == 0 {
+				return map[string]string{}, nil
+			}
+
+			// if the input is starting with either '{' or '[', just preserve original json parsing error.
+			firstIndex := strings.IndexFunc(s, func(r rune) bool {
+				return !unicode.IsSpace(r)
+			})
+			if firstIndex != -1 && (s[firstIndex] == '{' || s[firstIndex] == '[') {
+				return v, err
+			}
+
+			if !isValidKeyValuePair(s) {
+				return map[string]string{}, fmt.Errorf("'%s' is not formatted as key=value,key1=value1", s)
+			}
+
+			var v = map[string]string{}
+			kvs := strings.Split(s, ",")
+			for _, kv := range kvs {
+				temp := strings.Split(kv, "=")
+				if len(temp) != 2 {
+					return map[string]string{}, fmt.Errorf("'%s' is not formatted as key=value,key1=value1", s)
+				}
+				v[temp[0]] = temp[1]
+			}
+			return v, nil
+		}
+	}
+	return v, nil
+}
+
+// isValidKeyValuePair returns true if the input is following key1=value1,key2=value2,...,keyN=valueN format.
+func isValidKeyValuePair(str string) bool {
+	if len(str) == 0 {
+		return true
+	}
+	return len(keyValueRegex.ReplaceAllString(str, "")) == 0
+}
diff --git a/vendor/github.com/cilium/cilium/pkg/command/output.go b/vendor/github.com/cilium/cilium/pkg/command/output.go
new file mode 100644
index 0000000000..3a98b62d74
--- /dev/null
+++ b/vendor/github.com/cilium/cilium/pkg/command/output.go
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2016-2020 Authors of Cilium
+
+package command
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/util/jsonpath"
+)
+
+var (
+	outputOpt string
+	re        = regexp.MustCompile(`^jsonpath\=(.*)`)
+)
+
+// OutputJSON returns true if the JSON output option was specified
+func OutputJSON() bool {
+	return len(outputOpt) > 0
+}
+
+//AddJSONOutput adds the -o|--output option to any cmd to export to json
+func AddJSONOutput(cmd *cobra.Command) {
+	cmd.Flags().StringVarP(&outputOpt, "output", "o", "", "json| jsonpath='{}'")
+}
+
+//ForceJSON sets output mode to JSON (for unit tests)
+func ForceJSON() {
+	outputOpt = "json"
+}
+
+//PrintOutput receives an interface and dump the data using the --output flag.
+//ATM only json or jsonpath. In the future yaml
+func PrintOutput(data interface{}) error {
+	return PrintOutputWithType(data, outputOpt)
+}
+
+//PrintOutputWithPatch merges data with patch and dump the data using the --output flag.
+func PrintOutputWithPatch(data interface{}, patch interface{}) error {
+	mergedInterface, err := mergeInterfaces(data, patch)
+	if err != nil {
+		return fmt.Errorf("Unable to merge Interfaces:%v", err)
+	}
+	return PrintOutputWithType(mergedInterface, outputOpt)
+}
+
+func mergeInterfaces(data, patch interface{}) (interface{}, error) {
+	var i1, i2 interface{}
+
+	data1, err := json.Marshal(data)
+	if err != nil {
+		return nil, err
+	}
+	data2, err := json.Marshal(patch)
+	if err != nil {
+		return nil, err
+	}
+	err = json.Unmarshal(data1, &i1)
+	if err != nil {
+		return nil, err
+	}
+
+	err = json.Unmarshal(data2, &i2)
+	if err != nil {
+		return nil, err
+	}
+	return recursiveMerge(i1, i2), nil
+}
+
+func recursiveMerge(i1, i2 interface{}) interface{} {
+	switch i1 := i1.(type) {
+	case map[string]interface{}:
+		i2, ok := i2.(map[string]interface{})
+		if !ok {
+			return i1
+		}
+		for k, v2 := range i2 {
+			if v1, ok := i1[k]; ok {
+				i1[k] = recursiveMerge(v1, v2)
+			} else {
+				i1[k] = v2
+			}
+		}
+	case nil:
+		i2, ok := i2.(map[string]interface{})
+		if ok {
+			return i2
+		}
+	}
+	return i1
+}
+
+//PrintOutputWithType receives an interface and dump the data using the --output flag.
+//ATM only json or jsonpath. In the future yaml
+func PrintOutputWithType(data interface{}, outputType string) error {
+	if outputType == "json" {
+		return dumpJSON(data, "")
+	}
+
+	if re.MatchString(outputType) {
+		return dumpJSON(data, re.ReplaceAllString(outputType, "$1"))
+	}
+
+	return fmt.Errorf("couldn't found output printer")
+}
+
+// DumpJSONToString dumps the contents of data into a string. If jsonpath is
+// non-empty, will attempt to do jsonpath filtering using said string. Returns a
+// string containing the JSON in data, or an error if any JSON marshaling,
+// parsing operations fail.
+func DumpJSONToString(data interface{}, jsonPath string) (string, error) {
+	if len(jsonPath) == 0 {
+		result, err := json.MarshalIndent(data, "", "  ")
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Couldn't marshal to json: '%s'\n", err)
+			return "", err
+		}
+		fmt.Println(string(result))
+		return "", nil
+	}
+
+	parser := jsonpath.New("").AllowMissingKeys(true)
+	if err := parser.Parse(jsonPath); err != nil {
+		fmt.Fprintf(os.Stderr, "Couldn't parse jsonpath expression: '%s'\n", err)
+		return "", err
+	}
+
+	var sb strings.Builder
+	if err := parser.Execute(&sb, data); err != nil {
+		fmt.Fprintf(os.Stderr, "Couldn't parse jsonpath expression: '%s'\n", err)
+		return "", err
+
+	}
+	return sb.String(), nil
+}
+
+// dumpJSON dump the data variable to the stdout as json.
+// If somethings fail, it'll return an error
+// If jsonPath is passed, it'll run the json query over data var.
+func dumpJSON(data interface{}, jsonPath string) error {
+	jsonStr, err := DumpJSONToString(data, jsonPath)
+	if err != nil {
+		return err
+	}
+	fmt.Println(jsonStr)
+	return nil
+}
diff --git a/vendor/github.com/cilium/cilium/pkg/option/config.go b/vendor/github.com/cilium/cilium/pkg/option/config.go
index d593f1d901..dbc248303c 100644
--- a/vendor/github.com/cilium/cilium/pkg/option/config.go
+++ b/vendor/github.com/cilium/cilium/pkg/option/config.go
@@ -20,6 +20,7 @@ import (
 	"github.com/cilium/cilium/api/v1/models"
 	"github.com/cilium/cilium/pkg/cidr"
 	clustermeshTypes "github.com/cilium/cilium/pkg/clustermesh/types"
+	"github.com/cilium/cilium/pkg/command"
 	"github.com/cilium/cilium/pkg/common"
 	"github.com/cilium/cilium/pkg/defaults"
 	"github.com/cilium/cilium/pkg/ip"
@@ -2159,6 +2160,29 @@ func (c *DaemonConfig) TunnelingEnabled() bool {
 	return c.Tunnel != TunnelDisabled
 }
 
+// MasqueradingEnabled returns true if either IPv4 or IPv6 masquerading is enabled.
+func (c *DaemonConfig) MasqueradingEnabled() bool {
+	return c.EnableIPv4Masquerade || c.EnableIPv6Masquerade
+}
+
+// IptablesMasqueradingIPv4Enabled returns true if iptables-based
+// masquerading is enabled for IPv4.
+func (c *DaemonConfig) IptablesMasqueradingIPv4Enabled() bool {
+	return !c.EnableBPFMasquerade && c.EnableIPv4Masquerade
+}
+
+// IptablesMasqueradingIPv6Enabled returns true if iptables-based
+// masquerading is enabled for IPv6.
+func (c *DaemonConfig) IptablesMasqueradingIPv6Enabled() bool {
+	return !c.EnableBPFMasquerade && c.EnableIPv6Masquerade
+}
+
+// IptablesMasqueradingEnabled returns true if iptables-based
+// masquerading is enabled.
+func (c *DaemonConfig) IptablesMasqueradingEnabled() bool {
+	return c.IptablesMasqueradingIPv4Enabled() || c.IptablesMasqueradingIPv6Enabled()
+}
+
 // RemoteNodeIdentitiesEnabled returns true if the remote-node identity feature
 // is enabled
 func (c *DaemonConfig) RemoteNodeIdentitiesEnabled() bool {
@@ -2736,21 +2760,29 @@ func (c *DaemonConfig) Populate() {
 	c.MonitorAggregationFlags = ctMonitorReportFlags
 
 	// Map options
-	if m := viper.GetStringMapString(FixedIdentityMapping); len(m) != 0 {
+	if m := command.GetStringMapString(viper.GetViper(), FixedIdentityMapping); err != nil {
+		log.Fatalf("unable to parse %s: %s", FixedIdentityMapping, err)
+	} else if len(m) != 0 {
 		c.FixedIdentityMapping = m
 	}
 
 	c.ConntrackGCInterval = viper.GetDuration(ConntrackGCInterval)
 
-	if m := viper.GetStringMapString(KVStoreOpt); len(m) != 0 {
+	if m, err := command.GetStringMapStringE(viper.GetViper(), KVStoreOpt); err != nil {
+		log.Fatalf("unable to parse %s: %s", KVStoreOpt, err)
+	} else if len(m) != 0 {
 		c.KVStoreOpt = m
 	}
 
-	if m := viper.GetStringMapString(LogOpt); len(m) != 0 {
+	if m, err := command.GetStringMapStringE(viper.GetViper(), LogOpt); err != nil {
+		log.Fatalf("unable to parse %s: %s", LogOpt, err)
+	} else if len(m) != 0 {
 		c.LogOpt = m
 	}
 
-	if m := viper.GetStringMapString(APIRateLimitName); len(m) != 0 {
+	if m, err := command.GetStringMapStringE(viper.GetViper(), APIRateLimitName); err != nil {
+		log.Fatalf("unable to parse %s: %s", APIRateLimitName, err)
+	} else if len(m) != 0 {
 		c.APIRateLimit = m
 	}
 
diff --git a/vendor/github.com/cilium/cilium/pkg/option/map_options.go b/vendor/github.com/cilium/cilium/pkg/option/map_options.go
index 337ee63c8e..3b84f93e0f 100644
--- a/vendor/github.com/cilium/cilium/pkg/option/map_options.go
+++ b/vendor/github.com/cilium/cilium/pkg/option/map_options.go
@@ -46,7 +46,11 @@ func NewMapOpts(values map[string]string, validator Validator) *MapOptions {
 }
 
 func (opts *MapOptions) String() string {
-	return fmt.Sprintf("%v", opts.vals)
+	var kvs []string
+	for k, v := range opts.vals {
+		kvs = append(kvs, fmt.Sprintf("%s=%s", k, v))
+	}
+	return strings.Join(kvs, ",")
 }
 
 // Type returns a string name for this Option type
diff --git a/vendor/github.com/prometheus/client_model/go/metrics.pb.go b/vendor/github.com/prometheus/client_model/go/metrics.pb.go
index 2f4930d9dd..a2553373d3 100644
--- a/vendor/github.com/prometheus/client_model/go/metrics.pb.go
+++ b/vendor/github.com/prometheus/client_model/go/metrics.pb.go
@@ -1,5 +1,5 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
-// source: metrics.proto
+// source: io/prometheus/client/metrics.proto
 
 package io_prometheus_client
 
@@ -67,7 +67,7 @@ func (x *MetricType) UnmarshalJSON(data []byte) error {
 }
 
 func (MetricType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{0}
+	return fileDescriptor_d1e5ddb18987a258, []int{0}
 }
 
 type LabelPair struct {
@@ -82,7 +82,7 @@ func (m *LabelPair) Reset()         { *m = LabelPair{} }
 func (m *LabelPair) String() string { return proto.CompactTextString(m) }
 func (*LabelPair) ProtoMessage()    {}
 func (*LabelPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{0}
+	return fileDescriptor_d1e5ddb18987a258, []int{0}
 }
 
 func (m *LabelPair) XXX_Unmarshal(b []byte) error {
@@ -128,7 +128,7 @@ func (m *Gauge) Reset()         { *m = Gauge{} }
 func (m *Gauge) String() string { return proto.CompactTextString(m) }
 func (*Gauge) ProtoMessage()    {}
 func (*Gauge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{1}
+	return fileDescriptor_d1e5ddb18987a258, []int{1}
 }
 
 func (m *Gauge) XXX_Unmarshal(b []byte) error {
@@ -168,7 +168,7 @@ func (m *Counter) Reset()         { *m = Counter{} }
 func (m *Counter) String() string { return proto.CompactTextString(m) }
 func (*Counter) ProtoMessage()    {}
 func (*Counter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{2}
+	return fileDescriptor_d1e5ddb18987a258, []int{2}
 }
 
 func (m *Counter) XXX_Unmarshal(b []byte) error {
@@ -215,7 +215,7 @@ func (m *Quantile) Reset()         { *m = Quantile{} }
 func (m *Quantile) String() string { return proto.CompactTextString(m) }
 func (*Quantile) ProtoMessage()    {}
 func (*Quantile) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{3}
+	return fileDescriptor_d1e5ddb18987a258, []int{3}
 }
 
 func (m *Quantile) XXX_Unmarshal(b []byte) error {
@@ -263,7 +263,7 @@ func (m *Summary) Reset()         { *m = Summary{} }
 func (m *Summary) String() string { return proto.CompactTextString(m) }
 func (*Summary) ProtoMessage()    {}
 func (*Summary) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{4}
+	return fileDescriptor_d1e5ddb18987a258, []int{4}
 }
 
 func (m *Summary) XXX_Unmarshal(b []byte) error {
@@ -316,7 +316,7 @@ func (m *Untyped) Reset()         { *m = Untyped{} }
 func (m *Untyped) String() string { return proto.CompactTextString(m) }
 func (*Untyped) ProtoMessage()    {}
 func (*Untyped) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{5}
+	return fileDescriptor_d1e5ddb18987a258, []int{5}
 }
 
 func (m *Untyped) XXX_Unmarshal(b []byte) error {
@@ -357,7 +357,7 @@ func (m *Histogram) Reset()         { *m = Histogram{} }
 func (m *Histogram) String() string { return proto.CompactTextString(m) }
 func (*Histogram) ProtoMessage()    {}
 func (*Histogram) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{6}
+	return fileDescriptor_d1e5ddb18987a258, []int{6}
 }
 
 func (m *Histogram) XXX_Unmarshal(b []byte) error {
@@ -412,7 +412,7 @@ func (m *Bucket) Reset()         { *m = Bucket{} }
 func (m *Bucket) String() string { return proto.CompactTextString(m) }
 func (*Bucket) ProtoMessage()    {}
 func (*Bucket) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{7}
+	return fileDescriptor_d1e5ddb18987a258, []int{7}
 }
 
 func (m *Bucket) XXX_Unmarshal(b []byte) error {
@@ -467,7 +467,7 @@ func (m *Exemplar) Reset()         { *m = Exemplar{} }
 func (m *Exemplar) String() string { return proto.CompactTextString(m) }
 func (*Exemplar) ProtoMessage()    {}
 func (*Exemplar) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{8}
+	return fileDescriptor_d1e5ddb18987a258, []int{8}
 }
 
 func (m *Exemplar) XXX_Unmarshal(b []byte) error {
@@ -526,7 +526,7 @@ func (m *Metric) Reset()         { *m = Metric{} }
 func (m *Metric) String() string { return proto.CompactTextString(m) }
 func (*Metric) ProtoMessage()    {}
 func (*Metric) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{9}
+	return fileDescriptor_d1e5ddb18987a258, []int{9}
 }
 
 func (m *Metric) XXX_Unmarshal(b []byte) error {
@@ -610,7 +610,7 @@ func (m *MetricFamily) Reset()         { *m = MetricFamily{} }
 func (m *MetricFamily) String() string { return proto.CompactTextString(m) }
 func (*MetricFamily) ProtoMessage()    {}
 func (*MetricFamily) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{10}
+	return fileDescriptor_d1e5ddb18987a258, []int{10}
 }
 
 func (m *MetricFamily) XXX_Unmarshal(b []byte) error {
@@ -674,50 +674,52 @@ func init() {
 	proto.RegisterType((*MetricFamily)(nil), "io.prometheus.client.MetricFamily")
 }
 
-func init() { proto.RegisterFile("metrics.proto", fileDescriptor_6039342a2ba47b72) }
-
-var fileDescriptor_6039342a2ba47b72 = []byte{
-	// 665 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x54, 0xcd, 0x6e, 0xd3, 0x4c,
-	0x14, 0xfd, 0xdc, 0x38, 0x3f, 0xbe, 0x69, 0x3f, 0xa2, 0x51, 0x17, 0x56, 0xa1, 0x24, 0x78, 0x55,
-	0x58, 0x38, 0xa2, 0x6a, 0x05, 0x2a, 0xb0, 0x68, 0x4b, 0x48, 0x91, 0x48, 0x5b, 0x26, 0xc9, 0xa2,
-	0xb0, 0x88, 0x1c, 0x77, 0x70, 0x2c, 0x3c, 0xb1, 0xb1, 0x67, 0x2a, 0xb2, 0x66, 0xc1, 0x16, 0x5e,
-	0x81, 0x17, 0x05, 0xcd, 0x8f, 0x6d, 0x2a, 0xb9, 0x95, 0x40, 0xec, 0x66, 0xee, 0x3d, 0xe7, 0xfa,
-	0xcc, 0xf8, 0x9c, 0x81, 0x0d, 0x4a, 0x58, 0x1a, 0xfa, 0x99, 0x9b, 0xa4, 0x31, 0x8b, 0xd1, 0x66,
-	0x18, 0x8b, 0x15, 0x25, 0x6c, 0x41, 0x78, 0xe6, 0xfa, 0x51, 0x48, 0x96, 0x6c, 0xab, 0x1b, 0xc4,
-	0x71, 0x10, 0x91, 0xbe, 0xc4, 0xcc, 0xf9, 0x87, 0x3e, 0x0b, 0x29, 0xc9, 0x98, 0x47, 0x13, 0x45,
-	0x73, 0xf6, 0xc1, 0x7a, 0xe3, 0xcd, 0x49, 0x74, 0xee, 0x85, 0x29, 0x42, 0x60, 0x2e, 0x3d, 0x4a,
-	0x6c, 0xa3, 0x67, 0xec, 0x58, 0x58, 0xae, 0xd1, 0x26, 0xd4, 0xaf, 0xbc, 0x88, 0x13, 0x7b, 0x4d,
-	0x16, 0xd5, 0xc6, 0xd9, 0x86, 0xfa, 0xd0, 0xe3, 0xc1, 0x6f, 0x6d, 0xc1, 0x31, 0xf2, 0xf6, 0x7b,
-	0x68, 0x1e, 0xc7, 0x7c, 0xc9, 0x48, 0x5a, 0x0d, 0x40, 0x07, 0xd0, 0x22, 0x9f, 0x09, 0x4d, 0x22,
-	0x2f, 0x95, 0x83, 0xdb, 0xbb, 0xf7, 0xdd, 0xaa, 0x03, 0xb8, 0x03, 0x8d, 0xc2, 0x05, 0xde, 0x79,
-	0x0e, 0xad, 0xb7, 0xdc, 0x5b, 0xb2, 0x30, 0x22, 0x68, 0x0b, 0x5a, 0x9f, 0xf4, 0x5a, 0x7f, 0xa0,
-	0xd8, 0x5f, 0x57, 0x5e, 0x48, 0xfb, 0x6a, 0x40, 0x73, 0xcc, 0x29, 0xf5, 0xd2, 0x15, 0x7a, 0x00,
-	0xeb, 0x99, 0x47, 0x93, 0x88, 0xcc, 0x7c, 0xa1, 0x56, 0x4e, 0x30, 0x71, 0x5b, 0xd5, 0xe4, 0x01,
-	0xd0, 0x36, 0x80, 0x86, 0x64, 0x9c, 0xea, 0x49, 0x96, 0xaa, 0x8c, 0x39, 0x15, 0xe7, 0x28, 0xbe,
-	0x5f, 0xeb, 0xd5, 0x6e, 0x3e, 0x47, 0xae, 0xb8, 0xd4, 0xe7, 0x74, 0xa1, 0x39, 0x5d, 0xb2, 0x55,
-	0x42, 0x2e, 0x6f, 0xb8, 0xc5, 0x2f, 0x06, 0x58, 0x27, 0x61, 0xc6, 0xe2, 0x20, 0xf5, 0xe8, 0x3f,
-	0x10, 0xbb, 0x07, 0x8d, 0x39, 0xf7, 0x3f, 0x12, 0xa6, 0xa5, 0xde, 0xab, 0x96, 0x7a, 0x24, 0x31,
-	0x58, 0x63, 0x9d, 0x6f, 0x06, 0x34, 0x54, 0x09, 0x3d, 0x84, 0x8e, 0xcf, 0x29, 0x8f, 0x3c, 0x16,
-	0x5e, 0x5d, 0x97, 0x71, 0xa7, 0xac, 0x2b, 0x29, 0x5d, 0x68, 0xf3, 0x24, 0x21, 0xe9, 0x6c, 0x1e,
-	0xf3, 0xe5, 0xa5, 0xd6, 0x02, 0xb2, 0x74, 0x24, 0x2a, 0xd7, 0x1c, 0x50, 0xfb, 0x43, 0x07, 0x7c,
-	0x37, 0xa0, 0x95, 0x97, 0xd1, 0x3e, 0xd4, 0x23, 0xe1, 0x60, 0xdb, 0x90, 0x87, 0xea, 0x56, 0x4f,
-	0x29, 0x4c, 0x8e, 0x15, 0xba, 0xda, 0x1d, 0xe8, 0x29, 0x58, 0x45, 0x42, 0xb4, 0xac, 0x2d, 0x57,
-	0x65, 0xc8, 0xcd, 0x33, 0xe4, 0x4e, 0x72, 0x04, 0x2e, 0xc1, 0xce, 0xcf, 0x35, 0x68, 0x8c, 0x64,
-	0x22, 0xff, 0x56, 0xd1, 0x63, 0xa8, 0x07, 0x22, 0x53, 0x3a, 0x10, 0x77, 0xab, 0x69, 0x32, 0x76,
-	0x58, 0x21, 0xd1, 0x13, 0x68, 0xfa, 0x2a, 0x67, 0x5a, 0xec, 0x76, 0x35, 0x49, 0x87, 0x11, 0xe7,
-	0x68, 0x41, 0xcc, 0x54, 0x08, 0x6c, 0xf3, 0x36, 0xa2, 0x4e, 0x0a, 0xce, 0xd1, 0x82, 0xc8, 0x95,
-	0x69, 0xed, 0xfa, 0x6d, 0x44, 0xed, 0x6c, 0x9c, 0xa3, 0xd1, 0x0b, 0xb0, 0x16, 0xb9, 0x97, 0xed,
-	0xa6, 0xa4, 0xde, 0x70, 0x31, 0x85, 0xe5, 0x71, 0xc9, 0x10, 0xee, 0x2f, 0xee, 0x7a, 0x46, 0x33,
-	0xbb, 0xd1, 0x33, 0x76, 0x6a, 0xb8, 0x5d, 0xd4, 0x46, 0x99, 0xf3, 0xc3, 0x80, 0x75, 0xf5, 0x07,
-	0x5e, 0x79, 0x34, 0x8c, 0x56, 0x95, 0xcf, 0x19, 0x02, 0x73, 0x41, 0xa2, 0x44, 0xbf, 0x66, 0x72,
-	0x8d, 0xf6, 0xc0, 0x14, 0x1a, 0xe5, 0x15, 0xfe, 0xbf, 0xdb, 0xab, 0x56, 0xa5, 0x26, 0x4f, 0x56,
-	0x09, 0xc1, 0x12, 0x2d, 0xd2, 0xa4, 0x5e, 0x60, 0xdb, 0xbc, 0x2d, 0x4d, 0x8a, 0x87, 0x35, 0xf6,
-	0xd1, 0x08, 0xa0, 0x9c, 0x84, 0xda, 0xd0, 0x3c, 0x3e, 0x9b, 0x9e, 0x4e, 0x06, 0xb8, 0xf3, 0x1f,
-	0xb2, 0xa0, 0x3e, 0x3c, 0x9c, 0x0e, 0x07, 0x1d, 0x43, 0xd4, 0xc7, 0xd3, 0xd1, 0xe8, 0x10, 0x5f,
-	0x74, 0xd6, 0xc4, 0x66, 0x7a, 0x3a, 0xb9, 0x38, 0x1f, 0xbc, 0xec, 0xd4, 0xd0, 0x06, 0x58, 0x27,
-	0xaf, 0xc7, 0x93, 0xb3, 0x21, 0x3e, 0x1c, 0x75, 0xcc, 0x23, 0x0c, 0x95, 0xef, 0xfe, 0xbb, 0x83,
-	0x20, 0x64, 0x0b, 0x3e, 0x77, 0xfd, 0x98, 0xf6, 0xcb, 0x6e, 0x5f, 0x75, 0x67, 0x34, 0xbe, 0x24,
-	0x51, 0x3f, 0x88, 0x9f, 0x85, 0xf1, 0xac, 0xec, 0xce, 0x54, 0xf7, 0x57, 0x00, 0x00, 0x00, 0xff,
-	0xff, 0xd0, 0x84, 0x91, 0x73, 0x59, 0x06, 0x00, 0x00,
+func init() {
+	proto.RegisterFile("io/prometheus/client/metrics.proto", fileDescriptor_d1e5ddb18987a258)
+}
+
+var fileDescriptor_d1e5ddb18987a258 = []byte{
+	// 672 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x55, 0xcd, 0x6e, 0xd3, 0x4c,
+	0x14, 0xfd, 0xdc, 0x38, 0x3f, 0xbe, 0xe9, 0x07, 0xd1, 0xa8, 0x0b, 0xab, 0x50, 0x12, 0xbc, 0x2a,
+	0x2c, 0x1c, 0x51, 0xb5, 0x02, 0x15, 0x58, 0xb4, 0x25, 0xa4, 0x48, 0xa4, 0x2d, 0x93, 0x64, 0x51,
+	0x58, 0x44, 0x8e, 0x3b, 0x38, 0x16, 0x9e, 0x8c, 0xb1, 0x3d, 0x15, 0x59, 0xb3, 0x60, 0x0b, 0xaf,
+	0xc0, 0x8b, 0x82, 0xe6, 0xc7, 0x36, 0x15, 0x6e, 0x25, 0x10, 0xbb, 0x99, 0x3b, 0xe7, 0x5c, 0x9f,
+	0x3b, 0x39, 0x67, 0x02, 0x4e, 0xc8, 0xfa, 0x71, 0xc2, 0x28, 0xc9, 0x16, 0x84, 0xa7, 0x7d, 0x3f,
+	0x0a, 0xc9, 0x32, 0xeb, 0x53, 0x92, 0x25, 0xa1, 0x9f, 0xba, 0x71, 0xc2, 0x32, 0x86, 0x36, 0x42,
+	0xe6, 0x96, 0x18, 0x57, 0x61, 0x36, 0xbb, 0x01, 0x63, 0x41, 0x44, 0xfa, 0x12, 0x33, 0xe7, 0xef,
+	0xfb, 0x59, 0x48, 0x49, 0x9a, 0x79, 0x34, 0x56, 0x34, 0x67, 0x0f, 0xac, 0xd7, 0xde, 0x9c, 0x44,
+	0x67, 0x5e, 0x98, 0x20, 0x04, 0xe6, 0xd2, 0xa3, 0xc4, 0x36, 0x7a, 0xc6, 0xb6, 0x85, 0xe5, 0x1a,
+	0x6d, 0x40, 0xfd, 0xd2, 0x8b, 0x38, 0xb1, 0xd7, 0x64, 0x51, 0x6d, 0x9c, 0x2d, 0xa8, 0x0f, 0x3d,
+	0x1e, 0xfc, 0x72, 0x2c, 0x38, 0x46, 0x7e, 0xfc, 0x0e, 0x9a, 0x47, 0x8c, 0x2f, 0x33, 0x92, 0x54,
+	0x03, 0xd0, 0x3e, 0xb4, 0xc8, 0x27, 0x42, 0xe3, 0xc8, 0x4b, 0x64, 0xe3, 0xf6, 0xce, 0x3d, 0xb7,
+	0x6a, 0x00, 0x77, 0xa0, 0x51, 0xb8, 0xc0, 0x3b, 0xcf, 0xa0, 0xf5, 0x86, 0x7b, 0xcb, 0x2c, 0x8c,
+	0x08, 0xda, 0x84, 0xd6, 0x47, 0xbd, 0xd6, 0x1f, 0x28, 0xf6, 0x57, 0x95, 0x17, 0xd2, 0xbe, 0x18,
+	0xd0, 0x1c, 0x73, 0x4a, 0xbd, 0x64, 0x85, 0xee, 0xc3, 0x7a, 0xea, 0xd1, 0x38, 0x22, 0x33, 0x5f,
+	0xa8, 0x95, 0x1d, 0x4c, 0xdc, 0x56, 0x35, 0x39, 0x00, 0xda, 0x02, 0xd0, 0x90, 0x94, 0x53, 0xdd,
+	0xc9, 0x52, 0x95, 0x31, 0xa7, 0x62, 0x8e, 0xe2, 0xfb, 0xb5, 0x5e, 0xed, 0xfa, 0x39, 0x72, 0xc5,
+	0xa5, 0x3e, 0xa7, 0x0b, 0xcd, 0xe9, 0x32, 0x5b, 0xc5, 0xe4, 0xe2, 0x9a, 0x5b, 0xfc, 0x6c, 0x80,
+	0x75, 0x1c, 0xa6, 0x19, 0x0b, 0x12, 0x8f, 0xfe, 0x03, 0xb1, 0xbb, 0xd0, 0x98, 0x73, 0xff, 0x03,
+	0xc9, 0xb4, 0xd4, 0xbb, 0xd5, 0x52, 0x0f, 0x25, 0x06, 0x6b, 0xac, 0xf3, 0xd5, 0x80, 0x86, 0x2a,
+	0xa1, 0x07, 0xd0, 0xf1, 0x39, 0xe5, 0x91, 0x97, 0x85, 0x97, 0x57, 0x65, 0xdc, 0x2e, 0xeb, 0x4a,
+	0x4a, 0x17, 0xda, 0x3c, 0x8e, 0x49, 0x32, 0x9b, 0x33, 0xbe, 0xbc, 0xd0, 0x5a, 0x40, 0x96, 0x0e,
+	0x45, 0xe5, 0x8a, 0x03, 0x6a, 0x7f, 0xe8, 0x80, 0x6f, 0x06, 0xb4, 0xf2, 0x32, 0xda, 0x83, 0x7a,
+	0x24, 0x1c, 0x6c, 0x1b, 0x72, 0xa8, 0x6e, 0x75, 0x97, 0xc2, 0xe4, 0x58, 0xa1, 0xab, 0xdd, 0x81,
+	0x9e, 0x80, 0x55, 0x24, 0x44, 0xcb, 0xda, 0x74, 0x55, 0x86, 0xdc, 0x3c, 0x43, 0xee, 0x24, 0x47,
+	0xe0, 0x12, 0xec, 0xfc, 0x58, 0x83, 0xc6, 0x48, 0x26, 0xf2, 0x6f, 0x15, 0x3d, 0x82, 0x7a, 0x20,
+	0x32, 0xa5, 0x03, 0x71, 0xa7, 0x9a, 0x26, 0x63, 0x87, 0x15, 0x12, 0x3d, 0x86, 0xa6, 0xaf, 0x72,
+	0xa6, 0xc5, 0x6e, 0x55, 0x93, 0x74, 0x18, 0x71, 0x8e, 0x16, 0xc4, 0x54, 0x85, 0xc0, 0x36, 0x6f,
+	0x22, 0xea, 0xa4, 0xe0, 0x1c, 0x2d, 0x88, 0x5c, 0x99, 0xd6, 0xae, 0xdf, 0x44, 0xd4, 0xce, 0xc6,
+	0x39, 0x1a, 0x3d, 0x07, 0x6b, 0x91, 0x7b, 0xd9, 0x6e, 0x4a, 0xea, 0x35, 0x17, 0x53, 0x58, 0x1e,
+	0x97, 0x0c, 0xe1, 0xfe, 0xe2, 0xae, 0x67, 0x34, 0xb5, 0x1b, 0x3d, 0x63, 0xbb, 0x86, 0xdb, 0x45,
+	0x6d, 0x94, 0x3a, 0xdf, 0x0d, 0x58, 0x57, 0xbf, 0xc0, 0x4b, 0x8f, 0x86, 0xd1, 0xaa, 0xf2, 0x39,
+	0x43, 0x60, 0x2e, 0x48, 0x14, 0xeb, 0xd7, 0x4c, 0xae, 0xd1, 0x2e, 0x98, 0x42, 0xa3, 0xbc, 0xc2,
+	0x5b, 0x3b, 0xbd, 0x6a, 0x55, 0xaa, 0xf3, 0x64, 0x15, 0x13, 0x2c, 0xd1, 0x22, 0x4d, 0xea, 0x05,
+	0xb6, 0xcd, 0x9b, 0xd2, 0xa4, 0x78, 0x58, 0x63, 0x1f, 0x8e, 0x00, 0xca, 0x4e, 0xa8, 0x0d, 0xcd,
+	0xa3, 0xd3, 0xe9, 0xc9, 0x64, 0x80, 0x3b, 0xff, 0x21, 0x0b, 0xea, 0xc3, 0x83, 0xe9, 0x70, 0xd0,
+	0x31, 0x44, 0x7d, 0x3c, 0x1d, 0x8d, 0x0e, 0xf0, 0x79, 0x67, 0x4d, 0x6c, 0xa6, 0x27, 0x93, 0xf3,
+	0xb3, 0xc1, 0x8b, 0x4e, 0x0d, 0xfd, 0x0f, 0xd6, 0xf1, 0xab, 0xf1, 0xe4, 0x74, 0x88, 0x0f, 0x46,
+	0x1d, 0xf3, 0x10, 0x43, 0xe5, 0xbb, 0xff, 0x76, 0x3f, 0x08, 0xb3, 0x05, 0x9f, 0xbb, 0x3e, 0xa3,
+	0xbf, 0xff, 0x73, 0xcc, 0x28, 0xbb, 0x20, 0x51, 0x3f, 0x60, 0x4f, 0x43, 0x36, 0x2b, 0x4f, 0x67,
+	0xea, 0xf4, 0x67, 0x00, 0x00, 0x00, 0xff, 0xff, 0x2e, 0x33, 0xa8, 0xbc, 0x6e, 0x06, 0x00, 0x00,
 }
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
index c67e9b7f55..d219dc4c76 100644
--- a/vendor/golang.org/x/net/http2/server.go
+++ b/vendor/golang.org/x/net/http2/server.go
@@ -719,7 +719,15 @@ func (sc *serverConn) canonicalHeader(v string) string {
 		sc.canonHeader = make(map[string]string)
 	}
 	cv = http.CanonicalHeaderKey(v)
-	sc.canonHeader[v] = cv
+	// maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
+	// entries in the canonHeader cache. This should be larger than the number
+	// of unique, uncommon header keys likely to be sent by the peer, while not
+	// so high as to permit unreaasonable memory usage if the peer sends an unbounded
+	// number of unique header keys.
+	const maxCachedCanonicalHeaders = 32
+	if len(sc.canonHeader) < maxCachedCanonicalHeaders {
+		sc.canonHeader[v] = cv
+	}
 	return cv
 }
 
diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
index 1cecf98b23..f135b0f751 100644
--- a/vendor/golang.org/x/net/http2/transport.go
+++ b/vendor/golang.org/x/net/http2/transport.go
@@ -1124,36 +1124,49 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 		}
 	}
 
+	handleResponseHeaders := func() (*http.Response, error) {
+		res := cs.res
+		if res.StatusCode > 299 {
+			// On error or status code 3xx, 4xx, 5xx, etc abort any
+			// ongoing write, assuming that the server doesn't care
+			// about our request body. If the server replied with 1xx or
+			// 2xx, however, then assume the server DOES potentially
+			// want our body (e.g. full-duplex streaming:
+			// golang.org/issue/13444). If it turns out the server
+			// doesn't, they'll RST_STREAM us soon enough. This is a
+			// heuristic to avoid adding knobs to Transport. Hopefully
+			// we can keep it.
+			cs.abortRequestBodyWrite()
+		}
+		res.Request = req
+		res.TLS = cc.tlsState
+		if res.Body == noBody && actualContentLength(req) == 0 {
+			// If there isn't a request or response body still being
+			// written, then wait for the stream to be closed before
+			// RoundTrip returns.
+			if err := waitDone(); err != nil {
+				return nil, err
+			}
+		}
+		return res, nil
+	}
+
 	for {
 		select {
 		case <-cs.respHeaderRecv:
-			res := cs.res
-			if res.StatusCode > 299 {
-				// On error or status code 3xx, 4xx, 5xx, etc abort any
-				// ongoing write, assuming that the server doesn't care
-				// about our request body. If the server replied with 1xx or
-				// 2xx, however, then assume the server DOES potentially
-				// want our body (e.g. full-duplex streaming:
-				// golang.org/issue/13444). If it turns out the server
-				// doesn't, they'll RST_STREAM us soon enough. This is a
-				// heuristic to avoid adding knobs to Transport. Hopefully
-				// we can keep it.
-				cs.abortRequestBodyWrite()
-			}
-			res.Request = req
-			res.TLS = cc.tlsState
-			if res.Body == noBody && actualContentLength(req) == 0 {
-				// If there isn't a request or response body still being
-				// written, then wait for the stream to be closed before
-				// RoundTrip returns.
-				if err := waitDone(); err != nil {
-					return nil, err
-				}
-			}
-			return res, nil
+			return handleResponseHeaders()
 		case <-cs.abort:
-			waitDone()
-			return nil, cs.abortErr
+			select {
+			case <-cs.respHeaderRecv:
+				// If both cs.respHeaderRecv and cs.abort are signaling,
+				// pick respHeaderRecv. The server probably wrote the
+				// response and immediately reset the stream.
+				// golang.org/issue/49645
+				return handleResponseHeaders()
+			default:
+				waitDone()
+				return nil, cs.abortErr
+			}
 		case <-ctx.Done():
 			err := ctx.Err()
 			cs.abortStream(err)
@@ -1213,6 +1226,9 @@ func (cs *clientStream) writeRequest(req *http.Request) (err error) {
 		return err
 	}
 	cc.addStreamLocked(cs) // assigns stream ID
+	if isConnectionCloseRequest(req) {
+		cc.doNotReuse = true
+	}
 	cc.mu.Unlock()
 
 	// TODO(bradfitz): this is a copy of the logic in net/http. Unify somewhere?
@@ -1236,12 +1252,12 @@ func (cs *clientStream) writeRequest(req *http.Request) (err error) {
 	}
 
 	continueTimeout := cc.t.expectContinueTimeout()
-	if continueTimeout != 0 &&
-		!httpguts.HeaderValuesContainsToken(
-			req.Header["Expect"],
-			"100-continue") {
-		continueTimeout = 0
-		cs.on100 = make(chan struct{}, 1)
+	if continueTimeout != 0 {
+		if !httpguts.HeaderValuesContainsToken(req.Header["Expect"], "100-continue") {
+			continueTimeout = 0
+		} else {
+			cs.on100 = make(chan struct{}, 1)
+		}
 	}
 
 	// Past this point (where we send request headers), it is possible for
@@ -1310,6 +1326,7 @@ func (cs *clientStream) writeRequest(req *http.Request) (err error) {
 		case <-respHeaderTimer:
 			return errTimeout
 		case <-respHeaderRecv:
+			respHeaderRecv = nil
 			respHeaderTimer = nil // keep waiting for END_STREAM
 		case <-cs.abort:
 			return cs.abortErr
@@ -2313,7 +2330,7 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 	cs.bytesRemain = res.ContentLength
 	res.Body = transportResponseBody{cs}
 
-	if cs.requestedGzip && res.Header.Get("Content-Encoding") == "gzip" {
+	if cs.requestedGzip && asciiEqualFold(res.Header.Get("Content-Encoding"), "gzip") {
 		res.Header.Del("Content-Encoding")
 		res.Header.Del("Content-Length")
 		res.ContentLength = -1
@@ -2452,7 +2469,10 @@ func (b transportResponseBody) Close() error {
 	select {
 	case <-cs.donec:
 	case <-cs.ctx.Done():
-		return cs.ctx.Err()
+		// See golang/go#49366: The net/http package can cancel the
+		// request context after the response body is fully read.
+		// Don't treat this as an error.
+		return nil
 	case <-cs.reqCancel:
 		return errRequestCanceled
 	}
@@ -2576,6 +2596,12 @@ func (rl *clientConnReadLoop) endStream(cs *clientStream) {
 	// server.go's (*stream).endStream method.
 	if !cs.readClosed {
 		cs.readClosed = true
+		// Close cs.bufPipe and cs.peerClosed with cc.mu held to avoid a
+		// race condition: The caller can read io.EOF from Response.Body
+		// and close the body before we close cs.peerClosed, causing
+		// cleanupWriteRequest to send a RST_STREAM.
+		rl.cc.mu.Lock()
+		defer rl.cc.mu.Unlock()
 		cs.bufPipe.closeWithErrorAndCode(io.EOF, cs.copyTrailers)
 		close(cs.peerClosed)
 	}
diff --git a/vendor/golang.org/x/net/http2/writesched.go b/vendor/golang.org/x/net/http2/writesched.go
index f24d2b1e7d..c7cd001739 100644
--- a/vendor/golang.org/x/net/http2/writesched.go
+++ b/vendor/golang.org/x/net/http2/writesched.go
@@ -32,7 +32,8 @@ type WriteScheduler interface {
 
 	// Pop dequeues the next frame to write. Returns false if no frames can
 	// be written. Frames with a given wr.StreamID() are Pop'd in the same
-	// order they are Push'd. No frames should be discarded except by CloseStream.
+	// order they are Push'd, except RST_STREAM frames. No frames should be
+	// discarded except by CloseStream.
 	Pop() (wr FrameWriteRequest, ok bool)
 }
 
@@ -52,6 +53,7 @@ type FrameWriteRequest struct {
 
 	// stream is the stream on which this frame will be written.
 	// nil for non-stream frames like PING and SETTINGS.
+	// nil for RST_STREAM streams, which use the StreamError.StreamID field instead.
 	stream *stream
 
 	// done, if non-nil, must be a buffered channel with space for
diff --git a/vendor/golang.org/x/net/http2/writesched_random.go b/vendor/golang.org/x/net/http2/writesched_random.go
index 9a7b9e581c..f2e55e05ce 100644
--- a/vendor/golang.org/x/net/http2/writesched_random.go
+++ b/vendor/golang.org/x/net/http2/writesched_random.go
@@ -45,11 +45,11 @@ func (ws *randomWriteScheduler) AdjustStream(streamID uint32, priority PriorityP
 }
 
 func (ws *randomWriteScheduler) Push(wr FrameWriteRequest) {
-	id := wr.StreamID()
-	if id == 0 {
+	if wr.isControl() {
 		ws.zero.push(wr)
 		return
 	}
+	id := wr.StreamID()
 	q, ok := ws.sq[id]
 	if !ok {
 		q = ws.queuePool.get()
@@ -59,7 +59,7 @@ func (ws *randomWriteScheduler) Push(wr FrameWriteRequest) {
 }
 
 func (ws *randomWriteScheduler) Pop() (FrameWriteRequest, bool) {
-	// Control frames first.
+	// Control and RST_STREAM frames first.
 	if !ws.zero.empty() {
 		return ws.zero.shift(), true
 	}
diff --git a/vendor/golang.org/x/net/idna/go118.go b/vendor/golang.org/x/net/idna/go118.go
new file mode 100644
index 0000000000..c5c4338dbe
--- /dev/null
+++ b/vendor/golang.org/x/net/idna/go118.go
@@ -0,0 +1,14 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.18
+// +build go1.18
+
+package idna
+
+// Transitional processing is disabled by default in Go 1.18.
+// https://golang.org/issue/47510
+const transitionalLookup = false
diff --git a/vendor/golang.org/x/net/idna/idna10.0.0.go b/vendor/golang.org/x/net/idna/idna10.0.0.go
index 5208ba6cb8..64ccf85feb 100644
--- a/vendor/golang.org/x/net/idna/idna10.0.0.go
+++ b/vendor/golang.org/x/net/idna/idna10.0.0.go
@@ -59,10 +59,10 @@ type Option func(*options)
 // Transitional sets a Profile to use the Transitional mapping as defined in UTS
 // #46. This will cause, for example, "ß" to be mapped to "ss". Using the
 // transitional mapping provides a compromise between IDNA2003 and IDNA2008
-// compatibility. It is used by most browsers when resolving domain names. This
+// compatibility. It is used by some browsers when resolving domain names. This
 // option is only meaningful if combined with MapForLookup.
 func Transitional(transitional bool) Option {
-	return func(o *options) { o.transitional = true }
+	return func(o *options) { o.transitional = transitional }
 }
 
 // VerifyDNSLength sets whether a Profile should fail if any of the IDN parts
@@ -284,7 +284,7 @@ var (
 
 	punycode = &Profile{}
 	lookup   = &Profile{options{
-		transitional: true,
+		transitional: transitionalLookup,
 		useSTD3Rules: true,
 		checkHyphens: true,
 		checkJoiners: true,
diff --git a/vendor/golang.org/x/net/idna/idna9.0.0.go b/vendor/golang.org/x/net/idna/idna9.0.0.go
index 55f718f127..aae6aac872 100644
--- a/vendor/golang.org/x/net/idna/idna9.0.0.go
+++ b/vendor/golang.org/x/net/idna/idna9.0.0.go
@@ -58,10 +58,10 @@ type Option func(*options)
 // Transitional sets a Profile to use the Transitional mapping as defined in UTS
 // #46. This will cause, for example, "ß" to be mapped to "ss". Using the
 // transitional mapping provides a compromise between IDNA2003 and IDNA2008
-// compatibility. It is used by most browsers when resolving domain names. This
+// compatibility. It is used by some browsers when resolving domain names. This
 // option is only meaningful if combined with MapForLookup.
 func Transitional(transitional bool) Option {
-	return func(o *options) { o.transitional = true }
+	return func(o *options) { o.transitional = transitional }
 }
 
 // VerifyDNSLength sets whether a Profile should fail if any of the IDN parts
diff --git a/vendor/golang.org/x/net/idna/pre_go118.go b/vendor/golang.org/x/net/idna/pre_go118.go
new file mode 100644
index 0000000000..3aaccab1c5
--- /dev/null
+++ b/vendor/golang.org/x/net/idna/pre_go118.go
@@ -0,0 +1,12 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.18
+// +build !go1.18
+
+package idna
+
+const transitionalLookup = true
diff --git a/vendor/golang.org/x/net/idna/punycode.go b/vendor/golang.org/x/net/idna/punycode.go
index 02c7d59af3..e8e3ac11a9 100644
--- a/vendor/golang.org/x/net/idna/punycode.go
+++ b/vendor/golang.org/x/net/idna/punycode.go
@@ -49,6 +49,7 @@ func decode(encoded string) (string, error) {
 		}
 	}
 	i, n, bias := int32(0), initialN, initialBias
+	overflow := false
 	for pos < len(encoded) {
 		oldI, w := i, int32(1)
 		for k := base; ; k += base {
@@ -60,29 +61,32 @@ func decode(encoded string) (string, error) {
 				return "", punyError(encoded)
 			}
 			pos++
-			i += digit * w
-			if i < 0 {
+			i, overflow = madd(i, digit, w)
+			if overflow {
 				return "", punyError(encoded)
 			}
 			t := k - bias
-			if t < tmin {
+			if k <= bias {
 				t = tmin
-			} else if t > tmax {
+			} else if k >= bias+tmax {
 				t = tmax
 			}
 			if digit < t {
 				break
 			}
-			w *= base - t
-			if w >= math.MaxInt32/base {
+			w, overflow = madd(0, w, base-t)
+			if overflow {
 				return "", punyError(encoded)
 			}
 		}
+		if len(output) >= 1024 {
+			return "", punyError(encoded)
+		}
 		x := int32(len(output) + 1)
 		bias = adapt(i-oldI, x, oldI == 0)
 		n += i / x
 		i %= x
-		if n > utf8.MaxRune || len(output) >= 1024 {
+		if n < 0 || n > utf8.MaxRune {
 			return "", punyError(encoded)
 		}
 		output = append(output, 0)
@@ -115,6 +119,7 @@ func encode(prefix, s string) (string, error) {
 	if b > 0 {
 		output = append(output, '-')
 	}
+	overflow := false
 	for remaining != 0 {
 		m := int32(0x7fffffff)
 		for _, r := range s {
@@ -122,8 +127,8 @@ func encode(prefix, s string) (string, error) {
 				m = r
 			}
 		}
-		delta += (m - n) * (h + 1)
-		if delta < 0 {
+		delta, overflow = madd(delta, m-n, h+1)
+		if overflow {
 			return "", punyError(s)
 		}
 		n = m
@@ -141,9 +146,9 @@ func encode(prefix, s string) (string, error) {
 			q := delta
 			for k := base; ; k += base {
 				t := k - bias
-				if t < tmin {
+				if k <= bias {
 					t = tmin
-				} else if t > tmax {
+				} else if k >= bias+tmax {
 					t = tmax
 				}
 				if q < t {
@@ -164,6 +169,15 @@ func encode(prefix, s string) (string, error) {
 	return string(output), nil
 }
 
+// madd computes a + (b * c), detecting overflow.
+func madd(a, b, c int32) (next int32, overflow bool) {
+	p := int64(b) * int64(c)
+	if p > math.MaxInt32-int64(a) {
+		return 0, true
+	}
+	return a + int32(p), false
+}
+
 func decodeDigit(x byte) (digit int32, ok bool) {
 	switch {
 	case '0' <= x && x <= '9':
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 2e0cb20cea..ee1ddd1f33 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -51,7 +51,7 @@ github.com/census-instrumentation/opencensus-proto/gen-go/trace/v1
 # github.com/cespare/xxhash/v2 v2.1.2
 ## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/cilium/cilium v1.11.1
+# github.com/cilium/cilium v1.11.2
 ## explicit; go 1.17
 github.com/cilium/cilium/api/v1/client
 github.com/cilium/cilium/api/v1/client/daemon
@@ -77,6 +77,7 @@ github.com/cilium/cilium/pkg/azure/types
 github.com/cilium/cilium/pkg/cidr
 github.com/cilium/cilium/pkg/client
 github.com/cilium/cilium/pkg/clustermesh/types
+github.com/cilium/cilium/pkg/command
 github.com/cilium/cilium/pkg/common
 github.com/cilium/cilium/pkg/comparator
 github.com/cilium/cilium/pkg/components
@@ -556,7 +557,7 @@ github.com/pmezard/go-difflib/difflib
 github.com/prometheus/client_golang/prometheus
 github.com/prometheus/client_golang/prometheus/internal
 github.com/prometheus/client_golang/prometheus/promhttp
-# github.com/prometheus/client_model v0.2.1-0.20200623203004-60555c9708c7
+# github.com/prometheus/client_model v0.2.1-0.20210607210712-147c58e9608a
 ## explicit; go 1.9
 github.com/prometheus/client_model/go
 # github.com/prometheus/common v0.32.1
@@ -910,7 +911,7 @@ golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
 golang.org/x/mod/module
 golang.org/x/mod/semver
-# golang.org/x/net v0.0.0-20211101193420-4a448f8816b3
+# golang.org/x/net v0.0.0-20211209124913-491a49abca63
 ## explicit; go 1.17
 golang.org/x/net/context
 golang.org/x/net/context/ctxhttp
@@ -1400,7 +1401,7 @@ k8s.io/klog/v2
 k8s.io/kube-openapi/pkg/schemaconv
 k8s.io/kube-openapi/pkg/util/proto
 k8s.io/kube-openapi/pkg/validation/spec
-# k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b
+# k8s.io/utils v0.0.0-20211116205334-6203023598ed
 ## explicit; go 1.12
 k8s.io/utils/clock
 k8s.io/utils/clock/testing
@@ -1492,7 +1493,7 @@ sigs.k8s.io/kustomize/kyaml/yaml/merge2
 sigs.k8s.io/kustomize/kyaml/yaml/merge3
 sigs.k8s.io/kustomize/kyaml/yaml/schema
 sigs.k8s.io/kustomize/kyaml/yaml/walk
-# sigs.k8s.io/structured-merge-diff/v4 v4.2.0
+# sigs.k8s.io/structured-merge-diff/v4 v4.2.1
 ## explicit; go 1.13
 sigs.k8s.io/structured-merge-diff/v4/fieldpath
 sigs.k8s.io/structured-merge-diff/v4/schema
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v4/typed/merge.go b/vendor/sigs.k8s.io/structured-merge-diff/v4/typed/merge.go
index afec9f3cfd..75244ef646 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v4/typed/merge.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v4/typed/merge.go
@@ -17,8 +17,6 @@ limitations under the License.
 package typed
 
 import (
-	"math"
-
 	"sigs.k8s.io/structured-merge-diff/v4/fieldpath"
 	"sigs.k8s.io/structured-merge-diff/v4/schema"
 	"sigs.k8s.io/structured-merge-diff/v4/value"
@@ -170,74 +168,94 @@ func (w *mergingWalker) visitListItems(t *schema.List, lhs, rhs value.List) (err
 	if lhs != nil {
 		lLen = lhs.Length()
 	}
-	out := make([]interface{}, 0, int(math.Max(float64(rLen), float64(lLen))))
+	outLen := lLen
+	if outLen < rLen {
+		outLen = rLen
+	}
+	out := make([]interface{}, 0, outLen)
+
+	rhsOrder, observedRHS, rhsErrs := w.indexListPathElements(t, rhs)
+	errs = append(errs, rhsErrs...)
+	lhsOrder, observedLHS, lhsErrs := w.indexListPathElements(t, lhs)
+	errs = append(errs, lhsErrs...)
+
+	sharedOrder := make([]*fieldpath.PathElement, 0, rLen)
+	for i := range rhsOrder {
+		pe := &rhsOrder[i]
+		if _, ok := observedLHS.Get(*pe); ok {
+			sharedOrder = append(sharedOrder, pe)
+		}
+	}
 
-	lhsOrder := make([]fieldpath.PathElement, 0, lLen)
+	var nextShared *fieldpath.PathElement
+	if len(sharedOrder) > 0 {
+		nextShared = sharedOrder[0]
+		sharedOrder = sharedOrder[1:]
+	}
 
-	// First, collect all LHS children.
-	observedLHS := fieldpath.MakePathElementValueMap(lLen)
-	if lhs != nil {
-		for i := 0; i < lhs.Length(); i++ {
-			child := lhs.At(i)
-			pe, err := listItemToPathElement(w.allocator, w.schema, t, i, child)
-			if err != nil {
-				errs = append(errs, errorf("lhs: element %v: %v", i, err.Error())...)
-				// If we can't construct the path element, we can't
-				// even report errors deeper in the schema, so bail on
-				// this element.
+	lLen, rLen = len(lhsOrder), len(rhsOrder)
+	for lI, rI := 0, 0; lI < lLen || rI < rLen; {
+		if lI < lLen && rI < rLen {
+			pe := lhsOrder[lI]
+			if pe.Equals(rhsOrder[rI]) {
+				// merge LHS & RHS items
+				lChild, _ := observedLHS.Get(pe)
+				rChild, _ := observedRHS.Get(pe)
+				mergeOut, errs := w.mergeListItem(t, pe, lChild, rChild)
+				errs = append(errs, errs...)
+				if mergeOut != nil {
+					out = append(out, *mergeOut)
+				}
+				lI++
+				rI++
+
+				nextShared = nil
+				if len(sharedOrder) > 0 {
+					nextShared = sharedOrder[0]
+					sharedOrder = sharedOrder[1:]
+				}
 				continue
 			}
-			if _, ok := observedLHS.Get(pe); ok {
-				errs = append(errs, errorf("lhs: duplicate entries for key %v", pe.String())...)
-			}
-			observedLHS.Insert(pe, child)
-			lhsOrder = append(lhsOrder, pe)
-		}
-	}
-
-	// Then merge with RHS children.
-	observedRHS := fieldpath.MakePathElementSet(rLen)
-	if rhs != nil {
-		for i := 0; i < rhs.Length(); i++ {
-			child := rhs.At(i)
-			pe, err := listItemToPathElement(w.allocator, w.schema, t, i, child)
-			if err != nil {
-				errs = append(errs, errorf("rhs: element %v: %v", i, err.Error())...)
-				// If we can't construct the path element, we can't
-				// even report errors deeper in the schema, so bail on
-				// this element.
+			if _, ok := observedRHS.Get(pe); ok && nextShared != nil && !nextShared.Equals(lhsOrder[lI]) {
+				// shared item, but not the one we want in this round
+				lI++
 				continue
 			}
-			if observedRHS.Has(pe) {
-				errs = append(errs, errorf("rhs: duplicate entries for key %v", pe.String())...)
+		}
+		if lI < lLen {
+			pe := lhsOrder[lI]
+			if _, ok := observedRHS.Get(pe); !ok {
+				// take LHS item
+				lChild, _ := observedLHS.Get(pe)
+				mergeOut, errs := w.mergeListItem(t, pe, lChild, nil)
+				errs = append(errs, errs...)
+				if mergeOut != nil {
+					out = append(out, *mergeOut)
+				}
+				lI++
 				continue
 			}
-			observedRHS.Insert(pe)
-			w2 := w.prepareDescent(pe, t.ElementType)
-			w2.rhs = child
-			if lchild, ok := observedLHS.Get(pe); ok {
-				w2.lhs = lchild
+		}
+		if rI < rLen {
+			// Take the RHS item, merge with matching LHS item if possible
+			pe := rhsOrder[rI]
+			lChild, _ := observedLHS.Get(pe) // may be nil
+			rChild, _ := observedRHS.Get(pe)
+			mergeOut, errs := w.mergeListItem(t, pe, lChild, rChild)
+			errs = append(errs, errs...)
+			if mergeOut != nil {
+				out = append(out, *mergeOut)
 			}
-			errs = append(errs, w2.merge(pe.String)...)
-			if w2.out != nil {
-				out = append(out, *w2.out)
+			rI++
+			// Advance nextShared, if we are merging nextShared.
+			if nextShared != nil && nextShared.Equals(pe) {
+				nextShared = nil
+				if len(sharedOrder) > 0 {
+					nextShared = sharedOrder[0]
+					sharedOrder = sharedOrder[1:]
+				}
 			}
-			w.finishDescent(w2)
-		}
-	}
-
-	for _, pe := range lhsOrder {
-		if observedRHS.Has(pe) {
-			continue
-		}
-		value, _ := observedLHS.Get(pe)
-		w2 := w.prepareDescent(pe, t.ElementType)
-		w2.lhs = value
-		errs = append(errs, w2.merge(pe.String)...)
-		if w2.out != nil {
-			out = append(out, *w2.out)
 		}
-		w.finishDescent(w2)
 	}
 
 	if len(out) > 0 {
@@ -248,6 +266,46 @@ func (w *mergingWalker) visitListItems(t *schema.List, lhs, rhs value.List) (err
 	return errs
 }
 
+func (w *mergingWalker) indexListPathElements(t *schema.List, list value.List) ([]fieldpath.PathElement, fieldpath.PathElementValueMap, ValidationErrors) {
+	var errs ValidationErrors
+	length := 0
+	if list != nil {
+		length = list.Length()
+	}
+	observed := fieldpath.MakePathElementValueMap(length)
+	pes := make([]fieldpath.PathElement, 0, length)
+	for i := 0; i < length; i++ {
+		child := list.At(i)
+		pe, err := listItemToPathElement(w.allocator, w.schema, t, i, child)
+		if err != nil {
+			errs = append(errs, errorf("element %v: %v", i, err.Error())...)
+			// If we can't construct the path element, we can't
+			// even report errors deeper in the schema, so bail on
+			// this element.
+			continue
+		}
+		if _, found := observed.Get(pe); found {
+			errs = append(errs, errorf("duplicate entries for key %v", pe.String())...)
+			continue
+		}
+		observed.Insert(pe, child)
+		pes = append(pes, pe)
+	}
+	return pes, observed, errs
+}
+
+func (w *mergingWalker) mergeListItem(t *schema.List, pe fieldpath.PathElement, lChild, rChild value.Value) (out *interface{}, errs ValidationErrors) {
+	w2 := w.prepareDescent(pe, t.ElementType)
+	w2.lhs = lChild
+	w2.rhs = rChild
+	errs = append(errs, w2.merge(pe.String)...)
+	if w2.out != nil {
+		out = w2.out
+	}
+	w.finishDescent(w2)
+	return
+}
+
 func (w *mergingWalker) derefList(prefix string, v value.Value) (value.List, ValidationErrors) {
 	if v == nil {
 		return nil, nil

From 82d7277e1a146eee78168e4e9c46cc181f58d44d Mon Sep 17 00:00:00 2001
From: Tobias Klauser <tobias@cilium.io>
Date: Thu, 24 Feb 2022 09:09:17 +0100
Subject: [PATCH 3/3] Update default Cilium version to v1.11.2

Signed-off-by: Tobias Klauser <tobias@cilium.io>
---
 defaults/defaults.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/defaults/defaults.go b/defaults/defaults.go
index 11bf9fbc0c..9c8bd64da4 100644
--- a/defaults/defaults.go
+++ b/defaults/defaults.go
@@ -69,7 +69,7 @@ const (
 	ConnectivityCheckJSONMockImage   = "quay.io/cilium/json-mock:v1.3.0@sha256:2729064827fa9dbfface8d3df424feb6c792a0ba07117b844349635c93c06d2b"
 
 	ConfigMapName   = "cilium-config"
-	Version         = "v1.11.1"
+	Version         = "v1.11.2"
 	HubbleUIVersion = "v0.8.5"
 
 	TunnelType = "vxlan"